@app-vitals/agent-admin 1.12.1 → 1.14.0

package/src/github-enterprise-client.unit.test.ts

@@ -0,0 +1,97 @@
+/**
+ * admin/src/github-enterprise-client.unit.test.ts
+ * Unit tests for GitHub enterprise error mapping and client-side validation.
+ */
+
+import { describe, expect, it } from "bun:test";
+import {
+  GithubEnterpriseClient,
+  GithubEnterpriseError,
+  type GithubEnterpriseErrorKind,
+  mapGithubEnterpriseError,
+} from "./github-enterprise-client.ts";
+
+const h = (init?: Record<string, string>) => new Headers(init);
+
+describe("mapGithubEnterpriseError", () => {
+  const cases: Array<
+    [number, Record<string, string>, unknown, GithubEnterpriseErrorKind]
+  > = [
+    [401, {}, { message: "Bad credentials" }, "unauthorized"],
+    [
+      403,
+      {},
+      { message: "Resource not accessible by integration" },
+      "permission",
+    ],
+    [404, {}, { message: "Not Found" }, "not_found"],
+    [422, {}, { message: "Validation Failed" }, "validation"],
+    [429, {}, { message: "API rate limit exceeded" }, "rate_limit"],
+    [403, { "retry-after": "60" }, { message: "x" }, "rate_limit"],
+    [403, { "x-ratelimit-remaining": "0" }, { message: "x" }, "rate_limit"],
+    [
+      403,
+      {},
+      { message: "You have exceeded a secondary rate limit." },
+      "rate_limit",
+    ],
+    [500, {}, { message: "Server Error" }, "server"],
+    [503, {}, undefined, "server"],
+    [418, {}, undefined, "unexpected"],
+  ];
+  for (const [status, headers, body, kind] of cases) {
+    it(`maps ${status} ${JSON.stringify(headers)} to ${kind}`, () => {
+      const e = mapGithubEnterpriseError(status, h(headers), body, "ctx");
+      expect(e).toBeInstanceOf(GithubEnterpriseError);
+      expect(e.kind).toBe(kind);
+      expect(e.status).toBe(status);
+    });
+  }
+
+  it("exposes retry-after seconds", () => {
+    const e = mapGithubEnterpriseError(
+      429,
+      h({ "retry-after": "30" }),
+      {},
+      "ctx",
+    );
+    expect(e.retryAfterSeconds).toBe(30);
+  });
+
+  it("redacts secrets echoed in the message", () => {
+    const e = mapGithubEnterpriseError(
+      403,
+      h(),
+      { message: "token ghs_secret123 denied" },
+      "ctx",
+      ["ghs_secret123"],
+    );
+    expect(e.message).not.toContain("ghs_secret123");
+  });
+});
+
+describe("GithubEnterpriseClient validation", () => {
+  const neverFetch = (async () => {
+    throw new Error("fetch must not be called");
+  }) as unknown as typeof fetch;
+  const client = new GithubEnterpriseClient({
+    appId: "1",
+    enterprise: "acme",
+    privateKey: "unused",
+    fetchFn: neverFetch,
+  });
+
+  it("rejects selected without repositories before any network call", async () => {
+    const err = await client
+      .installOnOrg("o", { clientId: "Iv1.x", repositorySelection: "selected" })
+      .catch((e) => e);
+    expect(err.kind).toBe("validation");
+  });
+
+  it("rejects a missing clientId", async () => {
+    const err = await client
+      .installOnOrg("o", { clientId: "", repositorySelection: "all" })
+      .catch((e) => e);
+    expect(err.kind).toBe("validation");
+  });
+});

package/src/github-enterprise-isolation.unit.test.ts

@@ -0,0 +1,84 @@
+/**
+ * admin/src/github-enterprise-isolation.unit.test.ts
+ * Isolation exception guard (GHE-1.3): the GitHub Enterprise App private key
+ * is reachable only from the enterprise service, its admin API and the boot
+ * wiring. Agent config bundle, agent-bearer routes and env serialization must
+ * never import the service, touch its table or call getPrivateKey().
+ */
+
+import { describe, expect, it } from "bun:test";
+import { readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative } from "node:path";
+
+const REPO = new URL("../../", import.meta.url).pathname;
+
+/** Non-test source files that may reference the key-bearing service/table. */
+const ALLOWED = new Set([
+  "admin/src/github-enterprise-apps.ts",
+  "admin/src/github-enterprise-api.ts",
+  "admin/src/admin-boot.ts",
+]);
+
+function sources(dir: string, out: string[] = []): string[] {
+  for (const name of readdirSync(dir)) {
+    if (name === "node_modules" || name === "client" || name.startsWith(".")) {
+      continue;
+    }
+    const p = join(dir, name);
+    if (statSync(p).isDirectory()) sources(p, out);
+    else if (
+      /\.(ts|tsx)$/.test(name) &&
+      !/\.(unit|integration|smoke|fixtures)\.test\.ts$|\.test\.ts$|\.fixtures\.ts$/.test(
+        name,
+      )
+    ) {
+      out.push(p);
+    }
+  }
+  return out;
+}
+
+describe("GitHub Enterprise key isolation", () => {
+  const files = ["admin/src", "runtime", "lib", "chat", "index.ts"].flatMap(
+    (d) => {
+      const p = join(REPO, d);
+      return statSync(p).isDirectory() ? sources(p) : [p];
+    },
+  );
+
+  it("scans a non-trivial set of files", () => {
+    expect(files.length).toBeGreaterThan(50);
+  });
+
+  it("only the allowlisted modules touch the key-bearing service or table", () => {
+    const offenders = files
+      .map((f) => relative(REPO, f))
+      .filter((rel) => !ALLOWED.has(rel))
+      .filter((rel) => {
+        const src = readFileSync(join(REPO, rel), "utf-8");
+        return (
+          /github-enterprise-apps/.test(src) ||
+          /gitHubEnterpriseApp\b/.test(src) ||
+          /GitHubEnterpriseApp\b/.test(src) ||
+          /privateKeyEncrypted/.test(src)
+        );
+      });
+    expect(offenders).toEqual([]);
+  });
+
+  it("getPrivateKey() is only called by the enterprise API", () => {
+    const callers = files
+      .map((f) => relative(REPO, f))
+      .filter((rel) =>
+        /\.getPrivateKey\(/.test(readFileSync(join(REPO, rel), "utf-8")),
+      );
+    expect(callers).toEqual(["admin/src/github-enterprise-api.ts"]);
+  });
+
+  it("the config bundle and env serializers never read the enterprise table", () => {
+    for (const rel of ["admin/src/agent-envs.ts", "admin/src/api.ts"]) {
+      const src = readFileSync(join(REPO, rel), "utf-8");
+      expect(src).not.toMatch(/enterprise/i);
+    }
+  });
+});