Build MVP with Pi installer and atomic updates

2026-07-31 18:17:27 +02:00
parent e575ed2b2f
commit c52def7c37
35 changed files with 7762 additions and 1 deletions
@@ -0,0 +1,157 @@
+import { afterEach, describe, expect, it } from "vitest";
+import type { FastifyInstance } from "fastify";
+import { buildApp } from "../src/app.js";
+import type { AppConfig } from "../src/config.js";
+import { CSRF_COOKIE, SESSION_COOKIE } from "../src/security.js";
+
+const apps: FastifyInstance[] = [];
+
+function testConfig(): AppConfig {
+  return {
+    nodeEnv: "test",
+    host: "127.0.0.1",
+    port: 8787,
+    databasePath: ":memory:",
+    sessionTtlMs: 60_000,
+    cookieSecure: false,
+    allowedOrigins: new Set(["http://mg4pi.local:8787"]),
+    updateStatusPath: `/tmp/pi-car-companion-test-${process.pid}-missing-update.json`,
+    versionFile: `/tmp/pi-car-companion-test-${process.pid}-missing-revision`
+  };
+}
+
+async function createApp(): Promise<FastifyInstance> {
+  const app = await buildApp(testConfig());
+  apps.push(app);
+  return app;
+}
+
+async function csrf(app: FastifyInstance): Promise<string> {
+  const response = await app.inject({ method: "GET", url: "/api/auth/state" });
+  expect(response.statusCode).toBe(200);
+  return response.json<{ csrfToken: string }>().csrfToken;
+}
+
+function mutationHeaders(token: string) {
+  return {
+    cookie: `${CSRF_COOKIE}=${token}`,
+    "x-csrf-token": token,
+    origin: "http://mg4pi.local:8787"
+  };
+}
+
+async function setup(app: FastifyInstance, token: string) {
+  return app.inject({
+    method: "POST",
+    url: "/api/auth/setup",
+    headers: mutationHeaders(token),
+    payload: { username: "owner", password: "correct-horse-battery-staple" }
+  });
+}
+
+afterEach(async () => {
+  await Promise.all(apps.splice(0).map((app) => app.close()));
+});
+
+describe("authentication boundary", () => {
+  it("creates exactly one initial administrator", async () => {
+    const app = await createApp();
+    const token = await csrf(app);
+
+    expect((await setup(app, token)).statusCode).toBe(201);
+    const second = await app.inject({
+      method: "POST",
+      url: "/api/auth/setup",
+      headers: mutationHeaders(token),
+      payload: { username: "second", password: "another-secure-password" }
+    });
+
+    expect(second.statusCode).toBe(409);
+    expect(second.json()).toMatchObject({ error: { code: "SETUP_COMPLETE" } });
+  });
+
+  it("rejects state changes without a matching CSRF token", async () => {
+    const app = await createApp();
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/auth/setup",
+      payload: { username: "owner", password: "correct-horse-battery-staple" }
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json()).toMatchObject({ error: { code: "CSRF_REJECTED" } });
+  });
+
+  it("rejects an untrusted browser origin", async () => {
+    const app = await createApp();
+    const token = await csrf(app);
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/auth/setup",
+      headers: { ...mutationHeaders(token), origin: "https://attacker.example" },
+      payload: { username: "owner", password: "correct-horse-battery-staple" }
+    });
+
+    expect(response.statusCode).toBe(403);
+    expect(response.json()).toMatchObject({ error: { code: "ORIGIN_REJECTED" } });
+  });
+
+  it("accepts a same-host origin for dynamic LAN addresses", async () => {
+    const app = await createApp();
+    const token = await csrf(app);
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/auth/setup",
+      headers: {
+        ...mutationHeaders(token),
+        host: "192.168.4.20:8787",
+        origin: "http://192.168.4.20:8787"
+      },
+      payload: { username: "owner", password: "correct-horse-battery-staple" }
+    });
+
+    expect(response.statusCode).toBe(201);
+  });
+
+  it("requires a valid session for system status", async () => {
+    const app = await createApp();
+    expect((await app.inject({ method: "GET", url: "/api/status" })).statusCode).toBe(401);
+
+    const token = await csrf(app);
+    await setup(app, token);
+    const login = await app.inject({
+      method: "POST",
+      url: "/api/auth/login",
+      headers: mutationHeaders(token),
+      payload: { username: "owner", password: "correct-horse-battery-staple" }
+    });
+    expect(login.statusCode).toBe(200);
+    const sessionCookie = login.cookies.find((cookie) => cookie.name === SESSION_COOKIE);
+    expect(sessionCookie).toBeDefined();
+
+    const status = await app.inject({
+      method: "GET",
+      url: "/api/status",
+      headers: { cookie: `${SESSION_COOKIE}=${sessionCookie?.value ?? ""}` }
+    });
+    expect(status.statusCode, status.body).toBe(200);
+    expect(status.json()).toMatchObject({ service: { state: "healthy" } });
+
+    const update = await app.inject({
+      method: "POST",
+      url: "/api/system/update",
+      headers: {
+        ...mutationHeaders(token),
+        cookie: `${CSRF_COOKIE}=${token}; ${SESSION_COOKIE}=${sessionCookie?.value ?? ""}`
+      }
+    });
+    expect(update.statusCode).toBe(503);
+    expect(update.json()).toMatchObject({ error: { code: "UPDATES_UNAVAILABLE" } });
+  });
+
+  it("does not expose update state without authentication", async () => {
+    const app = await createApp();
+    const response = await app.inject({ method: "GET", url: "/api/system/update" });
+    expect(response.statusCode).toBe(401);
+  });
+});
@@ -0,0 +1,86 @@
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import type { AppConfig } from "../src/config.js";
+import { readUpdateStatus } from "../src/update.js";
+
+const temporaryDirectories: string[] = [];
+
+function config(updateStatusPath: string, versionFile: string): AppConfig {
+  return {
+    nodeEnv: "test",
+    host: "127.0.0.1",
+    port: 8787,
+    databasePath: ":memory:",
+    sessionTtlMs: 60_000,
+    cookieSecure: false,
+    allowedOrigins: new Set(),
+    updateStatusPath,
+    versionFile
+  };
+}
+
+afterEach(async () => {
+  await Promise.all(temporaryDirectories.splice(0).map((directory) => rm(directory, { recursive: true, force: true })));
+});
+
+describe("system update status", () => {
+  it("reads only validated updater state and active revision metadata", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "pi-car-update-test-"));
+    temporaryDirectories.push(directory);
+    const statusPath = join(directory, "status.json");
+    const versionPath = join(directory, "REVISION");
+    await writeFile(
+      statusPath,
+      JSON.stringify({
+        state: "success",
+        message: "Update installed.",
+        fromRevision: "a".repeat(40),
+        toRevision: "b".repeat(40),
+        updatedAt: "2026-07-31T18:00:00.000Z"
+      })
+    );
+    await writeFile(versionPath, `${"b".repeat(40)}\n`);
+
+    await expect(readUpdateStatus(config(statusPath, versionPath))).resolves.toMatchObject({
+      state: "success",
+      installedRevision: "b".repeat(40),
+      supported: true
+    });
+  });
+
+  it("treats missing or malformed status files as unsupported", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "pi-car-update-test-"));
+    temporaryDirectories.push(directory);
+    const statusPath = join(directory, "status.json");
+    await writeFile(statusPath, "not-json");
+
+    await expect(readUpdateStatus(config(statusPath, join(directory, "missing")))).resolves.toMatchObject({
+      state: "idle",
+      installedRevision: null,
+      supported: false
+    });
+  });
+
+  it("recovers an update state left running after interruption", async () => {
+    const directory = await mkdtemp(join(tmpdir(), "pi-car-update-test-"));
+    temporaryDirectories.push(directory);
+    const statusPath = join(directory, "status.json");
+    await writeFile(
+      statusPath,
+      JSON.stringify({
+        state: "building",
+        message: "Building.",
+        fromRevision: null,
+        toRevision: null,
+        updatedAt: "2020-01-01T00:00:00.000Z"
+      })
+    );
+
+    await expect(readUpdateStatus(config(statusPath, join(directory, "missing")))).resolves.toMatchObject({
+      state: "failed",
+      supported: true
+    });
+  });
+});