import { assert, describe, it } from "@effect/vitest";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Sink from "effect/Sink";import * as Stream from "effect/Stream";import { ChildProcessSpawner } from "effect/unstable/process"; import { type DevShareError, DevServeFailedError, shareDevServer, unshareDevServer,} from "./dev-share.ts"; const TAILNET_STATUS = JSON.stringify({ Self: { DNSName: "host.example.ts.net." } });const NO_HANDLER_STDERR = "error: failed to remove web serve: handler does not exist"; interface CallResult { readonly exitCode: number; readonly stderr?: string;} const encode = (value: string) => Stream.make(new TextEncoder().encode(value)); /** * Answers `tailscale status --json` with a valid tailnet name, and lets each * test set the outcome of the `off` (pre-clear) and `serve` calls separately — * they are the same subcommand and are told apart by the trailing `off`. */const spawnerLayer = (input: { readonly off?: CallResult; readonly serve?: CallResult; readonly calls?: Array<ReadonlyArray<string>>;}) => Layer.succeed( ChildProcessSpawner.ChildProcessSpawner, ChildProcessSpawner.make((command) => { const args = "args" in command ? (command.args as ReadonlyArray<string>) : []; input.calls?.push(args); const result: CallResult = args.includes("status") ? { exitCode: 0 } : args.includes("off") ? (input.off ?? { exitCode: 0 }) : (input.serve ?? { exitCode: 0 }); return Effect.succeed( ChildProcessSpawner.makeHandle({ pid: ChildProcessSpawner.ProcessId(1), exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(result.exitCode)), isRunning: Effect.succeed(false), kill: () => Effect.void, unref: Effect.succeed(Effect.void), stdin: Sink.drain, stdout: args.includes("status") ? encode(TAILNET_STATUS) : Stream.empty, stderr: result.stderr ? encode(result.stderr) : Stream.empty, all: Stream.empty, getInputFd: () => Sink.drain, getOutputFd: () => Stream.empty, }), ); }), ); describe("unshareDevServer", () => { it.effect("treats a removed mapping as cleared", () => Effect.gen(function* () { const result = yield* unshareDevServer(5788).pipe( Effect.provide(spawnerLayer({ off: { exitCode: 0 } })), ); assert.isTrue(result.cleared); }), ); // `tailscale serve … off` exits 1 when the port had no mapping, which is the // normal first-share case — the port is clear, so this must not be an error. it.effect("treats a missing handler as cleared", () => Effect.gen(function* () { const result = yield* unshareDevServer(5788).pipe( Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: NO_HANDLER_STDERR } })), ); assert.isTrue(result.cleared); }), ); it.effect("reports a genuine removal failure as not cleared", () => Effect.gen(function* () { const result = yield* unshareDevServer(5788).pipe( Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: "permission denied" } })), ); assert.isFalse(result.cleared); assert.include(result.explanation, "permission denied"); // Structured, so a wrapping error can keep the real chain. assert.equal(result.cause?._tag, "TailscaleCommandExitError"); }), );}); describe("shareDevServer", () => { it.effect("returns the tailnet URL for the same port", () => Effect.gen(function* () { const shared = yield* shareDevServer({ webPort: 5788 }).pipe( Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: NO_HANDLER_STDERR } })), ); assert.equal(shared.host, "host.example.ts.net"); assert.equal(shared.url, "https://host.example.ts.net:5788/"); }), ); // Vite binds `localhost`, which modern Node resolves to `::1` first, so a // 127.0.0.1 target would proxy to a loopback nothing listens on. it.effect("proxies to the localhost name Vite binds, not 127.0.0.1", () => Effect.gen(function* () { const calls: Array<ReadonlyArray<string>> = []; yield* shareDevServer({ webPort: 5788 }).pipe( Effect.provide(spawnerLayer({ off: { exitCode: 0 }, calls })), ); const serveCall = calls.find((args) => args.includes("--bg")); assert.deepEqual(serveCall, ["serve", "--bg", "--https=5788", "http://localhost:5788"]); }), ); // The stale-mapping clear runs before serve, so a failure here leaves the // port serving nothing. Saying only "serve failed" would let an operator // assume their previous mapping survived. it.effect("reports that the prior mapping was cleared when serve fails", () => Effect.gen(function* () { const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe( Effect.provide( spawnerLayer({ off: { exitCode: 0 }, serve: { exitCode: 1, stderr: "port already in use" }, }), ), Effect.flip, ); assert.instanceOf(error, DevServeFailedError); assert.equal(error.stage, "serve"); assert.equal(error.webPort, 5788); // The underlying failure is preserved rather than flattened to a string. assert.equal( (error.cause as { _tag?: string } | undefined)?._tag, "TailscaleCommandExitError", ); // Unclassifiable stderr is never quoted (it can carry auth keys), so the // message points at the command instead of echoing the CLI. assert.notInclude(error.message, "port already in use"); assert.include(error.message, "run the command by hand"); assert.include(error.message, "no longer served"); assert.include(error.message, "5788"); }), ); // A recognized failure gets our own wording for it — enough to act on // without passing CLI text through. it.effect("explains a recognized serve failure without quoting stderr", () => Effect.gen(function* () { const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe( Effect.provide( spawnerLayer({ off: { exitCode: 0 }, serve: { exitCode: 1, stderr: "permission denied for tskey-auth-secret-token-value", }, }), ), Effect.flip, ); assert.instanceOf(error, DevServeFailedError); assert.equal(error.stage, "serve"); assert.include(error.message, "permission denied"); assert.include(error.message, "elevated privileges"); assert.notInclude(error.message, "tskey-auth-secret-token-value"); }), ); // Serving over routes we could not remove yields a URL that loads but whose // /ws and /api quietly point at a dead backend. it.effect("refuses to serve when the existing mapping could not be cleared", () => Effect.gen(function* () { const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe( Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: "permission denied" } })), Effect.flip, ); assert.instanceOf(error, DevServeFailedError); // A distinct stage: the prior mapping survived, so nothing was replaced. assert.equal(error.stage, "clear-existing"); assert.include(error.message, "could not clear the existing mapping"); assert.include(error.message, "permission denied"); }), );});
import { assert, describe, it } from "@effect/vitest";
import * as Effect from "effect/Effect";
import * as Layer from "effect/Layer";
import * as Sink from "effect/Sink";
import * as Stream from "effect/Stream";
import { ChildProcessSpawner } from "effect/unstable/process";
import {
type DevShareError,
DevServeFailedError,
shareDevServer,
unshareDevServer,
} from "./dev-share.ts";
const TAILNET_STATUS = JSON.stringify({ Self: { DNSName: "host.example.ts.net." } });
const NO_HANDLER_STDERR = "error: failed to remove web serve: handler does not exist";
interface CallResult {
readonly exitCode: number;
readonly stderr?: string;
}
const encode = (value: string) => Stream.make(new TextEncoder().encode(value));
/**
* Answers `tailscale status --json` with a valid tailnet name, and lets each
* test set the outcome of the `off` (pre-clear) and `serve` calls separately —
* they are the same subcommand and are told apart by the trailing `off`.
*/
const spawnerLayer = (input: {
readonly off?: CallResult;
readonly serve?: CallResult;
readonly calls?: Array<ReadonlyArray<string>>;
}) =>
Layer.succeed(
ChildProcessSpawner.ChildProcessSpawner,
ChildProcessSpawner.make((command) => {
const args = "args" in command ? (command.args as ReadonlyArray<string>) : [];
input.calls?.push(args);
const result: CallResult = args.includes("status")
? { exitCode: 0 }
: args.includes("off")
? (input.off ?? { exitCode: 0 })
: (input.serve ?? { exitCode: 0 });
return Effect.succeed(
ChildProcessSpawner.makeHandle({
pid: ChildProcessSpawner.ProcessId(1),
exitCode: Effect.succeed(ChildProcessSpawner.ExitCode(result.exitCode)),
isRunning: Effect.succeed(false),
kill: () => Effect.void,
unref: Effect.succeed(Effect.void),
stdin: Sink.drain,
stdout: args.includes("status") ? encode(TAILNET_STATUS) : Stream.empty,
stderr: result.stderr ? encode(result.stderr) : Stream.empty,
all: Stream.empty,
getInputFd: () => Sink.drain,
getOutputFd: () => Stream.empty,
}),
);
}),
);
describe("unshareDevServer", () => {
it.effect("treats a removed mapping as cleared", () =>
Effect.gen(function* () {
const result = yield* unshareDevServer(5788).pipe(
Effect.provide(spawnerLayer({ off: { exitCode: 0 } })),
);
assert.isTrue(result.cleared);
}),
);
// `tailscale serve … off` exits 1 when the port had no mapping, which is the
// normal first-share case — the port is clear, so this must not be an error.
it.effect("treats a missing handler as cleared", () =>
Effect.gen(function* () {
const result = yield* unshareDevServer(5788).pipe(
Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: NO_HANDLER_STDERR } })),
);
assert.isTrue(result.cleared);
}),
);
it.effect("reports a genuine removal failure as not cleared", () =>
Effect.gen(function* () {
const result = yield* unshareDevServer(5788).pipe(
Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: "permission denied" } })),
);
assert.isFalse(result.cleared);
assert.include(result.explanation, "permission denied");
// Structured, so a wrapping error can keep the real chain.
assert.equal(result.cause?._tag, "TailscaleCommandExitError");
}),
);
});
describe("shareDevServer", () => {
it.effect("returns the tailnet URL for the same port", () =>
Effect.gen(function* () {
const shared = yield* shareDevServer({ webPort: 5788 }).pipe(
Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: NO_HANDLER_STDERR } })),
);
assert.equal(shared.host, "host.example.ts.net");
assert.equal(shared.url, "https://host.example.ts.net:5788/");
}),
);
// Vite binds `localhost`, which modern Node resolves to `::1` first, so a
// 127.0.0.1 target would proxy to a loopback nothing listens on.
it.effect("proxies to the localhost name Vite binds, not 127.0.0.1", () =>
Effect.gen(function* () {
const calls: Array<ReadonlyArray<string>> = [];
yield* shareDevServer({ webPort: 5788 }).pipe(
Effect.provide(spawnerLayer({ off: { exitCode: 0 }, calls })),
);
const serveCall = calls.find((args) => args.includes("--bg"));
assert.deepEqual(serveCall, ["serve", "--bg", "--https=5788", "http://localhost:5788"]);
}),
);
// The stale-mapping clear runs before serve, so a failure here leaves the
// port serving nothing. Saying only "serve failed" would let an operator
// assume their previous mapping survived.
it.effect("reports that the prior mapping was cleared when serve fails", () =>
Effect.gen(function* () {
const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe(
Effect.provide(
spawnerLayer({
off: { exitCode: 0 },
serve: { exitCode: 1, stderr: "port already in use" },
}),
),
Effect.flip,
);
assert.instanceOf(error, DevServeFailedError);
assert.equal(error.stage, "serve");
assert.equal(error.webPort, 5788);
// The underlying failure is preserved rather than flattened to a string.
assert.equal(
(error.cause as { _tag?: string } | undefined)?._tag,
"TailscaleCommandExitError",
);
// Unclassifiable stderr is never quoted (it can carry auth keys), so the
// message points at the command instead of echoing the CLI.
assert.notInclude(error.message, "port already in use");
assert.include(error.message, "run the command by hand");
assert.include(error.message, "no longer served");
assert.include(error.message, "5788");
}),
);
// A recognized failure gets our own wording for it — enough to act on
// without passing CLI text through.
it.effect("explains a recognized serve failure without quoting stderr", () =>
Effect.gen(function* () {
const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe(
Effect.provide(
spawnerLayer({
off: { exitCode: 0 },
serve: {
exitCode: 1,
stderr: "permission denied for tskey-auth-secret-token-value",
},
}),
),
Effect.flip,
);
assert.instanceOf(error, DevServeFailedError);
assert.equal(error.stage, "serve");
assert.include(error.message, "permission denied");
assert.include(error.message, "elevated privileges");
assert.notInclude(error.message, "tskey-auth-secret-token-value");
}),
);
// Serving over routes we could not remove yields a URL that loads but whose
// /ws and /api quietly point at a dead backend.
it.effect("refuses to serve when the existing mapping could not be cleared", () =>
Effect.gen(function* () {
const error: DevShareError = yield* shareDevServer({ webPort: 5788 }).pipe(
Effect.provide(spawnerLayer({ off: { exitCode: 1, stderr: "permission denied" } })),
Effect.flip,
);
assert.instanceOf(error, DevServeFailedError);
// A distinct stage: the prior mapping survived, so nothing was replaced.
assert.equal(error.stage, "clear-existing");
assert.include(error.message, "could not clear the existing mapping");
assert.include(error.message, "permission denied");
}),
);
});