fix(desktop): Tailscale HTTPS counts as on only when Serve reaches this backend

apps/desktop/src/backend/tailscaleEndpointProvider.test.ts

@@ -1,7 +1,7 @@
 import { assert, describe, it } from "@effect/vitest";
 import * as Effect from "effect/Effect";
 import * as Layer from "effect/Layer";
-import { HttpClient } from "effect/http";
+import { HttpClient, HttpClientResponse } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
 
 import { resolveTailscaleAdvertisedEndpoints } from "./tailscaleEndpointProvider.ts";
@@ -79,4 +79,41 @@ describe("tailscale endpoint provider", () => {
         );
       }).pipe(Effect.provide(layerUnusedTailscaleExternalServices)),
   );
+
+  it.effect("offers Tailscale HTTPS only when Serve reaches this desktop's backend", () =>
+    Effect.gen(function* () {
+      const magicDnsStatus = (servedEnvironmentId: string) =>
+        resolveTailscaleAdvertisedEndpoints({
+          port: 3773,
+          serveEnabled: true,
+          networkInterfaces: {},
+          statusJson: `{"Self":{"DNSName":"desktop.example.ts.net.","TailscaleIPs":[]}}`,
+        }).pipe(
+          Effect.map((endpoints) => endpoints.map((endpoint) => endpoint.status)),
+          Effect.provideService(
+            HttpClient.HttpClient,
+            HttpClient.make((request) =>
+              Effect.succeed(
+                HttpClientResponse.fromWeb(
+                  request,
+                  Response.json({
+                    environmentId:
+                      new URL(request.url).hostname === "127.0.0.1"
+                        ? "desktop-backend"
+                        : servedEnvironmentId,
+                    label: "T3 server",
+                    platform: { os: "linux", arch: "x64" },
+                    serverVersion: "0.1.9",
+                    capabilities: { repositoryIdentity: true },
+                  }),
+                ),
+              ),
+            ),
+          ),
+        );
+
+      assert.deepEqual(yield* magicDnsStatus("desktop-backend"), ["available"]);
+      assert.deepEqual(yield* magicDnsStatus("another-server"), ["unavailable"]);
+    }).pipe(Effect.provide(layerUnusedTailscaleExternalServices)),
+  );
 });

apps/desktop/src/backend/tailscaleEndpointProvider.ts

@@ -1,5 +1,9 @@
 import { createAdvertisedEndpoint } from "@t3tools/shared/advertisedEndpoint";
-import type { AdvertisedEndpoint, AdvertisedEndpointProvider } from "@t3tools/contracts";
+import {
+  ExecutionEnvironmentDescriptor,
+  type AdvertisedEndpoint,
+  type AdvertisedEndpointProvider,
+} from "@t3tools/contracts";
 import {
   buildTailscaleHttpsBaseUrl,
   isTailscaleIpv4Address,
@@ -11,6 +15,7 @@ import {
 import * as Effect from "effect/Effect";
 import * as Option from "effect/Option";
 import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientResponse from "effect/http/HttpClientResponse";
 import * as ChildProcessSpawner from "effect/process/ChildProcessSpawner";
 
 import type { NetworkInterfaces } from "./DesktopNetworkInterfaces.ts";
@@ -71,10 +76,20 @@ function resolveTailscaleIpAdvertisedEndpoints(input: {
   return endpoints;
 }
 
+// The backend may run elsewhere (WSL), so ask it for its id instead of reading the state dir.
+const probeServesThisBackend = (localHttpUrl: string) => (baseUrl: string) =>
+  HttpClient.get(new URL("/.well-known/t3/environment", localHttpUrl)).pipe(
+    Effect.flatMap(HttpClientResponse.filterStatusOk),
+    Effect.flatMap(HttpClientResponse.schemaBodyJson(ExecutionEnvironmentDescriptor)),
+    Effect.flatMap(({ environmentId }) => probeTailscaleHttpsEndpoint({ baseUrl, environmentId })),
+    Effect.orElseSucceed(() => false),
+  );
+
 const resolveTailscaleMagicDnsAdvertisedEndpoint = Effect.fn(
   "resolveTailscaleMagicDnsAdvertisedEndpoint",
 )(function* (input: {
   readonly dnsName: string | null;
+  readonly localHttpUrl: string;
   readonly serveEnabled: boolean;
   readonly servePort?: number;
   readonly probe?: (baseUrl: string) => Effect.Effect<boolean, never, HttpClient.HttpClient>;
@@ -87,11 +102,7 @@ const resolveTailscaleMagicDnsAdvertisedEndpoint = Effect.fn(
     magicDnsName: input.dnsName,
     ...(input.servePort === undefined ? {} : { servePort: input.servePort }),
   });
-  const probe =
-    input.probe?.(httpBaseUrl) ??
-    probeTailscaleHttpsEndpoint({
-      baseUrl: httpBaseUrl,
-    });
+  const probe = (input.probe ?? probeServesThisBackend(input.localHttpUrl))(httpBaseUrl);
   const isReachable = input.serveEnabled ? yield* probe : false;
 
   return Option.some(
@@ -140,6 +151,7 @@ export const resolveTailscaleAdvertisedEndpoints = Effect.fn("resolveTailscaleAd
     const ipEndpoints = resolveTailscaleIpAdvertisedEndpoints({ ...input, status });
     const magicDnsEndpoint = yield* resolveTailscaleMagicDnsAdvertisedEndpoint({
       dnsName: status?.magicDnsName ?? null,
+      localHttpUrl: `http://127.0.0.1:${input.port}`,
       serveEnabled: input.serveEnabled === true,
       ...(input.servePort === undefined ? {} : { servePort: input.servePort }),
       ...(input.probe === undefined ? {} : { probe: input.probe }),

apps/server/src/environment/DirectEndpoints.test.ts

@@ -1,4 +1,5 @@
 import * as NodeServices from "@effect/platform-node/NodeServices";
+import { EnvironmentId } from "@t3tools/contracts";
 import { it as effectIt } from "@effect/vitest";
 import type * as NodeOS from "node:os";
 import * as Effect from "effect/Effect";
@@ -16,6 +17,7 @@ import { describe, expect, it } from "vite-plus/test";
 
 import * as ServerConfig from "../config.ts";
 import * as DirectEndpoints from "./DirectEndpoints.ts";
+import * as ServerEnvironment from "./ServerEnvironment.ts";
 import { resolveBoundEndpoints } from "./DirectEndpoints.ts";
 
 const INTERFACES: ReturnType<typeof NodeOS.networkInterfaces> = {
@@ -284,6 +286,12 @@ const layerServeConfig = (host = "127.0.0.1") =>
   ).pipe(
     Layer.provide(ServerConfig.layerTest(process.cwd(), { prefix: "t3-direct-" })),
     Layer.provide(NodeServices.layer),
+    Layer.merge(
+      Layer.succeed(ServerEnvironment.ServerEnvironment, {
+        getEnvironmentId: Effect.succeed(EnvironmentId.make("serve-test")),
+        getDescriptor: Effect.die("unused"),
+      }),
+    ),
   );
 
 const resolveWithServe = (probeStatus: number) =>

apps/server/src/environment/DirectEndpoints.ts

@@ -23,6 +23,7 @@ import {
 } from "@t3tools/shared/hostClassification";
 
 import * as ServerConfig from "../config.ts";
+import * as ServerEnvironment from "./ServerEnvironment.ts";
 import { isLoopbackHost, isPrivateNetworkAddress, VIRTUAL_INTERFACE } from "../startupAccess.ts";
 
 type NetworkInterfacesMap = ReturnType<typeof NodeOS.networkInterfaces>;
@@ -120,6 +121,7 @@ export const make = Effect.gen(function* () {
   const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
   const httpClient = yield* HttpClient.HttpClient;
   const platform = yield* HostProcess.Platform;
+  const environmentId = yield* (yield* ServerEnvironment.ServerEnvironment).getEnvironmentId;
   // Only the service default listens on every interface without being asked,
   // so only it checks once whether it runs in a cloud. The check starts now so
   // the first client does not wait for its timeout.
@@ -155,7 +157,7 @@ export const make = Effect.gen(function* () {
             magicDnsName,
             servePort: config.tailscaleServePort,
           });
-          return probeTailscaleHttpsEndpoint({ baseUrl: httpBaseUrl }).pipe(
+          return probeTailscaleHttpsEndpoint({ baseUrl: httpBaseUrl, environmentId }).pipe(
             Effect.map((reachable) => (reachable ? httpBaseUrl : null)),
           );
         }),

apps/server/src/server.ts

@@ -773,7 +773,7 @@ const layerRuntimeDependencies = layerRuntimeCoreDependencies.pipe(
   Layer.provideMerge(AnalyticsService.layer.pipe(Layer.provide(ManagedPolicy.layer))),
   Layer.provideMerge(ExternalLauncher.layer),
   Layer.provideMerge(RemoteOpenTargets.layer),
-  Layer.provideMerge(DirectEndpoints.layer),
+  Layer.provideMerge(DirectEndpoints.layer.pipe(Layer.provide(layerServerEnvironment))),
   Layer.provideMerge(ServerLifecycleEvents.layer),
   Layer.provide(NetService.layer),
 );

packages/tailscale/src/tailscale.test.ts

@@ -110,6 +110,7 @@ describe("tailscale", () => {
       ] as const) {
         const reachable = yield* probeTailscaleHttpsEndpoint({
           baseUrl: "https://desktop.example.ts.net",
+          environmentId: "this-environment",
         }).pipe(
           Effect.provideService(
             HttpClient.HttpClient,
@@ -123,6 +124,34 @@ describe("tailscale", () => {
     }),
   );
 
+  it.effect("does not treat another T3 server behind the Serve URL as this server", () =>
+    Effect.gen(function* () {
+      const answer = (environmentId: string) =>
+        HttpClient.make((request) =>
+          Effect.succeed(
+            HttpClientResponse.fromWeb(
+              request,
+              Response.json({
+                environmentId,
+                label: "T3 server",
+                platform: { os: "linux", arch: "x64" },
+                serverVersion: "0.1.9",
+                capabilities: { repositoryIdentity: true },
+              }),
+            ),
+          ),
+        );
+      const probe = (served: string) =>
+        probeTailscaleHttpsEndpoint({
+          baseUrl: "https://desktop.example.ts.net",
+          environmentId: "this-environment",
+        }).pipe(Effect.provideService(HttpClient.HttpClient, answer(served)));
+
+      assert.isTrue(yield* probe("this-environment"));
+      assert.isFalse(yield* probe("another-environment"));
+    }),
+  );
+
   it("finds the Serve routes that forward to the bound address, and only those", () => {
     const status = JSON.stringify({
       TCP: {

packages/tailscale/src/tailscale.ts

@@ -711,18 +711,22 @@ export const readTailscaleServeRootHolders = (
   );
 
 export const probeTailscaleHttpsEndpoint = Effect.fn("tailscale.probeTailscaleHttpsEndpoint")(
-  function* (input: { readonly baseUrl: string; readonly timeout?: Duration.Input }) {
+  function* (input: {
+    readonly baseUrl: string;
+    readonly environmentId: string;
+    readonly timeout?: Duration.Input;
+  }) {
     const client = yield* HttpClient.HttpClient;
     const descriptor = yield* Effect.gen(function* () {
       const url = new URL("/.well-known/t3/environment", input.baseUrl);
       const response = yield* client
         .execute(HttpClientRequest.get(url.toString()))
         .pipe(Effect.flatMap(HttpClientResponse.filterStatusOk));
-      // A Serve mapping to another app also answers 2xx; only a T3 descriptor proves this server.
+      // Another app or another T3 server can hold the Serve port; only our own descriptor counts.
       return yield* HttpClientResponse.schemaBodyJson(ExecutionEnvironmentDescriptor)(response);
     }).pipe(Effect.timeoutOption(input.timeout ?? TAILSCALE_PROBE_TIMEOUT));
 
-    return Option.isSome(descriptor);
+    return Option.isSome(descriptor) && descriptor.value.environmentId === input.environmentId;
   },
   Effect.orElseSucceed(() => false),
 );