package cli_test

import (

"bufio"

"bytes"

"context"

"crypto/ecdsa"

"crypto/elliptic"

"crypto/rand"

"crypto/tls"

"crypto/x509"

"crypto/x509/pkix"

"encoding/json"

"encoding/pem"

"fmt"

"io"

"math/big"

"net"

"net/http"

"net/http/httptest"

"net/url"

"os"

"path/filepath"

"reflect"

"runtime"

"strconv"

"strings"

"sync/atomic"

"testing"

"time"

"github.com/go-chi/chi/v5"

"github.com/spf13/pflag"

"github.com/stretchr/testify/assert"

"github.com/stretchr/testify/require"

"go.uber.org/goleak"

"gopkg.in/yaml.v3"

"tailscale.com/derp/derphttp"

"tailscale.com/types/key"

"cdr.dev/slog/sloggers/slogtest"

"github.com/coder/coder/v2/buildinfo"

"github.com/coder/coder/v2/cli"

"github.com/coder/coder/v2/cli/clitest"

"github.com/coder/coder/v2/cli/config"

"github.com/coder/coder/v2/coderd/coderdtest"

"github.com/coder/coder/v2/coderd/database/dbtestutil"

"github.com/coder/coder/v2/coderd/database/migrations"

"github.com/coder/coder/v2/coderd/httpapi"

"github.com/coder/coder/v2/coderd/telemetry"

"github.com/coder/coder/v2/codersdk"

"github.com/coder/coder/v2/cryptorand"

"github.com/coder/coder/v2/pty/ptytest"

"github.com/coder/coder/v2/tailnet/tailnettest"

"github.com/coder/coder/v2/testutil"

)

func TestReadExternalAuthProvidersFromEnv(t *testing.T) {

t.Parallel()

t.Run("Valid", func(t *testing.T) {

t.Parallel()

providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{

"CODER_EXTERNAL_AUTH_0_ID=1",

"CODER_EXTERNAL_AUTH_0_TYPE=gitlab",

"CODER_EXTERNAL_AUTH_1_ID=2",

"CODER_EXTERNAL_AUTH_1_CLIENT_ID=sid",

"CODER_EXTERNAL_AUTH_1_CLIENT_SECRET=hunter12",

"CODER_EXTERNAL_AUTH_1_TOKEN_URL=google.com",

"CODER_EXTERNAL_AUTH_1_VALIDATE_URL=bing.com",

"CODER_EXTERNAL_AUTH_1_SCOPES=repo:read repo:write",

"CODER_EXTERNAL_AUTH_1_NO_REFRESH=true",

"CODER_EXTERNAL_AUTH_1_DISPLAY_NAME=Google",

"CODER_EXTERNAL_AUTH_1_DISPLAY_ICON=/icon/google.svg",

})

require.NoError(t, err)

require.Len(t, providers, 2)

// Validate the first provider.

assert.Equal(t, "1", providers[0].ID)

assert.Equal(t, "gitlab", providers[0].Type)

// Validate the second provider.

assert.Equal(t, "2", providers[1].ID)

assert.Equal(t, "sid", providers[1].ClientID)

assert.Equal(t, "hunter12", providers[1].ClientSecret)

assert.Equal(t, "google.com", providers[1].TokenURL)

assert.Equal(t, "bing.com", providers[1].ValidateURL)

assert.Equal(t, []string{"repo:read", "repo:write"}, providers[1].Scopes)

assert.Equal(t, true, providers[1].NoRefresh)

assert.Equal(t, "Google", providers[1].DisplayName)

assert.Equal(t, "/icon/google.svg", providers[1].DisplayIcon)

})

}

// TestReadGitAuthProvidersFromEnv ensures that the deprecated `CODER_GITAUTH_`

// environment variables are still supported.

func TestReadGitAuthProvidersFromEnv(t *testing.T) {

t.Parallel()

t.Run("Empty", func(t *testing.T) {

t.Parallel()

providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{

"HOME=/home/frodo",

})

require.NoError(t, err)

require.Empty(t, providers)

})

t.Run("InvalidKey", func(t *testing.T) {

t.Parallel()

providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{

"CODER_GITAUTH_XXX=invalid",

})

require.Error(t, err, "providers: %+v", providers)

require.Empty(t, providers)

})

t.Run("SkipKey", func(t *testing.T) {

t.Parallel()

providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{

"CODER_GITAUTH_0_ID=invalid",

"CODER_GITAUTH_2_ID=invalid",

})

require.Error(t, err, "%+v", providers)

require.Empty(t, providers)

})

t.Run("Valid", func(t *testing.T) {

t.Parallel()

providers, err := cli.ReadExternalAuthProvidersFromEnv([]string{

"CODER_GITAUTH_0_ID=1",

"CODER_GITAUTH_0_TYPE=gitlab",

"CODER_GITAUTH_1_ID=2",

"CODER_GITAUTH_1_CLIENT_ID=sid",

"CODER_GITAUTH_1_CLIENT_SECRET=hunter12",

"CODER_GITAUTH_1_TOKEN_URL=google.com",

"CODER_GITAUTH_1_VALIDATE_URL=bing.com",

"CODER_GITAUTH_1_SCOPES=repo:read repo:write",

"CODER_GITAUTH_1_NO_REFRESH=true",

})

require.NoError(t, err)

require.Len(t, providers, 2)

// Validate the first provider.

assert.Equal(t, "1", providers[0].ID)

assert.Equal(t, "gitlab", providers[0].Type)

// Validate the second provider.

assert.Equal(t, "2", providers[1].ID)

assert.Equal(t, "sid", providers[1].ClientID)

assert.Equal(t, "hunter12", providers[1].ClientSecret)

assert.Equal(t, "google.com", providers[1].TokenURL)

assert.Equal(t, "bing.com", providers[1].ValidateURL)

assert.Equal(t, []string{"repo:read", "repo:write"}, providers[1].Scopes)

assert.Equal(t, true, providers[1].NoRefresh)

})

}

func TestServer(t *testing.T) {

t.Parallel()

t.Run("BuiltinPostgres", func(t *testing.T) {

t.Parallel()

if testing.Short() {

t.SkipNow()

}

inv, cfg := clitest.New(t,

"server",

"--http-address", ":0",

"--access-url", "http://example.com",

"--cache-dir", t.TempDir(),

)

const superDuperLong = testutil.WaitSuperLong * 3

ctx := testutil.Context(t, superDuperLong)

clitest.Start(t, inv.WithContext(ctx))

//nolint:gocritic // Embedded postgres take a while to fire up.

require.Eventually(t, func() bool {

rawURL, err := cfg.URL().Read()

return err == nil && rawURL != ""

}, superDuperLong, testutil.IntervalFast, "failed to get access URL")

})

t.Run("EphemeralDeployment", func(t *testing.T) {

t.Parallel()

if testing.Short() {

t.SkipNow()

}

inv, _ := clitest.New(t,

"server",

"--http-address", ":0",

"--access-url", "http://example.com",

"--ephemeral",

)

pty := ptytest.New(t).Attach(inv)

// Embedded postgres takes a while to fire up.

const superDuperLong = testutil.WaitSuperLong * 3

ctx, cancelFunc := context.WithCancel(testutil.Context(t, superDuperLong))

errCh := make(chan error, 1)

go func() {

errCh <- inv.WithContext(ctx).Run()

}()

pty.ExpectMatch("Using an ephemeral deployment directory")

rootDirLine := pty.ReadLine(ctx)

rootDir := strings.TrimPrefix(rootDirLine, "Using an ephemeral deployment directory")

rootDir = strings.TrimSpace(rootDir)

rootDir = strings.TrimPrefix(rootDir, "(")

rootDir = strings.TrimSuffix(rootDir, ")")

require.NotEmpty(t, rootDir)

require.DirExists(t, rootDir)

pty.ExpectMatchContext(ctx, "View the Web UI")

cancelFunc()

<-errCh

require.NoDirExists(t, rootDir)

})

t.Run("BuiltinPostgresURL", func(t *testing.T) {

t.Parallel()

root, _ := clitest.New(t, "server", "postgres-builtin-url")

pty := ptytest.New(t)

root.Stdout = pty.Output()

err := root.Run()

require.NoError(t, err)

pty.ExpectMatch("psql")

})

t.Run("BuiltinPostgresURLRaw", func(t *testing.T) {

t.Parallel()

ctx := testutil.Context(t, testutil.WaitLong)

root, _ := clitest.New(t, "server", "postgres-builtin-url", "--raw-url")

pty := ptytest.New(t)

root.Stdout = pty.Output()

err := root.WithContext(ctx).Run()

require.NoError(t, err)

got := pty.ReadLine(ctx)

if !strings.HasPrefix(got, "postgres://") {

t.Fatalf("expected postgres URL to start with \"postgres://\", got %q", got)

}

})

// Validate that a warning is printed that it may not be externally

// reachable.

t.Run("LocalAccessURL", func(t *testing.T) {

t.Parallel()

inv, cfg := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "http://localhost:3000/",

"--cache-dir", t.TempDir(),

)

pty := ptytest.New(t).Attach(inv)

clitest.Start(t, inv)

// Just wait for startup

_ = waitAccessURL(t, cfg)

pty.ExpectMatch("this may cause unexpected problems when creating workspaces")

pty.ExpectMatch("View the Web UI:")

pty.ExpectMatch("http://localhost:3000/")

})

// Validate that an https scheme is prepended to a remote access URL

// and that a warning is printed for a host that cannot be resolved.

t.Run("RemoteAccessURL", func(t *testing.T) {

t.Parallel()

inv, cfg := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "https://foobarbaz.mydomain",

"--cache-dir", t.TempDir(),

)

pty := ptytest.New(t).Attach(inv)

clitest.Start(t, inv)

// Just wait for startup

_ = waitAccessURL(t, cfg)

pty.ExpectMatch("this may cause unexpected problems when creating workspaces")

pty.ExpectMatch("View the Web UI:")

pty.ExpectMatch("https://foobarbaz.mydomain")

})

t.Run("NoWarningWithRemoteAccessURL", func(t *testing.T) {

t.Parallel()

inv, cfg := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "https://google.com",

"--cache-dir", t.TempDir(),

)

pty := ptytest.New(t).Attach(inv)

clitest.Start(t, inv)

// Just wait for startup

_ = waitAccessURL(t, cfg)

pty.ExpectMatch("View the Web UI:")

pty.ExpectMatch("https://google.com")

})

t.Run("NoSchemeAccessURL", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

root, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "google.com",

"--cache-dir", t.TempDir(),

)

err := root.WithContext(ctx).Run()

require.Error(t, err)

})

t.Run("TLSBadVersion", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

root, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", "",

"--access-url", "http://example.com",

"--tls-enable",

"--tls-address", ":0",

"--tls-min-version", "tls9",

"--cache-dir", t.TempDir(),

)

err := root.WithContext(ctx).Run()

require.Error(t, err)

})

t.Run("TLSBadClientAuth", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

root, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", "",

"--access-url", "http://example.com",

"--tls-enable",

"--tls-address", ":0",

"--tls-client-auth", "something",

"--cache-dir", t.TempDir(),

)

err := root.WithContext(ctx).Run()

require.Error(t, err)

})

t.Run("TLSInvalid", func(t *testing.T) {

t.Parallel()

cert1Path, key1Path := generateTLSCertificate(t)

cert2Path, key2Path := generateTLSCertificate(t)

cases := []struct {

name string

args []string

errContains string

}{

{

name: "NoCert",

args: []string{"--tls-enable", "--tls-key-file", key1Path},

errContains: "--tls-cert-file and --tls-key-file must be used the same amount of times",

},

{

name: "NoKey",

args: []string{"--tls-enable", "--tls-cert-file", cert1Path},

errContains: "--tls-cert-file and --tls-key-file must be used the same amount of times",

},

{

name: "MismatchedCount",

args: []string{"--tls-enable", "--tls-cert-file", cert1Path, "--tls-key-file", key1Path, "--tls-cert-file", cert2Path},

errContains: "--tls-cert-file and --tls-key-file must be used the same amount of times",

},

{

name: "MismatchedCertAndKey",

args: []string{"--tls-enable", "--tls-cert-file", cert1Path, "--tls-key-file", key2Path},

errContains: "load TLS key pair",

},

}

for _, c := range cases {

c := c

t.Run(c.name, func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

args := []string{

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "http://example.com",

"--cache-dir", t.TempDir(),

}

args = append(args, c.args...)

root, _ := clitest.New(t, args...)

err := root.WithContext(ctx).Run()

require.Error(t, err)

t.Logf("args: %v", args)

require.ErrorContains(t, err, c.errContains)

})

}

})

t.Run("TLSValid", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

certPath, keyPath := generateTLSCertificate(t)

root, cfg := clitest.New(t,

"server",

"--in-memory",

"--http-address", "",

"--access-url", "https://example.com",

"--tls-enable",

"--tls-address", ":0",

"--tls-cert-file", certPath,

"--tls-key-file", keyPath,

"--cache-dir", t.TempDir(),

)

clitest.Start(t, root.WithContext(ctx))

// Verify HTTPS

accessURL := waitAccessURL(t, cfg)

require.Equal(t, "https", accessURL.Scheme)

client := codersdk.New(accessURL)

client.HTTPClient = &http.Client{

Transport: &http.Transport{

TLSClientConfig: &tls.Config{

//nolint:gosec

InsecureSkipVerify: true,

},

},

}

defer client.HTTPClient.CloseIdleConnections()

_, err := client.HasFirstUser(ctx)

require.NoError(t, err)

})

t.Run("TLSValidMultiple", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

cert1Path, key1Path := generateTLSCertificate(t, "alpaca.com")

cert2Path, key2Path := generateTLSCertificate(t, "*.llama.com")

root, cfg := clitest.New(t,

"server",

"--in-memory",

"--http-address", "",

"--access-url", "https://example.com",

"--tls-enable",

"--tls-address", ":0",

"--tls-cert-file", cert1Path,

"--tls-key-file", key1Path,

"--tls-cert-file", cert2Path,

"--tls-key-file", key2Path,

"--cache-dir", t.TempDir(),

)

pty := ptytest.New(t)

root.Stdout = pty.Output()

clitest.Start(t, root.WithContext(ctx))

accessURL := waitAccessURL(t, cfg)

require.Equal(t, "https", accessURL.Scheme)

originalHost := accessURL.Host

var (

expectAddr string

dials int64

)

client := codersdk.New(accessURL)

client.HTTPClient = &http.Client{

Transport: &http.Transport{

DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {

atomic.AddInt64(&dials, 1)

assert.Equal(t, expectAddr, addr)

host, _, err := net.SplitHostPort(addr)

require.NoError(t, err)

// Always connect to the accessURL ip:port regardless of

// hostname.

conn, err := tls.Dial(network, originalHost, &tls.Config{

MinVersion: tls.VersionTLS12,

//nolint:gosec

InsecureSkipVerify: true,

ServerName: host,

})

if err != nil {

return nil, err

}

// We can't call conn.VerifyHostname because it requires

// that the certificates are valid, so we call

// VerifyHostname on the first certificate instead.

require.Len(t, conn.ConnectionState().PeerCertificates, 1)

err = conn.ConnectionState().PeerCertificates[0].VerifyHostname(host)

assert.NoError(t, err, "invalid cert common name")

return conn, nil

},

},

}

defer client.HTTPClient.CloseIdleConnections()

// Use the first certificate and hostname.

client.URL.Host = "alpaca.com:443"

expectAddr = "alpaca.com:443"

_, err := client.HasFirstUser(ctx)

require.NoError(t, err)

require.EqualValues(t, 1, atomic.LoadInt64(&dials))

// Use the second certificate (wildcard) and hostname.

client.URL.Host = "hi.llama.com:443"

expectAddr = "hi.llama.com:443"

_, err = client.HasFirstUser(ctx)

require.NoError(t, err)

require.EqualValues(t, 2, atomic.LoadInt64(&dials))

})

t.Run("TLSAndHTTP", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

certPath, keyPath := generateTLSCertificate(t)

inv, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "https://example.com",

"--tls-enable",

"--tls-redirect-http-to-https=false",

"--tls-address", ":0",

"--tls-cert-file", certPath,

"--tls-key-file", keyPath,

"--cache-dir", t.TempDir(),

)

pty := ptytest.New(t).Attach(inv)

clitest.Start(t, inv)

// We can't use waitAccessURL as it will only return the HTTP URL.

const httpLinePrefix = "Started HTTP listener at"

pty.ExpectMatch(httpLinePrefix)

httpLine := pty.ReadLine(ctx)

httpAddr := strings.TrimSpace(strings.TrimPrefix(httpLine, httpLinePrefix))

require.NotEmpty(t, httpAddr)

const tlsLinePrefix = "Started TLS/HTTPS listener at "

pty.ExpectMatch(tlsLinePrefix)

tlsLine := pty.ReadLine(ctx)

tlsAddr := strings.TrimSpace(strings.TrimPrefix(tlsLine, tlsLinePrefix))

require.NotEmpty(t, tlsAddr)

// Verify HTTP

httpURL, err := url.Parse(httpAddr)

require.NoError(t, err)

client := codersdk.New(httpURL)

client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {

return http.ErrUseLastResponse

}

_, err = client.HasFirstUser(ctx)

require.NoError(t, err)

// Verify TLS

tlsURL, err := url.Parse(tlsAddr)

require.NoError(t, err)

client = codersdk.New(tlsURL)

client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {

return http.ErrUseLastResponse

}

client.HTTPClient = &http.Client{

Transport: &http.Transport{

TLSClientConfig: &tls.Config{

//nolint:gosec

InsecureSkipVerify: true,

},

},

}

defer client.HTTPClient.CloseIdleConnections()

_, err = client.HasFirstUser(ctx)

require.NoError(t, err)

})

t.Run("TLSRedirect", func(t *testing.T) {

t.Parallel()

cases := []struct {

name string

httpListener bool

tlsListener bool

redirect bool

accessURL string

requestURL string

// Empty string means no redirect.

expectRedirect string

}{

{

name: "OK",

httpListener: true,

tlsListener: true,

redirect: true,

accessURL: "https://example.com",

expectRedirect: "https://example.com",

},

{

name: "NoRedirect",

httpListener: true,

tlsListener: true,

accessURL: "https://example.com",

expectRedirect: "",

},

{

name: "NoRedirectWithWildcard",

tlsListener: true,

accessURL: "https://example.com",

requestURL: "https://dev.example.com",

expectRedirect: "",

redirect: true,

},

{

name: "NoTLSListener",

httpListener: true,

tlsListener: false,

accessURL: "https://example.com",

expectRedirect: "",

},

{

name: "NoHTTPListener",

httpListener: false,

tlsListener: true,

accessURL: "https://example.com",

expectRedirect: "",

},

}

for _, c := range cases {

c := c

t.Run(c.name, func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

if c.requestURL == "" {

c.requestURL = c.accessURL

}

httpListenAddr := ""

if c.httpListener {

httpListenAddr = ":0"

}

certPath, keyPath := generateTLSCertificate(t)

flags := []string{

"server",

"--in-memory",

"--cache-dir", t.TempDir(),

"--http-address", httpListenAddr,

}

if c.tlsListener {

flags = append(flags,

"--tls-enable",

"--tls-address", ":0",

"--tls-cert-file", certPath,

"--tls-key-file", keyPath,

"--wildcard-access-url", "*.example.com",

)

}

if c.accessURL != "" {

flags = append(flags, "--access-url", c.accessURL)

}

if c.redirect {

flags = append(flags, "--redirect-to-access-url")

}

inv, _ := clitest.New(t, flags...)

pty := ptytest.New(t)

pty.Attach(inv)

clitest.Start(t, inv)

var (

httpAddr string

tlsAddr string

)

// We can't use waitAccessURL as it will only return the HTTP URL.

if c.httpListener {

const httpLinePrefix = "Started HTTP listener at"

pty.ExpectMatch(httpLinePrefix)

httpLine := pty.ReadLine(ctx)

httpAddr = strings.TrimSpace(strings.TrimPrefix(httpLine, httpLinePrefix))

require.NotEmpty(t, httpAddr)

}

if c.tlsListener {

const tlsLinePrefix = "Started TLS/HTTPS listener at"

pty.ExpectMatch(tlsLinePrefix)

tlsLine := pty.ReadLine(ctx)

tlsAddr = strings.TrimSpace(strings.TrimPrefix(tlsLine, tlsLinePrefix))

require.NotEmpty(t, tlsAddr)

}

// Verify HTTP redirects (or not)

if c.httpListener {

httpURL, err := url.Parse(httpAddr)

require.NoError(t, err)

client := codersdk.New(httpURL)

client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {

return http.ErrUseLastResponse

}

resp, err := client.Request(ctx, http.MethodGet, "/api/v2/buildinfo", nil)

require.NoError(t, err)

defer resp.Body.Close()

if c.expectRedirect == "" {

require.Equal(t, http.StatusOK, resp.StatusCode)

} else {

require.Equal(t, http.StatusTemporaryRedirect, resp.StatusCode)

require.Equal(t, c.expectRedirect, resp.Header.Get("Location"))

}

// We should never readirect /healthz

respHealthz, err := client.Request(ctx, http.MethodGet, "/healthz", nil)

require.NoError(t, err)

defer respHealthz.Body.Close()

require.Equal(t, http.StatusOK, respHealthz.StatusCode, "/healthz should never redirect")

// We should never redirect DERP

respDERP, err := client.Request(ctx, http.MethodGet, "/derp", nil)

require.NoError(t, err)

defer respDERP.Body.Close()

require.Equal(t, http.StatusUpgradeRequired, respDERP.StatusCode, "/derp should never redirect")

}

// Verify TLS

if c.tlsListener {

accessURLParsed, err := url.Parse(c.requestURL)

require.NoError(t, err)

client := &http.Client{

CheckRedirect: func(req *http.Request, via []*http.Request) error {

return http.ErrUseLastResponse

},

Transport: &http.Transport{

DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {

return tls.Dial(network, strings.TrimPrefix(tlsAddr, "https://"), &tls.Config{

// nolint:gosec

InsecureSkipVerify: true,

})

},

},

}

defer client.CloseIdleConnections()

req, err := http.NewRequestWithContext(ctx, http.MethodGet, accessURLParsed.String(), nil)

require.NoError(t, err)

resp, err := client.Do(req)

// We don't care much about the response, just that TLS

// worked.

require.NoError(t, err)

defer resp.Body.Close()

}

})

}

})

t.Run("CanListenUnspecifiedv4", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

root, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", "0.0.0.0:0",

"--access-url", "http://example.com",

)

pty := ptytest.New(t)

root.Stdout = pty.Output()

root.Stderr = pty.Output()

serverStop := make(chan error, 1)

go func() {

err := root.WithContext(ctx).Run()

if err != nil {

t.Error(err)

}

close(serverStop)

}()

pty.ExpectMatch("Started HTTP listener")

pty.ExpectMatch("http://0.0.0.0:")

cancelFunc()

<-serverStop

})

t.Run("CanListenUnspecifiedv6", func(t *testing.T) {

t.Parallel()

inv, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", "[::]:0",

"--access-url", "http://example.com",

)

pty := ptytest.New(t).Attach(inv)

clitest.Start(t, inv)

pty.ExpectMatch("Started HTTP listener at")

pty.ExpectMatch("http://[::]:")

})

t.Run("NoAddress", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

inv, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":80",

"--tls-enable=false",

"--tls-address", "",

)

err := inv.WithContext(ctx).Run()

require.Error(t, err)

require.ErrorContains(t, err, "tls-address")

})

t.Run("NoTLSAddress", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

inv, _ := clitest.New(t,

"server",

"--in-memory",

"--tls-enable=true",

"--tls-address", "",

)

err := inv.WithContext(ctx).Run()

require.Error(t, err)

require.ErrorContains(t, err, "must not be empty")

})

// DeprecatedAddress is a test for the deprecated --address flag. If

// specified, --http-address and --tls-address are both ignored, a warning

// is printed, and the server will either be HTTP-only or TLS-only depending

// on if --tls-enable is set.

t.Run("DeprecatedAddress", func(t *testing.T) {

t.Parallel()

t.Run("HTTP", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

inv, cfg := clitest.New(t,

"server",

"--in-memory",

"--address", ":0",

"--access-url", "http://example.com",

"--cache-dir", t.TempDir(),

)

pty := ptytest.New(t)

inv.Stdout = pty.Output()

inv.Stderr = pty.Output()

clitest.Start(t, inv.WithContext(ctx))

pty.ExpectMatch("is deprecated")

accessURL := waitAccessURL(t, cfg)

require.Equal(t, "http", accessURL.Scheme)

client := codersdk.New(accessURL)

_, err := client.HasFirstUser(ctx)

require.NoError(t, err)

})

t.Run("TLS", func(t *testing.T) {

t.Parallel()

ctx, cancelFunc := context.WithCancel(context.Background())

defer cancelFunc()

certPath, keyPath := generateTLSCertificate(t)

root, cfg := clitest.New(t,

"server",

"--in-memory",

"--address", ":0",

"--access-url", "https://example.com",

"--tls-enable",

"--tls-cert-file", certPath,

"--tls-key-file", keyPath,

"--cache-dir", t.TempDir(),

)

pty := ptytest.New(t)

root.Stdout = pty.Output()

root.Stderr = pty.Output()

clitest.Start(t, root.WithContext(ctx))

pty.ExpectMatch("is deprecated")

accessURL := waitAccessURL(t, cfg)

require.Equal(t, "https", accessURL.Scheme)

client := codersdk.New(accessURL)

client.HTTPClient = &http.Client{

Transport: &http.Transport{

TLSClientConfig: &tls.Config{

//nolint:gosec

InsecureSkipVerify: true,

},

},

}

defer client.HTTPClient.CloseIdleConnections()

_, err := client.HasFirstUser(ctx)

require.NoError(t, err)

})

})

t.Run("TracerNoLeak", func(t *testing.T) {

t.Parallel()

inv, _ := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "http://example.com",

"--trace=true",

"--cache-dir", t.TempDir(),

)

ctx, cancel := context.WithCancel(context.Background())

defer cancel()

clitest.Start(t, inv.WithContext(ctx))

cancel()

require.Error(t, goleak.Find())

})

t.Run("Telemetry", func(t *testing.T) {

t.Parallel()

telemetryServerURL, deployment, snapshot := mockTelemetryServer(t)

inv, cfg := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "http://example.com",

"--telemetry",

"--telemetry-url", telemetryServerURL.String(),

"--cache-dir", t.TempDir(),

)

clitest.Start(t, inv)

<-deployment

<-snapshot

accessURL := waitAccessURL(t, cfg)

ctx := testutil.Context(t, testutil.WaitMedium)

client := codersdk.New(accessURL)

body, err := client.Request(ctx, http.MethodGet, "/", nil)

require.NoError(t, err)

require.NoError(t, body.Body.Close())

require.Eventually(t, func() bool {

snap := <-snapshot

htmlFirstServedFound := false

for _, item := range snap.TelemetryItems {

if item.Key == string(telemetry.TelemetryItemKeyHTMLFirstServedAt) {

htmlFirstServedFound = true

}

}

return htmlFirstServedFound

}, testutil.WaitMedium, testutil.IntervalFast, "no html_first_served telemetry item")

})

t.Run("Prometheus", func(t *testing.T) {

t.Parallel()

t.Run("DBMetricsDisabled", func(t *testing.T) {

t.Parallel()

ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)

defer cancel()

randPort := testutil.RandomPort(t)

inv, cfg := clitest.New(t,

"server",

"--in-memory",

"--http-address", ":0",

"--access-url", "http://example.com",