lab/bastion/src/bastion/tests/vyos.test.ts

import { describe, it, expect, beforeEach, afterEach } from "vitest";
import { mkdirSync, rmSync } from "node:fs";
import { join } from "node:path";
import { tmpdir } from "node:os";
import type { BastionConfig } from "@lab/shared";
import type { FastifyInstance } from "fastify";
import { createApp } from "../src/server.js";
import type { StateManager } from "../src/services/state.js";
import { buildVyosConfigSpec } from "../src/templates/vyos-config-spec.js";
import { renderVyosInstallPy } from "../src/templates/vyos-install.py.js";

function createTestConfig(testDir: string): BastionConfig {
  return {
    fedoraVersion: "43",
    arch: "x86_64",
    httpPort: 0,
    timezone: "Europe/London",
    locale: "en_GB.UTF-8",
    bastionDir: testDir,
    domain: "test.local",
    dhcpMode: "proxy",
    dhcpRangeStart: "",
    dhcpRangeEnd: "",
    ubuntuVersion: "26.04",
    ubuntuMirror: "https://releases.ubuntu.com/26.04",
    vyosIsoUrl: "https://example.invalid/vyos.iso",
    vyosDefaultPassword: "test-pw",
    iface: "eth0",
    serverIp: "10.0.0.1",
    network: "10.0.0.0",
    gateway: "10.0.0.1",
    sshKeys: ["ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAITEST lab@test"],
    adminUser: "testadmin",
    syslogPort: 15515,
    skipDnsmasq: true,
    skipArtifacts: true,
    fedoraMirror: "https://example.invalid/fedora",
    tftpDir: join(testDir, "tftp"),
    httpDir: join(testDir, "http"),
    stateFile: join(testDir, "state.json"),
  };
}

/** Pull the base64 spec back out of the generated Python driver. */
function decodeSpecFrom(python: string): Record<string, unknown> {
  const match = /base64\.b64decode\("([^"]+)"\)/.exec(python);
  if (!match?.[1]) throw new Error("no base64 spec found in generated driver");
  return JSON.parse(Buffer.from(match[1], "base64").toString("utf-8"));
}

describe("vyos config spec", () => {
  it("puts VLANs on the bond when members are given", () => {
    const spec = buildVyosConfigSpec({
      hostname: "fw1",
      defaultPassword: "pw",
      spec: {
        mgmtInterface: "eth0",
        mgmtAddress: "10.0.8.2/24",
        bondMembers: ["eth2", "eth3"],
        vlans: [{ id: 10, address: "10.0.10.1/24", description: "k8s" }],
      },
    });

    const paths = spec.sets.map((s) => s.path.join(" "));
    expect(paths).toContain("interfaces bonding bond0 mode");
    expect(paths).toContain("interfaces bonding bond0 vif 10 address");
    // VLANs must hang off the bond, not the management NIC.
    expect(paths).not.toContain("interfaces ethernet eth0 vif 10 address");

    // Bond members are a multi-value node — appending, not replacing, is what
    // keeps the second member from overwriting the first.
    const members = spec.sets.filter(
      (s) => s.path.join(" ") === "interfaces bonding bond0 member interface",
    );
    expect(members.map((m) => m.value)).toEqual(["eth2", "eth3"]);
    expect(members.every((m) => m.replace === false)).toBe(true);
  });

  it("falls back to VLANs on the management NIC when unbonded", () => {
    const spec = buildVyosConfigSpec({
      hostname: "fw2",
      defaultPassword: "pw",
      spec: { mgmtInterface: "eth1", vlans: [{ id: 20, address: "10.0.20.1/24" }] },
    });

    const paths = spec.sets.map((s) => s.path.join(" "));
    expect(paths).toContain("interfaces ethernet eth1 vif 20 address");
  });

  it("normalises the target disk to a full /dev path", () => {
    // find_disks() enumerates with `lsblk -Jbp`, so valid responses are full
    // paths; a bare name fails valid_responses and re-prompts forever.
    expect(buildVyosConfigSpec({ hostname: "fw3", defaultPassword: "pw", disk: "/dev/mmcblk0" }).disk)
      .toBe("/dev/mmcblk0");
    expect(buildVyosConfigSpec({ hostname: "fw3", defaultPassword: "pw", disk: "mmcblk0" }).disk)
      .toBe("/dev/mmcblk0");
    expect(buildVyosConfigSpec({ hostname: "fw3", defaultPassword: "pw" }).disk).toBe("");
  });

  it("defaults to dhcp on eth0 and never opts into RAID", () => {
    const spec = buildVyosConfigSpec({ hostname: "fw4", defaultPassword: "pw" });
    const address = spec.sets.find(
      (s) => s.path.join(" ") === "interfaces ethernet eth0 address",
    );
    expect(address?.value).toBe("dhcp");
    // The installer's RAID prompt defaults to yes; a second disk must not
    // silently produce a mirror.
    expect(spec.raid).toBe(false);
  });
});

describe("vyos routes", () => {
  let testDir: string;
  let app: FastifyInstance;
  let state: StateManager;
  const mac = "aa:bb:cc:11:22:33";

  beforeEach(() => {
    testDir = join(tmpdir(), `bastion-vyos-test-${Date.now()}-${Math.random().toString(36).slice(2)}`);
    mkdirSync(join(testDir, "http"), { recursive: true });
    mkdirSync(join(testDir, "tftp"), { recursive: true });

    const result = createApp(createTestConfig(testDir));
    app = result.app;
    state = result.state;
  });

  afterEach(async () => {
    await app.close();
    rmSync(testDir, { recursive: true, force: true });
  });

  it("dispatches a queued vyos machine to the live-boot script", async () => {
    state.update((s) => {
      s.install_queue[mac] = {
        hostname: "fw1",
        disk: "/dev/nvme0n1",
        role: "worker",
        os: "vyos-rolling",
        queued_at: new Date().toISOString(),
      };
    });

    const response = await app.inject({ method: "GET", url: `/dispatch?mac=${mac}` });
    expect(response.statusCode).toBe(200);

    expect(response.body).toContain("/vyos-vmlinuz");
    expect(response.body).toContain("fetch=http://10.0.0.1:0/vyos-filesystem.squashfs");
    expect(response.body).toContain(`live-config.hooks=http://10.0.0.1:0/vyos/autoinstall.sh?mac=${mac}`);

    // `nonetworking` appears in VyOS's own PXE docs but breaks the hook fetch,
    // and console=ttyS0 costs 30s per systemd phase on boards with no UART.
    expect(response.body).not.toContain("nonetworking");
    expect(response.body).not.toContain("console=ttyS0");
  });

  it("serves a hook that fetches and executes the install driver", async () => {
    const response = await app.inject({ method: "GET", url: `/vyos/autoinstall.sh?mac=${mac}` });
    expect(response.statusCode).toBe(200);
    expect(response.body).toContain(`/vyos/install.py?mac=${mac}`);
    expect(response.body).toContain("python3 /tmp/vyos-install.py");
  });

  it("bakes the machine's config into the generated install driver", async () => {
    state.update((s) => {
      s.install_queue[mac] = {
        hostname: "fw1",
        disk: "/dev/nvme0n1",
        role: "worker",
        os: "vyos-rolling",
        queued_at: new Date().toISOString(),
        vyos: {
          mgmtInterface: "eth0",
          mgmtAddress: "10.0.8.2/24",
          bondMembers: ["eth2", "eth3"],
          vlans: [{ id: 10, address: "10.0.10.1/24" }],
          password: "s3cret",
        },
      };
    });

    const response = await app.inject({ method: "GET", url: `/vyos/install.py?mac=${mac}` });
    expect(response.statusCode).toBe(200);

    // Builds config from the image's own default so the vyos-config-version
    // trailer matches and first boot skips migrations.
    expect(response.body).toContain("/opt/vyatta/etc/config.boot.default");
    expect(response.body).toContain("/usr/libexec/vyos/op_mode/image_installer.py");
    // "complete" is what moves the machine out of the install queue.
    expect(response.body).toContain('report("complete"');

    const spec = decodeSpecFrom(response.body);
    expect(spec["hostname"]).toBe("fw1");
    expect(spec["password"]).toBe("s3cret");
    expect(spec["disk"]).toBe("/dev/nvme0n1");

    const paths = (spec["sets"] as Array<{ path: string[] }>).map((s) => s.path.join(" "));
    expect(paths).toContain("interfaces bonding bond0 vif 10 address");
    expect(paths).toContain("system host-name");
  });

  it("falls back to the bastion default password when none is set", async () => {
    state.update((s) => {
      s.install_queue[mac] = {
        hostname: "fw9",
        disk: "",
        role: "worker",
        os: "vyos-rolling",
        queued_at: new Date().toISOString(),
      };
    });

    const response = await app.inject({ method: "GET", url: `/vyos/install.py?mac=${mac}` });
    const spec = decodeSpecFrom(response.body);
    expect(spec["password"]).toBe("test-pw");
    // Empty disk means "accept the installer's first-disk default".
    expect(spec["disk"]).toBe("");
  });
});

describe("vyos hw-id pinning", () => {
  it("emits hw-id for the mgmt interface and each bond member", () => {
    // Discovery sees enp2s0/enp1s0f0np0 under Fedora, but VyOS enumerates its
    // own eth<N>. Pinning by MAC is what makes the mapping deterministic.
    const spec = buildVyosConfigSpec({
      hostname: "fw1",
      defaultPassword: "pw",
      spec: {
        mgmtInterface: "eth2",
        bondMembers: ["eth0", "eth1"],
        hwIds: {
          eth2: "64:62:66:25:96:47",
          eth0: "64:62:66:25:96:45",
          eth1: "64:62:66:25:96:46",
        },
      },
    });

    const hw = spec.sets.filter((s) => s.path[s.path.length - 1] === "hw-id");
    expect(hw.map((s) => [s.path[2], s.value])).toEqual([
      ["eth2", "64:62:66:25:96:47"],
      ["eth0", "64:62:66:25:96:45"],
      ["eth1", "64:62:66:25:96:46"],
    ]);
  });

  it("omits hw-id entirely when no mapping is given", () => {
    const spec = buildVyosConfigSpec({ hostname: "fw1", defaultPassword: "pw" });
    expect(spec.sets.some((s) => s.path.includes("hw-id"))).toBe(false);
  });
});

describe("vyos management VLAN", () => {
  it("puts the mgmt VLAN on the PXE port while the bond carries routed VLANs", () => {
    // Trunked PXE port: boots untagged on the VLAN the bastion serves, stays
    // reachable on the tagged management VLAN.
    const spec = buildVyosConfigSpec({
      hostname: "vyos001",
      defaultPassword: "pw",
      spec: {
        mgmtInterface: "eth2",
        mgmtAddress: "dhcp",
        mgmtVlan: { id: 3, address: "192.168.3.4/24", description: "kvm" },
        bondMembers: ["eth0", "eth1"],
        vlans: [{ id: 2, address: "192.168.8.2/23" }],
      },
    });

    const paths = spec.sets.map((s) => s.path.join(" "));
    expect(paths).toContain("interfaces ethernet eth2 vif 3 address");
    expect(paths).toContain("interfaces bonding bond0 vif 2 address");
    // The mgmt VLAN must not land on the bond.
    expect(paths).not.toContain("interfaces bonding bond0 vif 3 address");
    expect(spec.tags.map((t) => t.join(" "))).toContain("interfaces ethernet eth2 vif");
  });
});

describe("vyos VRRP HA", () => {
  const haSpec = {
    mgmtInterface: "eth2",
    mgmtAddress: "dhcp",
    bondMembers: ["eth0", "eth1"],
    bondAddress: "192.168.1.252/24",
    bondVrrp: "192.168.1.254/24",
    vrrpPriority: 200,
    vlans: [
      { id: 3, address: "192.168.3.4/24", vrrp: "192.168.3.254/24" },
      { id: 200, address: "192.168.2.252/24" },   // no VIP on this one
    ],
  };

  it("emits a vrrp group per VIP with vrid = VLAN id and dotted vif interface", () => {
    const spec = buildVyosConfigSpec({ hostname: "fw1", defaultPassword: "pw", spec: haSpec });
    const paths = spec.sets.map((s) => `${s.path.join(" ")}${s.value !== undefined ? "=" + s.value : ""}`);

    expect(paths).toContain("interfaces bonding bond0 address=192.168.1.252/24");
    // untagged bond group: vrid 1, interface bond0 itself
    expect(paths).toContain("high-availability vrrp group native interface=bond0");
    expect(paths).toContain("high-availability vrrp group native vrid=1");
    // address is a tag node -- VIP is the final path segment, no value
    expect(paths).toContain("high-availability vrrp group native address 192.168.1.254/24");
    // VLAN group: vrid = VLAN id, dotted vif
    expect(paths).toContain("high-availability vrrp group vlan3 interface=bond0.3");
    expect(paths).toContain("high-availability vrrp group vlan3 vrid=3");
    expect(paths).toContain("high-availability vrrp group vlan3 address 192.168.3.254/24");
    // VLAN without a VIP gets no group
    expect(paths.some((p) => p.includes("group vlan200"))).toBe(false);
  });

  it("applies the box-wide priority and one sync group over all groups", () => {
    const spec = buildVyosConfigSpec({ hostname: "fw1", defaultPassword: "pw", spec: haSpec });
    const prio = spec.sets.filter((s) => s.path[s.path.length - 1] === "priority"
      && s.path[0] === "high-availability");
    expect(prio).toHaveLength(2);
    expect(prio.every((s) => s.value === "200")).toBe(true);

    // sync group binds the pair: all groups fail over together
    const members = spec.sets.filter(
      (s) => s.path.join(" ") === "high-availability vrrp sync-group MAIN member",
    );
    expect(members.map((m) => m.value)).toEqual(["native", "vlan3"]);
    expect(members.every((m) => m.replace === false)).toBe(true);
  });

  it("emits no high-availability nodes when no VIPs are given", () => {
    const spec = buildVyosConfigSpec({
      hostname: "fw1",
      defaultPassword: "pw",
      spec: { bondMembers: ["eth0", "eth1"], vlans: [{ id: 3, address: "192.168.3.4/24" }] },
    });
    expect(spec.sets.some((s) => s.path[0] === "high-availability")).toBe(false);
  });
});

describe("pickLargestInitrd", async () => {
  const { pickLargestInitrd } = await import("../src/main.js");

  // Verbatim from `xorriso -lsl /live/` on vyos-2026.08.05-0033-rolling.
  const realListing = `total 8
-r--r--r--    1 0        0           22255 Aug  5 01:33 'filesystem.packages'
-r--r--r--    1 0        0               6 Aug  5 01:33 'filesystem.packages-remove'
-r--r--r--    1 0        0        541192192 Aug  5 01:33 'filesystem.squashfs'
-r--r--r--    1 0        0        50352547 Aug  5 01:33 'initrd.img'
-r--r--r--    1 0        0        50352547 Aug  5 01:33 'initrd.img-6.18.41-vyos'
-r--r--r--    1 0        0              20 Aug  5 01:33 'packages.txt'
-r--r--r--    1 0        0         9135104 Aug  2 19:54 'vmlinuz'
-r--r--r--    1 0        0         9135104 Aug  2 19:54 'vmlinuz-6.18.41-vyos'
`;

  it("picks a full-size initrd from a real nightly listing", () => {
    expect(pickLargestInitrd(realListing)).toEqual({ name: "initrd.img", size: 50352547 });
  });

  it("ignores 0-byte decoys and symlinks (which report link size, not target size)", () => {
    const listing = `total 8
-r--r--r--    1 0        0               0 Aug  5 01:33 'initrd.img'
lrwxrwxrwx    1 0        0              24 Aug  5 01:33 'initrd.img-link' -> 'initrd.img-6.18.41-vyos'
-r--r--r--    1 0        0        50352547 Aug  5 01:33 'initrd.img-6.18.41-vyos'
`;
    expect(pickLargestInitrd(listing)).toEqual({ name: "initrd.img-6.18.41-vyos", size: 50352547 });
  });

  it("returns undefined when only decoys exist", () => {
    expect(pickLargestInitrd("-r--r--r-- 1 0 0 0 Aug 5 01:33 'initrd.img'\n")).toBeUndefined();
  });
});

describe("vyos fedora-parity features", () => {
  it("computes reportAddress from a static mgmt address, empty for dhcp", () => {
    const staticSpec = buildVyosConfigSpec({
      hostname: "fw1", defaultPassword: "pw",
      spec: { mgmtAddress: "192.168.8.2/23" },
    });
    expect(staticSpec.reportAddress).toBe("192.168.8.2");

    const dhcpSpec = buildVyosConfigSpec({ hostname: "fw1", defaultPassword: "pw" });
    expect(dhcpSpec.reportAddress).toBe("");
  });

  it("defaults freshConfig off (reinstall preserves the on-disk config)", () => {
    expect(buildVyosConfigSpec({ hostname: "fw1", defaultPassword: "pw" }).freshConfig).toBe(false);
    expect(buildVyosConfigSpec({
      hostname: "fw1", defaultPassword: "pw", spec: { freshConfig: true },
    }).freshConfig).toBe(true);
  });

  it("driver streams logs to /api/log and reports 'ready at' on completion", async () => {
    const testDir = join(tmpdir(), `bastion-vyos-parity-${Date.now()}`);
    mkdirSync(join(testDir, "http"), { recursive: true });
    mkdirSync(join(testDir, "tftp"), { recursive: true });
    const { app: parityApp, state: parityState } = createApp(createTestConfig(testDir));
    try {
      parityState.update((s) => {
        s.install_queue["aa:bb:cc:44:55:66"] = {
          hostname: "fw9", disk: "/dev/vda", role: "vanilla",
          os: "vyos-rolling", queued_at: new Date().toISOString(),
        };
      });
      const response = await parityApp.inject({
        method: "GET", url: "/vyos/install.py?mac=aa:bb:cc:44:55:66",
      });
      expect(response.body).toContain("/api/log");
      expect(response.body).toContain('"lines": batch');
      expect(response.body).toContain('report("complete", "ready at %s"');
      expect(response.body).toContain("ensure_network_boot_first");
      expect(response.body).toContain("lab-provisioned");
      expect(response.body).toContain('ROLE = "vanilla"');
    } finally {
      await parityApp.close();
      rmSync(testDir, { recursive: true, force: true });
    }
  });

  it("complete with 'ready at' records installed.ip for a vyos machine", async () => {
    const testDir = join(tmpdir(), `bastion-vyos-complete-${Date.now()}`);
    mkdirSync(join(testDir, "http"), { recursive: true });
    mkdirSync(join(testDir, "tftp"), { recursive: true });
    const { app: cApp, state: cState } = createApp(createTestConfig(testDir));
    try {
      const mac2 = "aa:bb:cc:77:88:99";
      cState.update((s) => {
        s.install_queue[mac2] = {
          hostname: "fw1", disk: "/dev/vda", role: "vanilla",
          os: "vyos-rolling", queued_at: new Date().toISOString(),
        };
      });
      const response = await cApp.inject({
        method: "POST", url: "/api/progress",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({ mac: mac2, stage: "complete", detail: "ready at 192.168.8.2" }),
      });
      expect(response.statusCode).toBe(200);
      const installed = cState.load().installed[mac2];
      expect(installed?.ip).toBe("192.168.8.2");
      expect(installed?.os).toBe("vyos-rolling");
    } finally {
      await cApp.close();
      rmSync(testDir, { recursive: true, force: true });
    }
  });
});

describe("vyos installer prompt coverage", () => {
  // Every interactive prompt image_installer.py can emit, copied verbatim from
  // the MSG_* constants (including the reinstall-only search_previous_installation
  // ones). An unanswered prompt does not fail loudly -- the installer simply
  // blocks on stdin until the driver's stall timeout, which is how the reinstall
  // path silently hung for 15 minutes in the VM test.
  const PROMPTS: Record<string, string> = {
    continue: "Would you like to continue? [y/N] ",
    imageName: "What would you like to name this image? (Default: 1.5-rolling) ",
    password: 'Please enter a password for the "vyos" user: ',
    passwordConfirm: 'Please confirm password for the "vyos" user: ',
    console: "What console should be used by default? (K: KVM, S: Serial)? (Default: K) ",
    raidConfigure: "Would you like to configure RAID-1 mirroring? [Y/n] ",
    raidFoundDisks: "Would you like to configure RAID-1 mirroring on them? [Y/n] ",
    raidChooseDisks: "Would you like to choose two disks for RAID-1 mirroring? [Y/n] ",
    diskSelect: "Which one should be used for installation? (Default: /dev/vda) ",
    diskConfirm: "Installation will delete all data on the drive. Continue? [y/N] ",
    raidConfirm: "Installation will delete all data on both drives. Continue? [y/N] ",
    rootSizeAll: "Would you like to use all the free space on the drive? [Y/n] ",
    bootConfig: "Which file would you like as boot config? ",
    copyData: "Would you like to copy data to the new image? [Y/n] ",
    chooseCopyData: "From which image would you like to save config information? ",
    copyEncData: "Would you like to copy the encrypted config to the new image? [Y/n] ",
    chooseCopyEncData: "From which image would you like to copy the encrypted config? ",
  };

  it("answers every installer prompt exactly once", () => {
    const { execFileSync } = require("node:child_process") as typeof import("node:child_process");
    const { writeFileSync, unlinkSync, mkdtempSync } = require("node:fs") as typeof import("node:fs");

    // Skip cleanly where python3 is unavailable (same spirit as the
    // ksvalidator-backed kickstart test).
    try {
      execFileSync("python3", ["--version"], { stdio: "pipe" });
    } catch {
      return;
    }

    const spec = buildVyosConfigSpec({
      hostname: "fw1", defaultPassword: "pw", disk: "/dev/vda",
    });
    const driver = renderVyosInstallPy({
      spec, mac: "aa:bb:cc:11:22:33", serverIp: "10.0.0.1", httpPort: 8080, role: "vanilla",
    });

    const dir = mkdtempSync(join(tmpdir(), "vyos-rules-"));
    const driverPath = join(dir, "driver.py");
    const checkPath = join(dir, "check.py");
    writeFileSync(driverPath, driver);
    writeFileSync(checkPath, `
import importlib.util, json, sys
spec = importlib.util.spec_from_file_location("drv", ${JSON.stringify(driverPath)})
drv = importlib.util.module_from_spec(spec); spec.loader.exec_module(drv)
rules = drv.build_rules()
prompts = json.loads(sys.argv[1])
out = {}
for label, text in prompts.items():
    out[label] = len([r for p, r in rules if p.search(text.encode())])
print(json.dumps(out))
`);

    try {
      const stdout = execFileSync("python3", [checkPath, JSON.stringify(PROMPTS)], {
        encoding: "utf-8", stdio: ["pipe", "pipe", "pipe"],
      });
      const counts = JSON.parse(stdout) as Record<string, number>;
      const unanswered = Object.entries(counts).filter(([, n]) => n !== 1);
      expect(unanswered).toEqual([]);
    } finally {
      try { unlinkSync(driverPath); unlinkSync(checkPath); } catch { /* best effort */ }
      try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ }
    }
  });
});

describe("vyos boot NIC pinning", () => {
  it("pins the boot interface by MAC via BOOTIF", async () => {
    // Without this, live-boot picks the first *connected* NIC. On the VP2440
    // the SFP+ pair links before the copper PXE port, so live-boot tried the
    // fiber ports (no DHCP), timed out 15s each, and failed with "Unable to
    // find a live file system on the network".
    const testDir = join(tmpdir(), `bastion-vyos-bootif-${Date.now()}`);
    mkdirSync(join(testDir, "http"), { recursive: true });
    mkdirSync(join(testDir, "tftp"), { recursive: true });
    const { app: a, state: st } = createApp(createTestConfig(testDir));
    try {
      const m = "64:62:66:25:96:47";
      st.update((s) => {
        s.install_queue[m] = {
          hostname: "vyos001", disk: "/dev/mmcblk0", role: "vanilla",
          os: "vyos-rolling", queued_at: new Date().toISOString(),
        };
      });
      const res = await a.inject({ method: "GET", url: `/dispatch?mac=${m}` });
      // live-boot's Device_from_bootif() expects 01-<mac with dashes>
      expect(res.body).toContain("BOOTIF=01-64-62-66-25-96-47");
      // and it must be on the kernel line, before fetch= is attempted
      const kernelLine = res.body.split("\n").find((l) => l.startsWith("kernel "));
      expect(kernelLine).toContain("BOOTIF=01-64-62-66-25-96-47");
      expect(kernelLine).toContain("fetch=");
    } finally {
      await a.close();
      rmSync(testDir, { recursive: true, force: true });
    }
  });
});