homeio

1import { mkdtemp, readFile } from "node:fs/promises";
2import os from "node:os";
3import path from "node:path";
4import { beforeEach, describe, expect, it, vi } from "vitest";
5
6const { execFileMock } = vi.hoisted(() => ({
7  execFileMock: vi.fn(),
8}));
9
10vi.mock("node:child_process", () => ({
11  execFile: execFileMock,
12}));
13
14import {
15  buildFail2BanOverrideContent,
16  getSystemSecuritySettings,
17  resetSecuritySettingsCacheForTests,
18  updateSystemSecuritySettings,
19} from "@/lib/server/modules/system/security-service";
20
21function resolveExecFileCallback(args: unknown[]) {
22  const maybeCallback = args.at(-1);
23  if (typeof maybeCallback !== "function") {
24    throw new Error("Expected execFile callback");
25  }
26
27  return maybeCallback as (error: Error | null, stdout?: string, stderr?: string) => void;
28}
29
30describe("security-service", () => {
31  beforeEach(async () => {
32    execFileMock.mockReset();
33    resetSecuritySettingsCacheForTests();
34    const root = await mkdtemp(path.join(os.tmpdir(), "homeio-security-"));
35    process.env.HOMEIO_FAIL2BAN_OVERRIDE_PATH = path.join(root, "jail.d", "homeio.local");
36  });
37
38  it("reads the host once for repeated Settings loads, and again after a change", async () => {
39    execFileMock.mockImplementation((_command: string, _args: string[], ...rest: unknown[]) => {
40      resolveExecFileCallback(rest)(null, "", "");
41    });
42    const ufwStatusReads = () =>
43      execFileMock.mock.calls.filter(([command, args]) => command === "ufw" && args[0] === "status").length;
44
45    await getSystemSecuritySettings();
46    await getSystemSecuritySettings();
47    expect(ufwStatusReads()).toBe(1);
48
49    await updateSystemSecuritySettings({
50      firewallEnabled: true,
51      firewallIncomingPolicy: "deny",
52      firewallOutgoingPolicy: "allow",
53      fail2banEnabled: false,
54      fail2banMaxRetries: 5,
55      fail2banBanDurationSeconds: 3_600,
56    }).catch(() => {});
57    await getSystemSecuritySettings();
58    expect(ufwStatusReads()).toBe(2);
59  });
60
61  it("reads UFW and Fail2Ban state from the host", async () => {
62    execFileMock.mockImplementation((command: string, args: string[], ...rest: unknown[]) => {
63      const callback = resolveExecFileCallback(rest);
64
65      if (command === "ufw") {
66        callback(
67          null,
68          "Status: active\nDefault: deny (incoming), allow (outgoing), disabled (routed)\n",
69          "",
70        );
71        return;
72      }
73
74      if (command === "systemctl") {
75        callback(null, "enabled\n", "");
76        return;
77      }
78
79      callback(null, "", "");
80    });
81
82    const settings = await getSystemSecuritySettings();
83
84    expect(settings).toEqual({
85      firewallEnabled: true,
86      firewallIncomingPolicy: "deny",
87      firewallOutgoingPolicy: "allow",
88      fail2banEnabled: true,
89      fail2banMaxRetries: 5,
90      fail2banBanDurationSeconds: 3600,
91    });
92  });
93
94  it("treats missing Fail2Ban service as unavailable but non-fatal state", async () => {
95    execFileMock.mockImplementation((command: string, args: string[], ...rest: unknown[]) => {
96      const callback = resolveExecFileCallback(rest);
97
98      if (command === "ufw") {
99        callback(
100          null,
101          "Status: active\nDefault: deny (incoming), allow (outgoing), disabled (routed)\n",
102          "",
103        );
104        return;
105      }
106
107      if (command === "systemctl") {
108        const error = new Error("Command failed: systemctl is-enabled fail2ban") as Error & {
109          stdout?: string;
110          stderr?: string;
111        };
112        error.stdout = "not-found\n";
113        error.stderr = "Unit fail2ban.service could not be found.\n";
114        callback(error, "not-found\n", "Unit fail2ban.service could not be found.\n");
115        return;
116      }
117
118      callback(null, "", "");
119    });
120
121    const settings = await getSystemSecuritySettings();
122
123    expect(settings.fail2banEnabled).toBe(false);
124    expect(settings.fail2banMaxRetries).toBe(5);
125    expect(settings.fail2banBanDurationSeconds).toBe(3600);
126  });
127
128  it("returns defaults when UFW is not installed", async () => {
129    execFileMock.mockImplementation((command: string, args: string[], ...rest: unknown[]) => {
130      const callback = resolveExecFileCallback(rest);
131
132      if (command === "ufw") {
133        const error = Object.assign(new Error("spawn ufw ENOENT"), { code: "ENOENT" });
134        callback(error as Error, "", "");
135        return;
136      }
137
138      if (command === "systemctl") {
139        callback(null, "enabled\n", "");
140        return;
141      }
142
143      callback(null, "", "");
144    });
145
146    const settings = await getSystemSecuritySettings();
147
148    expect(settings.firewallEnabled).toBe(false);
149    expect(settings.firewallIncomingPolicy).toBe("deny");
150    expect(settings.firewallOutgoingPolicy).toBe("allow");
151    expect(settings.fail2banEnabled).toBe(true);
152  });
153
154  it("returns defaults when systemctl is not available (non-systemd host)", async () => {
155    execFileMock.mockImplementation((command: string, args: string[], ...rest: unknown[]) => {
156      const callback = resolveExecFileCallback(rest);
157
158      if (command === "ufw") {
159        callback(
160          null,
161          "Status: active\nDefault: deny (incoming), allow (outgoing), disabled (routed)\n",
162          "",
163        );
164        return;
165      }
166
167      if (command === "systemctl") {
168        const error = Object.assign(new Error("spawn systemctl ENOENT"), { code: "ENOENT" });
169        callback(error as Error, "", "");
170        return;
171      }
172
173      callback(null, "", "");
174    });
175
176    const settings = await getSystemSecuritySettings();
177
178    expect(settings.firewallEnabled).toBe(true);
179    expect(settings.fail2banEnabled).toBe(false);
180  });
181
182  it("writes managed Fail2Ban override config correctly", async () => {
183    const content = buildFail2BanOverrideContent({
184      maxRetries: 7,
185      banDurationSeconds: 7200,
186    });
187
188    expect(content).toContain("[DEFAULT]");
189    expect(content).toContain("maxretry = 7");
190    expect(content).toContain("bantime = 7200");
191  });
192
193  it("applies UFW and Fail2Ban commands in the correct order", async () => {
194    const calls: Array<{ command: string; args: string[] }> = [];
195
196    execFileMock.mockImplementation((command: string, args: string[], ...rest: unknown[]) => {
197      calls.push({ command, args });
198      const callback = resolveExecFileCallback(rest);
199
200      if (command === "ufw" && args[0] === "status") {
201        callback(
202          null,
203          "Status: active\nDefault: deny (incoming), allow (outgoing), disabled (routed)\n",
204          "",
205        );
206        return;
207      }
208
209      if (command === "systemctl" && args[0] === "is-enabled") {
210        callback(null, "enabled\n", "");
211        return;
212      }
213
214      callback(null, "", "");
215    });
216
217    await updateSystemSecuritySettings({
218      firewallEnabled: true,
219      firewallIncomingPolicy: "reject",
220      firewallOutgoingPolicy: "deny",
221      fail2banEnabled: true,
222      fail2banMaxRetries: 7,
223      fail2banBanDurationSeconds: 7200,
224    });
225
226    expect(calls).toEqual(
227      expect.arrayContaining([
228        { command: "ufw", args: ["default", "reject", "incoming"] },
229        { command: "ufw", args: ["default", "deny", "outgoing"] },
230        { command: "ufw", args: ["--force", "enable"] },
231        { command: "systemctl", args: ["enable", "--now", "fail2ban"] },
232        { command: "systemctl", args: ["restart", "fail2ban"] },
233      ]),
234    );
235
236    const overrideContent = await readFile(
237      process.env.HOMEIO_FAIL2BAN_OVERRIDE_PATH!,
238      "utf8",
239    );
240    expect(overrideContent).toContain("maxretry = 7");
241    expect(overrideContent).toContain("bantime = 7200");
242  });
243
244  it("disables Fail2Ban and UFW with the correct commands", async () => {
245    const calls: Array<{ command: string; args: string[] }> = [];
246
247    execFileMock.mockImplementation((command: string, args: string[], ...rest: unknown[]) => {
248      calls.push({ command, args });
249      const callback = resolveExecFileCallback(rest);
250      if (command === "ufw" && args[0] === "status") {
251        callback(null, "Status: inactive\n", "");
252        return;
253      }
254      if (command === "systemctl" && args[0] === "is-enabled") {
255        const error = new Error("disabled") as Error & { stdout?: string };
256        error.stdout = "disabled\n";
257        callback(error, "disabled\n", "");
258        return;
259      }
260      callback(null, "", "");
261    });
262
263    await updateSystemSecuritySettings({
264      firewallEnabled: false,
265      firewallIncomingPolicy: "deny",
266      firewallOutgoingPolicy: "allow",
267      fail2banEnabled: false,
268      fail2banMaxRetries: 5,
269      fail2banBanDurationSeconds: 3600,
270    });
271
272    expect(calls).toEqual(
273      expect.arrayContaining([
274        { command: "ufw", args: ["--force", "disable"] },
275        { command: "systemctl", args: ["disable", "--now", "fail2ban"] },
276      ]),
277    );
278  });
279});
280