Add UI-controlled TProxy bypass for devices

test/server/device-bypass-mode.test.js

@@ -0,0 +1,108 @@
+import assert from "node:assert/strict";
+import test from "node:test";
+
+const {
+  deviceCidrs,
+  normalizeDeviceProfiles,
+} = await import("../../src/server/devices.js");
+const { matchRoute } = await import("../../src/server/routeMatcher.js");
+const {
+  sourceBypassCidrs,
+  buildSourceBypassIptablesCommands,
+} = await import("../../src/server/tproxySourceBypass.js");
+
+test("device profiles preserve bypass mode for kernel-level TProxy bypass", () => {
+  const profiles = normalizeDeviceProfiles({
+    devices: [
+      {
+        id: "pc",
+        name: "PC",
+        enabled: true,
+        ip: "192.168.50.25",
+        mode: "bypass",
+      },
+    ],
+  });
+
+  assert.equal(profiles.devices[0].mode, "bypass");
+  assert.deepEqual(deviceCidrs(profiles.devices, "bypass"), [
+    "192.168.50.25/32",
+  ]);
+});
+
+test("route checker reports transparent bypass before sing-box rules", () => {
+  const result = matchRoute(
+    {
+      host: "example.com",
+      ip: "93.184.216.34",
+      sourceIp: "192.168.50.25",
+      inbound: "tproxy-in",
+    },
+    [
+      {
+        id: "vpn-all",
+        enabled: true,
+        name: "VPN all",
+        domains: ["example.com"],
+        outbound: "vpn",
+      },
+    ],
+    {
+      vpnTag: "test-vpn",
+      deviceProfiles: {
+        defaultTransparentMode: "vpn",
+        proxyDefaultMode: "vpn",
+        devices: [
+          {
+            id: "pc",
+            name: "PC",
+            enabled: true,
+            ip: "192.168.50.25",
+            mode: "bypass",
+          },
+        ],
+      },
+    },
+  );
+
+  assert.equal(result.matched, "kernel-bypass");
+  assert.equal(result.ruleName, "PC -> bypass TProxy");
+  assert.equal(result.outbound, "direct");
+});
+
+test("source bypass sync combines env CIDRs and bypass-mode devices", () => {
+  const cidrs = sourceBypassCidrs(
+    {
+      devices: [
+        { enabled: true, ip: "192.168.50.25", mode: "bypass" },
+        { enabled: false, ip: "192.168.50.26", mode: "bypass" },
+        { enabled: true, ip: "192.168.50.27", mode: "direct" },
+      ],
+    },
+    "192.168.50.30/32",
+  );
+
+  assert.deepEqual(cidrs, ["192.168.50.30/32", "192.168.50.25/32"]);
+});
+
+test("source bypass iptables commands use ACCEPT inside the managed subchain", () => {
+  assert.deepEqual(
+    buildSourceBypassIptablesCommands(["192.168.50.25/32"], {
+      chain: "VPN_PROXY_SOURCE_BYPASS",
+    }),
+    [
+      ["-w", "-t", "mangle", "-F", "VPN_PROXY_SOURCE_BYPASS"],
+      [
+        "-w",
+        "-t",
+        "mangle",
+        "-A",
+        "VPN_PROXY_SOURCE_BYPASS",
+        "-s",
+        "192.168.50.25/32",
+        "-j",
+        "ACCEPT",
+      ],
+    ],
+  );
+});