Refactor VPN proxy client implementation

test/server/device-inventory.test.js

@@ -3,15 +3,16 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import test from 'node:test';
-import { parseNeighborSnapshot, readNeighborSnapshot } from '../../src/server/adapters/neighbors.js';
+import { parseNeighborSnapshot, readNeighborSnapshot } from '../../dist/server/adapters/neighbors.js';
 import {
   createDeviceInventoryService,
   createVendorLookup,
   DEVICE_INVENTORY_SCHEMA_VERSION,
+  deviceId,
   migrateDeviceInventoryState,
-} from '../../src/server/services/deviceInventoryService.js';
-import { fingerprintDirectDevices } from '../../src/server/services/devicePolicyService.js';
-import { createJsonStore } from '../../src/server/services/stateStore.js';
+} from '../../dist/server/services/deviceInventoryService.js';
+import { fingerprintDirectDevices } from '../../dist/server/services/devicePolicyService.js';
+import { createJsonStore } from '../../dist/server/services/stateStore.js';
 
 test('container neighbors are hidden while a real 172 LAN device remains valid', () => {
   const observedAt = '2026-08-07T12:00:00.000Z';
@@ -47,6 +48,73 @@ test('container neighbors are hidden while a real 172 LAN device remains valid',
   assert.deepEqual(migrated.devices.map(({ ip }) => ip), ['172.20.0.7']);
 });
 
+test('malformed persisted devices and remote observations cannot enter canonical inventory', async (t) => {
+  const observedAt = '2026-08-08T12:00:00.000Z';
+  const mac = '00:11:22:33:44:55';
+  const persisted = {
+    id: 'legacy-device-id',
+    alias: 42,
+    pinned: 'yes',
+    hostname: 42,
+    manufacturer: [],
+    mac,
+    ip: '192.168.50.7',
+    interface: 'eth0',
+    firstSeenAt: observedAt,
+    lastSeenAt: observedAt,
+    source: null,
+    confidence: 'untrusted',
+  };
+  const migrated = migrateDeviceInventoryState({
+    schemaVersion: DEVICE_INVENTORY_SCHEMA_VERSION,
+    devices: [
+      persisted,
+      { ...persisted, mac: 'invalid' },
+      { ...persisted, mac: '00:11:22:33:44:66', ip: 'not-an-ip' },
+      { ...persisted, mac: '00:11:22:33:44:77', lastSeenAt: 'not-a-date' },
+    ],
+  });
+  assert.deepEqual(migrated.devices, [{
+    ...persisted,
+    id: deviceId(mac),
+    alias: '',
+    pinned: false,
+    hostname: null,
+    manufacturer: null,
+    source: 'neighbor',
+    confidence: 'high',
+  }]);
+
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'harbor-device-guard-'));
+  t.after(() => fs.rmSync(directory, { recursive: true, force: true }));
+  const store = createJsonStore({
+    filePath: path.join(directory, 'devices.json'),
+    defaultValue: {},
+    migrate: migrateDeviceInventoryState,
+  });
+  store.remove();
+  const service = createDeviceInventoryService({
+    store,
+    observe: () => ({
+      observedAt,
+      error: null,
+      observations: [
+        { ip: '192.168.50.8', mac: '00:11:22:33:44:88', interface: 'eth0', observedAt, active: true },
+        { ip: 'bad', mac: '00:11:22:33:44:99', interface: 'eth0', observedAt, active: true },
+        { ip: '192.168.50.9', mac: 'invalid', interface: 'eth0', observedAt, active: true },
+        { ip: '192.168.50.10', mac: '00:11:22:33:44:aa', interface: 'docker0', observedAt, active: true },
+        { ip: '192.168.50.11', mac: '00:11:22:33:44:bb', interface: 'eth0', observedAt, active: 'yes' },
+        { ip: '192.168.50.12', mac: '00:11:22:33:44:cc', interface: 'eth0', observedAt: 'bad', active: true },
+      ],
+    }),
+    now: () => new Date(observedAt),
+  });
+  const snapshot = await service.refresh();
+  assert.deepEqual(snapshot.devices.map(({ mac: deviceMac, ip }) => [deviceMac, ip]), [
+    ['00:11:22:33:44:88', '192.168.50.8'],
+  ]);
+});
+
 test('device inventory discovers, merges, persists metadata and expires anonymous devices', async (t) => {
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'harbor-devices-'));
   t.after(() => fs.rmSync(directory, { recursive: true, force: true }));