270 lines
9.0 KiB
JavaScript
270 lines
9.0 KiB
JavaScript
|
const assert = require('node:assert/strict');
|
|||
|
|
const { EventEmitter, once } = require('node:events');
|
|||
|
|
const fs = require('node:fs');
|
|||
|
|
const http = require('node:http');
|
|||
|
|
const os = require('node:os');
|
|||
|
|
const path = require('node:path');
|
|||
|
|
const { PassThrough } = require('node:stream');
|
|||
|
|
const test = require('node:test');
|
|||
|
|
|
|||
|
|
const {
|
|||
|
|
SidecarManager,
|
|||
|
|
buildChildEnv,
|
|||
|
|
bundledSidecarPath,
|
|||
|
|
probeHealth,
|
|||
|
|
reserveLoopbackPort,
|
|||
|
|
waitForHealth,
|
|||
|
|
} = require('../sidecar.cjs');
|
|||
|
|
|
|||
|
|
function fixture() {
|
|||
|
|
const root = fs.mkdtempSync(path.join(os.tmpdir(), 'aps-sidecar-'));
|
|||
|
|
const resourcesPath = path.join(root, 'resources');
|
|||
|
|
const apsHome = path.join(root, '.aps');
|
|||
|
|
fs.mkdirSync(path.join(resourcesPath, 'sidecar'), { recursive: true });
|
|||
|
|
fs.mkdirSync(path.join(resourcesPath, 'web', 'dist'), { recursive: true });
|
|||
|
|
fs.writeFileSync(path.join(resourcesPath, 'sidecar', 'aps-sidecar.exe'), 'fixture');
|
|||
|
|
fs.writeFileSync(path.join(resourcesPath, 'web', 'dist', 'index.html'), '<!doctype html>');
|
|||
|
|
return { root, resourcesPath, apsHome };
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
function fakeChild(pid) {
|
|||
|
|
const child = new EventEmitter();
|
|||
|
|
child.pid = pid;
|
|||
|
|
child.stdout = new PassThrough();
|
|||
|
|
child.stderr = new PassThrough();
|
|||
|
|
child.killed = false;
|
|||
|
|
child.kill = () => {
|
|||
|
|
child.killed = true;
|
|||
|
|
child.emit('exit', 0, null);
|
|||
|
|
return true;
|
|||
|
|
};
|
|||
|
|
return child;
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
test('reserves a loopback port', async () => {
|
|||
|
|
const port = await reserveLoopbackPort();
|
|||
|
|
assert.ok(Number.isInteger(port));
|
|||
|
|
assert.ok(port > 0 && port < 65_536);
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('requires the packaged sidecar executable', () => {
|
|||
|
|
const { root, resourcesPath } = fixture();
|
|||
|
|
try {
|
|||
|
|
assert.equal(
|
|||
|
|
bundledSidecarPath(resourcesPath, 'win32'),
|
|||
|
|
path.join(resourcesPath, 'sidecar', 'aps-sidecar.exe'),
|
|||
|
|
);
|
|||
|
|
assert.throws(() => bundledSidecarPath(path.join(root, 'missing'), 'win32'), /missing/);
|
|||
|
|
} finally {
|
|||
|
|
fs.rmSync(root, { recursive: true, force: true });
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('health wait retries transient failures', async () => {
|
|||
|
|
let attempts = 0;
|
|||
|
|
await waitForHealth('http://127.0.0.1:1/api/health', {
|
|||
|
|
timeoutMs: 500,
|
|||
|
|
intervalMs: 1,
|
|||
|
|
probe: async () => {
|
|||
|
|
attempts += 1;
|
|||
|
|
if (attempts < 3) throw new Error('not ready');
|
|||
|
|
},
|
|||
|
|
});
|
|||
|
|
assert.equal(attempts, 3);
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('health probe requires the expected sidecar nonce', async () => {
|
|||
|
|
const nonce = 'c'.repeat(64);
|
|||
|
|
const received = [];
|
|||
|
|
const server = http.createServer((request, response) => {
|
|||
|
|
received.push(request.headers['x-aps-sidecar-nonce']);
|
|||
|
|
response.writeHead(200, { 'X-APS-Sidecar-Nonce': nonce });
|
|||
|
|
response.end('{"ok":true}');
|
|||
|
|
});
|
|||
|
|
await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
|
|||
|
|
const address = server.address();
|
|||
|
|
const url = `http://127.0.0.1:${address.port}/api/health`;
|
|||
|
|
try {
|
|||
|
|
await probeHealth(url, { expectedNonce: nonce });
|
|||
|
|
await assert.rejects(
|
|||
|
|
probeHealth(url, { expectedNonce: 'd'.repeat(64) }),
|
|||
|
|
/unexpected sidecar identity/,
|
|||
|
|
);
|
|||
|
|
assert.deepEqual(received, [nonce, 'd'.repeat(64)]);
|
|||
|
|
} finally {
|
|||
|
|
await new Promise((resolve, reject) => server.close((error) => error ? reject(error) : resolve()));
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('cleans Conda and Python environment state before launching a frozen sidecar', () => {
|
|||
|
|
const condaRoot = 'D:\\AppData\\anaconda3';
|
|||
|
|
const env = buildChildEnv(
|
|||
|
|
{
|
|||
|
|
PATH: [
|
|||
|
|
condaRoot,
|
|||
|
|
`${condaRoot}\\Library\\bin`,
|
|||
|
|
`${condaRoot}\\Library\\mingw-w64\\bin`,
|
|||
|
|
`${condaRoot}\\Scripts`,
|
|||
|
|
`${condaRoot}\\condabin`,
|
|||
|
|
'C:\\Windows\\System32',
|
|||
|
|
'C:\\Program Files\\Git\\cmd',
|
|||
|
|
'C:\\APS\\Scripts',
|
|||
|
|
].join(';'),
|
|||
|
|
CONDA_PREFIX: condaRoot,
|
|||
|
|
CONDA_DEFAULT_ENV: 'base',
|
|||
|
|
CONDA_EXE: `${condaRoot}\\Scripts\\conda.exe`,
|
|||
|
|
PYTHONHOME: 'bad-home',
|
|||
|
|
PythonPath: 'bad-path',
|
|||
|
|
PYTHONUSERBASE: 'bad-user-site',
|
|||
|
|
WEB_CONCURRENCY: '2',
|
|||
|
|
UVICORN_WORKERS: '3',
|
|||
|
|
GUNICORN_CMD_ARGS: '--workers 4',
|
|||
|
|
APS_AUTH_PROVIDER: 'untrusted-provider',
|
|||
|
|
HTTP_PROXY: 'http://untrusted.invalid',
|
|||
|
|
},
|
|||
|
|
{
|
|||
|
|
APS_MODE: 'desktop',
|
|||
|
|
CONDA_PREFIX: 'C:\\override-conda',
|
|||
|
|
PYTHONPATH: 'override-user-site',
|
|||
|
|
PYTHONNOUSERSITE: '0',
|
|||
|
|
},
|
|||
|
|
'win32',
|
|||
|
|
);
|
|||
|
|
assert.equal(
|
|||
|
|
env.PATH,
|
|||
|
|
['C:\\Windows\\System32', 'C:\\Program Files\\Git\\cmd', 'C:\\APS\\Scripts'].join(';'),
|
|||
|
|
);
|
|||
|
|
assert.equal(env.CONDA_PREFIX, undefined);
|
|||
|
|
assert.equal(env.CONDA_DEFAULT_ENV, undefined);
|
|||
|
|
assert.equal(env.CONDA_EXE, undefined);
|
|||
|
|
assert.equal(env.PYTHONHOME, undefined);
|
|||
|
|
assert.equal(env.PythonPath, undefined);
|
|||
|
|
assert.equal(env.PYTHONPATH, undefined);
|
|||
|
|
assert.equal(env.PYTHONUSERBASE, undefined);
|
|||
|
|
assert.equal(env.WEB_CONCURRENCY, undefined);
|
|||
|
|
assert.equal(env.UVICORN_WORKERS, undefined);
|
|||
|
|
assert.equal(env.GUNICORN_CMD_ARGS, undefined);
|
|||
|
|
assert.equal(env.APS_AUTH_PROVIDER, undefined);
|
|||
|
|
assert.equal(env.HTTP_PROXY, undefined);
|
|||
|
|
assert.equal(env.PYTHONNOUSERSITE, '1');
|
|||
|
|
assert.equal(env.PYTHONUTF8, '1');
|
|||
|
|
assert.equal(env.APS_MODE, 'desktop');
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('starts the bundled executable with a same-origin UI and stops it', async () => {
|
|||
|
|
const { root, resourcesPath, apsHome } = fixture();
|
|||
|
|
const calls = [];
|
|||
|
|
const child = fakeChild(42);
|
|||
|
|
const manager = new SidecarManager({
|
|||
|
|
resourcesPath,
|
|||
|
|
apsHome,
|
|||
|
|
platform: 'win32',
|
|||
|
|
getPort: async () => 43123,
|
|||
|
|
waitForHealthy: async () => {},
|
|||
|
|
createNonce: () => 'a'.repeat(64),
|
|||
|
|
terminateChild: (target) => target.kill(),
|
|||
|
|
spawnProcess: (...args) => {
|
|||
|
|
calls.push(args);
|
|||
|
|
return child;
|
|||
|
|
},
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
try {
|
|||
|
|
assert.equal(await manager.start(), 'http://127.0.0.1:43123');
|
|||
|
|
assert.equal(calls.length, 1);
|
|||
|
|
assert.equal(path.basename(calls[0][0]), 'aps-sidecar.exe');
|
|||
|
|
assert.deepEqual(calls[0][1], []);
|
|||
|
|
assert.equal(calls[0][2].env.APS_HOME, apsHome);
|
|||
|
|
assert.equal(calls[0][2].env.APS_MODE, 'desktop');
|
|||
|
|
assert.equal(calls[0][2].env.APS_API_PORT, '43123');
|
|||
|
|
assert.equal(calls[0][2].env.APS_UI_DIR, path.join(resourcesPath, 'web', 'dist'));
|
|||
|
|
assert.equal(calls[0][2].env.APS_SIDECAR_NONCE, 'a'.repeat(64));
|
|||
|
|
assert.equal(calls[0][2].env.APS_PARENT_PID, String(process.pid));
|
|||
|
|
manager.stop();
|
|||
|
|
assert.equal(child.killed, true);
|
|||
|
|
} finally {
|
|||
|
|
fs.rmSync(root, { recursive: true, force: true });
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
test('restarts an unexpectedly exited sidecar with a fresh port and nonce', async () => {
|
|||
|
|
const { root, resourcesPath, apsHome } = fixture();
|
|||
|
|
const children = [fakeChild(1), fakeChild(2)];
|
|||
|
|
const ports = [43124, 43125];
|
|||
|
|
const nonces = ['b'.repeat(64), 'c'.repeat(64)];
|
|||
|
|
const calls = [];
|
|||
|
|
let launches = 0;
|
|||
|
|
const manager = new SidecarManager({
|
|||
|
|
resourcesPath,
|
|||
|
|
apsHome,
|
|||
|
|
platform: 'win32',
|
|||
|
|
getPort: async () => ports.shift(),
|
|||
|
|
waitForHealthy: async () => {},
|
|||
|
|
restartDelayMs: 1,
|
|||
|
|
stabilityResetMs: 10_000,
|
|||
|
|
createNonce: () => nonces.shift(),
|
|||
|
|
terminateChild: (target) => target.kill(),
|
|||
|
|
spawnProcess: (...args) => {
|
|||
|
|
calls.push(args);
|
|||
|
|
return children[launches++];
|
|||
|
|
},
|
|||
|
|
});
|
|||
|
|
|
|||
|
|
try {
|
|||
|
|
await manager.start();
|
|||
|
|
const restarted = once(manager, 'restarted');
|
|||
|
|
children[0].emit('exit', 7, null);
|
|||
|
|
const [event] = await restarted;
|
|||
|
|
assert.equal(event.attempt, 1);
|
|||
|
|
assert.equal(launches, 2);
|
|||
|
|
assert.equal(manager.origin, 'http://127.0.0.1:43125');
|
|||
|
|
assert.equal(calls[0][2].env.APS_API_PORT, '43124');
|
|||
|
|
assert.equal(calls[0][2].env.APS_SIDECAR_NONCE, 'b'.repeat(64));
|
|||
|
|
assert.equal(calls[1][2].env.APS_API_PORT, '43125');
|
|||
|
|
assert.equal(calls[1][2].env.APS_SIDECAR_NONCE, 'c'.repeat(64));
|
|||
|
|
manager.stop();
|
|||
|
|
} finally {
|
|||
|
|
fs.rmSync(root, { recursive: true, force: true });
|
|||
|
|
}
|
|||
|
|
});
|
|||
|
|
test('generates a one-time audit token per launch and never leaks it to the child env', async () => {
|
|||
|
|
const { root, resourcesPath, apsHome } = fixture();
|
|||
|
|
const children = [fakeChild(1), fakeChild(2)];
|
|||
|
|
const tokens = ['audit-token-1', 'audit-token-2'];
|
|||
|
|
const calls = [];
|
|||
|
|
let launches = 0;
|
|||
|
|
const manager = new SidecarManager({
|
|||
|
|
resourcesPath,
|
|||
|
|
apsHome,
|
|||
|
|
platform: 'win32',
|
|||
|
|
appVersion: '0.2.0',
|
|||
|
|
getPort: async () => 43127,
|
|||
|
|
waitForHealthy: async () => {},
|
|||
|
|
restartDelayMs: 1,
|
|||
|
|
stabilityResetMs: 10_000,
|
|||
|
|
createNonce: () => 'a'.repeat(64),
|
|||
|
|
createAuditToken: () => tokens.shift(),
|
|||
|
|
terminateChild: (target) => target.kill(),
|
|||
|
|
spawnProcess: (...args) => {
|
|||
|
|
calls.push(args);
|
|||
|
|
return children[launches++];
|
|||
|
|
},
|
|||
|
|
});
|
|||
|
|
try {
|
|||
|
|
await manager.start();
|
|||
|
|
assert.equal(manager.auditToken, 'audit-token-1');
|
|||
|
|
// 应用版本注入子进程 env；审计 token 仅限 Electron main 进程内，不进 env/不写盘
|
|||
|
|
assert.equal(calls[0][2].env.APS_APP_VERSION, '0.2.0');
|
|||
|
|
assert.equal(calls[0][2].env.APS_AUDIT_TOKEN, undefined);
|
|||
|
|
assert.equal(calls[0][2].env.APS_SIDECAR_NONCE, 'a'.repeat(64));
|
|||
|
|
const restarted = once(manager, 'restarted');
|
|||
|
|
children[0].emit('exit', 7, null);
|
|||
|
|
await restarted;
|
|||
|
|
assert.equal(manager.auditToken, 'audit-token-2'); // 重启后一次性 token 重新生成
|
|||
|
|
assert.equal(calls[1][2].env.APS_AUDIT_TOKEN, undefined);
|
|||
|
|
manager.stop();
|
|||
|
|
} finally {
|
|||
|
|
fs.rmSync(root, { recursive: true, force: true });
|
|||
|
|
}
|
|||
|
|
});
|