模型配置", `说明`} {
+ if !strings.Contains(notes.HTML, fragment) {
+ t.Fatalf("missing HTML fragment %q: %s", fragment, notes.HTML)
+ }
+ }
+ }
+ })
+ }
+}
+
+func TestReleaseNotesResolvesRelativeLinks(t *testing.T) {
+ server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+ _, _ = w.Write([]byte(``))
+ }))
+ defer server.Close()
+ notes, err := readReleaseNotes(t.Context(), server.Client(), server.URL+"/releases/tag/v2.1.3")
+ if err != nil || !strings.Contains(notes.HTML, `href="`+server.URL+`/repo/issues/1"`) || !strings.Contains(notes.HTML, `src="`+server.URL+`/releases/image.png"`) {
+ t.Fatalf("notes=%+v err=%v", notes, err)
+ }
+}
+
+func TestUnavailableNotesDoNotBlockInstall(t *testing.T) {
+ m := newManager(t.Context(), Options{BaseDir: t.TempDir(), Version: "v1.0.0", Release: true})
+ m.platform = "linux-x86_64"
+ m.status.Notes = "outdated notes"
+ m.status.NotesHTML = "outdated notes
" + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if r.Method == http.MethodHead && r.URL.Path == "/releases/latest" { + w.Header().Set("Location", "https://github.com/"+repository+"/releases/tag/v2.1.3") + w.WriteHeader(http.StatusFound) + return + } + if r.Method != http.MethodGet || r.URL.Path != "/releases/tag/v2.1.3" { + t.Errorf("unexpected request: %s %s", r.Method, r.URL) + } + w.WriteHeader(http.StatusForbidden) + })) + defer server.Close() + m.endpoint = server.URL + "/releases/latest" + m.client = server.Client() + m.check() + status := m.Status() + if !status.CanInstall || !status.Available || status.Error != "" || status.Notes != "" || status.NotesHTML != "" || status.LatestVersion != "v2.1.3" { + t.Fatalf("status=%+v", status) + } +} + +func TestReleaseNotesRequestCanBeCanceled(t *testing.T) { + ctx, cancel := context.WithCancel(t.Context()) + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + cancel() + <-r.Context().Done() + })) + defer server.Close() + defer cancel() + if _, err := readReleaseNotes(ctx, server.Client(), server.URL); err == nil { + t.Fatal("canceled notes request succeeded") + } +} diff --git a/internal/update/process.go b/internal/update/process.go new file mode 100644 index 00000000..833ebf9b --- /dev/null +++ b/internal/update/process.go @@ -0,0 +1,41 @@ +package update + +import ( + "os" + "os/exec" + "path/filepath" + "strings" +) + +func startDetached(executable string, args []string, dir, readyFile string) (*exec.Cmd, error) { + logDir := filepath.Join(dir, "logs") + if err := os.MkdirAll(logDir, 0755); err != nil { + return nil, err + } + log, err := os.OpenFile(filepath.Join(logDir, "update.log"), os.O_WRONLY|os.O_CREATE|os.O_APPEND, 0600) + if err != nil { + return nil, err + } + defer log.Close() + input, err := os.Open(os.DevNull) + if err != nil { + return nil, err + } + defer input.Close() + cmd := exec.Command(executable, args...) + cmd.Dir = dir + for _, env := range os.Environ() { + if !strings.HasPrefix(env, readyEnvironment+"=") && !strings.HasPrefix(env, "JAVBOSS_BACKGROUND_CHILD=") { + cmd.Env = append(cmd.Env, env) + } + } + if readyFile != "" { + cmd.Env = append(cmd.Env, readyEnvironment+"="+readyFile) + } + cmd.Stdin, cmd.Stdout, cmd.Stderr = input, log, log + detachProcess(cmd) + if err := cmd.Start(); err != nil { + return nil, err + } + return cmd, nil +} diff --git a/internal/update/process_unix.go b/internal/update/process_unix.go new file mode 100644 index 00000000..92d5fff8 --- /dev/null +++ b/internal/update/process_unix.go @@ -0,0 +1,10 @@ +//go:build !windows + +package update + +import ( + "os/exec" + "syscall" +) + +func detachProcess(cmd *exec.Cmd) { cmd.SysProcAttr = &syscall.SysProcAttr{Setsid: true} } diff --git a/internal/update/process_windows.go b/internal/update/process_windows.go new file mode 100644 index 00000000..24597cca --- /dev/null +++ b/internal/update/process_windows.go @@ -0,0 +1,12 @@ +//go:build windows + +package update + +import ( + "os/exec" + "syscall" +) + +func detachProcess(cmd *exec.Cmd) { + cmd.SysProcAttr = &syscall.SysProcAttr{HideWindow: true, CreationFlags: 0x00000008 | 0x00000200} +} diff --git a/internal/update/releases.go b/internal/update/releases.go new file mode 100644 index 00000000..305766f6 --- /dev/null +++ b/internal/update/releases.go @@ -0,0 +1,89 @@ +package update + +import ( + "context" + "fmt" + "net/http" + "net/url" + "regexp" + "strings" + + "golang.org/x/mod/semver" +) + +const repository = "Solr159/JavBoss" + +var releaseTag = regexp.MustCompile(`^v[0-9]+\.[0-9]+\.[0-9]+$`) + +type asset struct { + Name string + URL string +} + +type release struct { + Tag string +} + +func platformName(goos, goarch string) string { + return map[string]string{ + "windows/amd64": "windows-x86_64", "linux/amd64": "linux-x86_64", + "darwin/amd64": "macos-x86_64", "darwin/arm64": "macos-arm64", + }[goos+"/"+goarch] +} + +// Read GitHub's Latest redirect without fetching its HTML or using the REST API. +// Fail closed if Latest was accidentally assigned to a browser extension release. +func latestRelease(ctx context.Context, client *http.Client, endpoint string) (*release, error) { + req, err := http.NewRequestWithContext(ctx, http.MethodHead, endpoint, nil) + if err != nil { + return nil, err + } + req.Header.Set("User-Agent", "JavBoss-Updater") + redirectClient := *client + redirectClient.CheckRedirect = func(*http.Request, []*http.Request) error { return http.ErrUseLastResponse } + resp, err := redirectClient.Do(req) + if err != nil { + return nil, fmt.Errorf("check latest release: %w", err) + } + defer resp.Body.Close() + if resp.StatusCode == http.StatusNotFound { + return nil, nil + } + switch resp.StatusCode { + case http.StatusMovedPermanently, http.StatusFound, http.StatusSeeOther, http.StatusTemporaryRedirect, http.StatusPermanentRedirect: + default: + return nil, fmt.Errorf("check latest release: expected a redirect, got HTTP %d", resp.StatusCode) + } + location, err := url.Parse(resp.Header.Get("Location")) + if err != nil { + return nil, fmt.Errorf("invalid latest release redirect: %w", err) + } + // GitHub may return a relative Location. Resolve against the trusted website, + // not a caller-supplied Host or the redirected destination. + base, _ := url.Parse("https://github.com/" + repository + "/releases/latest") + location = base.ResolveReference(location) + prefix := "/" + repository + "/releases/tag/" + if location.Scheme != "https" || location.Host != "github.com" || location.User != nil || + location.RawQuery != "" || location.Fragment != "" || !strings.HasPrefix(location.Path, prefix) { + return nil, fmt.Errorf("latest release does not point to an official application release") + } + tag := strings.TrimPrefix(location.Path, prefix) + if !releaseTag.MatchString(tag) || !semver.IsValid(tag) { + return nil, fmt.Errorf("latest release is not a stable application version: %s", tag) + } + return &release{Tag: tag}, nil +} + +// Release archives have fixed names, so no API or manifest is needed. +func releaseAsset(r *release, platform string) (asset, error) { + if r == nil || !releaseTag.MatchString(r.Tag) || !semver.IsValid(r.Tag) { + return asset{}, fmt.Errorf("invalid application release version") + } + switch platform { + case "windows-x86_64", "linux-x86_64", "macos-x86_64", "macos-arm64": + default: + return asset{}, fmt.Errorf("unsupported release platform: %s", platform) + } + name := "javboss-" + r.Tag + "-" + platform + ".zip" + return asset{Name: name, URL: "https://github.com/" + repository + "/releases/download/" + r.Tag + "/" + name}, nil +} diff --git a/internal/update/releases_test.go b/internal/update/releases_test.go new file mode 100644 index 00000000..11a88e45 --- /dev/null +++ b/internal/update/releases_test.go @@ -0,0 +1,81 @@ +package update + +import ( + "archive/zip" + "bytes" + "errors" + "net/http" + "net/http/httptest" + "path/filepath" + "testing" +) + +func TestFailedCheckClearsPreviousInstall(t *testing.T) { + m := newManager(t.Context(), Options{BaseDir: t.TempDir(), Version: "v1.0.0", Release: true}) + m.status.CanInstall = true + m.selected = asset{Name: "old.zip"} + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + w.WriteHeader(http.StatusForbidden) + })) + defer server.Close() + m.endpoint = server.URL + "/releases/latest" + m.client = server.Client() + m.check() + status := m.Status() + if status.CanInstall || status.Error == "" || m.selected.Name != "" { + t.Fatalf("status=%+v selected=%+v", status, m.selected) + } +} + +func TestDownloadFollowsAssetRedirectAfterLatestCheck(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + switch r.URL.Path { + case "/releases/latest": + w.Header().Set("Location", "https://github.com/"+repository+"/releases/tag/v2.1.4") + w.WriteHeader(http.StatusFound) + case "/release.zip": + http.Redirect(w, r, "/asset-content", http.StatusFound) + case "/asset-content": + _, _ = w.Write([]byte("archive contents")) + default: + t.Errorf("unexpected URL: %s", r.URL) + } + })) + defer server.Close() + client := server.Client() + if _, err := latestRelease(t.Context(), client, server.URL+"/releases/latest"); err != nil { + t.Fatal(err) + } + target := filepath.Join(t.TempDir(), "release.zip") + if err := downloadArchive(t.Context(), client, asset{URL: server.URL + "/release.zip"}, target, func(int64, int64) {}); err != nil { + t.Fatal(err) + } + requireFile(t, filepath.Dir(target), "release.zip", "archive contents") +} + +func TestExtractArchiveRejectsCorruptContents(t *testing.T) { + var buffer bytes.Buffer + writer := zip.NewWriter(&buffer) + entry, err := writer.CreateHeader(&zip.FileHeader{Name: "package/file", Method: zip.Store}) + if err != nil { + t.Fatal(err) + } + content := []byte("unique archive content") + if _, err := entry.Write(content); err != nil { + t.Fatal(err) + } + if err := writer.Close(); err != nil { + t.Fatal(err) + } + data := buffer.Bytes() + index := bytes.Index(data, content) + if index < 0 { + t.Fatal("missing stored content") + } + data[index] ^= 1 + root := t.TempDir() + archive := putFile(t, root, "corrupt.zip", string(data)) + if err := extractArchive(t.Context(), archive, filepath.Join(root, "payload"), "package"); !errors.Is(err, zip.ErrChecksum) { + t.Fatalf("expected ZIP checksum failure, got %v", err) + } +} diff --git a/internal/update/replace.go b/internal/update/replace.go new file mode 100644 index 00000000..a9d0e0d9 --- /dev/null +++ b/internal/update/replace.go @@ -0,0 +1,119 @@ +package update + +import ( + "errors" + "fmt" + "os" + "path/filepath" +) + +type replacedFile struct { + Target string `json:"target"` + Backup string `json:"backup"` + Old bool `json:"old"` + Installed bool `json:"installed"` +} + +type replacement struct { + files []*replacedFile + journal string + rename func(string, string) error + rollbackFailed bool +} + +func replacePayload(base, payload, backup string) (*replacement, error) { + t := &replacement{journal: filepath.Join(backup, "files.json"), rename: os.Rename} + return t, t.apply(base, payload, backup) +} + +func (t *replacement) apply(base, payload, backup string) (err error) { + defer func() { + if err != nil { + rollbackErr := t.rollback() + t.rollbackFailed = rollbackErr != nil + err = errors.Join(err, rollbackErr) + } + }() + // Only release-owned paths are replaced. Never copy default configuration or + // touch data/tools (user-installed FFmpeg), covers, videos, or client settings. + paths := []string{executableName(), "web/dist", "internal/bin/ffprobe", "internal/bin/ffprobe.exe", + "internal/bin/ffmpeg", "internal/bin/ffmpeg.exe", "internal/bin/mpv", "modernz", "javboss.command", ".version"} + for _, rel := range paths { + rel = filepath.FromSlash(rel) + src := filepath.Join(payload, rel) + if _, err := os.Lstat(src); os.IsNotExist(err) { + continue + } else if err != nil { + return err + } + if err := validateParents(base, rel); err != nil { + return err + } + target, saved := filepath.Join(base, rel), filepath.Join(backup, "files", rel) + if err := os.MkdirAll(filepath.Dir(saved), 0700); err != nil { + return err + } + if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil { + return err + } + entry := &replacedFile{Target: target, Backup: saved} + t.files = append(t.files, entry) + if _, err := os.Lstat(target); err == nil { + if err := t.rename(target, saved); err != nil { + return err + } + entry.Old = true + } else if !os.IsNotExist(err) { + return err + } + if err := writeJSON(t.journal, t.files); err != nil { + return err + } + if err := t.rename(src, target); err != nil { + return err + } + entry.Installed = true + if err := writeJSON(t.journal, t.files); err != nil { + return err + } + } + return nil +} + +func validateParents(base, rel string) error { + for parent := filepath.Dir(rel); parent != "."; parent = filepath.Dir(parent) { + info, err := os.Lstat(filepath.Join(base, parent)) + if os.IsNotExist(err) { + continue + } + if err != nil { + return err + } + if !info.IsDir() { + return fmt.Errorf("update parent is not a regular directory: %s", parent) + } + } + return nil +} + +func (t *replacement) rollback() error { + var failures []error + for i := len(t.files) - 1; i >= 0; i-- { + entry := t.files[i] + if entry.Installed { + if err := os.RemoveAll(entry.Target); err != nil { + failures = append(failures, err) + continue + } + entry.Installed = false + } + if entry.Old { + if err := os.Rename(entry.Backup, entry.Target); err != nil { + failures = append(failures, err) + continue + } + entry.Old = false + } + } + return errors.Join(failures...) +} diff --git a/internal/update/update_test.go b/internal/update/update_test.go new file mode 100644 index 00000000..be822b05 --- /dev/null +++ b/internal/update/update_test.go @@ -0,0 +1,361 @@ +package update + +import ( + "archive/zip" + "bytes" + "context" + "database/sql" + "errors" + "fmt" + "net/http" + "net/http/httptest" + "net/url" + "os" + "path/filepath" + "strings" + "sync/atomic" + "testing" + "time" +) + +func putFile(t *testing.T, root, rel, value string) string { + t.Helper() + name := filepath.Join(root, filepath.FromSlash(rel)) + if err := os.MkdirAll(filepath.Dir(name), 0755); err != nil { + t.Fatal(err) + } + if err := os.WriteFile(name, []byte(value), 0644); err != nil { + t.Fatal(err) + } + return name +} + +func requireFile(t *testing.T, root, rel, value string) { + t.Helper() + data, err := os.ReadFile(filepath.Join(root, filepath.FromSlash(rel))) + if err != nil || string(data) != value { + t.Fatalf("%s = %q, %v; want %q", rel, data, err, value) + } +} + +func TestLatestReleaseUsesOnlyValidatedRedirect(t *testing.T) { + prefix := "https://github.com/" + repository + "/releases/tag/" + for _, tc := range []struct { + name, location, want string + status int + bad bool + }{ + {"stable", prefix + "v2.10.0", "v2.10.0", 302, false}, + {"relative", "/" + repository + "/releases/tag/v2.10.0", "v2.10.0", 302, false}, + {"extension", prefix + "browser-extension-v9.0.0", "", 302, true}, + {"prerelease", prefix + "v2.10.0-rc.1", "", 302, true}, + {"foreign host", "https://example.com/" + repository + "/releases/tag/v2.10.0", "", 302, true}, + {"foreign repo", "https://github.com/other/repo/releases/tag/v2.10.0", "", 302, true}, + {"insecure", strings.Replace(prefix, "https:", "http:", 1) + "v2.10.0", "", 302, true}, + {"query", prefix + "v2.10.0?x=1", "", 302, true}, + {"missing location", "", "", 302, true}, + {"no release", "", "", 404, false}, + {"forbidden", "", "", 403, true}, + {"html instead of redirect", "", "", 200, true}, + } { + t.Run(tc.name, func(t *testing.T) { + requests := 0 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + requests++ + if r.Method != http.MethodHead || r.URL.Path != "/releases/latest" || r.URL.RawQuery != "" { + t.Errorf("unexpected request %s %s", r.Method, r.URL) + } + w.Header().Set("Location", tc.location) + w.WriteHeader(tc.status) + })) + defer server.Close() + r, err := latestRelease(t.Context(), server.Client(), server.URL+"/releases/latest") + if (err != nil) != tc.bad || requests != 1 { + t.Fatalf("release=%+v requests=%d err=%v", r, requests, err) + } + if tc.want != "" && (r == nil || r.Tag != tc.want) { + t.Fatalf("release=%+v", r) + } + if tc.status == 404 && r != nil { + t.Fatalf("expected no release: %+v", r) + } + }) + } +} + +func TestReleaseAssetUsesFixedOfficialURL(t *testing.T) { + for _, platform := range []string{"windows-x86_64", "linux-x86_64", "macos-x86_64", "macos-arm64"} { + a, err := releaseAsset(&release{Tag: "v2.0.0"}, platform) + name := "javboss-v2.0.0-" + platform + ".zip" + if err != nil || a.Name != name || a.URL != "https://github.com/"+repository+"/releases/download/v2.0.0/"+name { + t.Fatalf("asset=%+v err=%v", a, err) + } + } + for _, tag := range []string{"browser-extension-v2.0.0", "v2.0.0-rc.1", "v02.0.0", "../v2.0.0"} { + if _, err := releaseAsset(&release{Tag: tag}, "linux-x86_64"); err == nil { + t.Fatalf("accepted invalid version %s", tag) + } + } + if _, err := releaseAsset(&release{Tag: "v2.0.0"}, "../linux-x86_64"); err == nil { + t.Fatal("accepted unsupported platform") + } +} + +func TestDownloadWithoutManifest(t *testing.T) { + content := "release bytes" + for _, tc := range []struct { + name string + length int64 + status int + bad bool + }{ + {"known size", int64(len(content)), 200, false}, + {"chunked", -1, 200, false}, + {"truncated", int64(len(content) + 1), 200, true}, + {"over limit", maxArchiveSize + 1, 200, true}, + {"empty", 0, 200, true}, + {"missing asset", -1, 404, true}, + } { + t.Run(tc.name, func(t *testing.T) { + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + if tc.length >= 0 { + w.Header().Set("Content-Length", fmt.Sprint(tc.length)) + } + w.WriteHeader(tc.status) + w.(http.Flusher).Flush() + if tc.length != 0 { + _, _ = w.Write([]byte(content)) + } + })) + defer server.Close() + var downloaded, total int64 + target := filepath.Join(t.TempDir(), "release.zip") + err := downloadArchive(t.Context(), server.Client(), asset{URL: server.URL}, target, func(n, size int64) { downloaded, total = n, size }) + if (err != nil) != tc.bad { + t.Fatalf("err=%v", err) + } + if !tc.bad { + wantTotal := tc.length + if wantTotal < 0 { + wantTotal = 0 + } + if downloaded != int64(len(content)) || total != wantTotal { + t.Fatalf("downloaded=%d total=%d", downloaded, total) + } + requireFile(t, filepath.Dir(target), "release.zip", content) + } + }) + } +} + +func TestExtractArchiveRejectsUnsafeEntries(t *testing.T) { + for _, tc := range []struct { + name, path string + mode os.FileMode + bad bool + }{ + {"valid", "package/web/dist/index.html", 0644, false}, + {"traversal", "package/../escaped", 0644, true}, + {"absolute", "/package/file", 0644, true}, + {"backslash", `package/..\escaped`, 0644, true}, + {"wrong root", "other/file", 0644, true}, + {"link", "package/link", os.ModeSymlink | 0777, true}, + {"drive", "package/C:/file", 0644, true}, + {"windows parent alias", "package/.. /escaped", 0644, true}, + {"windows device", "package/NUL.txt", 0644, true}, + {"windows trailing dot", "package/file.", 0644, true}, + } { + t.Run(tc.name, func(t *testing.T) { + var buffer bytes.Buffer + writer := zip.NewWriter(&buffer) + header := &zip.FileHeader{Name: tc.path, Method: zip.Deflate} + header.SetMode(tc.mode) + file, err := writer.CreateHeader(header) + if err != nil { + t.Fatal(err) + } + _, _ = file.Write([]byte("content")) + if err := writer.Close(); err != nil { + t.Fatal(err) + } + root := t.TempDir() + archive := putFile(t, root, "archive.zip", buffer.String()) + err = extractArchive(t.Context(), archive, filepath.Join(root, "payload"), "package") + if (err != nil) != tc.bad { + t.Fatalf("err=%v", err) + } + }) + } +} + +func TestReplacementPreservesDataAndRollsBackFailures(t *testing.T) { + for _, failAt := range []int{0, 1, 2, 3, 4, 5, 6} { + t.Run(fmt.Sprint(failAt), func(t *testing.T) { + base, payload, backup := t.TempDir(), t.TempDir(), t.TempDir() + for _, rel := range []string{executableName(), "web/dist/index.html", "modernz/file"} { + putFile(t, base, rel, "old") + putFile(t, payload, rel, "new") + } + for _, rel := range []string{"config.toml", "data/javboss.db", "data/client/settings.json", "data/tools/ffmpeg"} { + putFile(t, base, rel, "user") + putFile(t, payload, rel, "default") + } + putFile(t, base, "web/dist/obsolete.js", "old asset") + calls := 0 + tx := &replacement{journal: filepath.Join(backup, "files.json"), rename: func(a, b string) error { + calls++ + if calls == failAt { + return errors.New("simulated locked file") + } + return os.Rename(a, b) + }} + err := tx.apply(base, payload, backup) + if (err != nil) != (failAt > 0) { + t.Fatalf("err=%v", err) + } + want := "new" + if failAt > 0 { + want = "old" + } + for _, rel := range []string{executableName(), "web/dist/index.html", "modernz/file"} { + requireFile(t, base, rel, want) + } + for _, rel := range []string{"config.toml", "data/javboss.db", "data/client/settings.json", "data/tools/ffmpeg"} { + requireFile(t, base, rel, "user") + } + if failAt == 0 { + if _, err := os.Stat(filepath.Join(base, "web/dist/obsolete.js")); !os.IsNotExist(err) { + t.Fatal("obsolete frontend survived replacement") + } + } + }) + } +} + +func TestDatabaseBackupIncludesWALAndDoesNotMigrate(t *testing.T) { + root := t.TempDir() + source := filepath.Join(root, "database.db") + dest := filepath.Join(root, "backup.db") + db, err := sql.Open("sqlite3", source) + if err != nil { + t.Fatal(err) + } + defer db.Close() + if _, err = db.Exec("PRAGMA journal_mode=WAL; PRAGMA wal_autocheckpoint=0; CREATE TABLE example (value TEXT); INSERT INTO example VALUES ('saved')"); err != nil { + t.Fatal(err) + } + if err = backupDatabase(source, dest); err != nil { + t.Fatal(err) + } + backup, err := sql.Open("sqlite3", dest) + if err != nil { + t.Fatal(err) + } + defer backup.Close() + var got string + if err = backup.QueryRow("SELECT value FROM example").Scan(&got); err != nil || got != "saved" { + t.Fatalf("backup=%q err=%v", got, err) + } + var count int + if err = backup.QueryRow("SELECT count(*) FROM sqlite_master WHERE name='goose_db_version'").Scan(&count); err != nil || count != 0 { + t.Fatalf("migration unexpectedly run: %d %v", count, err) + } +} + +func TestManagerCheckNeverStopsApplicationAndDisablesUnsupportedInstall(t *testing.T) { + for _, tc := range []struct { + name string + release, container bool + version, reason string + }{ + {"desktop", true, false, "v1.0.0", ""}, + {"container", true, true, "v1.0.0", "container"}, + {"development", false, false, "dev", "development"}, + {"already current", true, false, "v2.0.0", ""}, + } { + t.Run(tc.name, func(t *testing.T) { + var stops atomic.Int32 + m := newManager(t.Context(), Options{BaseDir: t.TempDir(), Version: tc.version, Release: tc.release, Container: tc.container, Stop: func() { stops.Add(1) }}) + m.platform = "linux-x86_64" + name := "javboss-v2.0.0-linux-x86_64.zip" + requests := 0 + server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + requests++ + if r.Method == http.MethodHead && r.URL.Path == "/releases/latest" { + w.Header().Set("Location", "https://github.com/"+repository+"/releases/tag/v2.0.0") + w.WriteHeader(http.StatusFound) + return + } + if r.Method == http.MethodGet && r.URL.Path == "/releases/tag/v2.0.0" { + _, _ = w.Write([]byte(`更新说明
更新说明
" { + t.Fatalf("requests=%d notes=%q", requests, status.Notes) + } + if installable && m.selected.URL != "https://github.com/"+repository+"/releases/download/v2.0.0/"+name { + t.Fatalf("wrong download URL: %s", m.selected.URL) + } + if stops.Load() != 0 { + t.Fatal("checking stopped app") + } + if tc.reason != "" && m.StartInstall() == nil { + t.Fatal("unsupported install accepted") + } + }) + } +} + +func TestBusyOperationsAndHTTPNeverAcceptArbitraryDownloads(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + m := newManager(ctx, Options{BaseDir: t.TempDir(), Version: "v1.0.0", Release: true}) + m.status.Phase = "downloading" + if m.StartCheck() == nil || m.StartInstall() == nil { + t.Fatal("concurrent operation accepted") + } + old := active.Swap(m) + defer active.Store(old) + m.status.Phase = "idle" + w := httptest.NewRecorder() + ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/system/update/install", strings.NewReader(`{"url":"https://attacker/evil","path":"/tmp/evil"}`)), "/system/update") + if w.Code != http.StatusConflict { + t.Fatalf("unexpected status=%d", w.Code) + } + cancel() + if !errors.Is(m.StartCheck(), context.Canceled) { + t.Fatal("started check during shutdown") + } +} + +func TestWaitFileCancellation(t *testing.T) { + ctx, cancel := context.WithTimeout(t.Context(), time.Millisecond) + defer cancel() + if err := waitFile(ctx, filepath.Join(t.TempDir(), "absent"), "ready"); !errors.Is(err, context.DeadlineExceeded) { + t.Fatalf("error=%v", err) + } +} + +func TestDatabaseURIEscapesPathsAndWindowsDrives(t *testing.T) { + for _, path := range []string{"/tmp/数据库 ?#.db", "C:/Users/My Name/数据库.db"} { + parsed, err := url.Parse(databaseURI(path)) + if err != nil { + t.Fatal(err) + } + if parsed.Host != "" || parsed.Fragment != "" || parsed.Query().Get("mode") != "rw" || strings.TrimPrefix(parsed.Path, "/") != strings.TrimPrefix(path, "/") { + t.Fatalf("invalid SQLite URI: %s", parsed) + } + } +} diff --git a/scripts/cli/tests/install.test.mjs b/scripts/cli/tests/install.test.mjs index af7ae9fb..2b9564f6 100644 --- a/scripts/cli/tests/install.test.mjs +++ b/scripts/cli/tests/install.test.mjs @@ -288,10 +288,18 @@ test("version update only changes README links", (t) => { for (const name of ["install.sh", "install.ps1"]) { fs.writeFileSync(path.join(dir, "scripts", name), "installer must stay unchanged\n"); } - fs.writeFileSync(path.join(dir, "README.md"), "https://github.com/Solr159/JavBoss/releases/download/v1.0.0/javboss-v1.0.0-linux-x86_64.zip\n"); + const platforms = ["windows-x86_64", "linux-x86_64", "macos-x86_64", "macos-arm64"]; + const extension = "https://github.com/Solr159/JavBoss/releases/download/v1.0.0/javboss-browser-extension-v0.14.1.zip"; + const before = ["Release documentation", ...platforms.map(platform => + `https://github.com/Solr159/JavBoss/releases/download/v1.0.0/javboss-v1.0.0-${platform}.zip`), extension].join("\n"); + fs.writeFileSync(path.join(dir, "README.md"), before); const result = spawnSync(process.execPath, [path.join(dir, "scripts", "update-release-version.mjs"), "v9.8.7"], { encoding: "utf8" }); assert.equal(result.status, 0, result.stderr); - assert.match(fs.readFileSync(path.join(dir, "README.md"), "utf8"), /download\/v9\.8\.7\/javboss-v9\.8\.7-linux-x86_64.zip/); + const expected = before.replaceAll(/download\/v1\.0\.0\/javboss-v1\.0\.0-/g, "download/v9.8.7/javboss-v9.8.7-"); + assert.equal(fs.readFileSync(path.join(dir, "README.md"), "utf8"), expected); + const retry = spawnSync(process.execPath, [path.join(dir, "scripts", "update-release-version.mjs"), "v9.8.7"], { encoding: "utf8" }); + assert.equal(retry.status, 0, retry.stderr); + assert.equal(fs.readFileSync(path.join(dir, "README.md"), "utf8"), expected); for (const name of ["install.sh", "install.ps1"]) { assert.equal(fs.readFileSync(path.join(dir, "scripts", name), "utf8"), "installer must stay unchanged\n"); } diff --git a/scripts/cli/tests/update-release-version.test.mjs b/scripts/cli/tests/update-release-version.test.mjs new file mode 100644 index 00000000..e749af41 --- /dev/null +++ b/scripts/cli/tests/update-release-version.test.mjs @@ -0,0 +1,68 @@ +import assert from "node:assert/strict"; +import { spawnSync } from "node:child_process"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; +import { fileURLToPath } from "node:url"; +import test from "node:test"; + +const script = fileURLToPath(new URL("../../update-release-version.mjs", import.meta.url)); +const baseURL = "https://github.com/Solr159/JavBoss/releases/download/"; +const appURL = baseURL + "v1.0.0/javboss-v1.0.0-linux-x86_64.zip"; +const extURL = version => baseURL + `v1.0.0/javboss-browser-extension-v${version}.zip`; + +for (const scenario of [ + { name: "standalone extension updates only its own link", tag: "browser-extension-v0.15.0", extension: "0.15.0", current: "0.14.1", update: true }, + { name: "bundled extension uses the main release tag and its own asset version", tag: "v2.1.4", extension: "0.15.0", current: "0.14.1", update: true }, + { name: "main release without an extension preserves the extension link", tag: "v2.1.4", current: "0.14.1", update: false }, + { name: "old standalone retry cannot downgrade the extension", tag: "browser-extension-v0.14.0", extension: "0.14.0", current: "0.15.0", update: false }, + { name: "older bundled extension cannot downgrade a newer standalone link", tag: "v2.1.4", extension: "0.14.0", current: "0.15.0", update: false, standalone: true }, + { name: "extension versions compare numerically", tag: "browser-extension-v0.10.0", extension: "0.10.0", current: "0.9.0", update: true }, + { name: "extension versions support four components", tag: "browser-extension-v0.14.1.2", extension: "0.14.1.2", current: "0.14.1", update: true }, +]) { + test(scenario.name, (t) => { + const dir = fs.mkdtempSync(path.join(os.tmpdir(), "javboss-readme-update-")); + t.after(() => fs.rmSync(dir, { recursive: true, force: true })); + const readme = path.join(dir, "README.md"); + const metadata = path.join(dir, "release.json"); + const oldExtension = scenario.standalone + ? baseURL + `browser-extension-v${scenario.current}/javboss-browser-extension-v${scenario.current}.zip` + : extURL(scenario.current); + const before = `Keep documentation\n[App](${appURL})\n[Extension](${oldExtension})\n`; + fs.writeFileSync(readme, before); + fs.writeFileSync(metadata, JSON.stringify({ assets: scenario.extension ? [{ name: `javboss-browser-extension-v${scenario.extension}.zip` }] : [] })); + let expected = before; + if (scenario.tag.startsWith("v")) { + expected = expected.replace(appURL, baseURL + `${scenario.tag}/javboss-${scenario.tag}-linux-x86_64.zip`); + } + if (scenario.update) { + expected = expected.replace(oldExtension, baseURL + `${scenario.tag}/javboss-browser-extension-v${scenario.extension}.zip`); + } + for (let retry = 0; retry < 2; retry++) { + const result = spawnSync(process.execPath, [script, scenario.tag, metadata, readme], { encoding: "utf8" }); + assert.equal(result.status, 0, result.stderr); + assert.equal(fs.readFileSync(readme, "utf8"), expected); + } + }); +} + +for (const scenario of [ + { name: "missing extension asset", tag: "browser-extension-v0.15.0", assets: [] }, + { name: "mismatched extension asset", tag: "browser-extension-v0.15.0", assets: ["javboss-browser-extension-v0.14.1.zip"] }, + { name: "ambiguous bundled extension assets", tag: "v2.1.4", assets: ["javboss-browser-extension-v0.15.0.zip", "javboss-browser-extension-v0.14.1.zip"] }, + { name: "missing README extension link", tag: "v2.1.4", assets: ["javboss-browser-extension-v0.15.0.zip"], missingLink: true }, + { name: "invalid release tag", tag: "../invalid", assets: [] }, +]) { + test(`${scenario.name} leaves README untouched`, (t) => { + const dir = fs.mkdtempSync(path.join(os.tmpdir(), "javboss-readme-update-")); + t.after(() => fs.rmSync(dir, { recursive: true, force: true })); + const readme = path.join(dir, "README.md"); + const metadata = path.join(dir, "release.json"); + const before = appURL + "\n" + (scenario.missingLink ? "" : extURL("0.14.1")); + fs.writeFileSync(readme, before); + fs.writeFileSync(metadata, JSON.stringify({ assets: scenario.assets.map(name => ({ name })) })); + const result = spawnSync(process.execPath, [script, scenario.tag, metadata, readme], { encoding: "utf8" }); + assert.notEqual(result.status, 0); + assert.equal(fs.readFileSync(readme, "utf8"), before); + }); +} diff --git a/scripts/update-release-version.mjs b/scripts/update-release-version.mjs index 06ea9df0..536b75d1 100644 --- a/scripts/update-release-version.mjs +++ b/scripts/update-release-version.mjs @@ -6,45 +6,72 @@ import { fileURLToPath } from "node:url"; const SCRIPT_DIR = path.dirname(fileURLToPath(import.meta.url)); const ROOT_DIR = path.dirname(SCRIPT_DIR); const REPO = "Solr159/JavBoss"; - const version = String(process.argv[2] || "").trim(); -if (!/^v[0-9]+\.[0-9]+\.[0-9]+([-.][0-9A-Za-z.-]+)?$/.test(version)) { - console.error("usage: node scripts/update-release-version.mjs vX.Y.Z"); +const metadataPath = process.argv[3]; +// The workflow reads its script from the selected ref, but edits only main's README. +const readmePath = path.resolve(process.argv[4] || path.join(ROOT_DIR, "README.md")); +const applicationRelease = /^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$/.test(version); +const extensionRelease = /^browser-extension-v[0-9]+(?:\.[0-9]+){0,3}$/.test(version); +if (!applicationRelease && !extensionRelease) { + console.error("usage: node scripts/update-release-version.mjs RELEASE_TAG [RELEASE_JSON] [README_PATH]"); process.exit(1); } -async function replaceRequired(relativePath, replacements) { - const filePath = path.join(ROOT_DIR, relativePath); - let content = await fs.readFile(filePath, "utf8"); - let changed = false; - - for (const [pattern, replacement] of replacements) { - pattern.lastIndex = 0; - if (!pattern.test(content)) { - throw new Error(`${relativePath}: pattern not found: ${pattern}`); - } - pattern.lastIndex = 0; - content = content.replace(pattern, replacement); - changed = true; - } +const extensionAssetPattern = /^javboss-browser-extension-v([0-9]+(?:\.[0-9]+){0,3})\.zip$/; +let extensionAsset; +if (metadataPath) { + const release = JSON.parse(await fs.readFile(metadataPath, "utf8")); + const extensions = release.assets.filter(asset => extensionAssetPattern.test(asset.name)); + if (extensions.length > 1) throw new Error("release has multiple browser extension packages"); + extensionAsset = extensions[0]?.name; +} else if (extensionRelease) { + extensionAsset = `javboss-${version}.zip`; +} +if (extensionRelease && extensionAsset !== `javboss-${version}.zip`) { + throw new Error("release is missing its browser extension package"); +} - if (changed) { - await fs.writeFile(filePath, content); - } +const before = await fs.readFile(readmePath, "utf8"); +let content = before; +function replaceRequired(pattern, replacement) { + if (!pattern.test(content)) throw new Error(`README.md: pattern not found: ${pattern}`); + pattern.lastIndex = 0; + content = content.replace(pattern, replacement); } -const platformPattern = "(windows-x86_64|linux-x86_64|macos-x86_64|macos-arm64)"; -const existingVersionPattern = "v[0-9]+\\.[0-9]+\\.[0-9]+(?:[-.][0-9A-Za-z.-]+)?"; -const releaseUrlPattern = new RegExp( - `https://github\\.com/${REPO}/releases/download/` + - `${existingVersionPattern}/` + - `javboss-${existingVersionPattern}-` + - `${platformPattern}\\.zip`, - "g", -); +if (applicationRelease) { + const platformPattern = "(windows-x86_64|linux-x86_64|macos-x86_64|macos-arm64)"; + const existingVersionPattern = "v[0-9]+\\.[0-9]+\\.[0-9]+(?:[-.][0-9A-Za-z.-]+)?"; + const releaseUrlPattern = new RegExp( + `https://github\\.com/${REPO}/releases/download/` + + `${existingVersionPattern}/javboss-${existingVersionPattern}-${platformPattern}\\.zip`, "g", + ); + replaceRequired(releaseUrlPattern, + `https://github.com/${REPO}/releases/download/${version}/javboss-${version}-$1.zip`); +} -const releaseUrlReplacement = `https://github.com/${REPO}/releases/download/${version}/javboss-${version}-$1.zip`; +// Compare the extension's own 1–4 numeric version components, not the main tag. +function compareExtensionVersions(left, right) { + const a = left.split(".").map(BigInt); + const b = right.split(".").map(BigInt); + for (let i = 0; i < 4; i++) { + const diff = (a[i] ?? 0n) - (b[i] ?? 0n); + if (diff !== 0n) return diff > 0n ? 1 : -1; + } + return 0; +} -await replaceRequired("README.md", [[releaseUrlPattern, releaseUrlReplacement]]); +if (extensionAsset) { + const extensionVersion = extensionAsset.match(extensionAssetPattern)[1]; + const extensionUrlPattern = new RegExp( + `https://github\\.com/${REPO}/releases/download/[^/\\s<>"()]+/` + + "javboss-browser-extension-v([0-9]+(?:\\.[0-9]+){0,3})\\.zip", "g", + ); + replaceRequired(extensionUrlPattern, (url, installedVersion) => { + if (compareExtensionVersions(extensionVersion, installedVersion) < 0) return url; + return `https://github.com/${REPO}/releases/download/${version}/${extensionAsset}`; + }); +} -console.log(`updated release version to ${version}`); +if (content !== before) await fs.writeFile(readmePath, content); +console.log(content === before ? "README download links are already up to date" : `updated README download links for ${version}`); diff --git a/web/package-lock.json b/web/package-lock.json index 3f57a224..ac6f3b8d 100644 --- a/web/package-lock.json +++ b/web/package-lock.json @@ -13,6 +13,7 @@ "@emotion/styled": "^11.14.1", "@mui/icons-material": "^7.3.6", "@mui/material": "^7.3.6", + "dompurify": "^3.4.17", "flv.js": "^1.6.2", "react": "^18.3.1", "react-dom": "^18.3.1", @@ -1219,6 +1220,13 @@ "@types/react": "*" } }, + "node_modules/@types/trusted-types": { + "version": "2.0.7", + "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz", + "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==", + "license": "MIT", + "optional": true + }, "node_modules/@ungap/structured-clone": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/@ungap/structured-clone/-/structured-clone-1.3.0.tgz", @@ -2229,6 +2237,15 @@ "resolved": "https://registry.npmjs.org/dom-walk/-/dom-walk-0.1.2.tgz", "integrity": "sha512-6QvTW9mrGeIegrFXdtQi9pk7O/nSK6lSdXW2eqUspN5LWD7UTji2Fqw5V2YLjBpHEoU9Xl/eUWNpDeZvoyOv2w==" }, + "node_modules/dompurify": { + "version": "3.4.17", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.17.tgz", + "integrity": "sha512-B/pSlYVHQ58kqISD/yDjuJ1yfzI34m1gF4lAod2bwSRhiN4K5Cl3H8Af7hqB2PmTL911tdEudnnXn5FnhRoz0w==", + "license": "(MPL-2.0 OR Apache-2.0)", + "optionalDependencies": { + "@types/trusted-types": "^2.0.7" + } + }, "node_modules/dunder-proto": { "version": "1.0.1", "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", diff --git a/web/package.json b/web/package.json index 71b3b090..e7a4e849 100644 --- a/web/package.json +++ b/web/package.json @@ -18,6 +18,7 @@ "@emotion/styled": "^11.14.1", "@mui/icons-material": "^7.3.6", "@mui/material": "^7.3.6", + "dompurify": "^3.4.17", "flv.js": "^1.6.2", "react": "^18.3.1", "react-dom": "^18.3.1", diff --git a/web/src/features/settings/api.js b/web/src/features/settings/api.js index ac0e4381..976d791e 100644 --- a/web/src/features/settings/api.js +++ b/web/src/features/settings/api.js @@ -50,3 +50,37 @@ export async function downloadFFmpeg() { if (!res.ok) throw await apiError(res) return parseJSONResponse(res) } + +export async function fetchAppUpdate({ local = false, signal } = {}) { + const res = await apiFetch(local ? '/__client/update' : '/system/update', { + signal: updateRequestSignal(signal), + cache: 'no-store', + }) + if (!res.ok) throw await apiError(res) + return parseJSONResponse(res) +} + +function updateRequestSignal(signal) { + const timeout = AbortSignal.timeout(5000) + return signal ? AbortSignal.any([signal, timeout]) : timeout +} + +// A restarted service may be reachable before its update endpoint can be read +// by the old page. Probe the public endpoint for the selected target instead. +// In client mode /auth/status is proxied to the server; /healthz is local. +export async function isAppUpdateTargetReady({ local = false, signal } = {}) { + const res = await fetch(local ? '/healthz' : '/auth/status', { + signal: updateRequestSignal(signal), + cache: 'no-store', + }) + if (!res.ok) return false + const status = await parseJSONResponse(res) + return local ? status?.status === 'ok' : typeof status?.authenticated === 'boolean' +} + +export async function requestAppUpdate(action, { local = false } = {}) { + const prefix = local ? '/__client/update' : '/system/update' + const res = await apiFetch(`${prefix}/${action}`, { method: 'POST' }) + if (!res.ok) throw await apiError(res) + return parseJSONResponse(res) +} diff --git a/web/src/features/settings/components/AppUpdateSettings.jsx b/web/src/features/settings/components/AppUpdateSettings.jsx new file mode 100644 index 00000000..ee28821f --- /dev/null +++ b/web/src/features/settings/components/AppUpdateSettings.jsx @@ -0,0 +1,322 @@ +import { useEffect, useState } from 'react' +import { + Alert, + Button, + Dialog, + DialogActions, + DialogContent, + DialogContentText, + DialogTitle, + LinearProgress, + MenuItem, + TextField, +} from '@mui/material' +import ArrowForwardRoundedIcon from '@mui/icons-material/ArrowForwardRounded' +import SystemUpdateAltRoundedIcon from '@mui/icons-material/SystemUpdateAltRounded' +import { fetchAppUpdate, isAppUpdateTargetReady, requestAppUpdate } from '@/features/settings/api' +import { getErrorMessage } from '@/utils/errors' +import { zh } from '@/utils/i18n' +import ReleaseNotes from '@/features/settings/components/ReleaseNotes' + +export default function AppUpdateSettings({ clientMode = false }) { + const [target, setTarget] = useState(clientMode ? 'local' : 'server') + return ( ++ {zh('当前版本', 'Current version')}：{status?.current_version || '—'} +
++ {zh('最新版本', 'Latest version')}：{status?.latest_version || '—'} +
+ {status?.checked_at > 0 && ( ++ {zh('上次检查', 'Last checked')}：{new Date(status.checked_at).toLocaleString()} +
+ )} ++ {reconnecting + ? zh('JavBoss 暂时断开，正在重新连接…', 'JavBoss is disconnected. Reconnecting…') + : phaseText} +
++ {zh('没有可用的新版本。', 'No newer version is available.')} +
+ )} +{text}
+ ) +} diff --git a/web/tests/features/settings/AppUpdateSettings.browser.test.js b/web/tests/features/settings/AppUpdateSettings.browser.test.js new file mode 100644 index 00000000..6cc4c296 --- /dev/null +++ b/web/tests/features/settings/AppUpdateSettings.browser.test.js @@ -0,0 +1,277 @@ +import assert from 'node:assert/strict' +import test from 'node:test' +import { browserUnavailable, openBrowser } from '../../helpers/browser.js' + +async function setup(t, clientMode = false) { + const browser = await openBrowser(t, { cacheDir: 'node_modules/.vite-update-settings-test' }) + const { origin, command, evaluate, waitFor } = browser + await command('Page.navigate', { url: `${origin}/tests/fixtures/app.html?view=video` }) + await waitFor(`document.querySelector('aside button[aria-label="Settings"]')`) + await evaluate(`{ + window.updateRequests = []; + window.updateStatus = { + current_version: 'v1.0.0', latest_version: 'v2.0.0', + available: true, can_install: true, phase: 'idle', checked_at: Date.now() + }; + const originalFetch = window.fetch; + window.fetch = (input, init = {}) => { + const path = new URL(input, location.origin).pathname; + if (path.startsWith('/system/update') || path.startsWith('/__client/update')) { + window.updateRequests.push({path, method: init.method || 'GET'}); + if (path.endsWith('/install')) window.updateStatus.phase = 'downloading'; + return Promise.resolve(Response.json(window.updateStatus)); + } + return originalFetch(input, init); + }; + window.testStore.setState({config: {...window.testStore.getState().config, runtime_client: '${clientMode}'}}); + document.querySelector('aside button[aria-label="Settings"]').click(); + }`) + await waitFor(`document.querySelector('[aria-labelledby="global-settings-title"]')`) + await evaluate( + `Array.from(document.querySelectorAll('aside button')).find(button => button.textContent === 'Check for Updates').click()` + ) + await waitFor(`document.body.textContent.includes('v2.0.0')`) + return browser +} + +test( + 'installation requires confirmation and download errors remain visible', + { skip: browserUnavailable, timeout: 60000 }, + async (t) => { + const { evaluate, waitFor } = await setup(t) + const click = (text) => + evaluate( + `Array.from(document.querySelectorAll('button')).find(button => button.textContent === '${text}').click()` + ) + await click('Update and restart') + await waitFor(`document.getElementById('app-update-confirm-title')`) + assert.equal( + await evaluate(`window.updateRequests.filter(r => r.path.endsWith('/install')).length`), + 0 + ) + await click('Cancel') + await waitFor(`!document.getElementById('app-update-confirm-title')`) + assert.equal( + await evaluate(`window.updateRequests.filter(r => r.path.endsWith('/install')).length`), + 0 + ) + await click('Update and restart') + await waitFor(`document.getElementById('app-update-confirm-title')`) + await click('Continue update') + await waitFor( + `window.updateRequests.filter(r => r.path === '/system/update/install').length === 1` + ) + await waitFor(`document.body.textContent.includes('Downloading update')`) + assert.equal( + await evaluate( + `Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Update and restart').disabled` + ), + true + ) + await evaluate( + `window.updateStatus.phase = 'error'; window.updateStatus.error = 'release SHA256 mismatch'` + ) + await waitFor(`document.body.textContent.includes('release SHA256 mismatch')`) + assert.equal( + await evaluate( + `Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Update and restart').disabled` + ), + false + ) + assert.deepEqual(await evaluate('window.appErrors'), []) + } +) + +test( + 'client updates default to local and the remote target is explicit', + { skip: browserUnavailable, timeout: 60000 }, + async (t) => { + const { evaluate, waitFor } = await setup(t, true) + assert.ok(await evaluate(`window.updateRequests.some(r => r.path === '/__client/update')`)) + assert.equal( + await evaluate(`window.updateRequests.some(r => r.path === '/system/update')`), + false + ) + await evaluate( + `document.querySelector('[role="combobox"]').dispatchEvent(new MouseEvent('mousedown', {bubbles:true}))` + ) + await waitFor(`document.querySelector('[role="option"][data-value="server"]')`) + await evaluate(`document.querySelector('[role="option"][data-value="server"]').click()`) + await waitFor(`window.updateRequests.some(r => r.path === '/system/update')`) + await evaluate( + `Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Update and restart').click()` + ) + await waitFor(`document.body.textContent.includes('on the remote server')`) + assert.equal( + await evaluate(`window.updateRequests.some(r => r.path.endsWith('/install'))`), + false + ) + assert.deepEqual(await evaluate('window.appErrors'), []) + } +) + +for (const target of ['server', 'local client', 'remote server']) { + test( + `reconnect refreshes the old page when the ${target} returns without its update API`, + { skip: browserUnavailable, timeout: 60000 }, + async (t) => { + const { evaluate, waitFor } = await setup(t, target !== 'server') + if (target === 'remote server') { + await evaluate( + `document.querySelector('[role="combobox"]').dispatchEvent(new MouseEvent('mousedown', {bubbles:true}))` + ) + await waitFor(`document.querySelector('[role="option"][data-value="server"]')`) + await evaluate(`document.querySelector('[role="option"][data-value="server"]').click()`) + await waitFor(`window.updateRequests.some(r => r.path === '/system/update')`) + } + const started = await evaluate('performance.timeOrigin') + const readinessPath = target === 'local client' ? '/healthz' : '/auth/status' + await evaluate(`{ + window.targetReady = false; + window.updateDisconnected = false; + window.readinessRequests = []; + const originalFetch = window.fetch; + window.fetch = (input, init = {}) => { + const path = new URL(input, location.origin).pathname; + if (window.updateDisconnected && (path === '/system/update' || path === '/__client/update')) { + return Promise.resolve(Response.json({error_en: 'Update endpoint unavailable'}, {status: 503})); + } + if (path === '${readinessPath}') { + window.readinessRequests.push(path); + return Promise.resolve(window.targetReady + ? Response.json(${target === 'local client' ? "{status: 'ok'}" : '{authenticated: false}'}) + : Response.json({}, {status: 503})); + } + // A live client must not be mistaken for a restarted remote server. + if (path === '/healthz') return Promise.resolve(Response.json({status: 'ok'})); + return originalFetch(input, init); + }; + Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Update and restart').click(); + }`) + await waitFor(`document.getElementById('app-update-confirm-title')`) + await evaluate( + `Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Continue update').click()` + ) + await waitFor(`window.updateRequests.some(r => r.path.endsWith('/install'))`) + await evaluate(`window.updateDisconnected = true`) + await waitFor(`document.body.textContent.includes('JavBoss is disconnected. Reconnecting')`) + await waitFor(`window.readinessRequests.length > 0`) + assert.equal(await evaluate('performance.timeOrigin'), started) + assert.ok( + await evaluate( + `Array.from(document.querySelectorAll('button')).some(b => b.textContent === 'Refresh page' && !b.disabled)` + ) + ) + await evaluate(`window.targetReady = true`) + await waitFor(`performance.timeOrigin !== ${started}`) + await waitFor(`document.querySelector('aside button[aria-label="Settings"]')`) + assert.equal( + await evaluate( + `document.body.textContent.includes('JavBoss is disconnected. Reconnecting')` + ), + false + ) + assert.deepEqual(await evaluate('window.appErrors'), []) + } + ) +} + +test( + 'a stalled update status request times out and probes the restarted service', + { skip: browserUnavailable, timeout: 60000 }, + async (t) => { + const { evaluate, waitFor } = await setup(t) + const started = await evaluate('performance.timeOrigin') + await evaluate(`{ + window.stallUpdate = false; + const originalTimeout = AbortSignal.timeout; + AbortSignal.timeout = () => originalTimeout(100); + const originalFetch = window.fetch; + window.fetch = (input, init = {}) => { + if (window.stallUpdate && new URL(input, location.origin).pathname === '/system/update') { + return new Promise((resolve, reject) => { + init.signal.addEventListener('abort', () => reject(init.signal.reason), {once: true}); + }); + } + return originalFetch(input, init); + }; + Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Update and restart').click(); + }`) + await waitFor(`document.getElementById('app-update-confirm-title')`) + await evaluate( + `Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Continue update').click()` + ) + await waitFor(`window.updateRequests.some(r => r.path.endsWith('/install'))`) + await evaluate(`window.stallUpdate = true`) + await waitFor(`performance.timeOrigin !== ${started}`) + await waitFor(`document.querySelector('aside button[aria-label="Settings"]')`) + assert.deepEqual(await evaluate('window.appErrors'), []) + } +) + +test( + 'release notes preserve formatting, sanitize HTML and fall back to plain text', + { skip: browserUnavailable, timeout: 60000 }, + async (t) => { + const { evaluate, waitFor } = await setup(t) + const markup = `Bold text and emphasis
+line one\nline twoA quotation+
| Platform | Windows |
|---|
Safe text
` + await evaluate(`{ + window.notesXSS = 0; + window.updateStatus.notes = 'Plain notes'; + window.updateStatus.notes_html = ${JSON.stringify(markup)}; + Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Check for updates').click(); + }`) + await waitFor(`document.querySelector('.release-notes h1')`) + const result = await evaluate(`(() => { + const root = document.querySelector('.release-notes'); + const link = root.querySelector('a'); + return { + title: root.previousElementSibling.textContent, + headingSize: parseFloat(getComputedStyle(root.querySelector('h1')).fontSize), + bodySize: parseFloat(getComputedStyle(root).fontSize), + weight: getComputedStyle(root.querySelector('strong')).fontWeight, + listStyle: getComputedStyle(root.querySelector('ul')).listStyleType, + orderedStyle: getComputedStyle(root.querySelector('ol')).listStyleType, + code: root.querySelector('pre code').textContent, + target: link.target, rel: link.rel, + unsafeLink: root.querySelectorAll('a')[1].hasAttribute('href'), + unsafeElements: root.querySelectorAll('script, svg, iframe, [onerror], [onload], [style], [class], [id]').length, + unsafeImage: root.querySelector('img').hasAttribute('src'), + xss: window.notesXSS + }; + })()`) + assert.equal(result.title, 'v2.0.0') + assert.ok(result.headingSize > result.bodySize) + assert.ok(Number(result.weight) >= 600) + assert.equal(result.listStyle, 'disc') + assert.equal(result.orderedStyle, 'decimal') + assert.equal(result.code, 'line one\nline two') + assert.equal(result.target, '_blank') + assert.match(result.rel, /noopener/) + assert.match(result.rel, /noreferrer/) + assert.equal(result.unsafeLink, false) + assert.equal(result.unsafeImage, false) + assert.equal(result.unsafeElements, 0) + assert.equal(result.xss, 0) + + await evaluate(`{ + window.updateStatus.notes_html = ''; + window.updateStatus.notes = 'Legacy plain text'; + Array.from(document.querySelectorAll('button')).find(b => b.textContent === 'Check for updates').click(); + }`) + await waitFor( + `!document.querySelector('.release-notes') && document.body.textContent.includes('Legacy plain text')` + ) + assert.deepEqual(await evaluate('window.appErrors'), []) + } +)