feat: harden plugin api for separate repos, signed updates and generic external login

plugins/remote-desktop/tests/backend/macos-vnc-proxy.test.ts

@@ -43,7 +43,7 @@ describe("createMacosVncCompatibilityProxy", () => {
         socket.write(Buffer.from([5, 30, 33]));
         socket.write(Buffer.from([36, 2, 35]));
         socket.once("data", (selection) => {
-          selectedSecurityType = selection[0];
+          selectedSecurityType = Number(selection[0]);
           socket.write("desktop-data");
         });
       });

plugins/remote-desktop/tests/backend/routes.test.ts

@@ -17,8 +17,8 @@ import { GuacamoleTokenService } from "../../src/backend/token-service.js";
 
 const manifest = manifestJson as unknown as PluginManifest;
 
-// The token key comes from JWT_SECRET; without one each service picks its own.
-process.env.JWT_SECRET = "remote-desktop-test-secret";
+// Without a fixed key each token service picks its own.
+process.env.GUACAMOLE_ENCRYPTION_KEY = "ab".repeat(32);
 
 function target(
   overrides: Partial<PluginProtocolTarget["auth"]> = {},

plugins/remote-desktop/tests/backend/token-security.test.ts

@@ -10,7 +10,7 @@ import {
   isServerOwnedSetting,
 } from "../../src/backend/token-service.js";
 
-process.env.JWT_SECRET = "remote-desktop-test-secret";
+process.env.GUACAMOLE_ENCRYPTION_KEY = "ab".repeat(32);
 
 function decode(token: string) {
   return JSON.parse(Buffer.from(token, "base64").toString("utf8")) as {

plugins/remote-desktop/tests/backend/token-service.test.ts

@@ -59,8 +59,10 @@ describe("GuacamoleTokenService", () => {
     const termixMeta = {
       termixConnectId: "connect-1",
       hostId: 7,
+      hostName: "windows",
       ownerUserId: "user-1",
       protocol: "rdp" as const,
+      tabInstanceId: null,
     };
     const token = tokenService.createRdpToken(
       "windows.example.test",