Update VPN client connection flow

test/server/connectivity-diagnostics.test.js

@@ -92,7 +92,7 @@ test('connectivity diagnostics skips VPN probes when sing-box is off', async ()
   assert.equal(calls.some((args) => args.includes('--proxy')), false);
 });
 
-test('connectivity diagnostics keeps a partial snapshot and falls back when one IP source fails', async () => {
+test('connectivity diagnostics keeps every IP source in a partial snapshot', async () => {
   const execute = async (args) => {
     const url = args.at(-1);
     if (url.includes('cloudflare')) {
@@ -112,5 +112,42 @@ test('connectivity diagnostics keeps a partial snapshot and falls back when one
     'cloudflare',
     'ipify',
     'aws',
+    'icanhazip',
+    'ifconfig-me',
+    'yandex-internet',
   ]);
 });
+
+test('connectivity diagnostics pins public custom services and rejects private destinations', async () => {
+  const calls = [];
+  const execute = async (args) => {
+    calls.push(args);
+    const url = args.at(-1);
+    if (url.includes('cloudflare')) return response('ip=198.51.100.10\n');
+    if (url.includes('api6')) return response('', { exitcode: 6, http_code: 0, errormsg: 'resolve failed' });
+    if (url.includes('ipify')) return response('198.51.100.10');
+    return response();
+  };
+  const lookup = async (hostname) => hostname === 'router.local'
+    ? [{ address: '192.168.50.1', family: 4 }]
+    : [{ address: '93.184.216.34', family: 4 }];
+  const result = await createConnectivityDiagnosticsService({ proxyPort: 18080, execute, lookup })
+    .run({
+      vpnAvailable: false,
+      services: [
+        { id: 'custom-public', label: 'Example', url: 'https://example.com/status' },
+        { id: 'custom-private', label: 'Router', url: 'https://router.local/' },
+      ],
+    });
+
+  const publicCall = calls.find((args) => args.at(-1) === 'https://example.com/status');
+  assert.ok(publicCall);
+  assert.equal(publicCall.includes('--location'), false);
+  assert.deepEqual(publicCall.slice(publicCall.indexOf('--resolve'), publicCall.indexOf('--resolve') + 2), [
+    '--resolve',
+    'example.com:443:93.184.216.34',
+  ]);
+  assert.equal(calls.some((args) => args.at(-1) === 'https://router.local/'), false);
+  assert.equal(result.direct.sites.find((site) => site.id === 'custom-private').stage, 'validation');
+  assert.equal(result.assessment.comparisons.some((item) => item.id === 'custom-public'), true);
+});

test/server/dataplane-client.test.js

@@ -26,7 +26,7 @@ test('control uses the dataplane socket protocol', async () => {
   assert.equal(traffic.running, true);
   await client.observeDevicePolicy();
   await client.applyDevicePolicies([{ id: 'dev_0011223344556677' }]);
-  await client.runConnectivityDiagnostics();
+  await client.runConnectivityDiagnostics([{ id: 'custom-test', url: 'https://example.com' }]);
   assert.equal(client.running, true);
   await client.restart();
   assert.equal((await client.stop()).running, false);
@@ -42,6 +42,9 @@ test('control uses the dataplane socket protocol', async () => {
     'POST /stop /run/dataplane.sock',
   ]);
   assert.deepEqual(requests[5].body, { devices: [{ id: 'dev_0011223344556677' }] });
+  assert.deepEqual(requests[6].body, {
+    services: [{ id: 'custom-test', url: 'https://example.com' }],
+  });
   assert.equal(requests[6].timeoutMs, 15_000);
 });
 

test/server/deploy-split.test.js

@@ -18,7 +18,7 @@ test('gateway deploy updates control without recreating dataplane', () => {
   assert.match(workflow, /UPDATE_DATAPLANE="\$\{UPDATE_DATAPLANE\}"/);
   assert.match(workflow, /src\/server\/\(config\|dataplane\|gatewayRouting\|singbox\|singboxRuntime\|version\)/);
   assert.match(workflow, /src\/server\/\(adapters\/neighbors\|services\/\(connectivityDiagnosticsService\|deviceTrafficService\|devicePolicyService\)\)/);
-  assert.match(workflow, /src\/shared\/errors/);
+  assert.match(workflow, /src\/shared\/\(connectivityDiagnostics\|errors\)/);
   assert.doesNotMatch(workflow, /dataplaneClient/);
 });