SecureBitChat/securebit-chat
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

fix: make WebRTC privacy mode explicit

Browse Source
This commit is contained in:
lockbitchat
2026-05-17 17:57:11 -04:00
parent ce48e8a851
commit f71ff62417
2 changed files with 72 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/webrtc-privacy-mode.test.mjs
+35 -6
View File
@@ -14,6 +14,7 @@ function fake(config = {}) {
return {
_config: {
webrtc: {
privacyMode: config.privacyMode ?? (config.relayOnly ? 'relay-only' : 'standard'),
relayOnly: config.relayOnly ?? false,
iceServers: config.iceServers ?? [{ urls: 'stun:stun.example.test:3478' }]
}
@@ -23,11 +24,12 @@ function fake(config = {}) {
deliverMessageToUI(message, type) {
this.delivered.push({ message, type });
},
_hasTurnServer: EnhancedSecureWebRTCManager.prototype._hasTurnServer
_hasTurnServer: EnhancedSecureWebRTCManager.prototype._hasTurnServer,
_isRelayOnlyMode: EnhancedSecureWebRTCManager.prototype._isRelayOnlyMode
};
}
// Default mode preserves current behavior.
// Standard mode remains usable, but it is not relay-only.
{
const manager = fake();
const config = EnhancedSecureWebRTCManager.prototype._buildPeerConnectionConfig.call(manager);
@@ -35,26 +37,53 @@ function fake(config = {}) {
assert.equal(config.iceServers[0].urls, 'stun:stun.example.test:3478');
}
// Privacy mode uses relay-only transport.
// Explicit privacy mode uses relay-only transport, suppressing host/srflx usage.
{
const manager = fake({ privacyMode: 'relay-only', iceServers: [{ urls: 'turn:turn.example.test:3478' }] });
const config = EnhancedSecureWebRTCManager.prototype._buildPeerConnectionConfig.call(manager);
assert.equal(config.iceTransportPolicy, 'relay');
}
// Backward-compatible relayOnly alias still enables relay transport.
{
const manager = fake({ relayOnly: true, iceServers: [{ urls: 'turn:turn.example.test:3478' }] });
const config = EnhancedSecureWebRTCManager.prototype._buildPeerConnectionConfig.call(manager);
assert.equal(config.iceTransportPolicy, 'relay');
}
// Missing TURN warns clearly.
// Missing TURN in standard mode warns clearly and visibly.
{
const manager = fake();
EnhancedSecureWebRTCManager.prototype._warnIfTurnMissing.call(manager);
assert.match(manager.delivered[0].message, /may expose IP addresses/i);
assert.equal(manager.delivered[0].type, 'system');
assert.match(manager.delivered[0].message, /relay-only mode is disabled/i);
assert.match(manager.delivered[0].message, /may expose host or server-reflexive IP addresses/i);
}
// STUN-only config does not claim IP protection, even with privacy mode selected.
{
const manager = fake({ relayOnly: true, iceServers: [{ urls: 'stun:stun.example.test:3478' }] });
const manager = fake({ privacyMode: 'relay-only', iceServers: [{ urls: 'stun:stun.example.test:3478' }] });
assert.equal(EnhancedSecureWebRTCManager.prototype._hasTurnServer.call(manager), false);
EnhancedSecureWebRTCManager.prototype._warnIfTurnMissing.call(manager);
assert.match(manager.delivered[0].message, /STUN alone does not hide IP addresses/i);
}
// Non-private mode warns even when TURN exists because direct candidates remain allowed.
{
const manager = fake({ iceServers: [{ urls: 'turn:turn.example.test:3478' }] });
EnhancedSecureWebRTCManager.prototype._warnIfTurnMissing.call(manager);
assert.equal(manager.delivered[0].type, 'system');
assert.match(manager.delivered[0].message, /relay-only mode is disabled/i);
assert.match(manager.delivered[0].message, /may expose host or server-reflexive IP addresses/i);
}
// ICE defaults are centralized and operator overrides remain untouched.
{
assert.equal(Array.isArray(EnhancedSecureWebRTCManager.DEFAULT_ICE_SERVERS), true);
const overrideServers = [{ urls: ['stun:operator.example.test:3478', 'turn:operator.example.test:3478'] }];
const manager = fake({ iceServers: overrideServers });
const config = EnhancedSecureWebRTCManager.prototype._buildPeerConnectionConfig.call(manager);
assert.equal(config.iceServers, overrideServers);
}
console.log('WebRTC privacy mode tests passed');