Fix auth() to handle partial success for address families (#14)

* Initial plan

* Fix auth() to use Promise.allSettled for dual-stack knock tolerance

Replace Promise.all with Promise.allSettled in auth() so that a single
unreachable address family (e.g. IPv6 ENETUNREACH) does not cause the
entire auth call to fail when the knock to the other family succeeded.

Now auth() only throws (with AggregateError) when ALL knocks fail.

Also bump tsconfig target to ES2021 for AggregateError type support.

Closes #13

Agent-Logs-Url: https://github.com/84codes/sparoid.js/sessions/c1d08905-5aa2-41cb-95f6-0515c412e206

Co-authored-by: snichme <102988+snichme@users.noreply.github.com>

* Guard against empty results array in auth() knock check

Agent-Logs-Url: https://github.com/84codes/sparoid.js/sessions/c1d08905-5aa2-41cb-95f6-0515c412e206

Co-authored-by: snichme <102988+snichme@users.noreply.github.com>

* test: make knock-failure tests deterministic via socket mocking

The "all knocks fail" and partial-success tests depended on real UDP/IPv6
behavior (sending to 100::1, dual-stack localhost), so their outcome varied
with the host's IPv6 routing — flaky across environments (Copilot review on #14).

Mock dgram.createSocket so send() outcomes are controlled directly:
- all sends fail -> auth() rejects with AggregateError
- one send fails, one succeeds -> auth() resolves (true partial-success path,
  which the old localhost test never actually exercised)

Also ports both tests from the leftover ava API to node:test/assert after the
rebase onto main.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
Co-authored-by: snichme <102988+snichme@users.noreply.github.com>
Co-authored-by: Magnus Landerblom <magnus@landerblom.se>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

src/sparoid.ts

@@ -47,7 +47,13 @@ export async function auth(host: string, port: number, key?: string, hmac_key?:
             promises.push(udpSend(hmaced, addr, port));
         }
     }
-    await Promise.all(promises)
+    const results = await Promise.allSettled(promises)
+    if (results.length === 0 || results.every(r => r.status === 'rejected')) {
+        throw new AggregateError(
+            results.map(r => (r as PromiseRejectedResult).reason),
+            'sparoid auth failed: all knocks failed',
+        )
+    }
     await sleep(200) // let the server process the packet
 }
 

test/test.ts

@@ -1,11 +1,23 @@
-import test from 'node:test'
+import test, { mock } from 'node:test'
 import assert from 'node:assert/strict'
 import dgram from 'dgram'
 import * as sparoid from '../src/sparoid.js'
 
 const key = "0000000000000000000000000000000000000000000000000000000000000000"
 const loopback = Buffer.from([127, 0, 0, 1])
 
+type SendCb = (err?: Error | null) => void
+
+// Replace dgram sockets with a fake whose send() outcome we control, so the
+// "all knocks fail" / "partial success" paths don't depend on the host's
+// network (IPv6 routing, reachability) — which is what made these tests flaky.
+function mockSend(send: (cb: SendCb) => void): void {
+  mock.method(dgram, 'createSocket', (() => ({
+    send: (_msg: Buffer, _port: number, _host: string, cb: SendCb) => send(cb),
+    close: () => {},
+  })) as unknown as typeof dgram.createSocket)
+}
+
 test("it can auth", async () => {
   const server = dgram.createSocket('udp4')
   await new Promise<void>((resolve, reject) => {
@@ -37,3 +49,31 @@ test("raises on error on DNS error", async () => {
   await assert.rejects(() => sparoid.auth("none.arpa", 8485, key, key),
     { message: /ENOTFOUND/ })
 })
+
+test("throws AggregateError when all knocks fail", async () => {
+  // Every send fails -> auth() must reject with an aggregated error.
+  mockSend(cb => cb(new Error('ENETUNREACH')))
+  try {
+    await assert.rejects(
+      () => sparoid.auth("100::1", 8486, key, key, [loopback]),
+      (err: unknown) =>
+        err instanceof AggregateError && /all knocks failed/.test(err.message),
+    )
+  } finally {
+    mock.restoreAll()
+  }
+})
+
+test("succeeds when at least one knock succeeds", async () => {
+  // First knock fails to send, the second succeeds: auth() must still resolve
+  // (mirrors a dual-stack host where one address family is unreachable).
+  let calls = 0
+  mockSend(cb => cb(calls++ === 0 ? new Error('ENETUNREACH') : null))
+  try {
+    await assert.doesNotReject(
+      () => sparoid.auth("127.0.0.1", 8487, key, key, [loopback, loopback]),
+    )
+  } finally {
+    mock.restoreAll()
+  }
+})

tsconfig.json

@@ -1,6 +1,6 @@
 {
   "compilerOptions": {
-    "target": "ES2020",
+    "target": "ES2021",
     "module": "NodeNext",
     "moduleResolution": "NodeNext",
     "strict": true,