3x-ui-agent/internal/sub/service_sharelink_test.go

package sub

import (
	"net/url"
	"strings"
	"testing"

	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
)

// shareLinkInbound builds a VLESS inbound with one client and the given stream
// settings, mirroring flowTestInbound but without forcing a flow.
func shareLinkInbound(streamSettings string) *model.Inbound {
	return &model.Inbound{
		Listen:         "203.0.113.1",
		Port:           443,
		Protocol:       model.VLESS,
		Remark:         "sharelink",
		Settings:       `{"clients":[{"id":"11111111-2222-4333-8444-555555555555","email":"user"}],"decryption":"none","encryption":"none"}`,
		StreamSettings: streamSettings,
	}
}

// TestGenVlessLink_TLSParamsMapped locks every field that applyShareTLSParams
// (service.go:1029) writes into a TLS share link. Without these assertions a mutant
// that drops `sni`, swaps a key, or skips `pcs`/`alpn`/`fp` survives the whole suite —
// the existing flow tests only check `flow=`.
func TestGenVlessLink_TLSParamsMapped(t *testing.T) {
	stream := `{
		"network":"tcp","security":"tls",
		"tcpSettings":{"header":{"type":"none"}},
		"tlsSettings":{
			"serverName":"sni.example.com",
			"alpn":["h2","http/1.1"],
			"settings":{"fingerprint":"chrome","pinnedPeerCertSha256":["YWJj"]}
		}
	}`
	s := &SubService{}
	link := s.genVlessLink(shareLinkInbound(stream), "user")

	// url.Values.Encode() percent-encodes values: "," -> %2C, "/" -> %2F.
	wants := []string{
		"security=tls",
		"sni=sni.example.com",
		"fp=chrome",
		"alpn=h2%2Chttp%2F1.1",
		"pcs=YWJj",
	}
	for _, w := range wants {
		if !strings.Contains(link, w) {
			t.Fatalf("TLS link missing %q\n got: %s", w, link)
		}
	}
}

// Locks the reality field mapping of applyShareRealityParams; distinct pbk/sid
// catch a swap mutant. spx must never be emitted (V2.0.1 ⑦).
func TestGenVlessLink_RealityParamsMapped(t *testing.T) {
	stream := `{
		"network":"tcp","security":"reality",
		"tcpSettings":{"header":{"type":"none"}},
		"realitySettings":{
			"serverNames":["reality.example.com"],
			"shortIds":["ab12cd"],
			"settings":{"publicKey":"PBKvalue","fingerprint":"firefox","spiderX":"/mypath"}
		}
	}`
	s := &SubService{}
	link := s.genVlessLink(shareLinkInbound(stream), "user")

	wants := []string{
		"security=reality",
		"sni=reality.example.com",
		"pbk=PBKvalue",
		"sid=ab12cd",
		"fp=firefox",
	}
	for _, w := range wants {
		if !strings.Contains(link, w) {
			t.Fatalf("reality link missing %q\n got: %s", w, link)
		}
	}
	if strings.Contains(link, "spx") {
		t.Fatalf("reality link must not carry spx (V2.0.1 ⑦): %s", link)
	}
	// A pbk<->sid swap must not silently pass: pbk must not carry the shortId.
	if strings.Contains(link, "pbk=ab12cd") || strings.Contains(link, "sid=PBKvalue") {
		t.Fatalf("reality pbk/sid mapping crossed: %s", link)
	}
}

// realityTwoClientInbound builds a reality VLESS inbound carrying two clients
// with distinct subIds.
func realityTwoClientInbound() *model.Inbound {
	return &model.Inbound{
		Listen:   "203.0.113.1",
		Port:     443,
		Protocol: model.VLESS,
		Remark:   "sharelink",
		Settings: `{"clients":[
			{"id":"11111111-2222-4333-8444-555555555555","email":"alice","subId":"subAlice"},
			{"id":"22222222-3333-4444-8555-666666666666","email":"bob","subId":"subBob"}
		],"decryption":"none","encryption":"none"}`,
		StreamSettings: `{
			"network":"tcp","security":"reality",
			"tcpSettings":{"header":{"type":"none"}},
			"realitySettings":{
				"serverNames":["reality.example.com"],
				"shortIds":["ab12cd"],
				"settings":{"publicKey":"PBKvalue","fingerprint":"firefox","spiderX":"/seed"}
			}
		}`,
	}
}

// V2.0.1 ⑦: generated reality links never carry spx, for any client,
// even when the inbound still stores a spiderX seed.
func TestGenVlessLink_RealityOmitsSpx(t *testing.T) {
	s := &SubService{}
	inbound := realityTwoClientInbound()
	for _, email := range []string{"alice", "bob"} {
		link := s.genVlessLink(inbound, email)
		u, err := url.Parse(link)
		if err != nil {
			t.Fatalf("parse link %q: %v", link, err)
		}
		if _, ok := u.Query()["spx"]; ok {
			t.Fatalf("link for %s carries spx: %s", email, link)
		}
	}
}