dbx/scripts/windows-installer.test.mjs

import assert from 'node:assert/strict'
import { execFileSync } from 'node:child_process'
import { existsSync, mkdtempSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs'
import { tmpdir } from 'node:os'
import path from 'node:path'
import { test } from 'node:test'

const compiler = process.env.NSIS_MAKENSIS || (process.platform === 'win32'
  ? path.join(process.env.LOCALAPPDATA || '', 'tauri', 'NSIS', 'makensis.exe')
  : 'makensis')
let compilerAvailable = false
try {
  execFileSync(compiler, [process.platform === 'win32' ? '/VERSION' : '-VERSION'], { timeout: 5000 })
  compilerAvailable = true
} catch {}
const available = process.platform === 'win32' && compilerAvailable
const template = readFileSync(new URL('../src-tauri/windows/nsis/installer.nsi', import.meta.url), 'utf8')
const diagnosticVariables = template.match(/^Var Dbx.*$/gm).join('\n')
const diagnostics = template.slice(template.indexOf('AllowSkipFiles off'), template.indexOf('; Probe without truncating'))
const elevationInit = template.slice(template.indexOf('Function .onInit\n') + 'Function .onInit\n'.length, template.indexOf('  \u0024{GetOptions} $CMDLINE "/P" $PassiveMode'))
const languages = ['English', 'SimpChinese', 'TradChinese'].map(language => `!insertmacro MUI_LANGUAGE "${language}"`).join('\n')

test('Windows installer access checks and elevation handoff', { skip: !available }, () => {
  const dir = mkdtempSync(path.join(tmpdir(), 'dbx installer test '))
  const helper = template.match(/Function DbxEnsureInstallAccess\r?\n[\s\S]*?FunctionEnd/)[0]
  assert.ok(elevationInit.includes('/DBX_PROFILE='))
  const launch = `ExecShell "runas" "$EXEPATH" '/DBX_ELEVATED /DBX_PROFILE="$3" /DBX_LANG=$LANGUAGE $2 /D=$INSTDIR'`
  assert.ok(helper.includes(launch))
  // Execute the production function, replacing only the OS UAC launch with a
  // recorder. Tests must never trigger an interactive prompt or install DBX.
  const fixtureHelper = helper.replace(launch, `WriteINIStr "\u0024EXEDIR\\result.ini" "handoff" "args" '/DBX_ELEVATED /DBX_PROFILE="$3" /DBX_LANG=$LANGUAGE $2 /D=$INSTDIR'
    \u0024{If} \u0024DbxTestCancel = 1
      SetErrors
    \u0024{EndIf}`)
  const exe = path.join(dir, 'probe.exe')
  const result = path.join(dir, 'result.ini')
  const destination = path.join(dir, 'existing DBX')
  mkdirSync(destination)
  const binary = path.join(destination, 'dbx.exe')
  writeFileSync(binary, 'original executable contents')
  const script = `Unicode true
XPStyle on
!include MUI2.nsh
!include FileFunc.nsh
!define MAINBINARYNAME "dbx"
!define VERSION "1.0.1"
Name "DBX access probe"
OutFile "${exe}"
RequestExecutionLevel user
SilentInstall silent
${diagnosticVariables}
Var DbxTestCancel
Var DbxTestHandle
${languages}
${diagnostics}
${fixtureHelper}
Function .onInit
${elevationInit}
  \u0024{If} $DbxElevated <> 1
    StrCpy $LANGUAGE 1033
  \u0024{EndIf}
  \u0024{GetOptions} $CMDLINE "/TEST_ELEVATED" $0
  \u0024{IfNot} \u0024{Errors}
    StrCpy $DbxElevated 1
  \u0024{EndIf}
  \u0024{GetOptions} $CMDLINE "/TEST_LOCK" $0
  \u0024{IfNot} \u0024{Errors}
    System::Call 'kernel32::CreateFileW(w "$INSTDIR\\dbx.exe", i 0x80000000, i 0, p 0, i 3, i 0, p 0) p .r0'
    StrCpy $DbxTestHandle $0
  \u0024{EndIf}
  \u0024{GetOptions} $CMDLINE "/TEST_CANCEL" $0
  \u0024{IfNot} \u0024{Errors}
    StrCpy $DbxTestCancel 1
  \u0024{EndIf}
FunctionEnd
Section
  ; NSIS applies the selected language after .onInit returns.
  StrCpy $0 "register zero"
  StrCpy $1 "register one"
  StrCpy $2 "register two"
  StrCpy $3 "register three"
  Call DbxEnsureInstallAccess
  WriteINIStr "$EXEDIR\\result.ini" "probe" "registers" "$0|$1|$2|$3"
  WriteINIStr "$EXEDIR\\result.ini" "probe" "destination" "$INSTDIR"
  WriteINIStr "$EXEDIR\\result.ini" "probe" "language" "$LANGUAGE"
  WriteINIStr "$EXEDIR\\result.ini" "probe" "elevation" "$DbxElevationCode"
  WriteINIStr "$EXEDIR\\result.ini" "probe" "fileError" "$DbxFileProbeError"
  WriteINIStr "$EXEDIR\\result.ini" "probe" "folderError" "$DbxDirectoryProbeError"
  SetErrorLevel 0
  Quit
SectionEnd
`
  const source = path.join(dir, 'probe.nsi')
  writeFileSync(source, script)
  try {
    // Also compile the unmodified production launch instruction and init code.
    writeFileSync(source, script.replace(fixtureHelper, helper))
    execFileSync(compiler, ['/V2', '/INPUTCHARSET', 'UTF8', source], { encoding: 'utf8', timeout: 30_000 })
    writeFileSync(source, script)
    execFileSync(compiler, ['/V2', '/INPUTCHARSET', 'UTF8', source], { encoding: 'utf8', timeout: 30_000 })
    const run = (args, target = destination) => {
      rmSync(result, { force: true })
      let status = 0
      try {
        execFileSync(exe, [...args, ...(target === null ? [] : [`/D=${target}`])], { timeout: 15_000, windowsVerbatimArguments: true, argv0: `"${exe}"` })
      } catch (error) {
        if (typeof error.status !== 'number') throw error
        status = error.status
      }
      return { status, output: existsSync(result) ? readFileSync(result, 'utf8') : '' }
    }
    const writable = run([])
    assert.equal(writable.status, 0, writable.output)
    assert.match(writable.output, /register zero\|register one\|register two\|register three/)
    assert.doesNotMatch(writable.output, /handoff/)
    assert.match(writable.output, /elevation=0/)
    assert.match(writable.output, /fileError=0/)
    assert.match(writable.output, /folderError=0/)
    assert.equal(readFileSync(binary, 'utf8'), 'original executable contents')

    const locked = run(['/TEST_LOCK'])
    assert.equal(locked.status, 0)
    assert.doesNotMatch(locked.output, /handoff/)
    assert.match(locked.output, /fileError=32/)
    assert.match(locked.output, /folderError=0/)
    assert.equal(readFileSync(binary, 'utf8'), 'original executable contents')

    const nested = run([], path.join(destination, 'new', 'nested DBX'))
    assert.equal(nested.status, 0)
    assert.doesNotMatch(nested.output, /handoff/)
    assert.equal(existsSync(path.join(destination, 'new')), false)

    // The read-only attribute yields ERROR_ACCESS_DENIED without changing ACLs.
    execFileSync('attrib.exe', ['+R', binary])
    const update = run(['/UPDATE', '/P', '/NS', '/R', '/ARGS', '"argument with spaces"'])
    assert.equal(update.status, 0)
    assert.match(update.output, /\/DBX_ELEVATED \/DBX_PROFILE="[^"]+" \/DBX_LANG=1033 \/UPDATE \/P \/NS \/R \/ARGS "argument with spaces" \/D=/)
    assert.ok(update.output.includes(`/D=${destination}`))
    assert.doesNotMatch(update.output, /registers=/)
    assert.equal(readFileSync(binary, 'utf8'), 'original executable contents')

    const resumed = run([update.output.match(/args=(.*)/)[1]], null)
    assert.equal(resumed.status, 0)
    assert.doesNotMatch(resumed.output, /handoff/)
    assert.ok(resumed.output.includes(`destination=${destination}`))
    assert.match(resumed.output, /language=1033/)

    const cancelled = run(['/TEST_CANCEL'])
    assert.equal(cancelled.status, 740)
    assert.doesNotMatch(cancelled.output, /registers=/)

    const elevated = run(['/TEST_ELEVATED'])
    assert.equal(elevated.status, 0)
    assert.doesNotMatch(elevated.output, /handoff/)
    assert.match(elevated.output, /elevation=3/)
    assert.match(elevated.output, /register zero\|register one\|register two\|register three/)

    const wrongUser = run(['/DBX_ELEVATED', '/DBX_LANG=1033', '/DBX_PROFILE="different Windows account"'])
    assert.equal(wrongUser.status, 740)
    assert.equal(wrongUser.output, '')

    // A machine-protected directory also requests elevation, including a
    // destination that does not exist yet. No files are installed there.
    const protectedPath = path.join(process.env.ProgramFiles, 'DBX access probe', 'nested')
    const protectedFolder = run(['/UPDATE'], protectedPath)
    assert.match(protectedFolder.output, /handoff/)
    assert.equal(existsSync(protectedPath), false)
  } finally {
    if (existsSync(binary)) execFileSync('attrib.exe', ['-R', binary])
    rmSync(dir, { recursive: true, force: true })
  }
})

// Compile the actual diagnostic strings and write policy on any host with NSIS.
// On Windows also execute a locked-file extraction: it must stop before the
// completion marker, and its expanded dialog must contain usable diagnostics.
test('Installer write failure diagnostics compile', { skip: !compilerAvailable }, async (t) => {
  const dir = mkdtempSync(path.join(tmpdir(), 'dbx write failure '))
  const payload = path.join(dir, 'payload.txt')
  const source = path.join(dir, 'failure.nsi')
  const exe = path.join(dir, 'failure.exe')
  const target = path.join(dir, 'destination')
  const report = path.join(dir, 'result.ini')
  mkdirSync(target)
  writeFileSync(payload, 'new executable contents')
  // Simulate only the user's Manual installation selection and Explorer launch.
  // Keep the production extraction policy, dialog code and exit handler intact.
  const fixtureDiagnostics = diagnostics
    .replace('Function DbxShowWriteError', 'Function DbxShowWriteErrorActual')
    .replace('    Call DbxShowWriteError\n', '    Call DbxShowWriteError\n    WriteINIStr "$EXEDIR\\result.ini" "trace" "action" "$DbxWriteFailureAction"\n')
    .replace(`ExecShell "open" "$WINDIR\\explorer.exe" '/select,"$EXEPATH"'`,
      `WriteINIStr "$EXEDIR\\result.ini" "manual" "args" '/select,"$EXEPATH"'`)
  const dialogSelection = `Function DbxShowWriteError
  \u0024{If} $TestManual = 1
    StrCpy $DbxWriteFailureAction \u0024{DBX_WRITE_MANUAL}
  \u0024{ElseIf} $TestRetry = 1
    StrCpy $TestRetry 0
    System::Call 'kernel32::CloseHandle(p $TestHandle)'
    StrCpy $DbxWriteFailureAction \u0024{DBX_WRITE_RETRY}
  \u0024{Else}
    Call DbxShowWriteErrorActual
  \u0024{EndIf}
FunctionEnd`
  const script = `Unicode true
XPStyle on
!include MUI2.nsh
!include FileFunc.nsh
!define VERSION "1.0.1"
!define MAINBINARYNAME "dbx"
Name "DBX required file write test"
OutFile "${exe}"
RequestExecutionLevel user
SilentInstall silent
${diagnosticVariables}
Var TestHandle
Var TestManual
Var TestRetry
${languages}
${fixtureDiagnostics}
${dialogSelection}
${template.match(/Function DbxEnsureInstallAccess\r?\n[\s\S]*?FunctionEnd/)[0]}
Function .onInit
${elevationInit}
  \u0024{GetOptions} $CMDLINE "/LANG=" $0
  StrCpy $LANGUAGE $0
  \u0024{GetOptions} $CMDLINE "/LOCK" $0
  \u0024{IfNot} \u0024{Errors}
    System::Call 'kernel32::CreateFileW(w "$INSTDIR\\dbx.exe", i 0x80000000, i 0, p 0, i 3, i 0, p 0) p .s'
    Pop $TestHandle
  \u0024{EndIf}
  \u0024{GetOptions} $CMDLINE "/MANUAL" $0
  \u0024{IfNot} \u0024{Errors}
    StrCpy $TestManual 1
  \u0024{EndIf}
  \u0024{GetOptions} $CMDLINE "/RETRY" $0
  \u0024{IfNot} \u0024{Errors}
    StrCpy $TestRetry 1
  \u0024{EndIf}
  Call DbxEnsureInstallAccess
  \u0024{GetOptions} $CMDLINE "/READONLY" $0
  \u0024{IfNot} \u0024{Errors}
    SetFileAttributes "$INSTDIR\\dbx.exe" READONLY
  \u0024{EndIf}
FunctionEnd
Section
  SetOutPath $INSTDIR
  ; NSIS applies the selected language after .onInit returns.
  Call DbxUpdateElevationStatus
  StrCpy $0 "$INSTDIR\\dbx.exe"
  WriteINIStr "$EXEDIR\\result.ini" "diagnostics" "dialog" "$(dbxFileWriteErrorNoIgnore)"
  !insertmacro DbxExtractFile "/oname=dbx.exe" "${payload}" "$INSTDIR\\dbx.exe"
  WriteINIStr "$EXEDIR\\result.ini" "install" "complete" "1"
SectionEnd
`
  try {
    writeFileSync(source, script)
    const flag = process.platform === 'win32' ? '/' : '-'
    const compilation = execFileSync(compiler, [`${flag}V2`, `${flag}INPUTCHARSET`, 'UTF8', source], { encoding: 'utf8', timeout: 30_000 })
    assert.doesNotMatch(compilation, /unknown variable|unknown constant|unknown identifier/i)
    await t.test('Windows locked-file extraction stops and reports diagnostics', { skip: !available }, () => {
      for (const [language, diagnosticLabel, instruction] of [
        ['1033', 'Diagnostic code:', 'Please run the installer as administrator.'],
        ['2052', '诊断码：', '请以管理员权限运行安装程序。'],
        ['1028', '診斷碼：', '請以系統管理員權限執行安裝程式。'],
      ]) {
        for (const action of ['writable', 'readonly', 'retry', 'cancel', 'manual']) {
          t.diagnostic(`Windows extraction: language=${language}, action=${action}`)
          const locked = ['retry', 'cancel', 'manual'].includes(action)
          writeFileSync(path.join(target, 'dbx.exe'), 'original executable contents')
          // Win32 INI writes otherwise use the runner's ANSI code page.
          writeFileSync(report, '\ufeff', 'utf16le')
          let exitCode = 0
          try {
            execFileSync(exe, ['/S', `/LANG=${language}`, ...(locked ? ['/LOCK'] : []), ...(action === 'manual' ? ['/MANUAL'] : []), ...(action === 'retry' ? ['/RETRY'] : []), ...(action === 'readonly' ? ['/READONLY'] : []), `/D=${target}`], { timeout: 15_000, windowsVerbatimArguments: true, argv0: `"${exe}"` })
          } catch (error) {
            if (typeof error.status !== 'number') {
              const diagnostic = existsSync(report) ? readFileSync(report, 'utf16le') : 'No fixture report'
              throw new Error(`language=${language}, action=${action}: ${error.message}\n${diagnostic}`, { cause: error })
            }
            exitCode = error.status
          }
          const output = readFileSync(report, 'utf16le')
          assert.doesNotMatch(output, /Installer:|安装包：|安裝套件：/)
          assert.ok(output.includes(target), output)
          assert.ok(output.includes(diagnosticLabel), output)
          assert.match(output, new RegExp(`A[01]-E[01]-F${locked ? 32 : 0}-D0`))
          assert.ok(output.includes(instruction), output)
          assert.ok(output.includes('1.0.1'), output)
          assert.doesNotMatch(output, /Program Files|\$Dbx|\$EXEPATH|\$INSTDIR/)
          if (action === 'cancel' || action === 'manual') {
            assert.equal(exitCode, 2, 'A failed required-file write must stop installation')
            assert.doesNotMatch(output, /complete=1/)
            if (action === 'manual') assert.ok(output.includes(`args=/select,"${exe}"`), output)
            else assert.doesNotMatch(output, /\[manual\]/)
            assert.equal(readFileSync(path.join(target, 'dbx.exe'), 'utf8'), 'original executable contents')
          } else {
            assert.equal(exitCode, 0)
            assert.match(output, /complete=1/)
            assert.equal(readFileSync(path.join(target, 'dbx.exe'), 'utf8'), 'new executable contents')
          }
        }
      }
    })
  } finally {
    rmSync(dir, { recursive: true, force: true })
  }
})