# Jungle VPN local activation test service

This is a local test service. It takes no money and does not provision PIA access.

1. Install and open the supplied Jungle VPN test app first.
2. On a Windows computer with Node.js 22.13 or later, double-click Start-Jungle-Test-Service.cmd. Keep its window open.
3. Open http://127.0.0.1:8789 in a browser on that computer.
4. Select the €3 month or €25 year test purchase. Confirm the app is downloaded and you are ready, and accept the displayed code expiry and purchase terms.
5. Issue a test code. Enter it in the app and press Activate on local test service within five minutes. The website's hosted mockup issues different browser-only demo codes.
6. Windows connects to this local service automatically. To test Android, connect your own test phone by USB, enable and approve Android USB debugging, and run `adb reverse tcp:8789 tcp:8789` for that device. The Android test app then connects to the computer's loopback service. No forwarding or device installation has been done automatically.
7. Successful activation triggers one installation confirmation. The server removes the temporary setup record and records the confirmation once. An acknowledgement retry is idempotent.

One test purchase binds one installation ID and token. Codes contain 15 characters: three letters and twelve digits, excluding 0, O, L, I, 1, 5 and S. Entry is case-insensitive. Five minutes begins at issue; an expired/used code cannot be reissued or redeemed. Access starts at activation and lasts exactly 31 days for the monthly pass or one calendar year for the annual pass. Tokens, installation IDs and codes are hashed in the server database. Clients store their activation credentials encrypted.

The test service stores its dedicated secret and necessary purchase/entitlement state in private-state beside these files. Protect that directory and do not upload it. It does not write request logs or traffic logs. Do not expose this server to the network: it deliberately binds only to 127.0.0.1. A local user can use the console to create test purchases.

An active test entitlement does not supply a VPN profile. To test tunnelling, import your own valid WireGuard profile with DNS and full IPv4/IPv6 routes. Both installers include WireGuard. Windows setup bundles the official signed x64 MSI and requests Windows permission to install it if absent. Android embeds its tunnel engine; no separate WireGuard app is needed. The app labels the tunnel as unverified until an external test establishes its route. No external tunnel or DNS/IPv6 leak test has been performed in this delivery.

Production work still required: verified merchant payment integration, current CMS integration, PIA provisioning scoped to each device, server-enforced provider expiry/revocation, signed production releases, and verification of privacy controls throughout the hosting and VPN stack. This development service uses bearer tokens; possession of a copied token plus installation ID could clone access, so hardware-backed proof of possession is needed for strong production device binding. The existing TVZZ ten-digit flow has not been changed.

Run `npm test` to run the policy and lifecycle tests.