chahinebrini 6962e09403 feat(devices): Windows 11 DoH protection — reg-file endpoint + tests
- Add server/utils/regfile.ts: generateWindowsDohRegFile() producing
  UTF-16 LE + BOM .reg content for DohWellKnownServers registry path.
  label and dohTemplate values are properly escape'd (\, ", \n, \r, \t).
- Add GET /api/devices/:id/profile.reg — public, windows-platform-gated,
  returns octet-stream with Content-Disposition attachment.
- Update enroll.post.ts: downloadUrl is now platform-aware
  (windows → .reg, all others → .mobileconfig).
- Add tests/devices/regfile.test.ts: 13 tests covering BOM, CRLF,
  token embed, subkey naming, AutoUpgradeFlag, label escaping (", \, \n),
  and labelToSlug edge cases. All 111 tests pass.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-11 04:48:51 +02:00

147 lines
4.7 KiB
TypeScript

/**
* Tests for generateWindowsDohRegFile + labelToSlug.
*
* Pure utility — no Prisma, no Nitro globals needed.
*/
import { describe, expect, it } from "vitest";
import { generateWindowsDohRegFile } from "../../server/utils/regfile";
import { labelToSlug } from "../../server/utils/mobileconfig";
const SAMPLE_TOKEN = "abcdef0123456789abcdef0123456789"; // 32 hex chars
const SAMPLE_DEVICE_ID = "device-uuid-1234";
describe("generateWindowsDohRegFile", () => {
it("output starts with UTF-16 LE BOM (0xFF 0xFE)", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Test PC",
});
expect(buf[0]).toBe(0xff);
expect(buf[1]).toBe(0xfe);
});
it("decoded content begins with registry header", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Test PC",
});
// Skip 2-byte BOM, decode remainder as UTF-16 LE
const text = buf.slice(2).toString("utf16le");
expect(text.startsWith("Windows Registry Editor Version 5.00")).toBe(true);
});
it("contains the full dnsToken in the DohTemplate value", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Test PC",
});
const text = buf.slice(2).toString("utf16le");
expect(text).toContain(SAMPLE_TOKEN);
});
it("uses token prefix (first 8 chars) in the subkey name and comment", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Test PC",
});
const text = buf.slice(2).toString("utf16le");
const prefix = SAMPLE_TOKEN.slice(0, 8); // "abcdef01"
expect(text).toContain(`rebreak-${prefix}`);
expect(text).toContain(`Token: ${prefix}`);
});
it("contains AutoUpgradeFlag as dword:00000001", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Test PC",
});
const text = buf.slice(2).toString("utf16le");
expect(text).toContain('"AutoUpgradeFlag"=dword:00000001');
});
it("uses CRLF line endings throughout", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Test PC",
});
const text = buf.slice(2).toString("utf16le");
// Every newline must be preceded by \r
const lines = text.split("\r\n");
// Rejoining with \r\n and comparing proves all endings were CRLF
expect(lines.join("\r\n")).toBe(text);
// And there must be multiple lines
expect(lines.length).toBeGreaterThan(5);
});
describe("label escaping", () => {
it('escapes double-quote in label', () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: 'My "Gaming" PC',
});
const text = buf.slice(2).toString("utf16le");
// In comment line the label appears escaped
expect(text).toContain('My \\"Gaming\\" PC');
});
it("escapes backslash in label", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "C:\\Users\\PC",
});
const text = buf.slice(2).toString("utf16le");
expect(text).toContain("C:\\\\Users\\\\PC");
});
it("escapes newline in label", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Line1\nLine2",
});
const text = buf.slice(2).toString("utf16le");
expect(text).toContain("Line1\\nLine2");
});
});
it("contains the correct HKLM registry path for DohWellKnownServers", () => {
const buf = generateWindowsDohRegFile({
deviceId: SAMPLE_DEVICE_ID,
dnsToken: SAMPLE_TOKEN,
label: "Test PC",
});
const text = buf.slice(2).toString("utf16le");
expect(text).toContain(
"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Dnscache\\Parameters\\DohWellKnownServers",
);
});
});
describe("labelToSlug", () => {
it("lowercases and replaces non-alphanumeric with hyphens", () => {
expect(labelToSlug("Mein PC")).toBe("mein-pc");
expect(labelToSlug("Büro-PC 2024")).toBe("b-ro-pc-2024");
});
it("strips leading and trailing hyphens", () => {
expect(labelToSlug(" --test-- ")).toBe("test");
});
it("truncates to 40 characters", () => {
const long = "a".repeat(50);
expect(labelToSlug(long)).toHaveLength(40);
});
it("returns empty string for label with no alphanumeric chars", () => {
expect(labelToSlug("---")).toBe("");
});
});