homeio

1import { mkdtemp, mkdir, rm } from "node:fs/promises";
2import os from "node:os";
3import path from "node:path";
4import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
5
6let mockDataRoot = "";
7
8vi.mock("@/lib/server/modules/files/path-resolver", () => {
9  class FilesPathError extends Error {
10    code: string;
11    statusCode: number;
12
13    constructor(
14      message: string,
15      options?: {
16        code?: string;
17        statusCode?: number;
18      },
19    ) {
20      super(message);
21      this.code = options?.code ?? "internal_error";
22      this.statusCode = options?.statusCode ?? 500;
23    }
24  }
25
26  function ensureWithinRoot(rootPath: string, absolutePath: string) {
27    const relative = path.relative(rootPath, absolutePath);
28    const within =
29      relative === "" || (!relative.startsWith("..") && !path.isAbsolute(relative));
30    if (!within) {
31      throw new FilesPathError("Path escapes root", {
32        code: "path_outside_root",
33        statusCode: 400,
34      });
35    }
36  }
37
38  return {
39    FilesPathError,
40    resolvePathWithinFilesRoot: vi.fn(async (input: {
41      inputPath?: string;
42      requiredPrefix?: string;
43      allowMissingLeaf?: boolean;
44    }) => {
45      const cleaned = (input.inputPath ?? "").trim().replaceAll("\\", "/");
46      const normalized = cleaned ? path.posix.normalize(cleaned) : "";
47      if (!normalized || normalized === "." || normalized === ".." || normalized.startsWith("../")) {
48        throw new FilesPathError("Invalid path", {
49          code: "invalid_path",
50          statusCode: 400,
51        });
52      }
53
54      if (
55        input.requiredPrefix &&
56        normalized !== input.requiredPrefix &&
57        !normalized.startsWith(`${input.requiredPrefix}/`)
58      ) {
59        throw new FilesPathError("Invalid path", {
60          code: "invalid_path",
61          statusCode: 400,
62        });
63      }
64
65      const absolutePath = path.resolve(mockDataRoot, normalized);
66      ensureWithinRoot(mockDataRoot, absolutePath);
67
68      return {
69        rootPath: mockDataRoot,
70        relativePath: normalized,
71        absolutePath,
72        segments: normalized.split("/"),
73        exists: true,
74      };
75    }),
76  };
77});
78
79vi.mock("@/lib/server/modules/files/network-shares-repository", () => ({
80  listNetworkSharesFromDb: vi.fn(),
81  getNetworkShareFromDb: vi.fn(),
82  getNetworkShareByMountPathFromDb: vi.fn(),
83  insertNetworkShareInDb: vi.fn(),
84  touchNetworkShareInDb: vi.fn(),
85  deleteNetworkShareFromDb: vi.fn(),
86}));
87
88vi.mock("node:child_process", () => ({
89  execFile: vi.fn(),
90}));
91
92import { execFile } from "node:child_process";
93import {
94  addShare,
95  discoverServers,
96  discoverShares,
97  getShareInfo,
98  mountShare,
99  removeShare,
100  type NetworkStorageError,
101} from "@/lib/server/modules/files/network-storage";
102import {
103  deleteNetworkShareFromDb,
104  getNetworkShareByMountPathFromDb,
105  getNetworkShareFromDb,
106  insertNetworkShareInDb,
107  listNetworkSharesFromDb,
108  touchNetworkShareInDb,
109} from "@/lib/server/modules/files/network-shares-repository";
110import { resolvePathWithinFilesRoot } from "@/lib/server/modules/files/path-resolver";
111import { encryptSecret } from "@/lib/server/modules/files/secrets";
112
113type ExecFileCallback = (error: Error | null, stdout: string, stderr: string) => void;
114
115function getExecFileCallback(restArgs: unknown[]) {
116  const callback = restArgs.at(-1);
117  if (typeof callback !== "function") {
118    throw new Error("Missing execFile callback");
119  }
120  return callback as ExecFileCallback;
121}
122
123describe("network storage service", () => {
124  beforeEach(async () => {
125    mockDataRoot = await mkdtemp(path.join(os.tmpdir(), "home-server-network-"));
126    await mkdir(path.join(mockDataRoot, "Network"), { recursive: true });
127    vi.clearAllMocks();
128  });
129
130  afterEach(async () => {
131    if (mockDataRoot) {
132      await rm(mockDataRoot, { recursive: true, force: true });
133    }
134  });
135
136  it("rejects duplicate share mount paths", async () => {
137    vi.mocked(getNetworkShareByMountPathFromDb).mockResolvedValueOnce({
138      id: "existing",
139      host: "nas.local",
140      share: "Media",
141      username: "user",
142      mountPath: "Network/nas.local/Media",
143      passwordCiphertext: "x",
144      passwordIv: "x",
145      passwordTag: "x",
146      createdAt: new Date(),
147      updatedAt: new Date(),
148    });
149
150    await expect(
151      addShare({
152        host: "nas.local",
153        share: "Media",
154        username: "user",
155        password: "secret",
156      }),
157    ).rejects.toMatchObject<Partial<NetworkStorageError>>({
158      code: "share_exists",
159      statusCode: 409,
160    });
161  });
162
163  it("parses discovered SMB servers", async () => {
164    vi.mocked(execFile).mockImplementation(
165      (command: string, ...restArgs: unknown[]) => {
166        const callback = getExecFileCallback(restArgs);
167        if (command === "avahi-browse") {
168          callback(
169            null,
170            `=;eth0;IPv4;NAS;_smb._tcp;local;nas.local;192.168.1.5;445\n=;eth0;IPv4;NAS;_smb._tcp;local;nas.local;192.168.1.5;445`,
171            "",
172          );
173          return {} as never;
174        }
175
176        callback(new Error(`Unexpected command ${command}`), "", "");
177        return {} as never;
178      },
179    );
180
181    const result = await discoverServers();
182    expect(result.servers).toEqual(["nas.local"]);
183  });
184
185  it("returns empty servers when avahi-browse is unavailable", async () => {
186    vi.mocked(execFile).mockImplementation(
187      (command: string, ...restArgs: unknown[]) => {
188        const callback = getExecFileCallback(restArgs);
189        if (command === "avahi-browse") {
190          const error = new Error("spawn avahi-browse ENOENT") as Error & {
191            code?: string;
192          };
193          error.code = "ENOENT";
194          callback(error, "", "");
195          return {} as never;
196        }
197
198        callback(new Error(`Unexpected command ${command}`), "", "");
199        return {} as never;
200      },
201    );
202
203    const result = await discoverServers();
204    expect(result.servers).toEqual([]);
205  });
206
207  it("parses discovered SMB shares", async () => {
208    vi.mocked(execFile).mockImplementation(
209      (command: string, ...restArgs: unknown[]) => {
210        const callback = getExecFileCallback(restArgs);
211        if (command === "smbclient") {
212          callback(
213            null,
214            `Disk|Media|Network Share\nDisk|Backups|Network Share\nDisk|IPC$|IPC`,
215            "",
216          );
217          return {} as never;
218        }
219
220        callback(new Error(`Unexpected command ${command}`), "", "");
221        return {} as never;
222      },
223    );
224
225    const result = await discoverShares({
226      host: "nas.local",
227      username: "user",
228      password: "secret",
229    });
230
231    expect(result.shares).toEqual(["Backups", "Media"]);
232  });
233
234  it("returns empty shares when smbclient is unavailable", async () => {
235    vi.mocked(execFile).mockImplementation(
236      (command: string, ...restArgs: unknown[]) => {
237        const callback = getExecFileCallback(restArgs);
238        if (command === "smbclient") {
239          const error = new Error("spawn smbclient ENOENT") as Error & {
240            code?: string;
241          };
242          error.code = "ENOENT";
243          callback(error, "", "");
244          return {} as never;
245        }
246
247        callback(new Error(`Unexpected command ${command}`), "", "");
248        return {} as never;
249      },
250    );
251
252    const result = await discoverShares({
253      host: "nas.local",
254      username: "user",
255      password: "secret",
256    });
257
258    expect(result.shares).toEqual([]);
259  });
260
261  it("mounts an existing share", async () => {
262    const encrypted = encryptSecret("secret");
263    vi.mocked(getNetworkShareFromDb).mockResolvedValueOnce({
264      id: "share-1",
265      host: "nas.local",
266      share: "Media",
267      username: "user",
268      mountPath: "Network/nas.local/Media",
269      passwordCiphertext: encrypted.ciphertext,
270      passwordIv: encrypted.iv,
271      passwordTag: encrypted.tag,
272      createdAt: new Date(),
273      updatedAt: new Date(),
274    });
275    vi.mocked(touchNetworkShareInDb).mockResolvedValueOnce({
276      id: "share-1",
277      host: "nas.local",
278      share: "Media",
279      username: "user",
280      mountPath: "Network/nas.local/Media",
281      passwordCiphertext: encrypted.ciphertext,
282      passwordIv: encrypted.iv,
283      passwordTag: encrypted.tag,
284      createdAt: new Date(),
285      updatedAt: new Date(),
286    });
287
288    vi.mocked(execFile).mockImplementation(
289      (command: string, ...restArgs: unknown[]) => {
290        const callback = getExecFileCallback(restArgs);
291        if (command === "mountpoint") {
292          const error = new Error("not mounted") as Error & { code?: number };
293          error.code = 1;
294          callback(error, "", "");
295          return {} as never;
296        }
297
298        if (command === "mount") {
299          callback(null, "", "");
300          return {} as never;
301        }
302
303        callback(new Error(`Unexpected command ${command}`), "", "");
304        return {} as never;
305      },
306    );
307
308    const mounted = await mountShare("share-1");
309
310    expect(mounted.isMounted).toBe(true);
311    expect(vi.mocked(insertNetworkShareInDb)).not.toHaveBeenCalled();
312  });
313
314  it("rolls back db reservation when mount fails", async () => {
315    vi.mocked(getNetworkShareByMountPathFromDb).mockResolvedValueOnce(null);
316    vi.mocked(insertNetworkShareInDb).mockResolvedValueOnce({
317      id: "share-rollback",
318      host: "nas.local",
319      share: "Media",
320      username: "user",
321      mountPath: "Network/nas.local/Media",
322      passwordCiphertext: "x",
323      passwordIv: "x",
324      passwordTag: "x",
325      createdAt: new Date(),
326      updatedAt: new Date(),
327    });
328    vi.mocked(deleteNetworkShareFromDb).mockResolvedValueOnce({
329      id: "share-rollback",
330      host: "nas.local",
331      share: "Media",
332      username: "user",
333      mountPath: "Network/nas.local/Media",
334      passwordCiphertext: "x",
335      passwordIv: "x",
336      passwordTag: "x",
337      createdAt: new Date(),
338      updatedAt: new Date(),
339    });
340
341    vi.mocked(execFile).mockImplementation((command: string, ...restArgs: unknown[]) => {
342      const callback = getExecFileCallback(restArgs);
343      if (command === "mountpoint") {
344        const error = new Error("not mounted") as Error & { code?: number };
345        error.code = 1;
346        callback(error, "", "");
347        return {} as never;
348      }
349      if (command === "mount") {
350        const error = new Error("permission denied") as Error & { code?: number };
351        error.code = 1;
352        callback(error, "", "permission denied");
353        return {} as never;
354      }
355      callback(null, "", "");
356      return {} as never;
357    });
358
359    await expect(
360      addShare({
361        host: "nas.local",
362        share: "Media",
363        username: "user",
364        password: "secret",
365      }),
366    ).rejects.toMatchObject<Partial<NetworkStorageError>>({
367      code: "mount_failed",
368      statusCode: 500,
369    });
370
371    expect(deleteNetworkShareFromDb).toHaveBeenCalledWith("share-rollback");
372  });
373
374  it("returns shares even when mount status resolution fails", async () => {
375    vi.mocked(listNetworkSharesFromDb).mockResolvedValueOnce([
376      {
377        id: "share-1",
378        host: "nas.local",
379        share: "Media",
380        username: "user",
381        mountPath: "Network/nas.local/Media",
382        passwordCiphertext: "x",
383        passwordIv: "x",
384        passwordTag: "x",
385        createdAt: new Date(),
386        updatedAt: new Date(),
387      },
388    ]);
389
390    vi.mocked(resolvePathWithinFilesRoot).mockRejectedValueOnce(
391      new Error("resolver failed"),
392    );
393
394    const shares = await getShareInfo();
395    expect(shares).toHaveLength(1);
396    expect(shares[0]).toMatchObject({
397      id: "share-1",
398      isMounted: false,
399    });
400  });
401
402  it("removes share when umount reports already unmounted", async () => {
403    const encrypted = encryptSecret("secret");
404    vi.mocked(getNetworkShareFromDb).mockResolvedValueOnce({
405      id: "share-remove",
406      host: "nas.local",
407      share: "Media",
408      username: "user",
409      mountPath: "Network/nas.local/Media",
410      passwordCiphertext: encrypted.ciphertext,
411      passwordIv: encrypted.iv,
412      passwordTag: encrypted.tag,
413      createdAt: new Date(),
414      updatedAt: new Date(),
415    });
416    vi.mocked(deleteNetworkShareFromDb).mockResolvedValueOnce({
417      id: "share-remove",
418      host: "nas.local",
419      share: "Media",
420      username: "user",
421      mountPath: "Network/nas.local/Media",
422      passwordCiphertext: encrypted.ciphertext,
423      passwordIv: encrypted.iv,
424      passwordTag: encrypted.tag,
425      createdAt: new Date(),
426      updatedAt: new Date(),
427    });
428
429    vi.mocked(execFile).mockImplementation((command: string, ...restArgs: unknown[]) => {
430      const callback = getExecFileCallback(restArgs);
431      if (command === "mountpoint") {
432        callback(null, "", "");
433        return {} as never;
434      }
435      if (command === "umount") {
436        const error = new Error("not mounted") as Error & { code?: number; stderr?: string };
437        error.code = 1;
438        error.stderr = "not mounted";
439        callback(error, "", "not mounted");
440        return {} as never;
441      }
442      callback(null, "", "");
443      return {} as never;
444    });
445
446    const result = await removeShare("share-remove");
447    expect(result).toEqual({
448      removed: true,
449      id: "share-remove",
450    });
451    expect(deleteNetworkShareFromDb).toHaveBeenCalledWith("share-remove");
452  });
453
454  it("removes stale db record when mount path is no longer valid", async () => {
455    const encrypted = encryptSecret("secret");
456    vi.mocked(getNetworkShareFromDb).mockResolvedValueOnce({
457      id: "share-stale",
458      host: "nas.local",
459      share: "Media",
460      username: "user",
461      mountPath: "Shared/nas.local/Media",
462      passwordCiphertext: encrypted.ciphertext,
463      passwordIv: encrypted.iv,
464      passwordTag: encrypted.tag,
465      createdAt: new Date(),
466      updatedAt: new Date(),
467    });
468    vi.mocked(deleteNetworkShareFromDb).mockResolvedValueOnce({
469      id: "share-stale",
470      host: "nas.local",
471      share: "Media",
472      username: "user",
473      mountPath: "Shared/nas.local/Media",
474      passwordCiphertext: encrypted.ciphertext,
475      passwordIv: encrypted.iv,
476      passwordTag: encrypted.tag,
477      createdAt: new Date(),
478      updatedAt: new Date(),
479    });
480
481    const result = await removeShare("share-stale");
482
483    expect(result).toEqual({
484      removed: true,
485      id: "share-stale",
486    });
487    expect(deleteNetworkShareFromDb).toHaveBeenCalledWith("share-stale");
488  });
489});
490