0.29.7

tools/checks/backend_cache_0297_ui_test.mjs

@@ -0,0 +1,100 @@
+#!/usr/bin/env node
+// Exercise the shipped 0.29.7 backend monitor editor with a minimal DOM double.
+// This checks browser form behavior, not health probing or compiled Rust code.
+import fs from 'node:fs';
+import vm from 'node:vm';
+
+const root = process.cwd();
+const core = fs.readFileSync(`${root}/src/admin/web/vhosts/core.js`, 'utf8');
+const editor = fs.readFileSync(`${root}/src/admin/web/vhosts/editor.js`, 'utf8');
+const settings = fs.readFileSync(`${root}/src/admin/web/app/settings.js`, 'utf8');
+const html = fs.readFileSync(`${root}/src/admin/web/index.html`, 'utf8');
+const start = core.indexOf('  function memberRow(');
+const end = core.indexOf('  function countryRateEditor(', start);
+if (start < 0 || end <= start) throw new Error('Backend editor code not found');
+const check = (condition, reason) => { if (!condition) throw new Error(reason); };
+
+class Element {
+  constructor(tag = 'div', value = '', css = '') {
+    this.tag = tag;
+    this.value = value == null ? '' : String(value);
+    this.checked = false;
+    this.hidden = false;
+    this.disabled = false;
+    this.name = '';
+    this.children = [];
+    this.listeners = new Map();
+    this.classes = new Set(css.split(/\s+/).filter(Boolean));
+    this.textContent = this.value;
+  }
+  append(...children) { for (const child of children) { child.parent = this; this.children.push(child); } }
+  addEventListener(type, handler) { this.listeners.set(type, handler); }
+  dispatch(type) { this.listeners.get(type)?.(); }
+  querySelectorAll() {
+    const found = [];
+    const walk = node => { for (const child of node.children) {
+      if (child.tag === 'input' || child.tag === 'select') found.push(child);
+      walk(child);
+    }};
+    walk(this);
+    return found;
+  }
+}
+const el = (tag, value, css) => new Element(tag, value, css);
+const text = (tag, label, css) => el(tag, label, css);
+const field = (parent, name, label, value, type = 'text') => {
+  const wrapper = el('label');
+  const input = el(type === 'select' ? 'select' : 'input', value);
+  input.name = name;
+  input.checked = !!value;
+  wrapper.append(input);
+  parent.append(wrapper);
+  return input;
+};
+const button = (label, handler) => { const node = el('button', label); node.addEventListener('click', handler); return node; };
+const note = (parent, label) => { const node = text('span', label); parent.append(node); return node; };
+const parent = el('div');
+const value = {
+  id: 'error_404', url: 'http://127.0.0.1:8282', weight: 1, enabled: true,
+  pool_eligible: false, health_check_enabled: false, preserve_host: true,
+  health_check: { mode: 'http', path: '/ready', host: 'errors.example.test',
+    interval_ms: 10000, timeout_ms: 1000, slow_response_ms: 500, fall: 2,
+    rise: 1, expected_status_min: 200, expected_status_max: 399 }
+};
+vm.runInNewContext(`${core.slice(start, end)}\nmemberRow(parent, value);`, {
+  parent, value, el, text, field, button, note,
+  t: key => key, toast: () => {}, changed: () => {},
+  appConfirm: async () => true, adminListenerBackendCandidate: () => false
+});
+const row = parent.children[0];
+const input = name => row.querySelectorAll().find(item => item.name === name);
+const fields = [];
+const visit = node => { if (node.classes.has('vh-backend-health-fields')) fields.push(node); for (const child of node.children) visit(child); };
+visit(row);
+check(fields.length === 1, 'Custom backend health panel not created');
+check(input('member-pool').checked === false, 'Internal 404 backend accidentally joined balanced pool');
+check(input('member-enabled').checked === true, 'Backend was disabled when monitoring was disabled');
+check(input('member-health-enabled').checked === false, 'Explicit monitoring off not restored');
+check(input('member-health-custom').checked === true, 'Custom health not restored');
+check(input('member-health-mode').value === 'http', 'Member health mode lost');
+check(input('member-health-path').value === '/ready', 'Member health path lost');
+check(input('member-health-interval').value === '10000', 'Member check interval lost');
+check(fields[0].hidden === false, 'Custom health fields hidden despite override');
+input('member-health-custom').checked = false;
+input('member-health-custom').dispatch('change');
+check(fields[0].hidden && input('member-health-path').disabled, 'Inherit switch did not hide/disable overrides');
+input('member-health-custom').checked = true;
+input('member-health-custom').dispatch('change');
+check(!fields[0].hidden && !input('member-health-path').disabled, 'Custom fields failed to re-enable');
+input('member-health-enabled').checked = true;
+check(input('member-pool').checked === false, 'Monitoring switch changed balanced-pool eligibility');
+
+for (const part of [
+  'health_check_enabled: yes("member-health-enabled", row)',
+  'health_check: yes("member-health-custom", row)',
+  'expose_only_hits: tri("vh-cache-only-hits")',
+]) check((editor + core).includes(part), `Missing saved field: ${part}`);
+check(editor.includes('tri(cacheOptions, "vh-cache-only-hits", "cacheOnlyHits", cache.expose_only_hits)'), 'Vhost cache override does not roundtrip');
+check(html.includes('id="cache-only-hits"') && settings.includes('expose_only_hits: $("cache-only-hits").checked'), 'Global cache checkbox does not save');
+check(settings.includes('$("cache-only-hits").checked = !!c.expose_only_hits'), 'Global cache checkbox does not load');
+console.log('PASS: 0.29.7 backend monitor and custom policy form state, independent pool status, global/vhost cache diagnostics toggles.');

tools/checks/check_source.py

@@ -24,7 +24,7 @@ def read_docker_agent_source() -> str:
 
 preflight(root)
 manifest = tomllib.loads((root / "Cargo.toml").read_text())
-assert manifest["package"]["version"] == "0.29.6"
+assert manifest["package"]["version"] == "0.29.7"
 assert manifest["dependencies"]["quinn"]["version"] == "0.11.12"
 h3dep = manifest["dependencies"]["h3"]
 assert h3dep["package"] == "hpx-h3" and h3dep["version"] == "=2.5.19" and "quinn" in h3dep["features"]
@@ -32,14 +32,14 @@ assert "h3-quinn" not in manifest["dependencies"]
 lock_path = root / "Cargo.lock"
 if lock_path.exists():
     lock = lock_path.read_text()
-    assert 'name = "rust-proxy"\nversion = "0.29.6"' in lock
+    assert 'name = "rust-proxy"\nversion = "0.29.7"' in lock
     assert 'name = "systemstat"' in lock and 'name = "metrics-process"' in lock and 'name = "sysinfo"' in lock, "Cargo.lock must be resolver-generated after adding cross-platform statistics libraries"
 for release_doc, marker in {
-    "README.md": "# RustProxy 0.29.6",
-    "CHANGELOG.md": "## 0.29.6",
-    "ROADMAP.md": "## 0.29.6",
-    "AGENTS.md": "Current source version: 0.29.6.",
-    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.29.6",
+    "README.md": "# RustProxy 0.29.7",
+    "CHANGELOG.md": "## 0.29.7",
+    "ROADMAP.md": "## 0.29.7",
+    "AGENTS.md": "Current source version: 0.29.7.",
+    "docs/TEST_REPORT.md": "# Verification report - RustProxy 0.29.7",
 }.items():
     assert marker in (root / release_doc).read_text(), f"stale release identity in {release_doc}"
 assert tomllib.loads((root / "rust-toolchain.toml").read_text())["toolchain"]["channel"] == "stable"
@@ -285,7 +285,7 @@ assert 'Opt-in health decisions based on ordinary user traffic. Defaults to disa
 assert '"force_ssl"' in openapi and '"forward_client_ip"' in openapi
 assert '"backend_header"' in openapi and '"backend_timing_header"' in openapi
 assert '"StreamMetrics"' in openapi and '"streams"' in openapi
-for marker in ['"version": "0.29.6"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
+for marker in ['"version": "0.29.7"', '"/api/traffic"', '"capture_user_agent"', '"capture_country"', '"hot_auto_trim_enabled"', '"hot_auto_trim_after_seconds"', '"hot_auto_trim_target_percent"', '"/api/config/{section}"', '"ConfigSectionUpdate"', '"cold_on_idle"', '"cold_on_age"', '"cold_max_hot_seconds"', '"cold_on_lru"', '"cold_on_shutdown"', '"cold_gc_interval_seconds"', '"cold_gc_max_delete"', '"collapse_enabled"', '"collapse_wait_timeout_ms"', '"collapse_timeout_fallback"', '"stale_if_error_timeout"', '"stale_if_error_connection"', '"stale_if_error_dns"', '"stale_if_error_tls"', '"stale_if_error_statuses"', '"proactive_refresh_enabled"', '"proactive_refresh_before_expiry_seconds"', '"proactive_refresh_percent"', '"proactive_refresh_max_inflight"', '"TransformSettings"', '"TransformOverrides"', '"/api/cache/cold/cleanup"', '"/api/cache/invalidate"', '"/api/cache/bans"', '"/api/cache/bans/{id}"', '"CacheInvalidationRequest"', '"CacheInvalidationResponse"', '"ColdCleanupJob"', '"match_type"', '"regex_insensitive"', '"rewrite"', '"response"', '"covered_hosts"', '"default": true']:
     assert marker in openapi, marker
 for marker in ['"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
     assert marker in openapi, marker
@@ -1396,7 +1396,7 @@ assert '"error_log" => {' not in admin_0241 and 'request("/api/config/error_log"
 assert '"error_log"' in openapi and 'logging, error_log, forwarding' not in openapi
 assert 'logging_section_persists_error_log_settings_atomically' in admin_0241 and 'error_log_is_not_a_standalone_configuration_section' in admin_0241
 assert 'location.pathname === "/logging"' in settings_js_0241
-assert '"RuntimeInformation"' in openapi and '"version": "0.29.6"' in openapi
+assert '"RuntimeInformation"' in openapi and '"version": "0.29.7"' in openapi
 
 # 0.24.1 compiler and hostname-cardinality regressions.
 tls_0241 = rust_source(root, "src/tls.rs")
@@ -1635,5 +1635,5 @@ for marker_0282 in [
 assert 'Zewnętrzne ścieżki plików' in (root / 'langs/pl_pl.json').read_text()
 assert 'setfacl -m u:rustproxy:--x /etc/ssl/' in (root / 'docs/V0.28.2_IMPLEMENTATION.md').read_text()
 
-print("PASS: 0.29.6 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
+print("PASS: 0.29.7 manifest/package, shared system-statistics/runtime metadata, Settings logging, retained H2, external-packaging/Grafana/Prometheus/404-host/custom-location/path/cache/dashboard/Nagios UI/source contracts, stopped legacy-renewal removal, session/admin/transport contracts, deterministic package source and embedded SQLite schema-v9 migrations.")
 print("NOT VERIFIED: Rust parsing, types, compilation, linking or runtime behavior. Run ./dev.sh test.")

tools/checks/docs_check.py

@@ -1,5 +1,5 @@
 #!/usr/bin/env python3
-"""Rust-independent documentation/Reader consistency checks for the 0.29.6 release."""
+"""Rust-independent documentation/Reader consistency checks for the 0.29.7 release."""
 from pathlib import Path
 import re
 from rust_source import rust_source
@@ -64,11 +64,11 @@ assert '"/docs/content.json"' in admin
 readme = (ROOT / "README.md").read_text(encoding="utf-8")
 roadmap = (ROOT / "ROADMAP.md").read_text(encoding="utf-8")
 changelog = (ROOT / "CHANGELOG.md").read_text(encoding="utf-8")
-assert readme.startswith("# RustProxy 0.29.6")
+assert readme.startswith("# RustProxy 0.29.7")
 assert "docs/WEB_SERVER.md" in readme and "docs/README.md" in readme
 assert readme.count("## What changed in ") == 1, "README duplicates historical release notes; use CHANGELOG/archive"
 assert "## Release history" in readme and "docs/ROADMAP_HISTORY.md" in readme
-assert roadmap.startswith("# RustProxy roadmap") and "## 0.29.6" and "## 0.29.1" in roadmap and "## 0.29.0" in roadmap and "## 0.28.2" in roadmap and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
+assert roadmap.startswith("# RustProxy roadmap") and "## 0.29.7" and "## 0.29.1" in roadmap and "## 0.29.0" in roadmap and "## 0.28.2" in roadmap and "## 0.28.1" in roadmap and "## 0.27.3" in roadmap and "## 0.27.2" in roadmap and "## 0.27.1" in roadmap and "## 0.27.0" in roadmap and "## 0.26.7" in roadmap and "## 0.26.6" in roadmap and "## 0.26.5" in roadmap and "## 0.26.4" in roadmap and "## 0.26.0" in roadmap and "## 0.25.5" in roadmap and "## 0.25.4" in roadmap and "## 0.25.3" in roadmap and "## 0.25.2" in roadmap and "## 0.25.1" in roadmap and "## 0.25.0" in roadmap
 assert "## 0.24." not in roadmap and "## Web Server follow-up" in roadmap and "docs/ROADMAP_HISTORY.md" in roadmap
 assert changelog.startswith("# Changelog\n")
 for release in ["0.29.1", "0.29.0", "0.28.2", "0.28.1", "0.28.0", "0.27.3", "0.27.2", "0.27.1", "0.27.0", "0.26.7", "0.26.6", "0.26.5", "0.26.4", "0.26.1", "0.26.0", "0.25.6", "0.25.5", "0.25.4", "0.25.3"]:

tools/checks/preflight.py

@@ -75,10 +75,10 @@ def check(root: Path, repair_known: bool = False) -> list[str]:
             raise ValueError(f"Conflicting Rust modules: {flat.relative_to(root)} and {module.relative_to(root)}")
     for path in ["src/auth/mod.rs", "src/auth/store.rs", "src/backup/snapshot.rs", "src/upstream.rs", "src/tls.rs", "src/config/internal_routing.rs", "src/proxy/websocket.rs", "src/proxy/error_fallback.rs", "src/cache/mod.rs", "src/cache/model.rs", "src/cache/lifecycle.rs", "src/cache/cold.rs", "src/cache/dashboard.rs", "src/cache/tickets.rs", "src/cache/lookup.rs", "src/cache/policy.rs", "src/cache/fill.rs", "src/cache/tests.rs", "src/settings.rs", "src/compression.rs", "src/diagnostics.rs", "src/traffic.rs", "src/system_stats/mod.rs", "src/system_stats/linux.rs", "src/vhost.rs", "src/vhost/error_fallback.rs", "src/web_server/mod.rs", "src/web_server/config.rs", "src/web_server/filesystem.rs", "src/web_server/security.rs", "src/web_server/response.rs", "src/web_server/request.rs", "src/web_server/routing.rs", "src/web_server/fastcgi.rs", "src/web_server/htaccess.rs", "src/web_server/serve.rs", "src/web_server/tests.rs", "src/balance.rs", "src/security.rs", "src/admin/web/vhosts/core.js", "src/admin/web/vhosts/editor.js", "src/admin/web/vhosts/render.js", "src/admin/web/web-server.js", "src/admin/web/streams.js", "src/admin/web/host404.js", "src/admin/web/app/core.js", "src/admin/web/app/preferences.js", "src/admin/web/app/config-history.js", "src/admin/web/app/runtime.js", "src/admin/web/app/settings.js", "src/admin/web/management.js", "src/admin/web/drafts.js", "src/pages.rs", "tools/dev/mock_server.py", "tools/dev/mock_auth.py", "src/forwarding.rs", "src/tinyauth.rs", "src/http3.rs", "src/stream.rs", "src/admin/web/integrations.js", "src/admin/web/traffic-panel.js", "src/prometheus.rs", "src/admin/web/settings.js", "src/admin/web/docker.js", "src/docker.rs", "docker-agent/main.go", "docker-agent/model.go", "docker-agent/docker.go", "docker-agent/network.go", "docker-agent/certificate.go", "docker-agent/server.go", "docker-agent/main_test.go", "docker-agent/rustproxy-docker-agent.service", "docker-agent/install.sh", "docs/DOCKER_DISCOVERY.md", "docs/WEB_SERVER.md", "docs/PHP_FPM.md", "docs/README.md", "docs/TODO.md", "docs/V0.25.5_AUDIT.md", "docs/V0.25.4_AUDIT.md", "docs/V0.25.3_AUDIT.md", "docs/V0.25.2_AUDIT.md", "docs/CHANGELOG_TECHNICAL_ARCHIVE.md", "docs/ROADMAP_HISTORY.md", "tools/checks/docs_check.py", "tools/checks/web_server_contracts.py", "tools/checks/rust_source.py", "tools/checks/rust_module_contracts.py", "tools/checks/source_module_contracts.py", "scripts/runtime/acme_provider.py", "src/basic_auth.rs", "scripts/deploy/deploy.py", "scripts/deploy/deploy_core.py", "scripts/deploy/deploy_runtime.py", "scripts/migration/migrate_npm.py", "scripts/migration/migrate_npm_core.py", "scripts/migration/migrate_npm_api.py", "docs/NPM_MIGRATION.md", "docs/STREAMS.md", "install.sh", "install-debian13.sh", "update.sh", "build.rs", "scripts/build/swagger_assets.py", "src/admin/documentation.rs", "src/admin/openapi.json", "langs/en_US.json", "langs/pl_pl.json", "Dockerfile", ".dockerignore", "docs/CONTAINER.md", "docs/PROMETHEUS.md", "docs/NOT_FOUND_HOSTS.md", "grafana/rustproxy-overview.json"]:
         if not (root / path).is_file():
-            raise ValueError(f"Incomplete RustProxy 0.29.6 source tree: missing {path}")
+            raise ValueError(f"Incomplete RustProxy 0.29.7 source tree: missing {path}")
     text = (root / "src/lib.rs").read_text(encoding="utf-8")
     if '#[path = "auth/mod.rs"]' not in text:
-        raise ValueError("src/lib.rs is not the 0.29.6 entry point; extract the complete package, not individual files.")
+        raise ValueError("src/lib.rs is not the 0.29.7 entry point; extract the complete package, not individual files.")
     return messages
 
 

tools/checks/release_smoke.py

@@ -135,7 +135,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert backup.is_dir()
     assert (backup / "src/obsolete.rs").is_file()
     assert not (target / "src/obsolete.rs").exists()
-    assert 'version = "0.29.6"' in (target / "Cargo.toml").read_text(encoding="utf-8")
+    assert 'version = "0.29.7"' in (target / "Cargo.toml").read_text(encoding="utf-8")
     assert (target / "data/keep.txt").read_text(encoding="utf-8") == "preserve\n"
     assert (target / ".env").read_text(encoding="utf-8") == "RUST_PROXY_DEMO=0\n"
     assert (target / "langs/site.json").is_file()
@@ -146,7 +146,7 @@ def upgrade_smoke(tmp: Path) -> None:
     assert (target / "docker-agent/certificate.go").is_file()
     assert (target / "docker-agent/server.go").is_file()
     manifest = json.loads((backup / "upgrade.json").read_text(encoding="utf-8"))
-    assert manifest["to_version"] == "0.29.6"
+    assert manifest["to_version"] == "0.29.7"
     assert manifest["removed_obsolete_runtime_state"] is True
     assert not legacy.exists()
     assert not (backup / "legacy-data").exists()
@@ -619,7 +619,7 @@ def source_contract_smoke() -> None:
         assert marker in admin, marker
     anonymous_block = admin.split("fn anonymous_allowed", 1)[1].split("const CERTIFICATE_API_KEY_HEADER", 1)[0]
     assert '"/api/status"' not in anonymous_block
-    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.29.6"' in openapi_0241
+    assert '"RuntimeInformation"' in openapi_0241 and '"version": "0.29.7"' in openapi_0241
     assert 'id="panel-logging"' not in html
     for marker in ['id="settings-tab-logging"', 'id="settings-page-logging"', 'id="logging-form"', 'id="error-log-form"']:
         assert marker in html, marker
@@ -1109,7 +1109,7 @@ def source_contract_smoke() -> None:
     assert '.managed-update' in main and "flush_hot_to_cold_for_update" in main
     openapi = (ROOT / "src/admin/openapi.json").read_text(encoding="utf-8")
     assert '"/api/config/history/restore"' in openapi
-    for marker in ['"version": "0.29.6"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
+    for marker in ['"version": "0.29.7"', '"memory_preset"', '"cold_preset"', '"memory_budget_bytes"', '"max_inflight"', '"preset"', '"session_days"', '"session_lifetime_seconds"', '"accept_local_listener_risk"', '"backend_header"', '"backend_timing_header"', '"cold_on_age"', '"match_type"', '"regex_insensitive"', '"NotFoundHost"', '"not_found_hosts"', '"PrometheusSettings"', '"allow_trusted_network_without_token"', '"include_docker_vhosts"', '"include_streams"', '"include_logging"']:
         assert marker in openapi, marker
     assert '"software_update"' in openapi and '"update_available"' in openapi
     for marker in ['"/api/certificates/deploy"', '"CertificateDeploy"', '"CertificateDeployResult"', '"/api/certificates/reload"']:
@@ -1314,7 +1314,7 @@ def main() -> None:
     source_contract_smoke()
     container_contract_smoke()
     grafana_contract_smoke()
-    print("PASS: 0.29.6 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
+    print("PASS: 0.29.7 SQLite/schema-9/upgrade, local-response 404 hosts, Prometheus/Grafana diagnostics, external Debian-packaging separation, cache/dashboard/logging/Nagios, retained admin/H3/stream/TLS contracts and reproducible source archives.")
 
 
 if __name__ == "__main__":

tools/checks/vhost_origin_errors_0297_ui_test.mjs

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+// 0.29.7 origin error-page interception form roundtrip and input validation.
+// Browser DOM is simulated; this is NOT a Rust/protocol integration test.
+import fs from 'node:fs';
+import vm from 'node:vm';
+
+const source = fs.readFileSync('src/admin/web/management.js', 'utf8');
+const start = source.indexOf('  function vhostEditor(');
+const end = source.indexOf('  let global = null;', start);
+if (start === -1 || end <= start) throw new Error('Missing current vhost pages form');
+const codes = [400,401,403,404,408,413,429,500,502,503,504];
+const check = (valid, message) => { if (!valid) throw new Error(message); };
+class Element {
+  constructor(tag='div', text='') {
+    this.tag = tag;
+    this.textContent = text;
+    this.value = '';
+    this.checked = false;
+    this.disabled = false;
+    this.children = [];
+    this.listeners = new Map();
+  }
+  append(...nodes) { this.children.push(...nodes); }
+  addEventListener(name, callback) { this.listeners.set(name, callback); }
+  dispatch(name) { this.listeners.get(name)?.(); }
+}
+const el = (tag, text) => new Element(tag, text);
+const label = (tag, key) => new Element(tag, key);
+const pageEditor = (parent, label, initial) => { parent.append(el('div', label)); return {read:()=>initial||null}; };
+const errorsEditor = (parent, initial) => { parent.append(el('div')); return {read:()=>initial||{}}; };
+const context = {
+  pageEditor, errorsEditor, el, label, codes,
+  document: { createElement: tag => el(tag) },
+  t: key => key,
+};
+vm.createContext(context);
+vm.runInContext(`${source.slice(start,end)}\nthis.makeEditor = vhostEditor;`,context);
+const build = values => {
+  const parent = el('div');
+  const editor = context.makeEditor(parent, values);
+  const section = parent.children[2];
+  check(section.tag === 'section', 'Missing origin interception section');
+  const input = section.children[0].children[0];
+  const statuses = section.children[1].children[1];
+  return {editor, input, statuses, section};
+};
+const prior = build({});
+check(!prior.input.checked && prior.statuses.disabled, 'Interception must default off');
+check(JSON.stringify(prior.editor.read().intercept_statuses) === '[]', 'Old config must remain unchanged');
+prior.input.checked = true; prior.input.dispatch('change');
+check(!prior.statuses.disabled, 'Status list must enable with checkbox');
+check(JSON.stringify(prior.editor.read().intercept_statuses) === '[404]', 'Default status must be HTTP 404');
+prior.statuses.value = '404, 500, 503';
+check(JSON.stringify(prior.editor.read().intercept_statuses) === '[404,500,503]', 'Explicit statuses lost');
+for (const invalid of ['302', '404,404', '404.0', '0x194', 'abc', '', '200', '600']) {
+  prior.statuses.value = invalid;
+  let rejected = false;
+  try { prior.editor.read(); } catch { rejected = true; }
+  check(rejected, `Invalid interception status should be rejected: ${invalid}`);
+}
+prior.input.checked = false; prior.input.dispatch('change');
+check(prior.statuses.disabled && prior.editor.read().intercept_statuses.length===0,'Disabling interception must clear saved statuses');
+const saved = build({intercept_statuses:[401,404],errors:{404:{kind:'html',status:null,html:'local'}}});
+check(saved.input.checked && !saved.statuses.disabled && saved.statuses.value==='401, 404','Existing interception settings not restored');
+check(saved.editor.read().errors['404'].html==='local', 'Custom error page lost');
+const rust = fs.readFileSync('src/proxy/error_fallback.rs','utf8');
+check(rust.includes('if route.internal {\n        return response;'), 'Internal fallback response is not protected from interception');
+const web = fs.readFileSync('src/proxy/forward/web_source.rs','utf8');
+const proxy = fs.readFileSync('src/proxy/forward/response.rs','utf8');
+check(web.includes('let mut response = intercept_route_origin_error(response, route, &snapshot);'), 'Web Server origin interception not in response path');
+const prepared = fs.readFileSync('src/proxy/forward/success_prepare.rs','utf8');
+check(proxy.includes('include!("success_prepare.rs")'), 'Reverse Proxy response preparation missing');
+check(!proxy.includes('let response = intercept_route_origin_error(response, route, &snapshot);'), 'Do not convert Incoming body before HTTP/2 WebSocket setup');
+check(prepared.includes('response = intercept_route_origin_error(response, route, &snapshot);'), 'Origin error interception missing after body adaptation');
+const marker = fs.readFileSync('src/proxy/error_fallback.rs','utf8');
+check(marker.includes('response.extensions_mut().insert(crate::pages::OriginProvidedResponse)'), 'Origin responses must be marked for the outer observer');
+const observer = fs.readFileSync('src/proxy/upstream_helpers.rs','utf8');
+check(observer.includes('response.extensions().get::<crate::pages::OriginProvidedResponse>().is_none()'), 'Outer response observer must not unconditionally replace origin 404/5xx');
+const pages = fs.readFileSync('src/pages.rs','utf8');
+check(pages.includes('body_only.status = None;'), 'Application error interception must preserve the upstream HTTP code even when page overrides status');
+const interceptPosition = prepared.indexOf('response = intercept_route_origin_error(response, route, &snapshot);');
+check(interceptPosition > prepared.indexOf('Response::from_parts(parts, Body::new(body))'), 'Origin interception must operate on Response<Body>');
+check(interceptPosition < prepared.indexOf('response.extensions_mut().insert(ResponseRulesApplied)'), 'Intercepted origin response must receive final response metadata');
+check(prepared.includes('websocket::wrap_h2_response_body(body, session, exchange)'), 'HTTP/2 WebSocket tunnel body must remain compatible with Incoming');
+const reappliedRules = prepared.indexOf('apply_response_rules(', interceptPosition);
+const errorNoStore = prepared.indexOf('HeaderValue::from_static("no-store")', interceptPosition);
+check(reappliedRules > interceptPosition && errorNoStore > reappliedRules, 'Intercepted pages must reapply header policy and then force no-store');
+const healthLoop = fs.readFileSync('src/balance/lease_runtime.rs','utf8');
+check(healthLoop.includes('checks.spawn(probe(Arc::clone(member), health.clone()))'), 'Health probe must take an owned Arc<Member>');
+const html = fs.readFileSync('src/admin/web/index.html','utf8');
+check(html.includes('id="php-fpm-profiles-help"') && html.includes('id="php-help-dialog"'), 'Shared PHP-FPM profiles lack help modal');
+for (const key of ['phpDocsScope','phpDocsValuesText','phpDocsAdminText','phpHintPathInfo']) {
+  check(html.includes(`data-i18n="${key}"`), `PHP help does not explain ${key}`);
+}
+console.log('PASS: application error interception form default/roundtrip/validation, internal fallback protection, PHP help access.');

tools/checks/web_service_ui_test.mjs

@@ -51,7 +51,7 @@ const ids = [
   "web-service-response-headers","web-service-rewrites","web-service-root","web-service-search",
   "web-service-symlink-policy","web-service-tabs","web-service-try-files",
   "web-service-php-profile", "web-service-php-profiles", "web-service-php-profiles-open", "php-fpm-profiles-dialog",
-  "php-fpm-profiles-list", "php-fpm-profiles-close", "php-fpm-profile-add"
+  "php-fpm-profiles-list", "php-fpm-profiles-close", "php-fpm-profile-add", "php-fpm-profiles-help"
 ];
 const elements = new Map(ids.map(id => [id, new Element(id)]));
 const pages = ["general","routing","htaccess","mime","cache","delivery","php","security"].map(name => {
@@ -193,6 +193,14 @@ context.envelope.config.php_fpm_profiles = [{
 // Both entry points must share the existing modal; the toolbar shortcut
 // belongs next to New Web Service rather than inside the service editor.
 const html = fs.readFileSync("src/admin/web/index.html", "utf8");
+const profileDialog = html.split('id="php-fpm-profiles-dialog"')[1]?.split('</dialog>')[0] ?? '';
+const listAt = profileDialog.indexOf('id="php-fpm-profiles-list"');
+const addAt = profileDialog.indexOf('id="php-fpm-profile-add"');
+const dividerAt = profileDialog.indexOf('class="php-profile-help-divider"');
+const helpAt = profileDialog.indexOf('id="php-fpm-profiles-help"');
+if (!(listAt >= 0 && listAt < addAt && addAt < dividerAt && dividerAt < helpAt)) {
+  throw new Error("PHP-FPM syntax/safety help must be at the bottom of the profile modal, separated by a rule");
+}
 const webPanel = html.split('id="panel-web-server"')[1]?.split("</section>")[0] ?? "";
 const toolbar = webPanel.match(/<div class="vhost-list-tools">([\s\S]*?)<\/div>/)?.[1] ?? "";
 const shortcutAt = toolbar.indexOf('id="web-service-php-profiles-open"');
@@ -209,6 +217,26 @@ if (!elements.get("php-fpm-profiles-dialog").open) throw new Error("PHP-FPM prof
 const profileDetail = elements.get("php-fpm-profiles-list").children[0];
 if (!profileDetail || profileDetail.children[0].textContent !== "WordPress pool") throw new Error("Shared profile list missing");
 const profileForm = profileDetail.children[1];
+const phpRows = profileForm.children.filter(node => node.classList.values.has("php-switch-row vh-wide"));
+if (phpRows.length !== 3) throw new Error("PHP-FPM / PATH_INFO / Authorization switches do not have separate aligned rows");
+for (const row of phpRows) {
+  if (row.children.length !== 2 || row.children[0].children[0].type !== "checkbox" ||
+      row.children[1].children[0].textContent !== "i" || row.children[1].children[1].children.length < 1) {
+    throw new Error("Profile PHP toggle lacks its checkbox label or explanation popover");
+  }
+}
+if (!phpRows[0].children[0].children[0].checked || !phpRows[1].children[0].children[0].checked) {
+  throw new Error("PHP execution and PATH_INFO saved values were not restored");
+}
+phpRows[1].children[0].children[0].checked = false;
+if (!phpRows[0].children[0].children[0].checked) {
+  throw new Error("Changing PATH_INFO also disabled PHP execution");
+}
+phpRows[1].children[0].children[0].checked = true;
+elements.get("php-fpm-profiles-help").dispatch("click");
+if (!elements.get("php-help-dialog").open) throw new Error("PHP profile help button did not open syntax documentation");
+elements.get("php-help-close").dispatch("click");
+if (elements.get("php-help-dialog").open) throw new Error("PHP syntax help dialog did not close");
 profileForm.children[1].children[1].value = "Updated WordPress pool";
 await profileForm.dispatch("submit");
 if (savedSection?.name !== "php-fpm-profiles" || savedSection.value[0].name !== "Updated WordPress pool") {