feat: add TallyNote local reimbursement ledger

tests/update-api.test.ts

@@ -0,0 +1,134 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { chmodSync, mkdtempSync, readFileSync, statSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { buildApp } from "../server/app.js";
+import { loadConfig, prepareDataDirectories } from "../server/config.js";
+import { openDatabase } from "../server/db/index.js";
+import { hashPassword } from "../server/security.js";
+import { detectPlatform } from "../server/update.js";
+
+describe("更新 API", () => {
+  let dataDir: string;
+  let config: ReturnType<typeof loadConfig>;
+  let database: ReturnType<typeof openDatabase>;
+  let app: Awaited<ReturnType<typeof buildApp>>;
+  const originalFetch = globalThis.fetch;
+
+  beforeEach(async () => {
+    dataDir = mkdtempSync(path.join(tmpdir(), "tallynote-update-api-"));
+    process.env.TALLYNOTE_DATA_DIR = dataDir;
+    process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3995";
+    process.env.TALLYNOTE_COOKIE_SECURE = "false";
+    process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
+    process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
+    process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
+    // This API fixture focuses on queue ownership; the signature path is
+    // covered by update.test.ts with a generated Ed25519 key.
+    process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
+    config = loadConfig();
+    prepareDataDirectories(config);
+    database = openDatabase(config);
+    app = await buildApp(database, config);
+  });
+
+  afterEach(async () => {
+    globalThis.fetch = originalFetch;
+    await app.close();
+    database.sqlite.close();
+    rmSync(dataDir, { recursive: true, force: true });
+    for (const key of ["TALLYNOTE_DATA_DIR", "TALLYNOTE_PUBLIC_ORIGIN", "TALLYNOTE_COOKIE_SECURE", "TALLYNOTE_UPDATE_STRATEGY", "TALLYNOTE_UPDATE_METADATA_URL", "TALLYNOTE_UPDATE_ALLOWED_HOSTS", "TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", "TALLYNOTE_UPDATE_PUBLIC_KEY"]) delete process.env[key];
+  });
+
+  async function login(username = "update-admin") {
+    const adminId = randomUUID();
+    const password = "UpdateApiPassword!2026";
+    const passwordHash = await hashPassword(password);
+    database.sqlite.prepare(`
+      INSERT INTO admins(id, username, username_norm, display_name, password_hash, status,
+        must_change_password, auth_version, version, created_at)
+      VALUES (?, ?, ?, ?, ?, 'active', 0, 1, 1, ?)
+    `).run(adminId, username, username, `更新测试管理员-${username}`, passwordHash, Date.now());
+    const response = await app.inject({ method: "POST", url: "/api/auth/login", headers: { origin: config.publicOrigin }, payload: { username, password } });
+    const raw = response.headers["set-cookie"];
+    const cookies = (Array.isArray(raw) ? raw : [raw ?? ""]).map((value) => value.split(";", 1)[0]).join("; ");
+    const csrf = /(?:^|; )tally_csrf=([^;]+)/.exec(cookies)?.[1] ?? "";
+    return { cookies, csrf };
+  }
+
+  function mockRelease() {
+    const digest = "c".repeat(64);
+    const asset = `tallynote-1.1.0-${detectPlatform().target}-glibc.tar.gz`;
+    globalThis.fetch = (async (input: string | URL) => input.toString().endsWith("SHA256SUMS")
+      ? new Response(`${digest}  ${asset}\n`, { status: 200 })
+      : new Response(JSON.stringify({ tag_name: "v1.1.0", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: asset, browser_download_url: `https://updates.example/${asset}` }] }), { status: 200 })) as typeof fetch;
+  }
+
+  it("检查 release、创建受保护请求文件并拒绝重复任务", async () => {
+    const session = await login();
+    mockRelease();
+    const checked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+    expect(checked.statusCode).toBe(200);
+    expect(checked.json().latest).toMatchObject({ version: "1.1.0", compatible: true, integrityReady: true, isNewer: true });
+    expect(checked.headers["cache-control"]).toBe("no-store");
+    const tooSoon = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: {} });
+    expect(tooSoon.statusCode).toBe(429);
+    expect(tooSoon.headers["retry-after"]).toBeDefined();
+
+    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.1.0", confirm: true } });
+    expect(applied.statusCode).toBe(202);
+    const jobId = applied.json().job.id as string;
+    const request = JSON.parse(readFileSync(config.updateRequestPath, "utf8")) as { jobId: string; expectedSha256: string; currentLink: string };
+    expect(request).toMatchObject({ jobId, expectedSha256: "c".repeat(64), currentLink: config.currentLink });
+    expect(statSync(config.updateRequestPath).mode & 0o777).toBe(0o600);
+
+    mockRelease();
+    const duplicate = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.1.0", confirm: true } });
+    expect(duplicate.statusCode).toBe(409);
+    expect(duplicate.json().error.code).toBe("UPDATE_IN_PROGRESS");
+    const status = await app.inject({ method: "GET", url: "/api/update/status", headers: { cookie: session.cookies } });
+    expect(status.json().job).toMatchObject({ id: jobId, status: "queued" });
+    const audit = database.sqlite.prepare("SELECT action FROM audit_events WHERE action LIKE 'update.%' ORDER BY id").all() as Array<{ action: string }>;
+    expect(audit.map((row) => row.action)).toEqual(expect.arrayContaining(["update.checked", "update.apply_requested"]));
+  });
+
+  it("缺少确认或未启用 systemd 时不接受更新", async () => {
+    const session = await login();
+    const invalid = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.1.0" } });
+    expect(invalid.statusCode).toBe(400);
+    process.env.TALLYNOTE_UPDATE_STRATEGY = "disabled";
+    const disabledConfig = loadConfig();
+    expect(disabledConfig.updateStrategy).toBe("disabled");
+  });
+
+  it("更新任务只对发起管理员可见，并隐藏内部错误详情", async () => {
+    const owner = await login("update-owner");
+    const other = await login("update-other");
+    mockRelease();
+    const checked = await app.inject({ method: "POST", url: "/api/update/check", headers: { origin: config.publicOrigin, cookie: owner.cookies, "x-csrf-token": owner.csrf }, payload: {} });
+    expect(checked.statusCode).toBe(200);
+    const applied = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: owner.cookies, "x-csrf-token": owner.csrf }, payload: { version: "1.1.0", confirm: true } });
+    expect(applied.statusCode).toBe(202);
+    const jobId = applied.json().job.id as string;
+    database.sqlite.prepare("UPDATE update_jobs SET error_message=? WHERE id=?").run("/var/lib/tallynote/secret-command-output", jobId);
+
+    const hiddenStatus = await app.inject({ method: "GET", url: "/api/update/status", headers: { cookie: other.cookies } });
+    expect(hiddenStatus.statusCode).toBe(200);
+    expect(hiddenStatus.json().job).toBeNull();
+    const hiddenDetail = await app.inject({ method: "GET", url: `/api/update/jobs/${jobId}`, headers: { cookie: other.cookies } });
+    expect(hiddenDetail.statusCode).toBe(404);
+    const ownDetail = await app.inject({ method: "GET", url: `/api/update/jobs/${jobId}`, headers: { cookie: owner.cookies } });
+    expect(ownDetail.statusCode).toBe(200);
+    expect(ownDetail.json().job.errorMessage).toBe("更新失败，请查看服务器日志或重试");
+  });
+
+  it("应用前重新校验失败时写入失败审计", async () => {
+    const session = await login("update-audit");
+    globalThis.fetch = (async () => new Response("upstream unavailable", { status: 503 })) as typeof fetch;
+    const response = await app.inject({ method: "POST", url: "/api/update/apply", headers: { origin: config.publicOrigin, cookie: session.cookies, "x-csrf-token": session.csrf }, payload: { version: "1.1.0", confirm: true } });
+    expect(response.statusCode).toBe(502);
+    const audit = database.sqlite.prepare("SELECT outcome FROM audit_events WHERE action='update.apply_requested' ORDER BY id DESC LIMIT 1").get() as { outcome: string } | undefined;
+    expect(audit?.outcome).toBe("failure");
+  });
+});