@automattic/vip 4.1.5 → 4.1.6

package/internal/devenv/hostops/elevate_message_test.go

@@ -1,35 +0,0 @@
-package hostops
-
-import "testing"
-
-func TestPlanActions(t *testing.T) {
-	if a := planActions(PrivilegedPlan{}); len(a) != 0 {
-		t.Fatalf("empty plan => no actions, got %v", a)
-	}
-	if a := planActions(PrivilegedPlan{CAPath: "/x/ca.pem", HostsAdd: []string{"a.test"}}); len(a) != 2 {
-		t.Fatalf("trust+hosts => 2 actions, got %v", a)
-	}
-	if a := planActions(PrivilegedPlan{CAPath: "/x/ca.pem"}); len(a) != 1 || a[0] != "trust the local development HTTPS certificate" {
-		t.Fatalf("trust-only actions wrong: %v", a)
-	}
-	if a := planActions(PrivilegedPlan{HostsRemove: true}); len(a) != 1 {
-		t.Fatalf("remove => 1 action, got %v", a)
-	}
-}
-
-func TestJoinAnd(t *testing.T) {
-	cases := []struct {
-		in   []string
-		want string
-	}{
-		{nil, ""},
-		{[]string{"one"}, "one"},
-		{[]string{"one", "two"}, "one and two"},
-		{[]string{"one", "two", "three"}, "one, two, and three"},
-	}
-	for _, c := range cases {
-		if got := joinAnd(c.in); got != c.want {
-			t.Fatalf("joinAnd(%v) = %q, want %q", c.in, got, c.want)
-		}
-	}
-}

package/internal/devenv/hostops/elevate_test.go

@@ -1,111 +0,0 @@
-package hostops
-
-import (
-	"strings"
-	"testing"
-)
-
-func TestBuildPrivilegedScriptIncludesBothOps(t *testing.T) {
-	plan := PrivilegedPlan{
-		GOOS:     "darwin",
-		CAPath:   "/x/ca.pem",
-		HostsAdd: []string{"example.test"},
-	}
-	script, err := buildPrivilegedScript(plan)
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(script, "add-trusted-cert") {
-		t.Fatalf("script missing trust op:\n%s", script)
-	}
-	if !strings.Contains(script, "example.test") || !strings.Contains(script, "/etc/hosts") {
-		t.Fatalf("script missing hosts op:\n%s", script)
-	}
-	// the script must be a single set -e shell program
-	if !strings.HasPrefix(script, "#!/bin/sh") {
-		t.Fatalf("script should be a /bin/sh program:\n%s", script)
-	}
-}
-
-func TestBuildPrivilegedScriptTrustOnly(t *testing.T) {
-	script, err := buildPrivilegedScript(PrivilegedPlan{GOOS: "darwin", CAPath: "/x/ca.pem"})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if strings.Contains(script, "/etc/hosts") {
-		t.Fatalf("no hosts ops requested; script should not touch /etc/hosts:\n%s", script)
-	}
-}
-
-func TestBuildPrivilegedScriptRemoveOnly(t *testing.T) {
-	script, err := buildPrivilegedScript(PrivilegedPlan{GOOS: "darwin", HostsRemove: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	if !strings.Contains(script, "/etc/hosts") || !strings.Contains(script, beginMarker) {
-		t.Fatalf("remove plan should strip the managed block:\n%s", script)
-	}
-	if strings.Contains(script, "add-trusted-cert") {
-		t.Fatalf("no CAPath given; script should not trust a cert:\n%s", script)
-	}
-}
-
-func TestBuildPrivilegedScriptUnsupportedOSErrors(t *testing.T) {
-	if _, err := buildPrivilegedScript(PrivilegedPlan{GOOS: "plan9", CAPath: "/x/ca.pem"}); err == nil {
-		t.Fatal("expected error: trust not supported on plan9")
-	}
-}
-
-func TestBuildPrivilegedScriptRejectsBadHostname(t *testing.T) {
-	_, err := buildPrivilegedScript(PrivilegedPlan{GOOS: "darwin", HostsAdd: []string{"bad host\nattacker"}})
-	if err == nil {
-		t.Fatal("expected error for hostname with embedded whitespace/newline")
-	}
-}
-
-func TestBuildPrivilegedScriptAddBeatsRemove(t *testing.T) {
-	script, err := buildPrivilegedScript(PrivilegedPlan{GOOS: "darwin", HostsAdd: []string{"a.test"}, HostsRemove: true})
-	if err != nil {
-		t.Fatal(err)
-	}
-	// HostsAdd path writes the block (append heredoc); it must include the host.
-	if !strings.Contains(script, "127.0.0.1 a.test") {
-		t.Fatalf("HostsAdd should win when both set:\n%s", script)
-	}
-}
-
-func TestBuildPowerShellScriptWritesWindowsHostsAndTrust(t *testing.T) {
-	ps, err := buildWindowsScript(PrivilegedPlan{CAPath: `C:\tmp\ca.pem`, HostsAdd: []string{"demo.vipdev.site"}})
-	if err != nil {
-		t.Fatalf("buildWindowsScript: %v", err)
-	}
-	for _, want := range []string{
-		`certutil`, `-addstore`, `Root`, `ca.pem`,
-		`drivers\etc\hosts`,
-		beginMarker, endMarker, "127.0.0.1 demo.vipdev.site",
-	} {
-		if !strings.Contains(ps, want) {
-			t.Fatalf("powershell script missing %q:\n%s", want, ps)
-		}
-	}
-}
-
-func TestBuildWindowsScriptRejectsBadHost(t *testing.T) {
-	if _, err := buildWindowsScript(PrivilegedPlan{HostsAdd: []string{"bad host"}}); err == nil {
-		t.Fatal("expected error for hostname with whitespace")
-	}
-}
-
-func TestShellQuote(t *testing.T) {
-	cases := map[string]string{
-		"":       "''",
-		"abc":    "'abc'",
-		"a'b":    `'a'\''b'`,
-		"/a b/c": "'/a b/c'",
-	}
-	for in, want := range cases {
-		if got := shellQuote(in); got != want {
-			t.Errorf("shellQuote(%q) = %q, want %q", in, got, want)
-		}
-	}
-}

package/internal/devenv/hostops/hosts.go

@@ -1,255 +0,0 @@
-// Package hostops performs the two host-privileged operations a vip dev
-// environment needs — trusting the local CA in the system trust store and
-// editing the managed /etc/hosts block — and runs them under a SINGLE privilege
-// elevation (spec §11). Plan 4 calls hostops.Apply(PrivilegedPlan) once: it
-// builds one /bin/sh script doing both ops and runs it behind one sudo prompt
-// (sudo, not macOS osascript — osascript's detached context can't authorize the
-// System-keychain trust change; see Apply). The block format and trust/elevation
-// command construction are pure and unit-tested; the elevated run is exercised
-// by the integration checklist. RenderHostsBlock previews the block; EnsureHosts
-// /RemoveHosts are the path-injected reference editors used in tests.
-package hostops
-
-import (
-	"fmt"
-	"os"
-	"strings"
-)
-
-const (
-	beginMarker = "# BEGIN vip-dev-env"
-	endMarker   = "# END vip-dev-env"
-)
-
-// renderBlock builds the managed hosts block for the given hostnames.
-func renderBlock(hosts []string) string {
-	var b strings.Builder
-	b.WriteString(beginMarker + "\n")
-	for _, h := range hosts {
-		b.WriteString("127.0.0.1 " + h + "\n")
-	}
-	b.WriteString(endMarker + "\n")
-	return b.String()
-}
-
-// validateHosts rejects hostnames that would corrupt the hosts file (embedded
-// whitespace/newlines could inject unmanaged entries when written as root).
-func validateHosts(hosts []string) error {
-	for _, h := range hosts {
-		if h == "" || strings.ContainsAny(h, " \t\r\n") {
-			return fmt.Errorf("hostops: invalid hostname %q", h)
-		}
-	}
-	return nil
-}
-
-// stripBlock returns content with the managed block removed. It errors on a
-// malformed file (a begin marker without a matching end marker) rather than
-// silently discarding everything to EOF, which would lose unmanaged content.
-func stripBlock(content string) (string, error) {
-	lines := strings.Split(content, "\n")
-	var out []string
-	inBlock := false
-	for _, ln := range lines {
-		trimmed := strings.TrimSpace(ln)
-		if trimmed == beginMarker {
-			inBlock = true
-			continue
-		}
-		if trimmed == endMarker {
-			inBlock = false
-			continue
-		}
-		if !inBlock {
-			out = append(out, ln)
-		}
-	}
-	if inBlock {
-		return "", fmt.Errorf("hostops: malformed hosts file: %s without matching %s", beginMarker, endMarker)
-	}
-	return strings.Join(out, "\n"), nil
-}
-
-// EnsureHosts writes (or replaces) the managed block in the hosts file at path,
-// mapping each hostname to 127.0.0.1. Idempotent; preserves other content. An
-// empty hosts slice removes the managed block (delegates to RemoveHosts).
-func EnsureHosts(path string, hosts []string) error {
-	if len(hosts) == 0 {
-		return RemoveHosts(path)
-	}
-	if err := validateHosts(hosts); err != nil {
-		return err
-	}
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-	stripped, err := stripBlock(string(b))
-	if err != nil {
-		return err
-	}
-	stripped = strings.TrimRight(stripped, "\n")
-	block := renderBlock(hosts)
-	updated := block
-	if stripped != "" {
-		updated = stripped + "\n" + block
-	}
-	return os.WriteFile(path, []byte(updated), 0o644)
-}
-
-// HostsPresent reports whether the managed block in the real /etc/hosts already
-// contains every hostname in hosts — a non-privileged read so Start can skip the
-// sudo elevation when the entries are unchanged. An empty list is trivially
-// present; an unreadable file reports false (fall back to elevating).
-func HostsPresent(hosts []string) bool {
-	if len(hosts) == 0 {
-		return true
-	}
-	path := etcHosts
-	if currentContext() == ctxWindows {
-		path = windowsHostsReadPath()
-	}
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return false
-	}
-	return hostsPresentIn(string(b), hosts)
-}
-
-// ManagedHostsMatch reports whether the managed block contains exactly hosts.
-// Unlike HostsPresent, it also detects stale extra entries, so callers that own
-// the complete global snapshot can safely decide whether a rewrite is needed.
-func ManagedHostsMatch(hosts []string) bool {
-	path := etcHosts
-	if currentContext() == ctxWindows {
-		path = windowsHostsReadPath()
-	}
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return false
-	}
-	return managedHostsMatchIn(string(b), hosts)
-}
-
-// windowsHostsReadPath returns a non-privileged readable path to the Windows
-// hosts file: the drvfs mount under WSL, else the native Windows path.
-func windowsHostsReadPath() string {
-	if _, err := os.Stat("/mnt/c/Windows/System32/drivers/etc/hosts"); err == nil {
-		return "/mnt/c/Windows/System32/drivers/etc/hosts"
-	}
-	if sr := os.Getenv("SystemRoot"); sr != "" {
-		return sr + `\System32\drivers\etc\hosts`
-	}
-	return `C:\Windows\System32\drivers\etc\hosts`
-}
-
-// hostsPresentIn is the pure core of HostsPresent: it reports whether the
-// managed block within content lists every requested hostname.
-func hostsPresentIn(content string, hosts []string) bool {
-	have := map[string]bool{}
-	inBlock := false
-	for _, ln := range strings.Split(content, "\n") {
-		t := strings.TrimSpace(ln)
-		switch {
-		case t == beginMarker:
-			inBlock = true
-		case t == endMarker:
-			inBlock = false
-		case inBlock:
-			fields := strings.Fields(t)
-			if len(fields) < 2 {
-				continue
-			}
-			for _, name := range fields[1:] { // skip the leading IP
-				have[name] = true
-			}
-		}
-	}
-	for _, h := range hosts {
-		if !have[h] {
-			return false
-		}
-	}
-	return true
-}
-
-func managedHostsMatchIn(content string, hosts []string) bool {
-	if validateHosts(hosts) != nil {
-		return false
-	}
-	want := map[string]bool{}
-	for _, host := range hosts {
-		want[host] = true
-	}
-	have := map[string]bool{}
-	inBlock := false
-	sawBegin := false
-	sawEnd := false
-	for _, line := range strings.Split(content, "\n") {
-		trimmed := strings.TrimSpace(line)
-		switch trimmed {
-		case beginMarker:
-			if inBlock || sawBegin {
-				return false
-			}
-			inBlock = true
-			sawBegin = true
-		case endMarker:
-			if !inBlock || sawEnd {
-				return false
-			}
-			inBlock = false
-			sawEnd = true
-		default:
-			if !inBlock {
-				continue
-			}
-			fields := strings.Fields(trimmed)
-			if len(fields) < 2 {
-				continue
-			}
-			for _, name := range fields[1:] {
-				have[name] = true
-			}
-		}
-	}
-	if inBlock || sawBegin != sawEnd {
-		return false
-	}
-	if len(want) == 0 && !sawBegin {
-		return true
-	}
-	if len(have) != len(want) {
-		return false
-	}
-	for host := range want {
-		if !have[host] {
-			return false
-		}
-	}
-	return true
-}
-
-// RenderHostsBlock returns the managed /etc/hosts block (begin/end markers and
-// the 127.0.0.1 mappings) for the given hostnames, without touching any file —
-// for Plan 4 to preview what Apply will write under elevation.
-func RenderHostsBlock(hosts []string) string {
-	return renderBlock(hosts)
-}
-
-// RemoveHosts strips the managed block from the hosts file at path.
-func RemoveHosts(path string) error {
-	b, err := os.ReadFile(path)
-	if err != nil {
-		return err
-	}
-	stripped, err := stripBlock(string(b))
-	if err != nil {
-		return err
-	}
-	stripped = strings.TrimRight(stripped, "\n")
-	if stripped == "" {
-		return os.WriteFile(path, []byte(""), 0o644)
-	}
-	return os.WriteFile(path, []byte(stripped+"\n"), 0o644)
-}

package/internal/devenv/hostops/hosts_test.go

@@ -1,178 +0,0 @@
-package hostops
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-func TestEnsureHostsAddsBlockIdempotently(t *testing.T) {
-	p := filepath.Join(t.TempDir(), "hosts")
-	if err := os.WriteFile(p, []byte("127.0.0.1 localhost\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	hosts := []string{"example.test", "foo.example.test"}
-	if err := EnsureHosts(p, hosts); err != nil {
-		t.Fatal(err)
-	}
-	// second call must not duplicate the block
-	if err := EnsureHosts(p, hosts); err != nil {
-		t.Fatal(err)
-	}
-	b, _ := os.ReadFile(p)
-	got := string(b)
-	if c := strings.Count(got, beginMarker); c != 1 {
-		t.Fatalf("block written %d times, want 1:\n%s", c, got)
-	}
-	for _, h := range hosts {
-		if !strings.Contains(got, "127.0.0.1 "+h) {
-			t.Fatalf("missing entry for %s:\n%s", h, got)
-		}
-	}
-	if !strings.Contains(got, "127.0.0.1 localhost") {
-		t.Fatalf("clobbered existing content:\n%s", got)
-	}
-}
-
-func TestEnsureHostsUpdatesBlock(t *testing.T) {
-	p := filepath.Join(t.TempDir(), "hosts")
-	if err := os.WriteFile(p, []byte("127.0.0.1 localhost\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := EnsureHosts(p, []string{"old.test"}); err != nil {
-		t.Fatal(err)
-	}
-	if err := EnsureHosts(p, []string{"new.test"}); err != nil {
-		t.Fatal(err)
-	}
-	b, _ := os.ReadFile(p)
-	got := string(b)
-	if strings.Contains(got, "old.test") {
-		t.Fatalf("stale entry not replaced:\n%s", got)
-	}
-	if !strings.Contains(got, "new.test") {
-		t.Fatalf("new entry missing:\n%s", got)
-	}
-}
-
-func TestRemoveHostsStripsBlock(t *testing.T) {
-	p := filepath.Join(t.TempDir(), "hosts")
-	if err := os.WriteFile(p, []byte("127.0.0.1 localhost\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := EnsureHosts(p, []string{"x.test"}); err != nil {
-		t.Fatal(err)
-	}
-	if err := RemoveHosts(p); err != nil {
-		t.Fatal(err)
-	}
-	b, _ := os.ReadFile(p)
-	got := string(b)
-	if strings.Contains(got, beginMarker) || strings.Contains(got, "x.test") {
-		t.Fatalf("block not removed:\n%s", got)
-	}
-	if !strings.Contains(got, "127.0.0.1 localhost") {
-		t.Fatalf("clobbered existing content:\n%s", got)
-	}
-}
-
-func TestEnsureHostsEmptyFileNoLeadingNewline(t *testing.T) {
-	p := filepath.Join(t.TempDir(), "hosts")
-	if err := os.WriteFile(p, []byte(""), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := EnsureHosts(p, []string{"a.test"}); err != nil {
-		t.Fatal(err)
-	}
-	b, _ := os.ReadFile(p)
-	if strings.HasPrefix(string(b), "\n") {
-		t.Fatalf("output must not start with a blank line:\n%q", string(b))
-	}
-	if !strings.HasPrefix(string(b), beginMarker) {
-		t.Fatalf("expected block at start of empty file:\n%q", string(b))
-	}
-}
-
-func TestEnsureHostsEmptySliceRemovesBlock(t *testing.T) {
-	p := filepath.Join(t.TempDir(), "hosts")
-	if err := os.WriteFile(p, []byte("127.0.0.1 localhost\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := EnsureHosts(p, []string{"x.test"}); err != nil {
-		t.Fatal(err)
-	}
-	if err := EnsureHosts(p, nil); err != nil {
-		t.Fatal(err)
-	}
-	b, _ := os.ReadFile(p)
-	got := string(b)
-	if strings.Contains(got, beginMarker) || strings.Contains(got, "x.test") {
-		t.Fatalf("empty slice should remove the block:\n%s", got)
-	}
-	if !strings.Contains(got, "127.0.0.1 localhost") {
-		t.Fatalf("clobbered existing content:\n%s", got)
-	}
-}
-
-func TestEnsureHostsRejectsBadHostname(t *testing.T) {
-	p := filepath.Join(t.TempDir(), "hosts")
-	if err := os.WriteFile(p, []byte("127.0.0.1 localhost\n"), 0o644); err != nil {
-		t.Fatal(err)
-	}
-	if err := EnsureHosts(p, []string{"evil host\n1.2.3.4 attacker"}); err == nil {
-		t.Fatal("expected error for hostname with embedded whitespace/newline")
-	}
-}
-
-func TestStripBlockUnclosedErrors(t *testing.T) {
-	_, err := stripBlock("127.0.0.1 localhost\n" + beginMarker + "\n127.0.0.1 a.test\n")
-	if err == nil {
-		t.Fatal("expected error for begin marker without matching end marker")
-	}
-}
-
-func TestRenderHostsBlockPreview(t *testing.T) {
-	got := RenderHostsBlock([]string{"a.test", "b.test"})
-	if !strings.Contains(got, beginMarker) || !strings.Contains(got, endMarker) {
-		t.Fatalf("preview missing markers:\n%s", got)
-	}
-	for _, h := range []string{"127.0.0.1 a.test", "127.0.0.1 b.test"} {
-		if !strings.Contains(got, h) {
-			t.Fatalf("preview missing %q:\n%s", h, got)
-		}
-	}
-}
-
-func TestHostsPresentIn(t *testing.T) {
-	content := "127.0.0.1 localhost\n" + beginMarker + "\n127.0.0.1 a.test\n127.0.0.1 b.test\n" + endMarker + "\n"
-	if !hostsPresentIn(content, []string{"a.test", "b.test"}) {
-		t.Fatal("both managed hosts should be present")
-	}
-	if hostsPresentIn(content, []string{"a.test", "c.test"}) {
-		t.Fatal("c.test is not in the managed block")
-	}
-	// A host outside the managed block does not count.
-	if hostsPresentIn("127.0.0.1 outside.test\n", []string{"outside.test"}) {
-		t.Fatal("hosts outside the managed block must not count as present")
-	}
-}
-
-func TestManagedHostsMatchInRequiresExactSnapshot(t *testing.T) {
-	content := "127.0.0.1 localhost\n" + RenderHostsBlock([]string{"a.test", "b.test"})
-	if !managedHostsMatchIn(content, []string{"b.test", "a.test"}) {
-		t.Fatal("same managed hosts in a different order should match")
-	}
-	if managedHostsMatchIn(content, []string{"a.test"}) {
-		t.Fatal("an extra managed hostname must make the snapshot differ")
-	}
-	if managedHostsMatchIn(content, []string{"a.test", "b.test", "c.test"}) {
-		t.Fatal("a missing managed hostname must make the snapshot differ")
-	}
-	if managedHostsMatchIn("# BEGIN vip-dev-env\n127.0.0.1 a.test\n", []string{"a.test"}) {
-		t.Fatal("a malformed managed block must not match")
-	}
-	if hostsPresentIn("# BEGIN vip-dev-env\n\n# END vip-dev-env\n", []string{"a.test"}) {
-		t.Fatal("a blank line in the managed block must not invent a hostname")
-	}
-}

package/internal/devenv/hostops/thumbprint_test.go

@@ -1,57 +0,0 @@
-package hostops
-
-import (
-	"crypto/ed25519"
-	"crypto/rand"
-	"crypto/sha1" // #nosec G505 -- test verifies the SHA-1 thumbprint format, not a security primitive
-	"crypto/x509"
-	"crypto/x509/pkix"
-	"encoding/hex"
-	"encoding/pem"
-	"math/big"
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-	"time"
-)
-
-// TestCertThumbprint verifies certThumbprint reads a PEM cert and returns its
-// SHA-1 thumbprint as uppercase hex — the identifier the Windows cert store uses.
-func TestCertThumbprint(t *testing.T) {
-	pub, priv, err := ed25519.GenerateKey(rand.Reader)
-	if err != nil {
-		t.Fatal(err)
-	}
-	tmpl := &x509.Certificate{
-		SerialNumber:          big.NewInt(42),
-		Subject:               pkix.Name{CommonName: "WPVIP Test CA"},
-		NotBefore:             time.Now().Add(-time.Hour),
-		NotAfter:              time.Now().Add(time.Hour),
-		IsCA:                  true,
-		BasicConstraintsValid: true,
-	}
-	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, pub, priv)
-	if err != nil {
-		t.Fatal(err)
-	}
-	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
-
-	p := filepath.Join(t.TempDir(), "ca.pem")
-	if err := os.WriteFile(p, pemBytes, 0o600); err != nil {
-		t.Fatal(err)
-	}
-
-	got, err := certThumbprint(p)
-	if err != nil {
-		t.Fatalf("certThumbprint: %v", err)
-	}
-	sum := sha1.Sum(der) // #nosec G401 -- test comparison, not security
-	want := strings.ToUpper(hex.EncodeToString(sum[:]))
-	if got != want {
-		t.Fatalf("thumbprint = %q, want %q", got, want)
-	}
-	if len(got) != 40 {
-		t.Fatalf("thumbprint %q is not 40 hex chars", got)
-	}
-}