DndGamePlayerLicenseServer/test/adminApi.test.mjs

import assert from 'node:assert/strict';
import fs from 'node:fs';
import http from 'node:http';
import os from 'node:os';
import path from 'node:path';
import test from 'node:test';
import { fileURLToPath } from 'node:url';

import { generateKeyPairSync } from 'node:crypto';

const __dirname = path.dirname(fileURLToPath(import.meta.url));
const root = path.resolve(__dirname, '..');

function listen(server) {
  return new Promise((resolve) => {
    server.listen(0, '127.0.0.1', () => {
      resolve(server.address().port);
    });
  });
}

function request(port, method, pathname, { token, body, origin, headers: extraHeaders, rawBody } = {}) {
  return new Promise((resolve, reject) => {
    const headers = { ...extraHeaders };
    if (body && !headers['Content-Type']) headers['Content-Type'] = 'application/json';
    if (token) headers.Authorization = `Bearer ${token}`;
    if (origin) headers.Origin = origin;
    const req = http.request(
      { hostname: '127.0.0.1', port, method, path: pathname, headers },
      (res) => {
        const chunks = [];
        res.on('data', (c) => chunks.push(c));
        res.on('end', () => {
          const raw = Buffer.concat(chunks).toString('utf8');
          resolve({
            status: res.statusCode,
            headers: res.headers,
            body: raw ? JSON.parse(raw) : null,
          });
        });
      },
    );
    req.on('error', reject);
    if (rawBody !== undefined) req.write(rawBody);
    else if (body) req.write(JSON.stringify(body));
    req.end();
  });
}

async function makeServer(dataPath, adminToken = 'test-admin') {
  process.env.SKIP_LICENSE_LISTEN = '1';
  const { createServer } = await import('../src/server.mjs');
  const { privateKey } = generateKeyPairSync('ed25519');
  const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
  process.env.DND_LICENSE_DATA_PATH = dataPath;
  const server = createServer({ privateKeyPem: pem, adminToken });
  return { server, adminToken };
}

void test('GET /v1/admin/licenses returns enriched product keys', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.writeFileSync(
    dataPath,
    JSON.stringify({
      productKeys: [
        {
          key: 'TTRPG-TEST-KEY',
          sub: 'lic_test',
          pid: 'dnd_player',
          maxDevices: 2,
          expiresAtSec: 1893456000,
        },
      ],
      revokedSubs: ['lic_test'],
      activations: { lic_test: ['dev1', 'dev2'] },
    }),
  );

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
    assert.equal(res.status, 200);
    assert.equal(res.body.licenses.length, 1);
    assert.equal(res.body.licenses[0].key, 'TTRPG-TEST-KEY');
    assert.equal(res.body.licenses[0].expiryMode, 'fixed');
    assert.equal(res.body.licenses[0].expiresAtSec, 1893456000);
    assert.equal(res.body.licenses[0].revoked, true);
    assert.deepEqual(res.body.licenses[0].activatedDevices, ['dev1', 'dev2']);
    assert.equal(res.body.licenses[0].activatedCount, 2);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/product-keys creates a new product key', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'POST', '/v1/admin/product-keys', {
      token: adminToken,
      body: { maxDevices: 5, expiresAtSec: 2000000000, pid: 'dnd_player' },
    });
    assert.equal(res.status, 201);
    assert.match(res.body.key, /^TTRPG-/);
    assert.match(res.body.sub, /^lic_/);
    assert.equal(res.body.maxDevices, 5);
    assert.equal(res.body.expiresAtSec, 2000000000);

    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
    assert.equal(data.productKeys.length, 3);
    assert.ok(data.productKeys.some((x) => x.key === res.body.key));
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/product-keys defaults to validDays period', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'POST', '/v1/admin/product-keys', {
      token: adminToken,
      body: { maxDevices: 3, pid: 'dnd_player' },
    });
    assert.equal(res.status, 201);
    assert.equal(res.body.validDays, 365);
    assert.equal(res.body.expiresAtSec, undefined);

    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
    const created = data.productKeys.find((x) => x.key === res.body.key);
    assert.equal(created.validDays, 365);
    assert.equal(created.expiresAtSec, undefined);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/product-keys rejects conflicting expiry', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'POST', '/v1/admin/product-keys', {
      token: adminToken,
      body: { maxDevices: 3, expiresAtSec: 2000000000, validDays: 30 },
    });
    assert.equal(res.status, 400);
    assert.equal(res.body.error, 'conflicting_expiry');
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/revoke by key revokes only that product key', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.writeFileSync(
    dataPath,
    JSON.stringify({
      productKeys: [
        {
          key: 'DND-SHARED-SUB',
          sub: 'lic_shared',
          pid: 'dnd_player',
          maxDevices: 2,
          expiresAtSec: 1893456000,
        },
        {
          key: 'TTRPG-SHARED-SUB',
          sub: 'lic_shared',
          pid: 'dnd_player',
          maxDevices: 2,
          expiresAtSec: 1893456000,
        },
      ],
      revokedSubs: [],
      revokedKeys: [],
      activations: {},
    }),
  );

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const revoke = await request(port, 'POST', '/v1/admin/revoke', {
      token: adminToken,
      body: { key: 'DND-SHARED-SUB' },
    });
    assert.equal(revoke.status, 200);

    const list = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
    assert.equal(list.status, 200);
    const byKey = Object.fromEntries(list.body.licenses.map((x) => [x.key, x.revoked]));
    assert.equal(byKey['DND-SHARED-SUB'], true);
    assert.equal(byKey['TTRPG-SHARED-SUB'], false);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/product-keys/delete removes key from data', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.writeFileSync(
    dataPath,
    JSON.stringify({
      productKeys: [
        {
          key: 'TTRPG-DELETE-ME',
          sub: 'lic_delete',
          pid: 'dnd_player',
          maxDevices: 1,
          validDays: 30,
          createdAtSec: 100,
        },
      ],
      revokedSubs: [],
      revokedKeys: ['TTRPG-DELETE-ME'],
      activations: { lic_delete: ['dev1'] },
    }),
  );

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const del = await request(port, 'POST', '/v1/admin/product-keys/delete', {
      token: adminToken,
      body: { key: 'TTRPG-DELETE-ME' },
    });
    assert.equal(del.status, 200);
    assert.equal(del.body.ok, true);

    const data = JSON.parse(fs.readFileSync(dataPath, 'utf8'));
    assert.equal(data.productKeys.length, 0);
    assert.equal(data.activations.lic_delete, undefined);
    assert.equal(data.revokedKeys.length, 0);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/admin/product-keys batch creates multiple keys', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'POST', '/v1/admin/product-keys', {
      token: adminToken,
      body: { count: 3, maxDevices: 2, validDays: 30 },
    });
    assert.equal(res.status, 201);
    assert.equal(res.body.count, 3);
    assert.equal(res.body.keys.length, 3);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('GET /v1/admin/licenses sorts newest first by createdAtSec', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.writeFileSync(
    dataPath,
    JSON.stringify({
      productKeys: [
        { key: 'OLD', sub: 'lic_old', pid: 'dnd_player', maxDevices: 1, validDays: 1, createdAtSec: 100 },
        { key: 'NEW', sub: 'lic_new', pid: 'dnd_player', maxDevices: 1, validDays: 1, createdAtSec: 999 },
      ],
      revokedSubs: [],
      revokedKeys: [],
      activations: {},
    }),
  );

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const list = await request(port, 'GET', '/v1/admin/licenses', { token: adminToken });
    assert.equal(list.body.licenses[0].key, 'NEW');
    assert.equal(list.body.licenses[1].key, 'OLD');
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/track/download and GET stats', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server, adminToken } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const track = await request(port, 'POST', '/v1/track/download', { body: { platform: 'windows' } });
    assert.equal(track.status, 200);

    const stats = await request(port, 'GET', '/v1/admin/stats/downloads', { token: adminToken });
    assert.equal(stats.status, 200);
    assert.ok(stats.body.currentMonth.windows >= 1);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('OPTIONS /v1/track/download returns CORS preflight for allowed origin', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'OPTIONS', '/v1/track/download', {
      origin: 'https://ttrpgplayer.ru',
    });
    assert.equal(res.status, 204);
    assert.equal(res.headers['access-control-allow-origin'], 'https://ttrpgplayer.ru');
    assert.match(res.headers['access-control-allow-methods'], /POST/);
    assert.equal(res.headers['access-control-allow-headers'], 'Content-Type');
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/track/download includes CORS headers for allowed origin', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'POST', '/v1/track/download', {
      body: { platform: 'linux' },
      origin: 'https://ttrpgplayer.ru',
    });
    assert.equal(res.status, 200);
    assert.equal(res.headers['access-control-allow-origin'], 'https://ttrpgplayer.ru');
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('OPTIONS /v1/track/download rejects unknown origin', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'OPTIONS', '/v1/track/download', {
      origin: 'https://evil.example',
    });
    assert.equal(res.status, 404);
    assert.equal(res.body.error, 'not_found');
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('POST /v1/track/download accepts text/plain beacon body', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'POST', '/v1/track/download', {
      rawBody: JSON.stringify({ platform: 'linux' }),
      origin: 'https://ttrpgplayer.ru',
      headers: { 'Content-Type': 'text/plain;charset=UTF-8' },
    });
    assert.equal(res.status, 200);
    assert.equal(res.body.platform, 'linux');
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('OPTIONS /v1/track/download allows localhost:5174', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'OPTIONS', '/v1/track/download', {
      origin: 'http://localhost:5174',
    });
    assert.equal(res.status, 204);
    assert.equal(res.headers['access-control-allow-origin'], 'http://localhost:5174');
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});

void test('admin endpoints reject missing token', async () => {
  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'lic-'));
  const dataPath = path.join(tmp, 'data.json');
  fs.copyFileSync(path.join(root, 'data.example.json'), dataPath);

  const { server } = await makeServer(dataPath);
  const port = await listen(server);
  try {
    const res = await request(port, 'GET', '/v1/admin/licenses');
    assert.equal(res.status, 401);
  } finally {
    server.close();
    fs.rmSync(tmp, { recursive: true, force: true });
  }
});