shater/panel/src/planeState.test.ts

// protectionState — the one sentence the whole panel shows about "am I protected".
//
// Run with `npm test` (node's built-in test runner + native TypeScript stripping;
// no test dependency is added to the SPA, which ships inside the daemon binary).
//
// The case this file was written for is "plane full, traffic direct": the exact
// state of a live router — one enabled rule, `default → direct`, no groups, no
// rule-sets — where every part of the data plane was installed and the readout
// therefore said "Protected — traffic from your network is going through the
// tunnel", under a green LED, while the whole LAN went out the plain WAN.
//
// planeState.ts has no runtime imports (both of its imports are `import type`),
// so this runs against the real module with nothing stubbed.

import { test } from 'node:test'
import assert from 'node:assert/strict'

import { protectionState } from './planeState.ts'
import type { Status, Traffic } from './api.ts'

/** A healthy, fully-installed router; `traffic` is what each case varies. */
function status(over: Partial<Status> = {}): Status {
  return {
    running: true,
    enabled: true,
    active: true,
    table: true,
    hash: 'abc',
    version: '1.11.0-shater',
    kill_switch: 'closed',
    engine_running: true,
    plane: 'full',
    warnings: [],
    ...over,
  }
}

function withTraffic(traffic: Traffic | undefined): Status {
  return status({ traffic })
}

// --- the field case ---------------------------------------------------------

test('plane full + default direct is NOT reported as protected', () => {
  const s = protectionState(withTraffic({ verdict: 'direct', default: 'direct', tunnel_rules: 0 }))
  assert.notEqual(s.headline, 'Protected')
  assert.equal(s.variant, 'crit')
  assert.equal(s.alarm, true)
  // The claim that was false must not survive anywhere in the copy.
  assert.doesNotMatch(s.detail, /going through the tunnel/)
  // ...and the honest consequence must be stated, not implied.
  assert.match(s.detail, /real address/)
})

// --- the other verdicts under a full plane ----------------------------------

test('plane full + default into a tunnel is protected', () => {
  const s = protectionState(withTraffic({ verdict: 'tunnel', default: 'auto', tunnel_rules: 1 }))
  assert.equal(s.variant, 'on')
  assert.equal(s.headline, 'Protected')
  assert.equal(s.alarm, false)
})

test('plane full + direct default with tunnelling rules is split, not protected', () => {
  const s = protectionState(withTraffic({ verdict: 'split', default: 'direct', tunnel_rules: 3 }))
  assert.equal(s.variant, 'amber')
  assert.notEqual(s.headline, 'Protected')
  // Says how much is protected, and that the default is not.
  assert.match(s.detail, /3 rules/)
  assert.match(s.detail, /normal internet connection/)
  // A working selective setup must not raise a banner on every other page.
  assert.equal(s.alarm, false)
})

test('split names a single rule in the singular', () => {
  const s = protectionState(withTraffic({ verdict: 'split', default: 'direct', tunnel_rules: 1 }))
  assert.match(s.detail, /^One rule sends traffic/)
})

test('plane full + blocked default with rules leaks nothing and is never crit', () => {
  const s = protectionState(withTraffic({ verdict: 'blocked', default: 'block', tunnel_rules: 2 }))
  assert.equal(s.variant, 'amber')
  assert.equal(s.alarm, false)
  assert.match(s.detail, /nothing is leaving unprotected/)
})

test('plane full + blocked default with no rules says the network has no way out', () => {
  const s = protectionState(withTraffic({ verdict: 'blocked', default: 'block', tunnel_rules: 0 }))
  assert.equal(s.variant, 'amber')
  assert.equal(s.alarm, true)
  assert.doesNotMatch(s.detail, /going through the tunnel/)
})

test('plane full with no verdict claims nothing either way', () => {
  for (const t of [undefined, { verdict: '' as const }]) {
    const s = protectionState(withTraffic(t))
    assert.notEqual(s.headline, 'Protected')
    assert.equal(s.variant, 'amber')
    assert.equal(s.alarm, false)
  }
})

// --- the branches that were already correct ---------------------------------

test('no status yet', () => {
  const s = protectionState(null)
  assert.equal(s.variant, 'off')
  assert.equal(s.alarm, false)
})

test('service switched off is a deliberate state, not a fault', () => {
  const s = protectionState(status({ enabled: false }))
  assert.equal(s.variant, 'amber')
  assert.equal(s.headline, 'Turned off')
  assert.equal(s.alarm, false)
})

test('hold: the kill-switch caught it — protected, offline', () => {
  const s = protectionState(status({ plane: 'hold', engine_running: false, active: false }))
  assert.equal(s.variant, 'amber')
  assert.equal(s.alarm, true)
  assert.match(s.headline, /blocked/)
})

test('none + fail-closed is the leak, and it is crit', () => {
  const s = protectionState(status({ plane: 'none', table: false, engine_running: false }))
  assert.equal(s.variant, 'crit')
  assert.equal(s.alarm, true)
})

test('none + fail-open is the operator’s documented choice, stated not alarmed at', () => {
  const s = protectionState(
    status({ plane: 'none', table: false, engine_running: false, kill_switch: 'open' }),
  )
  assert.equal(s.variant, 'amber')
  assert.equal(s.alarm, true)
})

test('daemon too old to send `plane` keeps its own fallback', () => {
  // Nothing here may depend on `traffic`: a daemon with no `plane` has no
  // `traffic` either, and this branch reads what it can observe instead.
  const { plane, ...noPlane } = status()
  void plane
  assert.equal(protectionState(noPlane as Status).headline, 'Protected')
  assert.equal(protectionState({ ...noPlane, running: false } as Status).headline, 'Service stopped')
  assert.equal(
    protectionState({ ...noPlane, active: false } as Status).headline,
    'Starting up',
  )
})