safesocket, version: fix safesocket_darwin behavior for cmd/tailscale (#15275)

fixes tailscale/tailscale#15269

Fixes the various CLIs for all of the various flavors of tailscaled on
darwin.  The logic in version is updated so that we have methods that
return true only for the actual GUI app (which can beCLI) and the
order of the checks in localTCPPortAndTokenDarwin are corrected so
that the logic works with all 5 combinations of CLI and tailscaled.

Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>

safesocket/safesocket_darwin_test.go

@@ -15,9 +15,12 @@ import (
 // sets the port and token correctly and that LocalTCPPortAndToken
 // returns the given values.
 func TestSetCredentials(t *testing.T) {
-	wantPort := 123
-	wantToken := "token"
-	tstest.Replace(t, &ssd.isMacGUIApp, func() bool { return true })
+	const (
+		wantToken = "token"
+		wantPort  = 123
+	)
+
+	tstest.Replace(t, &ssd.isMacGUIApp, func() bool { return false })
 	SetCredentials(wantToken, wantPort)
 
 	gotPort, gotToken, err := LocalTCPPortAndToken()
@@ -26,11 +29,47 @@ func TestSetCredentials(t *testing.T) {
 	}
 
 	if gotPort != wantPort {
-		t.Errorf("got port %d, want %d", gotPort, wantPort)
+		t.Errorf("port: got %d, want %d", gotPort, wantPort)
 	}
 
 	if gotToken != wantToken {
-		t.Errorf("got token %s, want %s", gotToken, wantToken)
+		t.Errorf("token: got %s, want %s", gotToken, wantToken)
+	}
+}
+
+// TestFallbackToSameuserproof verifies that we fallback to the
+// sameuserproof file via LocalTCPPortAndToken when we're running
+//
+//	s cmd/tailscale
+func TestFallbackToSameuserproof(t *testing.T) {
+	dir := t.TempDir()
+	const (
+		wantToken = "token"
+		wantPort  = 123
+	)
+
+	// Mimics cmd/tailscale falling back to sameuserproof
+	tstest.Replace(t, &ssd.isMacGUIApp, func() bool { return false })
+	tstest.Replace(t, &ssd.sharedDir, dir)
+	tstest.Replace(t, &ssd.checkConn, false)
+
+	// Behave as macSysExt when initializing sameuserproof
+	tstest.Replace(t, &ssd.isMacSysExt, func() bool { return true })
+	if err := initSameUserProofToken(dir, wantPort, wantToken); err != nil {
+		t.Fatalf("initSameUserProofToken: %v", err)
+	}
+
+	gotPort, gotToken, err := LocalTCPPortAndToken()
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	if gotPort != wantPort {
+		t.Errorf("port: got %d, want %d", gotPort, wantPort)
+	}
+
+	if gotToken != wantToken {
+		t.Errorf("token: got %s, want %s", gotToken, wantToken)
 	}
 }
 
@@ -38,7 +77,7 @@ func TestSetCredentials(t *testing.T) {
 // returns a listener and a non-zero port and non-empty token.
 func TestInitListenerDarwin(t *testing.T) {
 	temp := t.TempDir()
-	tstest.Replace(t, &ssd.isMacGUIApp, func() bool { return true })
+	tstest.Replace(t, &ssd.isMacGUIApp, func() bool { return false })
 
 	ln, err := InitListenerDarwin(temp)
 	if err != nil || ln == nil {
@@ -52,15 +91,14 @@ func TestInitListenerDarwin(t *testing.T) {
 	}
 
 	if port == 0 {
-		t.Errorf("expected non-zero port, got %d", port)
+		t.Errorf("port: got %d, want non-zero", port)
 	}
 
 	if token == "" {
-		t.Errorf("expected non-empty token, got empty string")
+		t.Errorf("token: got %s, want non-empty", token)
 	}
 }
 
-// TestTokenGeneration verifies token generation behavior
 func TestTokenGeneration(t *testing.T) {
 	token, err := getToken()
 	if err != nil {
@@ -70,7 +108,7 @@ func TestTokenGeneration(t *testing.T) {
 	// Verify token length (hex string is 2x byte length)
 	wantLen := sameUserProofTokenLength * 2
 	if got := len(token); got != wantLen {
-		t.Errorf("token length = %d, want %d", got, wantLen)
+		t.Errorf("token length: got %d, want %d", got, wantLen)
 	}
 
 	// Verify token persistence
@@ -79,7 +117,7 @@ func TestTokenGeneration(t *testing.T) {
 		t.Fatalf("subsequent getToken: %v", err)
 	}
 	if subsequentToken != token {
-		t.Errorf("subsequent token = %q, want %q", subsequentToken, token)
+		t.Errorf("subsequent token: got %q, want %q", subsequentToken, token)
 	}
 }
 
@@ -107,10 +145,10 @@ func TestMacsysSameuserproof(t *testing.T) {
 	}
 
 	if gotPort != wantPort {
-		t.Errorf("got port = %d, want %d", gotPort, wantPort)
+		t.Errorf("port: got %d, want %d", gotPort, wantPort)
 	}
 	if wantToken != gotToken {
-		t.Errorf("got token = %s, want %s", wantToken, gotToken)
+		t.Errorf("token: got %s, want %s", wantToken, gotToken)
 	}
 	assertFileCount(t, dir, 1, "sameuserproof-")
 }
@@ -138,7 +176,7 @@ func assertFileCount(t *testing.T, dir string, want int, prefix string) {
 
 	files, err := os.ReadDir(dir)
 	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
+		t.Fatalf("[unexpected] error: %v", err)
 	}
 	count := 0
 	for _, file := range files {
@@ -147,6 +185,6 @@ func assertFileCount(t *testing.T, dir string, want int, prefix string) {
 		}
 	}
 	if count != want {
-		t.Errorf("expected 1 file, got %d", count)
+		t.Errorf("files: got %d, want 1", count)
 	}
 }