v0.32.4

tools/checks/preserve_host_0324_ui_test.mjs

@@ -0,0 +1,42 @@
+import fs from 'node:fs';
+import vm from 'node:vm';
+import assert from 'node:assert/strict';
+
+const ui = fs.readFileSync('src/admin/web/vhosts/core.js', 'utf8');
+const head = 'function debugOriginIssues(members) {';
+const tail = '\nfunction aclEditor(';
+const start = ui.indexOf(head);
+const end = ui.indexOf(tail, start);
+assert(start >= 0 && end > start, 'debug origin verification helper is present');
+const warn = vm.runInNewContext('(' + ui.slice(start, end).trim() + ')', { URL });
+
+function member(protocol, more={}) { return {
+  url:'https://10.87.20.2:443',protocol,preserve_host:true,
+  pool_eligible:true,allow_private:true,tls_verify:false,...more,
+}; }
+for (const protocol of ['http1', 'auto', 'http2', 'h2']) {
+  assert.equal(warn([member(protocol)]).length, 0,
+    `${protocol} is accepted without forcing H1 or disabling preserved Host`);
+  assert.equal(warn([member(protocol, {tls_server_name:'unitraklub.pl',tls_verify:true})]).length, 0,
+    `${protocol} supports explicitly verified certificate DNS names`);
+}
+assert.equal(warn([member('h2',{pool_eligible:false,allow_private:false})]).length,0,
+  'pool and private-origin flags must not be mistaken for protocol requirements');
+assert.equal(warn([member('auto',{tls_verify:true})]).length,1,
+  'HTTPS-by-IP without TLS identity receives a nonblocking warning');
+assert.equal(warn([{...member('h2',{tls_verify:true}),url:'https://site.example'}]).length,0,
+  'DNS HTTPS origin needs no IP-certificate warning');
+assert.equal(warn([{...member('h2',{tls_verify:true}),url:'http://10.87.20.2:80'}]).length,0);
+assert(!/preserve\.disabled\s*=|preserve\.checked\s*=\s*false/.test(ui),
+  'Protocol selector may not disable or clear Preserve Host');
+assert(ui.includes('value.preserve_host === true'), 'Existing backend preference remains visible');
+assert(ui.includes('protocol.value = "http1"; preserve.checked = true'),
+  'Optional explicit H1 troubleshooting preset is retained');
+assert(!ui.includes('syncProtocol()'), 'Do not call removed protocol-only Host limiter');
+assert(ui.includes('protocol.dispatchEvent(new Event("change"))'), 'Preset refreshes protocol help text');
+for (const lang of ['en_US','pl_pl']) {
+  const t=JSON.parse(fs.readFileSync(`langs/${lang}.json`,'utf8')).translations;
+  for (const key of ['vhPreserveHost','vhDebugOriginPreset','vhOriginPresetHelp','vhDebugOriginMismatch'])
+    assert(t[key] && t[key].length>30,`${lang}.${key}`);
+}
+console.log('PASS: Preserve Host is available for four modes; IP/TLS hint is conditional and optional');