3x-ui/internal/sub/masque_test.go

package sub

import (
	"encoding/json"
	"reflect"
	"testing"

	"github.com/mhsanaei/3x-ui/v3/internal/database"
	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
)

// MASQUE has no share-link format, so the JSON subscription is the only way a client
// gets one: a masque outbound authenticating with the client's email and password.
func TestSubJsonServiceMasqueClientConfig(t *testing.T) {
	inbound := &model.Inbound{
		Listen: "203.0.113.9", Port: 8443, Protocol: model.MASQUE, Remark: "masque",
		Settings: `{"clients":[{"email":"ivy@example.test","password":"pw-ivy"}],"address":["10.14.0.1/24"]}`,
		StreamSettings: `{"network":"masque","security":"tls",
			"masqueSettings":{"path":"/.well-known/masque/ip/*/*/"},
			"tlsSettings":{"serverName":"masque.example.test","alpn":["h3"],
				"certificates":[{"certificateFile":"/etc/ssl/m.crt","keyFile":"/etc/ssl/m.key"}],
				"settings":{"fingerprint":"chrome"}}}`,
	}
	client := model.Client{Email: "ivy@example.test", Password: "pw-ivy"}

	configs := NewSubJsonService("", "", "", "", nil).getConfig(&SubService{address: "sub.example.com"}, inbound, client, "sub.example.com")
	if len(configs) != 1 {
		t.Fatalf("got %d configs, want one", len(configs))
	}
	var config struct {
		Outbounds []struct {
			Protocol       string         `json:"protocol"`
			Settings       map[string]any `json:"settings"`
			StreamSettings map[string]any `json:"streamSettings"`
		} `json:"outbounds"`
	}
	if err := json.Unmarshal(configs[0], &config); err != nil {
		t.Fatalf("decode config: %v", err)
	}
	proxy := config.Outbounds[0]
	if proxy.Protocol != "masque" {
		t.Fatalf("first outbound protocol = %q, want masque", proxy.Protocol)
	}
	if proxy.Settings["address"] != "203.0.113.9" || proxy.Settings["port"] != float64(8443) {
		t.Fatalf("masque settings = %v, want the inbound address and port", proxy.Settings)
	}
	wantMasque := map[string]any{"path": "/.well-known/masque/ip/*/*/", "user": "ivy@example.test", "pass": "pw-ivy"}
	if got := proxy.StreamSettings["masqueSettings"]; !reflect.DeepEqual(got, wantMasque) {
		t.Fatalf("masqueSettings = %v, want %v", got, wantMasque)
	}
	tls, _ := proxy.StreamSettings["tlsSettings"].(map[string]any)
	if proxy.StreamSettings["network"] != "masque" || proxy.StreamSettings["security"] != "tls" ||
		tls["serverName"] != "masque.example.test" || tls["certificates"] != nil {
		t.Fatalf("stream = %v, want masque over client-side TLS to masque.example.test", proxy.StreamSettings)
	}
}

// The subscription SQL allowlist decides which inbounds a subId can see at all; left
// off it, a MASQUE client's JSON subscription would come back empty.
func TestGetInboundsBySubIdIncludesMasque(t *testing.T) {
	initSubDB(t)
	db := database.GetDB()

	in := &model.Inbound{Port: 8443, Protocol: model.MASQUE, Enable: true, Tag: "masque-sub", Settings: `{"clients":[],"address":["10.14.0.1/24"]}`}
	if err := db.Create(in).Error; err != nil {
		t.Fatalf("create inbound: %v", err)
	}
	rec := &model.ClientRecord{Email: "u@masque", SubID: "submasque", Enable: true}
	if err := db.Create(rec).Error; err != nil {
		t.Fatalf("create client: %v", err)
	}
	if err := db.Create(&model.ClientInbound{ClientId: rec.Id, InboundId: in.Id}).Error; err != nil {
		t.Fatalf("create link: %v", err)
	}

	inbounds, err := (&SubService{}).getInboundsBySubId("submasque")
	if err != nil {
		t.Fatalf("getInboundsBySubId: %v", err)
	}
	if len(inbounds) != 1 || inbounds[0].Id != in.Id {
		t.Fatalf("masque inbound not returned for subId: %+v", inbounds)
	}
}