535 lines
31 KiB
TypeScript
535 lines
31 KiB
TypeScript
import { afterEach, describe, expect, it } from "vitest";
|
|
import { mkdir, readlink, symlink, writeFile, readFile, stat, readdir, utimes } from "node:fs/promises";
|
|
import { mkdtemp, rm } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import path from "node:path";
|
|
import { createHash, generateKeyPairSync, randomUUID, sign } from "node:crypto";
|
|
import {
|
|
atomicSwitchRelease,
|
|
applicationUpdateRuntimeHash,
|
|
createSafeArchive,
|
|
detectPlatform,
|
|
downloadReleaseAsset,
|
|
fetchReleaseMetadata,
|
|
fetchReleaseText,
|
|
extractSafeArchive,
|
|
isNewerVersion,
|
|
normalizeReleasePermissions,
|
|
sanitizeAssetName,
|
|
selectReleaseAsset,
|
|
runtimeHashFromLockfile,
|
|
validateHttpsUrl,
|
|
} from "../server/update.js";
|
|
import { finalizeUpdateJob, runUpdate } from "../server/cli/update.js";
|
|
import { validateUpdateRequest } from "../server/cli/update.js";
|
|
import { checkForUpdate, ORPHANED_UPDATE_TIMEOUT_MS, reconcileOrphanedUpdateJobs, verifyReleaseSignature } from "../server/update-service.js";
|
|
import { loadConfig, prepareDataDirectories } from "../server/config.js";
|
|
import { openDatabase } from "../server/db/index.js";
|
|
|
|
const envKeys = ["TALLYNOTE_DATA_DIR", "TALLYNOTE_INSTALL_PREFIX", "TALLYNOTE_PUBLIC_ORIGIN", "TALLYNOTE_COOKIE_SECURE", "TALLYNOTE_UPDATE_STRATEGY", "TALLYNOTE_UPDATE_METADATA_URL", "TALLYNOTE_UPDATE_ALLOWED_HOSTS", "TALLYNOTE_UPDATE_REQUIRE_SIGNATURE", "TALLYNOTE_UPDATE_PUBLIC_KEY"];
|
|
const originalFetch = globalThis.fetch;
|
|
|
|
afterEach(() => {
|
|
globalThis.fetch = originalFetch;
|
|
for (const key of envKeys) delete process.env[key];
|
|
});
|
|
|
|
describe("更新安全工具", () => {
|
|
it("严格比较 SemVer、平台和 HTTPS 白名单", () => {
|
|
expect(isNewerVersion("1.0.0", "1.1.0")).toBe(true);
|
|
expect(isNewerVersion("1.0.0", "1.0.0-beta.1")).toBe(false);
|
|
expect(detectPlatform("linux", "x86_64").target).toBe("linux-x64");
|
|
const release = {
|
|
version: "1.3.0",
|
|
assets: [
|
|
{ name: "tallynote-1.3.0-linux-arm64-glibc.tar.gz", url: "https://updates.example/arm" },
|
|
{ name: "tallynote-1.3.0-linux-x64-glibc.tar.gz", url: "https://updates.example/x64" },
|
|
],
|
|
};
|
|
expect(selectReleaseAsset(release, detectPlatform("linux", "x86_64"))?.name).toContain("linux-x64");
|
|
expect(selectReleaseAsset({ version: "1.3.0", assets: [{ name: "tallynote-1.3.0-linux-arm64-glibc.tar.gz", url: "https://updates.example/arm" }] }, detectPlatform("linux", "x86_64"))).toBeUndefined();
|
|
expect(() => validateHttpsUrl("http://updates.example/x64", { allowedHosts: ["updates.example"] })).toThrow();
|
|
expect(() => sanitizeAssetName("../release.tar.gz")).toThrow();
|
|
});
|
|
|
|
it("优先选择运行时匹配的轻量更新包，并对旧客户端保留完整包回退", () => {
|
|
const runtimeHash = runtimeHashFromLockfile("lockfile-v1\n");
|
|
const full = { name: "tallynote-1.3.0-linux-x64-glibc.tar.gz", url: "https://updates.example/full" };
|
|
const app = { name: `tallynote-1.3.0-linux-x64-glibc.update-${runtimeHash}.tar.gz`, url: "https://updates.example/app" };
|
|
const release = { version: "1.3.0", assets: [full, app] };
|
|
expect(applicationUpdateRuntimeHash(app.name)).toBe(runtimeHash);
|
|
expect(selectReleaseAsset(release, detectPlatform("linux", "x86_64"), runtimeHash)).toEqual(app);
|
|
expect(selectReleaseAsset(release, detectPlatform("linux", "x86_64"))).toEqual(full);
|
|
expect(applicationUpdateRuntimeHash(full.name)).toBeUndefined();
|
|
});
|
|
|
|
it("验证 SHA256SUMS 的 Ed25519 detached signature", () => {
|
|
const { publicKey, privateKey } = generateKeyPairSync("ed25519");
|
|
const payload = "a".repeat(64) + " tallynote.tar.gz\n";
|
|
const signature = sign(null, Buffer.from(payload), privateKey).toString("base64");
|
|
const pem = publicKey.export({ type: "spki", format: "pem" }).toString();
|
|
expect(verifyReleaseSignature(payload, signature, pem)).toBe(true);
|
|
expect(verifyReleaseSignature(payload, sign(null, Buffer.from(payload), privateKey), pem)).toBe(true);
|
|
expect(verifyReleaseSignature(payload + "tampered", signature, pem)).toBe(false);
|
|
});
|
|
|
|
it("拒绝把队列文件重定向到另一更新源", () => {
|
|
process.env.TALLYNOTE_DATA_DIR = "/tmp/tallynote-request-test";
|
|
process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3997";
|
|
process.env.TALLYNOTE_COOKIE_SECURE = "false";
|
|
process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
|
|
process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
|
|
process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
|
|
process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "true";
|
|
const config = loadConfig();
|
|
const base = {
|
|
jobId: "00000000-0000-4000-8000-000000000001",
|
|
version: "1.1.0",
|
|
assetUrl: "https://updates.example/app.tar.gz",
|
|
assetName: "app.tar.gz",
|
|
expectedSha256: "a".repeat(64),
|
|
requestedAt: Date.now(),
|
|
currentLink: config.currentLink,
|
|
releasesDir: config.releasesDir,
|
|
dataDir: config.dataDir,
|
|
};
|
|
expect(() => validateUpdateRequest({ ...base, metadataUrl: "https://evil.example/latest" }, config)).toThrow(/请求源|主机/);
|
|
expect(() => validateUpdateRequest({ ...base, metadataUrl: "https://updates.example/latest", requestedAt: Date.now() - 2 * 24 * 60 * 60 * 1000 }, config)).toThrow(/过期/);
|
|
});
|
|
|
|
it("读取 metadata 和 SHA256 sidecar 时限制重定向主机", async () => {
|
|
const digest = "a".repeat(64);
|
|
globalThis.fetch = (async (input: string | URL) => {
|
|
const url = input.toString();
|
|
if (url.endsWith("/latest")) {
|
|
return new Response(JSON.stringify({ tag_name: "v1.3.0", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: "app-linux-x64.tar.gz", browser_download_url: "https://updates.example/app-linux-x64.tar.gz" }] }), { status: 200, headers: { "content-type": "application/json" } });
|
|
}
|
|
return new Response(`${digest} app-linux-x64.tar.gz\n`, { status: 200 });
|
|
}) as typeof fetch;
|
|
const metadata = await fetchReleaseMetadata("https://updates.example/latest", { allowedHosts: ["updates.example"] });
|
|
expect(metadata.version).toBe("1.3.0");
|
|
expect((await fetchReleaseText("https://updates.example/SHA256SUMS", { allowedHosts: ["updates.example"] })).trim()).toContain(digest);
|
|
});
|
|
|
|
it("对没有 Content-Length 的 metadata 和 sidecar 响应执行流式大小限制", async () => {
|
|
const oversized = "x".repeat(2 * 1024 * 1024 + 1);
|
|
globalThis.fetch = (async (input: string | URL) => {
|
|
const url = input.toString();
|
|
return url.endsWith("/latest")
|
|
? new Response(oversized, { status: 200 })
|
|
: new Response(oversized, { status: 200 });
|
|
}) as typeof fetch;
|
|
await expect(fetchReleaseMetadata("https://updates.example/latest", { allowedHosts: ["updates.example"] })).rejects.toThrow("更新发布信息不可用");
|
|
await expect(fetchReleaseText("https://updates.example/SHA256SUMS", { allowedHosts: ["updates.example"], maxBytes: 1024 })).rejects.toThrow("更新校验文件过大");
|
|
});
|
|
|
|
it("不会把 SHA256SUMS.sig 误当成摘要清单", async () => {
|
|
const dataDir = await mkdtemp(path.join(tmpdir(), "tallynote-update-sidecar-order-"));
|
|
process.env.TALLYNOTE_DATA_DIR = dataDir;
|
|
process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
|
|
process.env.TALLYNOTE_COOKIE_SECURE = "false";
|
|
process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
|
|
process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
|
|
process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
|
|
process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
|
|
const config = loadConfig();
|
|
prepareDataDirectories(config);
|
|
const database = openDatabase(config);
|
|
const digest = "e".repeat(64);
|
|
const assetName = `tallynote-1.2.1-${detectPlatform().target}-glibc.tar.gz`;
|
|
globalThis.fetch = (async (input: string | URL) => input.toString().endsWith("SHA256SUMS.sig")
|
|
? new Response("not-a-digest")
|
|
: input.toString().endsWith("SHA256SUMS")
|
|
? new Response(`${digest} ${assetName}\n`)
|
|
: new Response(JSON.stringify({ tag_name: "v1.2.1", assets: [{ name: "SHA256SUMS.sig", browser_download_url: "https://updates.example/SHA256SUMS.sig" }, { name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: assetName, browser_download_url: `https://updates.example/${assetName}` }] })));
|
|
try {
|
|
const result = await checkForUpdate(database.sqlite, config);
|
|
expect(result.latest).toMatchObject({ compatible: true, integrityReady: true });
|
|
} finally {
|
|
database.sqlite.close();
|
|
await rm(dataDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("下载流限制大小并返回摘要", async () => {
|
|
const bytes = Buffer.from("release-bytes");
|
|
const destinationRoot = await mkdtemp(path.join(tmpdir(), "tallynote-update-download-"));
|
|
try {
|
|
globalThis.fetch = (async () => new Response(bytes, { status: 200, headers: { "content-length": String(bytes.length) } })) as typeof fetch;
|
|
const result = await downloadReleaseAsset("https://updates.example/release.tar.gz", path.join(destinationRoot, "release.tar.gz"), { allowedHosts: ["updates.example"], maxBytes: 1024 });
|
|
expect(result.size).toBe(bytes.length);
|
|
expect(result.sha256).toBe(createHash("sha256").update(bytes).digest("hex"));
|
|
} finally {
|
|
await rm(destinationRoot, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("原子切换 current 符号链接并保留旧版本", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-switch-"));
|
|
try {
|
|
const releases = path.join(root, "releases");
|
|
const current = path.join(root, "current");
|
|
const old = path.join(releases, "1.0.0");
|
|
const staged = path.join(root, "staged");
|
|
await mkdir(path.join(old, "dist"), { recursive: true });
|
|
await writeFile(path.join(old, "dist", "marker"), "old");
|
|
await mkdir(path.join(staged, "dist"), { recursive: true });
|
|
await writeFile(path.join(staged, "dist", "marker"), "new");
|
|
await symlink(old, current);
|
|
const result = await atomicSwitchRelease(staged, current, releases, "1.1.0");
|
|
expect(await readlink(current)).toBe(path.join(releases, "1.1.0"));
|
|
expect(result.previousTarget).toBe(path.relative(root, old));
|
|
} finally {
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("runUpdate 校验摘要、解包并原子替换目录", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-run-"));
|
|
try {
|
|
const source = path.join(root, "source");
|
|
const current = path.join(root, "current");
|
|
const staging = path.join(root, "staging");
|
|
const backup = path.join(root, "backups", "old.tar.gz");
|
|
await mkdir(path.join(source, "dist"), { recursive: true });
|
|
await writeFile(path.join(source, "dist", "marker"), "new");
|
|
await mkdir(path.join(current, "dist"), { recursive: true });
|
|
await writeFile(path.join(current, "dist", "marker"), "old");
|
|
const archive = path.join(root, "release.tar.gz");
|
|
await createSafeArchive(source, archive);
|
|
const bytes = await readFile(archive);
|
|
const digest = createHash("sha256").update(bytes).digest("hex");
|
|
const fetchImpl = (async () => new Response(bytes, { status: 200, headers: { "content-length": String(bytes.length) } })) as typeof fetch;
|
|
const result = await runUpdate({
|
|
assetUrl: "https://updates.example/release.tar.gz",
|
|
assetName: "release.tar.gz",
|
|
version: "1.1.0",
|
|
expectedSha256: digest,
|
|
currentVersion: "1.0.0",
|
|
currentDir: current,
|
|
stagingDir: staging,
|
|
backupArchivePath: backup,
|
|
allowedHosts: ["updates.example"],
|
|
fetchImpl,
|
|
});
|
|
expect(result.version).toBe("1.1.0");
|
|
expect(await readFile(path.join(current, "dist", "marker"), "utf8")).toBe("new");
|
|
expect((await stat(backup)).size).toBeGreaterThan(0);
|
|
} finally {
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("更新器支持旧客户端创建的 queued/apply 直接更新请求", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-direct-"));
|
|
const previousFetch = globalThis.fetch;
|
|
let database: ReturnType<typeof openDatabase> | undefined;
|
|
try {
|
|
const dataDir = path.join(root, "data");
|
|
const installPrefix = path.join(root, "install");
|
|
process.env.TALLYNOTE_DATA_DIR = dataDir;
|
|
process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
|
|
process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
|
|
process.env.TALLYNOTE_COOKIE_SECURE = "false";
|
|
process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
|
|
process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
|
|
process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
|
|
process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
|
|
const config = loadConfig();
|
|
prepareDataDirectories(config);
|
|
await mkdir(config.releasesDir, { recursive: true, mode: 0o755 });
|
|
const oldRelease = path.join(config.releasesDir, config.appVersion);
|
|
await mkdir(path.join(oldRelease, "dist"), { recursive: true, mode: 0o755 });
|
|
await writeFile(path.join(oldRelease, "dist", "marker"), "old");
|
|
await symlink(oldRelease, config.currentLink);
|
|
|
|
const source = path.join(root, "source");
|
|
await mkdir(path.join(source, "dist"), { recursive: true, mode: 0o755 });
|
|
await writeFile(path.join(source, "dist", "marker"), "new");
|
|
const archive = path.join(root, "release.tar.gz");
|
|
await createSafeArchive(source, archive);
|
|
const bytes = await readFile(archive);
|
|
const digest = createHash("sha256").update(bytes).digest("hex");
|
|
const jobId = randomUUID();
|
|
database = openDatabase(config);
|
|
const now = Date.now();
|
|
const assetName = `tallynote-1.3.0-${detectPlatform().target}.tar.gz`;
|
|
database.sqlite.prepare(`
|
|
INSERT INTO update_jobs(id, operation, status, version, platform, asset_url,
|
|
expected_sha256, created_at, updated_at, requested_at)
|
|
VALUES (?, 'apply', 'queued', '1.3.0', ?, ?, ?, ?, ?, ?)
|
|
`).run(jobId, detectPlatform().target, "https://updates.example/" + assetName, digest, now, now, now);
|
|
globalThis.fetch = (async (input: string | URL) => {
|
|
const url = input.toString();
|
|
if (url.endsWith("/latest")) return new Response(JSON.stringify({ tag_name: "v1.3.0", assets: [{ name: assetName, browser_download_url: `https://updates.example/${assetName}` }, { name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }] }));
|
|
if (url.endsWith("SHA256SUMS")) return new Response(`${digest} ${assetName}\n`);
|
|
return new Response(bytes, { headers: { "content-length": String(bytes.length) } });
|
|
}) as typeof fetch;
|
|
|
|
await runUpdate({
|
|
metadataUrl: config.updateMetadataUrl,
|
|
version: "1.3.0",
|
|
currentVersion: config.appVersion,
|
|
currentDir: config.currentLink,
|
|
stagingDir: path.join(root, "staging"),
|
|
currentLink: config.currentLink,
|
|
releasesDir: config.releasesDir,
|
|
allowedHosts: config.updateAllowedHosts,
|
|
maxBytes: config.updateMaxBytes,
|
|
dataBackupMaxBytes: config.maxTotalBytes,
|
|
deferCompletion: true,
|
|
operation: "apply",
|
|
jobId,
|
|
sqlite: database.sqlite,
|
|
fetchImpl: globalThis.fetch,
|
|
});
|
|
expect(await readFile(path.join(config.currentLink, "dist", "marker"), "utf8")).toBe("new");
|
|
const row = database.sqlite.prepare("SELECT operation, status FROM update_jobs WHERE id=?").get(jobId);
|
|
expect(row).toEqual({ operation: "apply", status: "applying" });
|
|
finalizeUpdateJob(database.sqlite, jobId, "failed", "健康检查失败（自定义）");
|
|
expect(database.sqlite.prepare("SELECT status, error_message AS errorMessage FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed", errorMessage: "健康检查失败（自定义）" });
|
|
finalizeUpdateJob(database.sqlite, jobId, "failed", "第二次 finalize 不应覆盖原消息");
|
|
expect(database.sqlite.prepare("SELECT status, error_message AS errorMessage FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed", errorMessage: "健康检查失败（自定义）" });
|
|
expect(database.sqlite.prepare("SELECT COUNT(*) AS count FROM audit_events WHERE action='update.failed' AND target_id=?").get(jobId)).toEqual({ count: 1 });
|
|
const defaultJobId = randomUUID();
|
|
database.sqlite.prepare(`
|
|
INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
|
|
VALUES (?, 'apply', 'applying', '1.3.0', ?, ?, ?, ?)
|
|
`).run(defaultJobId, detectPlatform().target, "https://updates.example/" + assetName, now, now);
|
|
finalizeUpdateJob(database.sqlite, defaultJobId, "failed", "");
|
|
expect(database.sqlite.prepare("SELECT error_message AS errorMessage FROM update_jobs WHERE id=?").get(defaultJobId)).toEqual({ errorMessage: "新版本健康检查失败，已恢复上一版本" });
|
|
const completedJobId = randomUUID();
|
|
database.sqlite.prepare(`
|
|
INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
|
|
VALUES (?, 'apply', 'completed', '1.3.0', ?, ?, ?, ?)
|
|
`).run(completedJobId, detectPlatform().target, "https://updates.example/" + assetName, now, now);
|
|
finalizeUpdateJob(database.sqlite, completedJobId, "completed");
|
|
expect(database.sqlite.prepare("SELECT COUNT(*) AS count FROM audit_events WHERE action='update.completed' AND target_id=?").get(completedJobId)).toEqual({ count: 0 });
|
|
expect(() => finalizeUpdateJob(database.sqlite, completedJobId, "failed", "不能降级已完成任务")).toThrow("更新任务状态不允许完成");
|
|
expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(completedJobId)).toEqual({ status: "completed" });
|
|
} finally {
|
|
globalThis.fetch = previousFetch;
|
|
if (database) database.sqlite.close();
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("在请求和恢复标记丢失后收敛孤儿任务，但保留 staged 下载", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-reconcile-"));
|
|
let database: ReturnType<typeof openDatabase> | undefined;
|
|
try {
|
|
const dataDir = path.join(root, "data");
|
|
const installPrefix = path.join(root, "install");
|
|
process.env.TALLYNOTE_DATA_DIR = dataDir;
|
|
process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
|
|
process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
|
|
process.env.TALLYNOTE_COOKIE_SECURE = "false";
|
|
process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
|
|
process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
|
|
process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
|
|
process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
|
|
const config = loadConfig();
|
|
prepareDataDirectories(config);
|
|
await mkdir(path.join(config.releasesDir, config.appVersion, "dist"), { recursive: true });
|
|
await symlink(path.join(config.releasesDir, config.appVersion), config.currentLink);
|
|
database = openDatabase(config);
|
|
const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
|
|
const insert = database.sqlite.prepare(`
|
|
INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
|
|
VALUES (?, ?, ?, ?, ?, ?, ?, ?)
|
|
`);
|
|
const queuedId = randomUUID();
|
|
const applyingId = randomUUID();
|
|
const stagedId = randomUUID();
|
|
const stagedApplyId = randomUUID();
|
|
insert.run(queuedId, "apply", "queued", "1.3.0", "linux-x64", "https://updates.example/queued.tar.gz", staleAt, staleAt);
|
|
insert.run(applyingId, "apply", "applying", config.appVersion, "linux-x64", "https://updates.example/applying.tar.gz", staleAt, staleAt);
|
|
insert.run(stagedId, "download", "staged", "1.3.0", "linux-x64", "https://updates.example/staged.tar.gz", staleAt, staleAt);
|
|
insert.run(stagedApplyId, "apply", "staged", "1.3.0", "linux-x64", "https://updates.example/staged-apply.tar.gz", staleAt, staleAt);
|
|
const now = Date.now();
|
|
expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(3);
|
|
expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(queuedId)).toEqual({ status: "failed" });
|
|
expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(applyingId)).toEqual({ status: "completed" });
|
|
expect(database.sqlite.prepare("SELECT status, operation FROM update_jobs WHERE id=?").get(stagedId)).toEqual({ status: "staged", operation: "download" });
|
|
expect(database.sqlite.prepare("SELECT status, operation FROM update_jobs WHERE id=?").get(stagedApplyId)).toEqual({ status: "staged", operation: "download" });
|
|
} finally {
|
|
if (database) database.sqlite.close();
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("下载心跳有效时不回收任务或删除仍在使用的请求文件", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-heartbeat-"));
|
|
let database: ReturnType<typeof openDatabase> | undefined;
|
|
try {
|
|
const dataDir = path.join(root, "data");
|
|
const installPrefix = path.join(root, "install");
|
|
process.env.TALLYNOTE_DATA_DIR = dataDir;
|
|
process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
|
|
process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
|
|
process.env.TALLYNOTE_COOKIE_SECURE = "false";
|
|
process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
|
|
process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
|
|
process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
|
|
process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
|
|
const config = loadConfig();
|
|
prepareDataDirectories(config);
|
|
await mkdir(path.join(config.releasesDir, config.appVersion, "dist"), { recursive: true });
|
|
await symlink(path.join(config.releasesDir, config.appVersion), config.currentLink);
|
|
database = openDatabase(config);
|
|
const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
|
|
const jobId = randomUUID();
|
|
database.sqlite.prepare(`
|
|
INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
|
|
VALUES (?, 'download', 'downloading', '1.3.0', 'linux-x64', ?, ?, ?)
|
|
`).run(jobId, "https://updates.example/download.tar.gz", staleAt, staleAt);
|
|
await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "download" }));
|
|
const statePath = path.join(config.installPrefix, ".update-state");
|
|
await writeFile(statePath, `job_id=${jobId}\nold_target=${path.join(config.releasesDir, config.appVersion)}\nphase=download\n`);
|
|
const now = Date.now();
|
|
await utimes(config.updateRequestPath, new Date(staleAt), new Date(staleAt));
|
|
await utimes(statePath, new Date(now), new Date(now));
|
|
expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(0);
|
|
expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "downloading" });
|
|
expect(await stat(config.updateRequestPath)).toBeTruthy();
|
|
|
|
const expiredNow = now + ORPHANED_UPDATE_TIMEOUT_MS + 1;
|
|
await utimes(statePath, new Date(staleAt), new Date(staleAt));
|
|
expect(reconcileOrphanedUpdateJobs(database.sqlite, config, expiredNow)).toBe(1);
|
|
expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
|
|
await expect(stat(config.updateRequestPath)).rejects.toThrow();
|
|
} finally {
|
|
if (database) database.sqlite.close();
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("队列任务有匹配请求标记时保留到租约过期，过期后才回收", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-queued-marker-"));
|
|
let database: ReturnType<typeof openDatabase> | undefined;
|
|
try {
|
|
const dataDir = path.join(root, "data");
|
|
const installPrefix = path.join(root, "install");
|
|
process.env.TALLYNOTE_DATA_DIR = dataDir;
|
|
process.env.TALLYNOTE_INSTALL_PREFIX = installPrefix;
|
|
process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3998";
|
|
process.env.TALLYNOTE_COOKIE_SECURE = "false";
|
|
process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
|
|
process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
|
|
process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
|
|
process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "false";
|
|
const config = loadConfig();
|
|
prepareDataDirectories(config);
|
|
database = openDatabase(config);
|
|
const staleAt = Date.now() - ORPHANED_UPDATE_TIMEOUT_MS - 1;
|
|
const jobId = randomUUID();
|
|
database.sqlite.prepare(`
|
|
INSERT INTO update_jobs(id, operation, status, version, platform, asset_url, created_at, updated_at)
|
|
VALUES (?, 'apply', 'queued', '1.3.0', 'linux-x64', ?, ?, ?)
|
|
`).run(jobId, "https://updates.example/queued.tar.gz", staleAt, staleAt);
|
|
await writeFile(config.updateRequestPath, JSON.stringify({ jobId, operation: "apply" }));
|
|
const now = Date.now();
|
|
await utimes(config.updateRequestPath, new Date(now), new Date(now));
|
|
|
|
// The DB row is old, but the request marker is fresh and names this
|
|
// exact job. Keep it queued while systemd has a chance to consume it.
|
|
expect(reconcileOrphanedUpdateJobs(database.sqlite, config, now)).toBe(0);
|
|
expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "queued" });
|
|
await expect(stat(config.updateRequestPath)).resolves.toBeTruthy();
|
|
|
|
const expiredNow = now + ORPHANED_UPDATE_TIMEOUT_MS + 1;
|
|
expect(reconcileOrphanedUpdateJobs(database.sqlite, config, expiredNow)).toBe(1);
|
|
expect(database.sqlite.prepare("SELECT status FROM update_jobs WHERE id=?").get(jobId)).toEqual({ status: "failed" });
|
|
await expect(stat(config.updateRequestPath)).rejects.toThrow();
|
|
} finally {
|
|
if (database) database.sqlite.close();
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("流式解包在展开大小上限前拒绝高压缩比归档，并修正发布树权限", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-stream-"));
|
|
try {
|
|
const source = path.join(root, "source");
|
|
const destination = path.join(root, "destination");
|
|
await mkdir(path.join(source, "dist", "server"), { recursive: true });
|
|
await mkdir(path.join(source, "bin"), { recursive: true });
|
|
await mkdir(path.join(source, "scripts"), { recursive: true });
|
|
await mkdir(path.join(source, "runtime", "bin"), { recursive: true });
|
|
await writeFile(path.join(source, "dist", "server", "large.js"), Buffer.alloc(2 * 1024 * 1024, 0x41));
|
|
await writeFile(path.join(source, "bin", "tallynote"), "#!/bin/sh\n");
|
|
await writeFile(path.join(source, "scripts", "runner.sh"), "#!/bin/sh\n");
|
|
await writeFile(path.join(source, "runtime", "bin", "node"), "node");
|
|
const archive = path.join(root, "release.tar.gz");
|
|
await createSafeArchive(source, archive);
|
|
expect((await stat(archive)).size).toBeLessThan(64 * 1024);
|
|
await expect(extractSafeArchive(archive, destination, { maxBytes: 1024 * 1024 })).rejects.toThrow(/大小限制/);
|
|
expect(await stat(destination).catch(() => null)).toBeNull();
|
|
|
|
await extractSafeArchive(archive, destination, { maxBytes: 4 * 1024 * 1024 });
|
|
await normalizeReleasePermissions(destination);
|
|
expect((await stat(path.join(destination, "dist"))).mode & 0o777).toBe(0o755);
|
|
expect((await stat(path.join(destination, "dist", "server", "large.js"))).mode & 0o777).toBe(0o644);
|
|
expect((await stat(path.join(destination, "bin", "tallynote"))).mode & 0o777).toBe(0o755);
|
|
expect((await stat(path.join(destination, "scripts", "runner.sh"))).mode & 0o777).toBe(0o755);
|
|
expect((await stat(path.join(destination, "runtime", "bin", "node"))).mode & 0o777).toBe(0o755);
|
|
} finally {
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("流式创建备份遵守大小上限并清理失败的临时文件", async () => {
|
|
const root = await mkdtemp(path.join(tmpdir(), "tallynote-update-archive-"));
|
|
try {
|
|
const source = path.join(root, "source");
|
|
const archive = path.join(root, "backup.tar.gz");
|
|
await mkdir(source, { recursive: true });
|
|
await writeFile(path.join(source, "large.bin"), Buffer.alloc(128 * 1024, 0x42));
|
|
await expect(createSafeArchive(source, archive, { maxBytes: 1024 })).rejects.toThrow(/大小限制/);
|
|
expect(await stat(archive).catch(() => null)).toBeNull();
|
|
expect((await readdir(root)).filter((name) => name.includes(".part-")).length).toBe(0);
|
|
await createSafeArchive(source, archive, { maxBytes: 256 * 1024 });
|
|
expect((await stat(archive)).size).toBeGreaterThan(0);
|
|
} finally {
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("更新元数据缓存", () => {
|
|
it("选择当前平台资产并要求 SHA256 sidecar", async () => {
|
|
const dataDir = await mkdtemp(path.join(tmpdir(), "tallynote-update-cache-"));
|
|
process.env.TALLYNOTE_DATA_DIR = dataDir;
|
|
process.env.TALLYNOTE_PUBLIC_ORIGIN = "http://127.0.0.1:3996";
|
|
process.env.TALLYNOTE_COOKIE_SECURE = "false";
|
|
process.env.TALLYNOTE_UPDATE_STRATEGY = "systemd";
|
|
process.env.TALLYNOTE_UPDATE_METADATA_URL = "https://updates.example/latest";
|
|
process.env.TALLYNOTE_UPDATE_ALLOWED_HOSTS = "updates.example";
|
|
process.env.TALLYNOTE_UPDATE_REQUIRE_SIGNATURE = "true";
|
|
const { publicKey, privateKey } = generateKeyPairSync("ed25519");
|
|
const publicPem = publicKey.export({ type: "spki", format: "pem" }).toString();
|
|
process.env.TALLYNOTE_UPDATE_PUBLIC_KEY = publicPem;
|
|
const config = loadConfig();
|
|
prepareDataDirectories(config);
|
|
const database = openDatabase(config);
|
|
const digest = "b".repeat(64);
|
|
const platformAsset = `tallynote-1.3.0-${detectPlatform().target}-glibc.tar.gz`;
|
|
const sums = `${digest} ${platformAsset}\n`;
|
|
const signature = sign(null, Buffer.from(sums), privateKey);
|
|
globalThis.fetch = (async (input: string | URL) => input.toString().endsWith("SHA256SUMS.sig")
|
|
? new Response(signature)
|
|
: input.toString().endsWith("SHA256SUMS")
|
|
? new Response(sums)
|
|
: new Response(JSON.stringify({ tag_name: "v1.3.0", published_at: "2026-08-28T00:00:00Z", assets: [{ name: "SHA256SUMS", browser_download_url: "https://updates.example/SHA256SUMS" }, { name: "SHA256SUMS.sig", browser_download_url: "https://updates.example/SHA256SUMS.sig" }, { name: platformAsset, browser_download_url: `https://updates.example/${platformAsset}` }] }), { status: 200 })) as typeof fetch;
|
|
try {
|
|
const result = await checkForUpdate(database.sqlite, config);
|
|
expect(result.latest).toMatchObject({ version: "1.3.0", compatible: true, integrityReady: true, signatureReady: true, isNewer: true });
|
|
const cached = database.sqlite.prepare("SELECT value FROM system_settings WHERE key='update.release.v1'").get() as { value: string };
|
|
expect(JSON.parse(cached.value).asset.sha256).toBe(digest);
|
|
} finally {
|
|
database.sqlite.close();
|
|
await rm(dataDir, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|