Add native traffic inspection to Harbor Connect and Gateway

test/server/startup-recovery.test.js

@@ -11,6 +11,35 @@ import { normalizeSubscriptionConfig } from '../../dist/server/subscription.js';
 
 const root = path.resolve(import.meta.dirname, '../..');
 
+test('startup recovery rejects a materialized native API secret as shared config truth', async (t) => {
+  const server = {
+    id: 'server-a',
+    label: 'Server A',
+    host: 'a.example',
+    port: 443,
+    protocol: 'vless',
+  };
+  const fixture = await startClientFixture(t, {
+    state: profileState(server),
+    config: {
+      ...generatedConfig(server),
+      services: [{
+        type: 'api',
+        listen: '127.0.0.1',
+        listen_port: 19091,
+        dashboard: false,
+        secret: 'a'.repeat(64),
+      }],
+    },
+    trafficSource: 'native',
+  });
+
+  assert.equal(fixture.state.connection.desired, 'stopped');
+  assert.equal(fixture.state.connection.process, 'stopped');
+  assert.equal(fs.existsSync(fixture.markerPath), false);
+  assert.equal(fs.existsSync(path.join(fixture.directory, 'sing-box-config.json')), false);
+});
+
 function listen(server, ...args) {
   return new Promise((resolve, reject) => {
     server.once('error', reject);
@@ -121,6 +150,7 @@ async function startClientFixture(t, {
   config,
   hostNetwork,
   gatewayPresencePort,
+  trafficSource,
 }) {
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'harbor-startup-recovery-'));
   const { binDirectory, markerPath } = fakeSingbox(directory);
@@ -148,6 +178,7 @@ async function startClientFixture(t, {
         : hostNetworkPath,
       ...(gatewayPresencePort ? { HARBOR_GATEWAY_CONTROL_PORT: String(gatewayPresencePort) } : {}),
       HARBOR_TEST_RUN_MARKER: markerPath,
+      ...(trafficSource ? { SING_BOX_TRAFFIC_SOURCE: trafficSource } : {}),
     },
     stdio: ['ignore', 'ignore', 'pipe'],
   });
@@ -363,6 +394,34 @@ test('boot rejects an existing config owned by a different applied target', asyn
   assert.equal(fs.existsSync(path.join(fixture.directory, 'sing-box-config.json')), false);
 });
 
+test('disabled traffic source rejects an existing config with any API service', async (t) => {
+  const server = {
+    id: 'server-a',
+    label: 'Server A',
+    host: 'a.example',
+    port: 443,
+    protocol: 'vless',
+  };
+  const fixture = await startClientFixture(t, {
+    state: profileState(server),
+    config: {
+      ...generatedConfig(server),
+      services: [{
+        type: 'api',
+        listen: '0.0.0.0',
+        listen_port: 19091,
+        dashboard: false,
+      }],
+    },
+    trafficSource: 'disabled',
+  });
+
+  assert.equal(fixture.state.connection.desired, 'stopped');
+  assert.equal(fixture.state.connection.process, 'stopped');
+  assert.equal(fs.existsSync(fixture.markerPath), false);
+  assert.equal(fs.existsSync(path.join(fixture.directory, 'sing-box-config.json')), false);
+});
+
 test('stopped Gateway boot explicitly stops an already running remote dataplane', async (t) => {
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'harbor-stopped-remote-'));
   const socketPath = path.join(directory, 'dataplane.sock');