@ashlr/stack-core 0.1.1

package/src/__tests__/secret-redaction.test.ts

@@ -0,0 +1,170 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import type { LogEvent } from "../providers/_base.ts";
+import { scrub } from "../providers/_helpers.ts";
+import { makeApiKeyProvider } from "../providers/_api-key.ts";
+import { StackError } from "../errors.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
+
+/**
+ * Secret redaction regression pack.
+ *
+ * The biggest exfiltration risk for Stack is a log line that interpolates a
+ * raw token — tokens end up in CI artifacts, shell scrollback, sentry
+ * breadcrumbs, etc. These tests pin the contract: when an API-key provider
+ * discovers a cached token is no longer valid and logs a warning, the raw
+ * token MUST NOT appear in the log message.
+ */
+
+describe("scrub()", () => {
+  test("keeps the last N chars and masks the rest", () => {
+    expect(scrub("sk-abcdef1234567890")).toBe("****7890");
+    expect(scrub("sk-abcdef1234567890", 6)).toBe("****567890");
+  });
+
+  test("short strings are fully redacted", () => {
+    expect(scrub("abcd")).toBe("****");
+    expect(scrub("abc")).toBe("****");
+  });
+
+  test("empty string returns empty", () => {
+    expect(scrub("")).toBe("");
+  });
+});
+
+describe("api-key provider login — invalid cached token warning", () => {
+  let h: Harness;
+  let realFetch: typeof fetch;
+  const RAW_TOKEN = "sk-SECRET-ABCD-1234-SHOULD-NOT-LEAK-XYZ";
+
+  beforeEach(() => {
+    // Seed the vault so the provider's login() finds a cached token to reject.
+    h = setupFakePhantom({ TEST_PROVIDER_KEY: RAW_TOKEN });
+    realFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    h.cleanup();
+  });
+
+  test("log lines never contain the raw cached token", async () => {
+    const logs: LogEvent[] = [];
+
+    const provider = makeApiKeyProvider({
+      name: "testprov",
+      displayName: "Test Provider",
+      category: "ai",
+      docs: "https://example.com",
+      secretName: "TEST_PROVIDER_KEY",
+      howTo: "n/a",
+      async verify(_key) {
+        // Simulate server rejection to trigger the "cached invalid" branch.
+        return undefined;
+      },
+    });
+
+    await expect(
+      provider.login({
+        cwd: process.cwd(),
+        interactive: false, // forces the no-prompt failure path
+        log: (event) => logs.push(event),
+      }),
+    ).rejects.toThrow(StackError);
+
+    // The provider emitted at least one warn log about the cached token.
+    const warn = logs.find((l) => l.level === "warn");
+    expect(warn).toBeDefined();
+    // The raw token must not appear anywhere in the message or data payload.
+    const full =
+      (warn?.msg ?? "") + " " + JSON.stringify(warn?.data ?? {});
+    expect(full).not.toContain(RAW_TOKEN);
+    // And the tail of the token (last 6 chars) must not leak either — the
+    // current _api-key warn doesn't reference the token at all, so belt + suspenders.
+    expect(full).not.toContain(RAW_TOKEN.slice(-6));
+  });
+});
+
+describe("phantom error formatting — regression guard for formatArgsForError", () => {
+  /**
+   * Hand-roll a tiny phantom replacement that exits 1 on every call, so we
+   * can observe how `exec()` stringifies the failed-args list into its
+   * StackError. The full fake harness succeeds on `add`, which wouldn't
+   * exercise the error path.
+   */
+  function setupAlwaysFailingPhantom(): { cleanup(): void } {
+    const { chmodSync, mkdtempSync, rmSync, writeFileSync } = require("node:fs") as typeof import("node:fs");
+    const { tmpdir } = require("node:os") as typeof import("node:os");
+    const { join } = require("node:path") as typeof import("node:path");
+    const { __resetPhantomCache } = require("../phantom.ts") as typeof import("../phantom.ts");
+
+    const dir = mkdtempSync(join(tmpdir(), "stack-phantom-fail-"));
+    const script = `#!/usr/bin/env bash
+case "\${1:-}" in
+  --version) echo "phantom fake 0.0.1" ;;
+  *) echo "boom" >&2; exit 1 ;;
+esac
+`;
+    const binPath = join(dir, "phantom");
+    writeFileSync(binPath, script);
+    chmodSync(binPath, 0o755);
+
+    const previousPath = process.env.PATH ?? "";
+    process.env.PATH = `${dir}:${previousPath}`;
+    __resetPhantomCache();
+
+    return {
+      cleanup() {
+        process.env.PATH = previousPath;
+        __resetPhantomCache();
+        try {
+          rmSync(dir, { recursive: true, force: true });
+        } catch {
+          /* best-effort */
+        }
+      },
+    };
+  }
+
+  test("failed `phantom add <KEY> <VALUE>` never leaks the VALUE", async () => {
+    const SECRET = "super-secret-VALUE-that-MUST-not-LEAK-999";
+    const h = setupAlwaysFailingPhantom();
+    try {
+      const { exec } = await import("../phantom.ts");
+      let caught: Error | undefined;
+      try {
+        await exec(["add", "LEAKY_KEY", SECRET]);
+      } catch (err) {
+        caught = err as Error;
+      }
+      expect(caught).toBeDefined();
+      // The canonical guarantee: the raw value NEVER appears in the error.
+      expect(caught!.message).not.toContain(SECRET);
+      // The key name is safe to show — it's the vault slot, not the value.
+      expect(caught!.message).toContain("LEAKY_KEY");
+      // And the redaction sentinel should be present.
+      expect(caught!.message).toContain("<redacted>");
+    } finally {
+      h.cleanup();
+    }
+  });
+
+  test("reveal / list / status calls pass their args through unredacted (no secret in args)", async () => {
+    const h = setupAlwaysFailingPhantom();
+    try {
+      const { exec } = await import("../phantom.ts");
+      let caught: Error | undefined;
+      try {
+        await exec(["reveal", "SOME_KEY"]);
+      } catch (err) {
+        caught = err as Error;
+      }
+      expect(caught).toBeDefined();
+      // Reveal's second arg is a key name, not a secret value — it's fine
+      // for it to appear in error output. The point is that `add`'s third arg
+      // is redacted, and reveal's isn't wrongly redacted into uselessness.
+      expect(caught!.message).toContain("SOME_KEY");
+    } finally {
+      h.cleanup();
+    }
+  });
+});

package/src/__tests__/security.test.ts

@@ -0,0 +1,80 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { addSecret, exec, revealSecret } from "../phantom.ts";
+import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
+
+/**
+ * Regression tests for the Wave 9 security review findings. Each test here
+ * guards against a specific historical vulnerability — breaking any of these
+ * should be treated as a gating regression.
+ */
+
+describe("security — secret redaction in error messages", () => {
+  let h: Harness;
+  beforeEach(() => {
+    h = setupFakePhantom();
+    // Put a fake `phantom` on PATH that always fails on `add`, so we can
+    // trigger the error path that used to leak secret values.
+    Bun.write(
+      `${h.dir}/phantom`,
+      `#!/usr/bin/env bash
+case "$1" in
+  --version) echo "phantom fake 0.0.1" ;;
+  add) echo "simulated failure" >&2; exit 7 ;;
+  *) echo "ok" ;;
+esac
+`,
+    ).then(() => Bun.spawn(["chmod", "+x", `${h.dir}/phantom`]).exited);
+  });
+  afterEach(() => h.cleanup());
+
+  test("error thrown by `phantom add <K> <V>` does not contain the secret value", async () => {
+    // Give it a moment for the chmod/write to settle.
+    await Bun.spawn(["chmod", "+x", `${h.dir}/phantom`]).exited;
+    let caught: Error | undefined;
+    try {
+      await exec(["add", "MY_KEY", "super-secret-value-XYZ123"]);
+    } catch (err) {
+      caught = err as Error;
+    }
+    expect(caught).toBeDefined();
+    expect(caught!.message).not.toContain("super-secret-value-XYZ123");
+    expect(caught!.message).toContain("<redacted>");
+  });
+});
+
+describe("security — fake phantom harness handles hostile secret values", () => {
+  let h: Harness;
+  beforeEach(() => {
+    h = setupFakePhantom();
+  });
+  afterEach(() => h.cleanup());
+
+  test("a secret containing single quotes does not break the harness", async () => {
+    const hostile = `value-with-'-quote-and-\"-and-$VAR-and-\\backslash`;
+    await addSecret("HOSTILE_KEY", hostile);
+    const revealed = await revealSecret("HOSTILE_KEY");
+    expect(revealed).toBe(hostile);
+    const vault = await readVault(h.dir);
+    expect(vault.HOSTILE_KEY).toBe(hostile);
+  });
+
+  test("a secret containing a newline survives round-trip", async () => {
+    const hostile = "first-line\n-second-line";
+    await addSecret("MULTILINE_KEY", hostile);
+    // revealSecret trims trailing whitespace via stdout.trim() — that's fine,
+    // but round-tripping the full value via the vault file should preserve it.
+    const vault = await readVault(h.dir);
+    expect(vault.MULTILINE_KEY).toBe(hostile);
+  });
+
+  test("a secret that looks like a Python expression is stored literally", async () => {
+    const hostile = `'; import os; os.system('echo pwned > /tmp/STACK_PWNED'); '`;
+    await addSecret("PYTHON_INJECTION_KEY", hostile);
+    const vault = await readVault(h.dir);
+    expect(vault.PYTHON_INJECTION_KEY).toBe(hostile);
+    // Sanity: the marker file must NOT exist — if the injection had fired,
+    // this file would have been created by /tmp/STACK_PWNED.
+    const { existsSync } = await import("node:fs");
+    expect(existsSync("/tmp/STACK_PWNED")).toBe(false);
+  });
+});

package/src/__tests__/supabase-provider.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import supabase from "../providers/supabase.ts";
+import type { ProviderContext } from "../providers/_base.ts";
+import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
+
+/**
+ * Supabase provider — exercised end-to-end with fetch mocked. Validates that
+ * we send the right payloads to the Supabase Management API, parse the
+ * responses correctly, and route secrets into the fake vault.
+ */
+describe("supabase provider (mocked fetch)", () => {
+  let h: Harness;
+  let realFetch: typeof fetch;
+
+  beforeEach(() => {
+    h = setupFakePhantom({
+      STACK_SUPABASE_ACCESS_TOKEN: "sbp_cached_valid_token",
+    });
+    realFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    h.cleanup();
+  });
+
+  test("reuses a cached token when the identity call succeeds", async () => {
+    globalThis.fetch = (async (url: string | URL | Request) => {
+      const u = String(url);
+      if (u.endsWith("/v1/profile")) {
+        return new Response(JSON.stringify({ id: "u1", email: "mason@example.com" }), {
+          status: 200,
+        });
+      }
+      throw new Error(`unexpected fetch ${u}`);
+    }) as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    const auth = await supabase.login(ctx);
+    expect(auth.token).toBe("sbp_cached_valid_token");
+    expect(auth.identity?.email).toBe("mason@example.com");
+  });
+
+  test("provision → materialize writes URL + anon + service_role", async () => {
+    const createdProject = {
+      id: "abcdefghij",
+      name: "stack-xyz",
+      region: "us-east-1",
+      organization_id: "org_1",
+    };
+
+    globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url);
+      const method = init?.method ?? "GET";
+      if (u.endsWith("/v1/organizations") && method === "GET") {
+        return new Response(JSON.stringify([{ id: "org_1", name: "Default" }]), { status: 200 });
+      }
+      if (u.endsWith("/v1/projects") && method === "POST") {
+        return new Response(JSON.stringify(createdProject), { status: 201 });
+      }
+      if (u.endsWith(`/v1/projects/${createdProject.id}/api-keys`)) {
+        return new Response(
+          JSON.stringify([
+            { name: "anon", api_key: "anon-key" },
+            { name: "service_role", api_key: "service-key" },
+          ]),
+          { status: 200 },
+        );
+      }
+      throw new Error(`unexpected fetch ${method} ${u}`);
+    }) as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    const auth = { token: "sbp_token", identity: {} };
+    const resource = await supabase.provision(ctx, auth, {});
+    expect(resource.id).toBe(createdProject.id);
+    expect(resource.region).toBe("us-east-1");
+
+    const materialized = await supabase.materialize(ctx, resource, auth);
+    expect(materialized.secrets.SUPABASE_URL).toBe(`https://${createdProject.id}.supabase.co`);
+    expect(materialized.secrets.SUPABASE_ANON_KEY).toBe("anon-key");
+    expect(materialized.secrets.SUPABASE_SERVICE_ROLE_KEY).toBe("service-key");
+    expect(materialized.mcp?.name).toBe("supabase");
+
+    // Provision also stashes the auto-generated DB password in Phantom.
+    const vault = await readVault(h.dir);
+    const dbPassKey = Object.keys(vault).find((k) => k.startsWith("SUPABASE_DB_PASSWORD_"));
+    expect(dbPassKey).toBeDefined();
+  });
+
+  test("bubbles up a useful error when the Management API rejects create", async () => {
+    globalThis.fetch = (async (url: string | URL | Request) => {
+      const u = String(url);
+      if (u.endsWith("/v1/organizations")) {
+        return new Response(JSON.stringify([{ id: "o", name: "x" }]), { status: 200 });
+      }
+      if (u.endsWith("/v1/projects")) {
+        return new Response("rate limited", { status: 429 });
+      }
+      throw new Error(`unexpected fetch ${u}`);
+    }) as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    await expect(supabase.provision(ctx, { token: "t" }, {})).rejects.toThrow(
+      /SUPABASE_CREATE_FAILED|project creation failed/,
+    );
+  });
+});

package/src/__tests__/templates.test.ts

@@ -0,0 +1,26 @@
+import { describe, expect, test } from "bun:test";
+import { listTemplates, loadTemplate } from "../templates.ts";
+import { listProviderNames } from "../providers/index.ts";
+
+describe("starter templates", () => {
+  test("all templates reference only registered providers", async () => {
+    const providerNames = new Set(listProviderNames());
+    const templates = listTemplates();
+    expect(templates.length).toBeGreaterThanOrEqual(4);
+    for (const name of templates) {
+      const template = await loadTemplate(name);
+      expect(template).toBeDefined();
+      for (const [serviceName, spec] of Object.entries(template?.services ?? {})) {
+        const providerName = spec.provider ?? serviceName;
+        expect(providerNames.has(providerName)).toBe(true);
+      }
+    }
+  });
+
+  test("every template declares at least one environment", async () => {
+    for (const name of listTemplates()) {
+      const template = await loadTemplate(name);
+      expect(template?.environments?.length ?? 0).toBeGreaterThanOrEqual(1);
+    }
+  });
+});

package/src/__tests__/turso-provider.test.ts

@@ -0,0 +1,71 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import turso from "../providers/turso.ts";
+import type { ProviderContext } from "../providers/_base.ts";
+import { type Harness, setupFakePhantom } from "./_harness.ts";
+
+describe("turso provider (mocked fetch)", () => {
+  let h: Harness;
+  let realFetch: typeof fetch;
+
+  beforeEach(() => {
+    h = setupFakePhantom();
+    realFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    h.cleanup();
+  });
+
+  test("provision creates a database and returns org/dbname resource id", async () => {
+    globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url);
+      const method = init?.method ?? "GET";
+      if (u.endsWith("/organizations") && method === "GET") {
+        return new Response(
+          JSON.stringify([{ slug: "my-org", name: "My Org" }]),
+          { status: 200 },
+        );
+      }
+      if (u.endsWith("/organizations/my-org/databases") && method === "POST") {
+        return new Response(
+          JSON.stringify({
+            database: { Name: "stack-xyz", Hostname: "stack-xyz-my-org.turso.io" },
+          }),
+          { status: 201 },
+        );
+      }
+      throw new Error(`unexpected ${method} ${u}`);
+    }) as unknown as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    const auth = { token: "turso-fake-platform-token", identity: {} };
+    const resource = await turso.provision(ctx, auth, {});
+    expect(resource.id).toBe("my-org/stack-xyz");
+    expect((resource.meta as { hostname?: string })?.hostname).toBe("stack-xyz-my-org.turso.io");
+  });
+
+  test("materialize mints an auth token and writes TURSO_DATABASE_URL", async () => {
+    const jwt = "eyJfake_jwt";
+    globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+      const u = String(url);
+      const method = init?.method ?? "GET";
+      if (u.endsWith("/auth/tokens") && method === "POST") {
+        return new Response(JSON.stringify({ jwt }), { status: 200 });
+      }
+      throw new Error(`unexpected ${method} ${u}`);
+    }) as unknown as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    const resource = {
+      id: "my-org/stack-xyz",
+      displayName: "stack-xyz",
+      meta: { hostname: "stack-xyz-my-org.turso.io" },
+    };
+    const auth = { token: "turso-platform-token", identity: {} };
+    const materialized = await turso.materialize(ctx, resource, auth);
+    expect(materialized.secrets.TURSO_DATABASE_URL).toBe("libsql://stack-xyz-my-org.turso.io");
+    expect(materialized.secrets.TURSO_AUTH_TOKEN).toBe(jwt);
+    expect(materialized.secrets.TURSO_PLATFORM_TOKEN).toBe("turso-platform-token");
+  });
+});