@app-vitals/agent-admin 0.0.0-stage → 0.1.0

package/src/startup-policy-reconcile.unit.test.ts

@@ -0,0 +1,251 @@
+/**
+ * admin/src/startup-policy-reconcile.unit.test.ts
+ * Unit tests for runStartupPolicyReconcile (ACP-1.3).
+ *
+ * agentService, provisioner and logger are all plain injected doubles — no
+ * mock.module(), no global overrides, per the repo's test-isolation rule
+ * (CLAUDE.md).
+ */
+
+import { describe, expect, it } from "bun:test";
+import type { AgentProvisioner, ReconcileResult } from "./agent-provisioner.ts";
+import type { AgentSummary } from "./agents.ts";
+import {
+  managedReconcileTargets,
+  runStartupPolicyReconcile,
+} from "./startup-policy-reconcile.ts";
+
+// ─── Doubles ────────────────────────────────────────────────────────────────
+
+type ReconcileCall = {
+  agents: Parameters<AgentProvisioner["reconcile"]>[0];
+  opts: Parameters<AgentProvisioner["reconcile"]>[1];
+};
+
+const EMPTY_RESULT: ReconcileResult = {
+  recreated: [],
+  migrated: [],
+  noOwner: [],
+  dryRun: false,
+  orphans: [],
+  failed: [],
+  updated: [],
+};
+
+function fakeProvisioner(opts: {
+  canProvision: boolean;
+  reconcile?: () => Promise<ReconcileResult>;
+}) {
+  const calls: ReconcileCall[] = [];
+  const provisioner = {
+    canProvision: opts.canProvision,
+    async reconcile(
+      agents: ReconcileCall["agents"],
+      reconcileOpts: ReconcileCall["opts"],
+    ) {
+      calls.push({ agents, opts: reconcileOpts });
+      return opts.reconcile ? opts.reconcile() : EMPTY_RESULT;
+    },
+  };
+  return { provisioner, calls };
+}
+
+function fakeAgentService(
+  agents: AgentSummary[] | (() => Promise<AgentSummary[]>),
+) {
+  let listCalls = 0;
+  return {
+    agentService: {
+      async list() {
+        listCalls++;
+        return typeof agents === "function" ? agents() : agents;
+      },
+    },
+    listCalls: () => listCalls,
+  };
+}
+
+function recordingLogger() {
+  const lines: { level: "log" | "error"; args: unknown[] }[] = [];
+  return {
+    logger: {
+      log: (...args: unknown[]) => lines.push({ level: "log", args }),
+      error: (...args: unknown[]) => lines.push({ level: "error", args }),
+    },
+    lines,
+  };
+}
+
+function agent(overrides: Partial<AgentSummary> & { id: string }) {
+  return {
+    name: `${overrides.id}-slug`,
+    selfHosted: false,
+    typeName: "dev",
+    accountId: null,
+    ...overrides,
+  } satisfies AgentSummary;
+}
+
+// ─── managedReconcileTargets ────────────────────────────────────────────────
+
+describe("managedReconcileTargets", () => {
+  it("drops self-hosted agents and maps name to slug", () => {
+    expect(
+      managedReconcileTargets([
+        agent({ id: "a1", name: "alpha", accountId: "acct-1" }),
+        agent({ id: "a2", selfHosted: true }),
+        agent({ id: "a3", name: "gamma" }),
+      ]),
+    ).toEqual([
+      { id: "a1", slug: "alpha", accountId: "acct-1" },
+      { id: "a3", slug: "gamma", accountId: null },
+    ]);
+  });
+});
+
+describe("managedReconcileTargets identity fields", () => {
+  it("carries the owner and per-agent identity fields of each agent", () => {
+    expect(
+      managedReconcileTargets([
+        agent({
+          id: "a1",
+          name: "alpha",
+          ownerEmail: "jane.doe@example.com",
+          anthropicIdentityName: "jane-doe-a1",
+          anthropicServiceAccountId: "svac_1",
+          anthropicFederationRuleId: "fdrl_1",
+          k8sServiceAccountName: "a1",
+        }),
+        agent({ id: "a2", name: "beta", ownerEmail: null }),
+      ]),
+    ).toEqual([
+      {
+        id: "a1",
+        slug: "alpha",
+        accountId: null,
+        ownerEmail: "jane.doe@example.com",
+        anthropicIdentityName: "jane-doe-a1",
+        anthropicServiceAccountId: "svac_1",
+        anthropicFederationRuleId: "fdrl_1",
+        k8sServiceAccountName: "a1",
+      },
+      { id: "a2", slug: "beta", accountId: null, ownerEmail: null },
+    ]);
+  });
+});
+
+// ─── runStartupPolicyReconcile ──────────────────────────────────────────────
+
+describe("runStartupPolicyReconcile", () => {
+  it("reconciles non-self-hosted agents with policyOnly true", async () => {
+    const { agentService } = fakeAgentService([
+      agent({ id: "a1", name: "alpha" }),
+      agent({ id: "a2", name: "beta", selfHosted: true }),
+      agent({ id: "a3", name: "gamma", accountId: "acct-3" }),
+    ]);
+    const { provisioner, calls } = fakeProvisioner({ canProvision: true });
+    const { logger } = recordingLogger();
+
+    await runStartupPolicyReconcile({ agentService, provisioner, logger });
+
+    expect(calls).toEqual([
+      {
+        agents: [
+          { id: "a1", slug: "alpha", accountId: null },
+          { id: "a3", slug: "gamma", accountId: "acct-3" },
+        ],
+        opts: { policyOnly: true },
+      },
+    ]);
+  });
+
+  it("does nothing when the provisioner cannot provision", async () => {
+    const { agentService, listCalls } = fakeAgentService([agent({ id: "a1" })]);
+    const { provisioner, calls } = fakeProvisioner({ canProvision: false });
+    const { logger, lines } = recordingLogger();
+
+    await runStartupPolicyReconcile({ agentService, provisioner, logger });
+
+    expect(calls).toHaveLength(0);
+    expect(listCalls()).toBe(0);
+    expect(lines).toHaveLength(0);
+  });
+
+  it("logs a provisioner error instead of throwing", async () => {
+    const { agentService } = fakeAgentService([agent({ id: "a1" })]);
+    const boom = new Error("kube api unreachable");
+    const { provisioner } = fakeProvisioner({
+      canProvision: true,
+      reconcile: () => Promise.reject(boom),
+    });
+    const { logger, lines } = recordingLogger();
+
+    await expect(
+      runStartupPolicyReconcile({ agentService, provisioner, logger }),
+    ).resolves.toBeUndefined();
+
+    const errors = lines.filter((l) => l.level === "error");
+    expect(errors).toHaveLength(1);
+    expect(errors[0]?.args).toContain(boom);
+  });
+
+  it("logs an agent listing error instead of throwing", async () => {
+    const boom = new Error("db down");
+    const { agentService } = fakeAgentService(() => Promise.reject(boom));
+    const { provisioner, calls } = fakeProvisioner({ canProvision: true });
+    const { logger, lines } = recordingLogger();
+
+    await expect(
+      runStartupPolicyReconcile({ agentService, provisioner, logger }),
+    ).resolves.toBeUndefined();
+
+    expect(calls).toHaveLength(0);
+    const errors = lines.filter((l) => l.level === "error");
+    expect(errors).toHaveLength(1);
+    expect(errors[0]?.args).toContain(boom);
+  });
+
+  it("logs the reconcile outcome on success", async () => {
+    const { agentService } = fakeAgentService([agent({ id: "a1" })]);
+    const { provisioner } = fakeProvisioner({
+      canProvision: true,
+      reconcile: async () => ({
+        ...EMPTY_RESULT,
+        recreated: ["a1"],
+        updated: ["a2", "a3"],
+        orphans: ["x9"],
+      }),
+    });
+    const { logger, lines } = recordingLogger();
+
+    await runStartupPolicyReconcile({ agentService, provisioner, logger });
+
+    expect(lines.filter((l) => l.level === "error")).toHaveLength(0);
+    const text = lines.map((l) => l.args.join(" ")).join("\n");
+    expect(text).toContain("updated=2");
+    expect(text).toContain("recreated=1");
+    expect(text).toContain("orphans=1");
+    expect(text).toContain("noOwner=0");
+  });
+
+  it("logs per-agent failures from the reconcile result as errors", async () => {
+    const { agentService } = fakeAgentService([agent({ id: "a1" })]);
+    const { provisioner } = fakeProvisioner({
+      canProvision: true,
+      reconcile: async () => ({
+        ...EMPTY_RESULT,
+        failed: [{ agentId: "a1", error: "patch rejected" }],
+      }),
+    });
+    const { logger, lines } = recordingLogger();
+
+    await runStartupPolicyReconcile({ agentService, provisioner, logger });
+
+    const errors = lines
+      .filter((l) => l.level === "error")
+      .map((l) => l.args.join(" "));
+    expect(errors).toHaveLength(1);
+    expect(errors[0]).toContain("a1");
+    expect(errors[0]).toContain("patch rejected");
+  });
+});

package/src/theme-tokens.json

@@ -0,0 +1,12 @@
+{
+  "$comment": "Admin's own copy of the brand design tokens it uses (subset of brand/tokens.json). Admin must not import outside admin/, so this is duplicated; brand/admin-theme-tokens.unit.test.ts fails if it drifts from brand/tokens.json.",
+  "color": {
+    "bg": { "base": "#080E1E" },
+    "brand": { "default": "#34C77B" },
+    "text": {
+      "heading": "#FFFFFF",
+      "body": "rgba(255,255,255,0.80)",
+      "editorial": "rgba(255,255,255,0.50)"
+    }
+  }
+}

package/src/token-crypto.ts

@@ -0,0 +1,60 @@
+/**
+ * agent/src/token-crypto.ts
+ * Token encryption/decryption interface and factory for agent credential storage.
+ *
+ * Centralises all token crypto so every storage path encrypts and decrypts
+ * automatically — callers work with plain text.
+ *
+ * Key: SHIPWRIGHT_ENCRYPTION_KEY — 64-char hex string (32 bytes for AES-256-GCM).
+ * If unset: identity functions (plain text stored, no encryption).
+ * If set but malformed: makeTokenCrypto() throws at construction — fail fast at
+ * boot with an actionable message, instead of an opaque runtime 500 on the
+ * first encrypted write.
+ *
+ * Legacy plain-text values: decrypt() catches parse errors and returns the stored
+ * value as-is, so existing rows continue to work after the key is added.
+ */
+
+import { decrypt, encrypt, isValidKeyHex } from "./crypto.ts";
+
+export interface TokenCrypto {
+  encrypt(token: string): string;
+  decrypt(token: string): string;
+}
+
+/** Identity implementation — no encryption. Used as default in tests and when key is unset. */
+export const identityCrypto: TokenCrypto = {
+  encrypt: (s) => s,
+  decrypt: (s) => s,
+};
+
+/**
+ * Creates a TokenCrypto backed by AES-256-GCM using SHIPWRIGHT_ENCRYPTION_KEY.
+ * Falls back to identity (plain text) if the env var is not set.
+ */
+export function makeTokenCrypto(
+  key = process.env.SHIPWRIGHT_ENCRYPTION_KEY,
+): TokenCrypto {
+  if (!key) {
+    console.warn(
+      "[shipwright admin] SHIPWRIGHT_ENCRYPTION_KEY not set — tokens stored in plain text",
+    );
+    return identityCrypto;
+  }
+  if (!isValidKeyHex(key)) {
+    throw new Error(
+      `SHIPWRIGHT_ENCRYPTION_KEY must be a 64-character hex string (32 bytes for AES-256-GCM), but got ${key.length} character(s). Generate one with: openssl rand -hex 32`,
+    );
+  }
+  return {
+    encrypt: (token) => encrypt(token, key),
+    decrypt: (encrypted) => {
+      try {
+        return decrypt(encrypted, key);
+      } catch {
+        // Legacy plain-text value — return as-is so existing rows keep working.
+        return encrypted;
+      }
+    },
+  };
+}

package/src/token-crypto.unit.test.ts

@@ -0,0 +1,182 @@
+/**
+ * agent/src/token-crypto.unit.test.ts
+ * Unit tests for the crypto round-trip (AES-256-GCM).
+ * Pure logic — no I/O, no DB, no network.
+ */
+
+import { afterEach, describe, expect, it } from "bun:test";
+import { decrypt, encrypt, isValidKeyHex } from "./crypto.ts";
+import { identityCrypto, makeTokenCrypto } from "./token-crypto.ts";
+
+// ─── Test key ─────────────────────────────────────────────────────────────────
+// A known 64-char hex key (32 bytes) for deterministic tests.
+const TEST_KEY =
+  "0000000000000000000000000000000000000000000000000000000000000001";
+
+// ─── crypto.ts: encrypt / decrypt ─────────────────────────────────────────────
+
+describe("encrypt / decrypt (AES-256-GCM)", () => {
+  it("round-trips a plain ASCII string", () => {
+    const plaintext = "hello world";
+    const encrypted = encrypt(plaintext, TEST_KEY);
+    expect(decrypt(encrypted, TEST_KEY)).toBe(plaintext);
+  });
+
+  it("round-trips an empty string", () => {
+    const plaintext = "";
+    const encrypted = encrypt(plaintext, TEST_KEY);
+    expect(decrypt(encrypted, TEST_KEY)).toBe(plaintext);
+  });
+
+  it("round-trips a unicode string", () => {
+    const plaintext = "こんにちは世界 🌍 — café résumé naïve";
+    const encrypted = encrypt(plaintext, TEST_KEY);
+    expect(decrypt(encrypted, TEST_KEY)).toBe(plaintext);
+  });
+
+  it("round-trips a 4096-byte value", () => {
+    const plaintext = "x".repeat(4096);
+    const encrypted = encrypt(plaintext, TEST_KEY);
+    expect(decrypt(encrypted, TEST_KEY)).toBe(plaintext);
+  });
+
+  it("produces a different ciphertext on each call (random IV)", () => {
+    const plaintext = "same input";
+    const enc1 = encrypt(plaintext, TEST_KEY);
+    const enc2 = encrypt(plaintext, TEST_KEY);
+    expect(enc1).not.toBe(enc2);
+  });
+
+  it("encrypted format is iv:ciphertext:authTag (3 colon-separated parts)", () => {
+    const encrypted = encrypt("test", TEST_KEY);
+    const parts = encrypted.split(":");
+    expect(parts.length).toBe(3);
+    // IV is 12 bytes = 24 hex chars
+    expect(parts[0]).toHaveLength(24);
+    // Auth tag is 16 bytes = 32 hex chars
+    expect(parts[2]).toHaveLength(32);
+  });
+
+  it("throws on invalid encrypted format (wrong part count)", () => {
+    expect(() => decrypt("notvalid", TEST_KEY)).toThrow(
+      "Invalid encrypted format",
+    );
+  });
+
+  it("throws when auth tag is wrong (tampered ciphertext)", () => {
+    const encrypted = encrypt("secret", TEST_KEY);
+    const parts = encrypted.split(":");
+    // Flip one char in the ciphertext
+    parts[1] = parts[1]
+      ? parts[1].slice(0, -2) + (parts[1].slice(-2) === "ff" ? "00" : "ff")
+      : "00";
+    const tampered = parts.join(":");
+    expect(() => decrypt(tampered, TEST_KEY)).toThrow();
+  });
+});
+
+// ─── isValidKeyHex ─────────────────────────────────────────────────────────────
+
+describe("isValidKeyHex", () => {
+  it("accepts a 64-char lowercase hex string", () => {
+    expect(isValidKeyHex(TEST_KEY)).toBe(true);
+  });
+
+  it("accepts uppercase hex", () => {
+    expect(isValidKeyHex("A".repeat(64))).toBe(true);
+  });
+
+  it("rejects a 32-char value (the chart's old randAlphaNum output length)", () => {
+    expect(isValidKeyHex("a".repeat(32))).toBe(false);
+  });
+
+  it("rejects a 64-char string with non-hex characters", () => {
+    expect(isValidKeyHex("z".repeat(64))).toBe(false);
+  });
+
+  it("rejects an empty string", () => {
+    expect(isValidKeyHex("")).toBe(false);
+  });
+});
+
+// ─── makeTokenCrypto — key validation (via injected key, no env mutation) ───────
+
+describe("makeTokenCrypto — key validation", () => {
+  it("returns identityCrypto when the key is undefined", () => {
+    const crypto = makeTokenCrypto(undefined);
+    expect(crypto.encrypt("t")).toBe("t");
+    expect(crypto.decrypt("t")).toBe("t");
+  });
+
+  it("returns identityCrypto when the key is an empty string", () => {
+    expect(makeTokenCrypto("").encrypt("t")).toBe("t");
+  });
+
+  it("throws an actionable error when the key is 32 chars (the old chart bug)", () => {
+    expect(() => makeTokenCrypto("a".repeat(32))).toThrow(
+      /64-character hex string/,
+    );
+  });
+
+  it("throws when the key contains non-hex characters", () => {
+    expect(() => makeTokenCrypto("z".repeat(64))).toThrow(/64-character hex/);
+  });
+
+  it("constructs a working crypto for a valid 64-char hex key", () => {
+    const crypto = makeTokenCrypto(TEST_KEY);
+    const enc = crypto.encrypt("secret");
+    expect(enc).not.toBe("secret");
+    expect(crypto.decrypt(enc)).toBe("secret");
+  });
+});
+
+// ─── makeTokenCrypto ───────────────────────────────────────────────────────────
+
+describe("makeTokenCrypto", () => {
+  const originalKey = process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+
+  afterEach(() => {
+    if (originalKey === undefined) {
+      delete process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+    } else {
+      process.env.SHIPWRIGHT_ENCRYPTION_KEY = originalKey;
+    }
+  });
+
+  it("returns identityCrypto when SHIPWRIGHT_ENCRYPTION_KEY is not set", () => {
+    delete process.env.SHIPWRIGHT_ENCRYPTION_KEY;
+    const crypto = makeTokenCrypto();
+    const token = "my-secret-token";
+    expect(crypto.encrypt(token)).toBe(token);
+    expect(crypto.decrypt(token)).toBe(token);
+  });
+
+  it("encrypts and decrypts when key is set", () => {
+    process.env.SHIPWRIGHT_ENCRYPTION_KEY = TEST_KEY;
+    const crypto = makeTokenCrypto();
+    const token = "my-secret-token";
+    const encrypted = crypto.encrypt(token);
+    expect(encrypted).not.toBe(token);
+    expect(crypto.decrypt(encrypted)).toBe(token);
+  });
+
+  it("decrypt falls back to returning plain text for legacy unencrypted tokens", () => {
+    process.env.SHIPWRIGHT_ENCRYPTION_KEY = TEST_KEY;
+    const crypto = makeTokenCrypto();
+    const legacyToken = "plain-text-stored-before-encryption";
+    // decrypt should not throw — returns the value as-is
+    expect(crypto.decrypt(legacyToken)).toBe(legacyToken);
+  });
+});
+
+// ─── identityCrypto ────────────────────────────────────────────────────────────
+
+describe("identityCrypto", () => {
+  it("encrypt returns input unchanged", () => {
+    expect(identityCrypto.encrypt("hello")).toBe("hello");
+  });
+
+  it("decrypt returns input unchanged", () => {
+    expect(identityCrypto.decrypt("hello")).toBe("hello");
+  });
+});