Files
ShadowsocksX-NG/ShadowsocksX-NG2/Tests/ProxyControlWorkflowIntegrationTests.swift
T
Qiu Yuzhou d2a8d6105c feat(system-proxy): route writes through privileged LaunchDaemon helper
Implements issue #71 with ADR-0020 (supersedes ADR-0019's endpoint-signature
cleanup, startup cleanup, and health-gate cleanup).

- New ShadowsocksX-NG2SystemProxyHelper target: app-bundled root LaunchDaemon
  (SMAppService.daemon, on-demand via MachServices) that mechanically applies
  a closed typed configuration or executes an unconditional clear. Clients are
  accepted by code-signing bundle identifier only; requests run serially on a
  shared queue (last-writer-wins).
- SystemProxyConfiguration is now the closed typed apply payload (Codable over
  JSON XPC): explicit SOCKS/HTTP/HTTPS enable + endpoints, PAC and
  auto-discovery disabled with URL/JS removed, explicit simple-hostname
  exclusion, complete ExceptionsList. Unmodeled Proxies keys are preserved and
  equivalent values skip the commit.
- Cleanup is a side effect of a persisted system-proxy intent on-to-off
  transition only: the switch itself, or the agent-off cascade (persist both
  intents off, clear, then stop listeners; failed cascade persistence records
  no transition and clears nothing). Launch with the switch off, health-gate
  closure, invalid targets, and passive events never clear. Failed clears are
  surfaced without deferred retry.
- Endpoint-signature store, ownership migration, and direct Authorization
  Services writes are removed; old signature files stay inert. Helper
  unavailability or pending approval keeps an enabled intent pending and
  surfaces the Login Items approval path (HomeView button + menu label).
2026-09-30 12:26:40 +08:00

299 lines
13 KiB
Swift
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import XCTest
@testable import ShadowsocksX_NG2
/// 代理控制命令矩阵(issue #47/#60):经生产 runtime adapter 包装的真实控制器
/// 验证 agent 开关、系统代理开关与模式切换的失败分类与恢复语义原样进入
/// snapshot。全部使用 fixture 替身,不启动真实 launch agent、不写真实
/// SystemConfiguration(这些替身测试不构成真实系统写入验证)。
@MainActor
final class ProxyControlWorkflowIntegrationTests: XCTestCase {
private var runtime: ProxyRuntimeFixture.TemporaryRuntime!
private var catalogFileURL: URL!
private var activationFileURL: URL!
private var credentials: InMemoryCredentialStore!
var agent: ProxyRuntimeFixture.FakeLaunchAgent!
var systemProxy: ProxyRuntimeFixture.FakeSystemProxy!
var systemProxyHelper: ProxyRuntimeFixture.FakeSystemProxyHelperService!
override func setUp() async throws {
try await super.setUp()
runtime = ProxyRuntimeFixture.makeTemporaryRuntime()
catalogFileURL = runtime.directory.appendingPathComponent("catalog.json")
activationFileURL = runtime.directory.appendingPathComponent("activation.json")
credentials = InMemoryCredentialStore()
agent = ProxyRuntimeFixture.FakeLaunchAgent()
systemProxy = ProxyRuntimeFixture.FakeSystemProxy()
systemProxyHelper = ProxyRuntimeFixture.FakeSystemProxyHelperService()
}
override func tearDown() async throws {
try? FileManager.default.removeItem(at: runtime.directory)
try await super.tearDown()
}
/// 控制器、目录工作流与代理控制工作流的生产组合(同一控制器经两条缝)。
struct Composition {
let catalog: CatalogWorkflow
let control: ProxyControlWorkflow
let controller: ProxyRuntimeController
}
/// 建一个含单台服务器的目录并落盘(服务器密码进内存凭据存储)。
func makeSeededCatalog() throws -> NodeID {
var catalog = ConfigurationCatalog()
let server = try ActivationFixture.addPlainServer(
"香港 01", in: &catalog, credentials: credentials)
try CatalogFileStore(fileURL: catalogFileURL).save(CatalogDocument(catalog: catalog))
return server
}
func makeProxies(
probe: EndpointProbing,
agentStatus: LaunchAgentStatus = .notRegistered,
settingsStore: ProxySettingsStoring? = nil,
settings: ProxySettings? = nil
) -> Composition {
agent.setStatus(agentStatus)
let runtimeFileStore = RuntimeFileStore(fileURL: runtime.contract)
agent.onRegister = { [runtimeFileStore] in
guard let document = runtimeFileStore.loadDocument() else { return }
try? runtimeFileStore.writeRuntimeReceipt(for: document, processID: 42)
}
let controller = ProxyRuntimeController(
catalogSnapshotReader: ProxyRuntimeFixture.catalogSnapshotReader(at: catalogFileURL),
activationFileStore: ActivationStateFileStore(fileURL: activationFileURL),
runtimeFileStore: runtimeFileStore,
credentials: credentials,
plugins: ActivationFixture.plugins,
listenRestore: RestoredListenSettings(
settings: ActivationFixture.listen, unreadableError: nil),
settingsStore: settingsStore ?? InMemoryProxySettingsStore(),
settingsRestore: RestoredProxySettings(
settings: settings ?? ProxySettings(listen: ActivationFixture.listen),
unreadableError: nil),
agent: agent,
probe: probe,
systemProxy: systemProxy,
systemProxyHelper: systemProxyHelper,
proxyMode: .rule,
firewallChecker: ProxyRuntimeFixture.FakeFirewallChecker(),
firewallExecutableURLs: [URL(fileURLWithPath: "/bundle/Helpers/sslocal")],
firewallPollIntervalNanoseconds: 1_000_000,
// 生产默认 15 秒健康窗;FakeProbe 结果确定,短窗口走同一超时呈现路径。
launchHealthTimeoutSeconds: 0.05,
sendSignal: { _, _ in 0 },
processIsAlive: { $0 == 42 })
let fileStore = CatalogFileStore(fileURL: catalogFileURL)
let bootstrap = CatalogCommitCoordinator.bootstrap(fileStore: fileStore)
let catalogWorkflow = makeCatalogWorkflow(
coordinator: CatalogCommitCoordinator(
fileStore: fileStore,
runtime: ProxyRuntimeSyncAdapter(controller: controller),
bootstrap: bootstrap),
credentials: credentials,
plugins: ActivationFixture.plugins,
activator: controller)
let control = ProxyControlWorkflow(
runtime: ControllerProxyRuntimeAdapter(controller: controller),
targetFacts: catalogWorkflow)
return Composition(
catalog: catalogWorkflow, control: control, controller: controller)
}
// MARK: - Agent 开关与首次默认
func testAgentEnableWithoutActiveTargetListensThroughSnapshot() async throws {
_ = try makeSeededCatalog()
let composition = makeProxies(
probe: ProxyRuntimeFixture.FakeProbe.reachable(),
settings: ProxySettings(listen: ActivationFixture.listen, agentEnabled: false))
let snapshot = await composition.control.setAgentEnabled(true)
XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
XCTAssertTrue(snapshot.agentIntentEnabled, "开关意图进入 snapshot")
XCTAssertTrue(snapshotAgentListening(composition), "空服务器监听契约已部署")
XCTAssertTrue(systemProxy.applied.isEmpty, "系统代理意图默认关闭")
XCTAssertEqual(snapshot.systemProxyApplication, .idle)
XCTAssertEqual(agent.registerCount, 1)
}
/// 空监听判定辅助:契约存在且无服务器。
private func snapshotAgentListening(_ composition: Composition) -> Bool {
guard
let data = try? Data(contentsOf: runtime.contract),
let document = SslocalRuntimeDocument.decodeValidated(data)
else { return false }
return document.servers.isEmpty
}
func testAgentEnableConvergesToWholeRunningSnapshotWithRealCatalogFacts() async throws {
let server = try makeSeededCatalog()
let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
// 目录激活走目录工作流(生产 activator 是同一控制器);agent 开关走控制 seam。
_ = try await composition.catalog.activate(server)
let snapshot = await composition.control.setAgentEnabled(true)
XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .running, isOn: true))
XCTAssertNil(snapshot.runtime.failure)
XCTAssertTrue(snapshot.agentIntentEnabled)
XCTAssertEqual(snapshot.proxyMode, .rule)
XCTAssertEqual(snapshot.availableModes, [.rule, .global, .direct])
XCTAssertEqual(snapshot.activeTarget?.pathSummary, "香港 01", "活动目标摘要来自真实目录树")
XCTAssertEqual(snapshot.skippedInvalidServerCount, 0)
XCTAssertTrue(
snapshot.httpExport.copyableLine.contains("127.0.0.1:11087"),
"HTTP 导出能力在 snapshot 中就绪")
}
func testUnhealthyEndpointSurfacesTypedLaunchFailureInSnapshot() async throws {
let server = try makeSeededCatalog()
let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.refusing())
_ = try await composition.catalog.activate(server)
let snapshot = await composition.control.setAgentEnabled(true)
XCTAssertEqual(snapshot.runtime.status, .launchFailed)
XCTAssertFalse(snapshot.runtime.isOn)
guard
case .launch(.localEndpoint(let endpoint, let host, _, .refused)) = snapshot.runtime.failure
else {
return XCTFail("应点名本机端点失败,实际 \(String(describing: snapshot.runtime.failure))")
}
XCTAssertEqual(endpoint, "SOCKS")
XCTAssertEqual(host, "127.0.0.1")
}
func testPendingBackgroundApprovalSurfacesTypedFactInSnapshot() async throws {
let server = try makeSeededCatalog()
agent.statusAfterRegister = .requiresApproval
let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
_ = try await composition.catalog.activate(server)
let snapshot = await composition.control.setAgentEnabled(true)
XCTAssertEqual(
snapshot.runtime,
ProxyRuntimeFacts(
status: .requiresApproval,
isOn: true,
failure: .requiresApproval))
}
// MARK: - Agent 关闭矩阵
func testDisableReflectsClosedIntentAndKeepsModesAvailable() async throws {
let server = try makeSeededCatalog()
let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
_ = try await composition.catalog.activate(server)
_ = await composition.control.setAgentEnabled(true)
let snapshot = await composition.control.setAgentEnabled(false)
XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .off, isOn: false))
XCTAssertFalse(snapshot.agentIntentEnabled)
XCTAssertNil(snapshot.runtime.failure)
XCTAssertEqual(snapshot.availableModes, [.rule, .global, .direct], "停用后可用操作不消失")
}
/// 关闭 agent 且系统代理清理失败:agent 停止,清理失败以系统代理 typed fact 呈现。
func testAgentOffWithSystemProxyClearFailureSurfacesTypedFact() async throws {
let server = try makeSeededCatalog()
let composition = makeProxies(
probe: ProxyRuntimeFixture.FakeProbe.reachable(),
settings: ProxySettings(
listen: ActivationFixture.listen, agentEnabled: true, systemProxyEnabled: true))
_ = try await composition.catalog.activate(server)
_ = await composition.control.setAgentEnabled(true)
XCTAssertEqual(composition.control.snapshot.systemProxyApplication, .applied)
systemProxy.clearError = SystemProxyError.commitFailed("busy")
let snapshot = await composition.control.setAgentEnabled(false)
XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .off, isOn: false))
XCTAssertEqual(
snapshot.systemProxyApplication, .failed(.operation(.commitFailed)),
"清理失败以 typed fact 呈现,不静默视为已清理")
}
// MARK: - 模式命令矩阵
func testModeSwitchWhileOffPersistsAndSnapshotConvergesWithoutRuntimeTouch() async throws {
_ = try makeSeededCatalog()
let settingsStore = InMemoryProxySettingsStore()
let composition = makeProxies(
probe: ProxyRuntimeFixture.FakeProbe.reachable(),
settingsStore: settingsStore,
settings: ProxySettings(listen: ActivationFixture.listen, agentEnabled: false))
let snapshot = await composition.control.setProxyMode(.global)
XCTAssertEqual(snapshot.proxyMode, .global)
XCTAssertEqual(snapshot.runtime, ProxyRuntimeFacts(status: .off, isOn: false))
XCTAssertEqual(settingsStore.saved?.preferredMode, .global, "模式先持久化")
XCTAssertTrue(systemProxy.applied.isEmpty, "agent 未运行时不触碰系统代理")
XCTAssertEqual(systemProxy.clearCount, 0)
}
func testModePersistenceFailureKeepsOldModeAndSurfacesServiceFact() async throws {
_ = try makeSeededCatalog()
let settingsStore = InMemoryProxySettingsStore()
settingsStore.saveError = ProxySettingsStoreError.ioFailure(detail: "disk unavailable")
let composition = makeProxies(
probe: ProxyRuntimeFixture.FakeProbe.reachable(),
settingsStore: settingsStore,
settings: ProxySettings(listen: ActivationFixture.listen, agentEnabled: false))
let snapshot = await composition.control.setProxyMode(.global)
XCTAssertEqual(snapshot.proxyMode, .rule, "持久化失败保留旧模式")
XCTAssertEqual(
snapshot.runtime.failure, .service(.persistence), "失败以既有 typed fact 呈现")
XCTAssertNil(settingsStore.saved, "失败不落半程设置")
}
func testSameModeCommandIsNoopWithoutSettingsOrSystemProxyWrites() async throws {
_ = try makeSeededCatalog()
let settingsStore = InMemoryProxySettingsStore()
let composition = makeProxies(
probe: ProxyRuntimeFixture.FakeProbe.reachable(),
settingsStore: settingsStore,
settings: ProxySettings(listen: ActivationFixture.listen, agentEnabled: false))
let before = composition.control.snapshot
let after = await composition.control.setProxyMode(.rule)
XCTAssertEqual(after, before, "同模式命令无副作用,snapshot 不动")
XCTAssertNil(settingsStore.saved)
XCTAssertTrue(systemProxy.applied.isEmpty)
XCTAssertEqual(systemProxy.clearCount, 0)
}
// MARK: - 集成级 model test(deletion 验证,story 38/39)
/// 状态菜单的呈现面只凭 ProxyControlWorkflow 的 snapshot 与 CatalogWorkflow
/// 的目录事实即可完整推导;本文件不要求启动 SwiftUI,也不依赖控制器字段。
func testStatusMenuSummaryIsFullyDerivableFromWorkflowSnapshot() async throws {
let server = try makeSeededCatalog()
let composition = makeProxies(probe: ProxyRuntimeFixture.FakeProbe.reachable())
_ = try await composition.catalog.activate(server)
_ = await composition.control.setAgentEnabled(true)
_ = await composition.control.setSystemProxyEnabled(true)
let summary = StatusMenuModel.summary(from: composition.control.snapshot)
XCTAssertTrue(summary.agentIntentEnabled)
XCTAssertTrue(summary.isOn)
XCTAssertEqual(summary.status, "代理运行中")
XCTAssertEqual(summary.modeLabel, "规则 · 未匹配时代理")
XCTAssertEqual(summary.targetPath, "香港 01")
XCTAssertNil(summary.detail)
XCTAssertTrue(summary.systemProxyIntentEnabled)
XCTAssertEqual(summary.systemProxyStatus, "系统代理:已应用")
XCTAssertNil(summary.systemProxyDetail)
}
}