Build verified checkpoint containers for TrueNAS

tests/automatic-response-recovery.test.ts

@@ -1,3 +1,4 @@
+import { requestOrigin } from '../lib/request-origin';
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { webcrypto } from 'node:crypto';
@@ -82,6 +83,7 @@ function unitStore(runBots = bots.runBots) {
       require: (name: string) => {
         if (name === 'cloudflare:workers') return { env: { DB: database } };
         if (name === '@/game/engine') return engine;
+        if (name === '@/lib/request-origin') return { requestOrigin };
         if (name === '@/game/bots') return { ...bots, runBots };
         if (name === '@/lib/seat-ai-delegation') return seatAiDelegation;
         throw new Error('Unexpected module ' + name);
@@ -300,8 +302,9 @@ function route(
           };
         if (name === '@/db/room-continuation') return continuation;
         if (name === '@/game/engine') return engine;
+        if (name === '@/lib/request-origin') return { requestOrigin };
         if (name === 'cloudflare:workers')
-          return { waitUntil: (work: Promise<void>) => pending.push(work) };
+          return { env: {}, waitUntil: (work: Promise<void>) => pending.push(work) };
         throw new Error('Unexpected route dependency ' + name);
       },
     },

tests/bot-pacing.test.ts

@@ -1,3 +1,4 @@
+import { requestOrigin } from '../lib/request-origin';
 import test from 'node:test';
 import assert from 'node:assert/strict';
 import { webcrypto } from 'node:crypto';
@@ -81,6 +82,7 @@ function unitStore(runBots = bots.runBots) {
       require: (name: string) => {
         if (name === 'cloudflare:workers') return { env: { DB: database } };
         if (name === '@/game/engine') return engine;
+        if (name === '@/lib/request-origin') return { requestOrigin };
         if (name === '@/game/bots') return { ...bots, runBots };
         if (name === '@/lib/seat-ai-delegation') return seatAiDelegation;
         throw new Error('Unexpected module ' + name);
@@ -359,8 +361,10 @@ void test('authenticated GET schedules the persisted queue after reconnect while
             };
           if (name === '@/db/room-continuation') return continuation;
           if (name === '@/game/engine') return engine;
+          if (name === '@/lib/request-origin') return { requestOrigin };
           if (name === 'cloudflare:workers')
             return {
+              env: {},
               waitUntil: (work: Promise<unknown>) => pending.push(work),
             };
           throw new Error('Unexpected route dependency ' + name);

tests/random-id.test.ts

@@ -0,0 +1,26 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { randomId } from '../lib/random-id';
+import { createRoomEntry } from '../lib/room-entry';
+
+void test('LAN HTTP operations work with getRandomValues and no randomUUID', (t) => {
+  const native = globalThis.crypto;
+  t.mock.getter(globalThis, 'crypto', () => ({
+    getRandomValues: native.getRandomValues.bind(native),
+  }) as Crypto);
+  assert.equal(typeof globalThis.crypto.randomUUID, 'undefined');
+  const id = randomId();
+  assert.match(id, /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/);
+  assert.notEqual(randomId(), id);
+  const attempt = createRoomEntry({
+    name: 'LAN player', faction: 'atreides', advanced: false, expansions: [],
+  });
+  assert.ok(attempt);
+});
+
+void test('UUID creation fails closed when cryptographic randomness fails', (t) => {
+  t.mock.getter(globalThis, 'crypto', () => ({
+    getRandomValues() { throw new Error('Randomness unavailable'); },
+  }) as unknown as Crypto);
+  assert.throws(() => randomId(), /Randomness unavailable/);
+});

tests/request-origin.test.ts

@@ -0,0 +1,14 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { requestOrigin } from '../lib/request-origin';
+
+void test('HTTP upstream can explicitly use its HTTPS public origin without trusting forwarded headers', () => {
+  const request = new Request('http://192.168.2.251:33046/api/rooms', {
+    headers: { 'x-forwarded-host': 'attacker.invalid', 'x-forwarded-proto': 'https' },
+  });
+  assert.equal(requestOrigin(request), 'http://192.168.2.251:33046');
+  assert.equal(requestOrigin(request, 'https://dune.example.test/'), 'https://dune.example.test');
+  for (const invalid of ['https://dune.example.test/path', 'https://user:secret@dune.example.test', 'https://dune.example.test/?x=1', 'https://dune.example.test/#x', 'file:///tmp', 'invalid']) {
+    assert.throws(() => requestOrigin(request, invalid));
+  }
+});