@automattic/vip 4.1.5 → 4.1.6

package/internal/parity/edge_workers_prompt_test.go

@@ -1,151 +0,0 @@
-//go:build parity && !windows
-
-package parity
-
-import (
-	"bytes"
-	"context"
-	"errors"
-	"io"
-	"os/exec"
-	"reflect"
-	"strings"
-	"syscall"
-	"testing"
-	"time"
-
-	"github.com/creack/pty"
-)
-
-func runEdgePrompt(t *testing.T, bin, dir string, args, env []string, prompt, answer string, redirect bool) (string, int) {
-	t.Helper()
-	ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
-	defer cancel()
-	cmd := exec.CommandContext(ctx, bin, args...)
-	cmd.Dir = dir
-	cmd.Env = env
-	// The PTY owns its session; on timeout also stop the Node dispatch child.
-	cmd.Cancel = func() error {
-		if cmd.Process == nil {
-			return nil
-		}
-		return syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL)
-	}
-	var stdout bytes.Buffer
-	if redirect {
-		cmd.Stdout = &stdout
-	}
-	master, err := pty.StartWithSize(cmd, &pty.Winsize{Rows: 24, Cols: 160})
-	if err != nil {
-		t.Fatal(err)
-	}
-	defer master.Close()
-	chunks := make(chan string, 128)
-	readDone := make(chan struct{})
-	go func() {
-		defer close(readDone)
-		buffer := make([]byte, 4096)
-		for {
-			n, err := master.Read(buffer)
-			if n > 0 {
-				chunks <- string(buffer[:n])
-			}
-			if err != nil {
-				return
-			}
-		}
-	}()
-	done := make(chan error, 1)
-	go func() { done <- cmd.Wait() }()
-	var transcript strings.Builder
-	answered := false
-	queries := 0
-	var answerTimer <-chan time.Time
-	for {
-		select {
-		case chunk := <-chunks:
-			transcript.WriteString(chunk)
-			// Survey asks the terminal for its cursor position before reading
-			// input. A PTY is only a byte stream, so emulate the terminal reply.
-			for count := strings.Count(transcript.String(), "[6n"); queries < count; queries++ {
-				_, _ = io.WriteString(master, "\x1b[24;80R")
-			}
-			if prompt != "" && !answered && answerTimer == nil && strings.Contains(transcript.String(), prompt) {
-				answerTimer = time.After(100 * time.Millisecond)
-			}
-		case <-answerTimer:
-			answered = true
-			answerTimer = nil
-			if _, err := io.WriteString(master, answer+"\r"); err != nil {
-				t.Fatal(err)
-			}
-		case err := <-done:
-			master.Close()
-			<-readDone
-			for len(chunks) > 0 {
-				transcript.WriteString(<-chunks)
-			}
-			if ctx.Err() != nil {
-				t.Fatalf("prompt timed out; answered=%v transcript=%s", answered, transcript.String())
-			}
-			if prompt != "" && !answered {
-				t.Fatalf("missing prompt %q: %s", prompt, transcript.String())
-			}
-			code := 0
-			var exitErr *exec.ExitError
-			if errors.As(err, &exitErr) {
-				code = exitErr.ExitCode()
-			} else if err != nil {
-				t.Fatal(err)
-			}
-			return stdout.String() + transcript.String(), code
-		}
-	}
-}
-
-func TestEdgeWorkersPromptParity(t *testing.T) {
-	rig, skip := differentialAvailable(t)
-	if skip != "" {
-		t.Skip(LoudSkip("Edge Workers terminal prompts", skip))
-	}
-	for _, tc := range []struct {
-		name, action, answer, state, fixture, prompt string
-		redirect                                     bool
-		want                                         int
-		ops                                          []string
-	}{
-		{"deploy-approve", "deploy", "y", "empty", "two-workers", "Deploy 2 edge workers (a, b) to example-app.production?", false, 0, []string{"create:a", "create:b"}},
-		{"deploy-decline", "deploy", "n", "empty", "two-workers", "Deploy 2 edge workers (a, b) to example-app.production?", false, 1, []string{}},
-		{"enable-decline", "enable", "n", "inactive", "basic", `Enable edge worker "headers" on example-app.production?`, false, 1, []string{}},
-		{"delete-approve", "delete", "y", "inactive", "basic", `Permanently delete edge worker "headers" from example-app.production?`, false, 0, []string{"delete:headers"}},
-		{"delete-decline", "delete", "n", "inactive", "basic", `Permanently delete edge worker "headers" from example-app.production?`, false, 1, []string{}},
-		{"stdout-redirect", "deploy", "", "empty", "basic", "", true, 1, []string{}},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			for _, bin := range []string{rig.nodeBin, rig.goBin} {
-				dir := edgeFixtureProject(t, tc.fixture)
-				api := newEdgeFixtureAPI(tc.state)
-				rig.serve(t, api)
-				args := []string{"edge-workers", tc.action, "headers", "--app=42", "--env=production"}
-				if tc.action == "deploy" {
-					args = append(args, "--skip-build")
-					if tc.fixture == "two-workers" {
-						args[2] = "--all"
-					}
-				}
-				env := FixtureEnv(rig.scenarioEnv(&Scenario{Env: map[string]string{"NO_COLOR": "1", "TERM": "xterm", "VIP_NON_INTERACTIVE": "0"}}))
-				transcript, code := runEdgePrompt(t, bin, dir, args, env, tc.prompt, tc.answer, tc.redirect)
-				if code != tc.want {
-					t.Errorf("exit %d want %d: %s", code, tc.want, transcript)
-				}
-				ops, _ := api.snapshot()
-				if !reflect.DeepEqual(ops, tc.ops) {
-					t.Errorf("operations %v want %v", ops, tc.ops)
-				}
-				if tc.redirect && !strings.Contains(transcript, "Refusing to deploy") {
-					t.Errorf("missing redirected-output refusal: %s", transcript)
-				}
-			}
-		})
-	}
-}

package/internal/parity/env.go

@@ -1,176 +0,0 @@
-//go:build parity
-
-package parity
-
-import (
-	"encoding/base64"
-	"os"
-	"sort"
-	"strings"
-	"time"
-
-	json "encoding/json/v2"
-)
-
-// FixtureAPIHost is the API host every fixture subprocess gets unless the
-// scenario points it at its own httptest server. Port 1 on loopback is
-// closed on every supported platform, so a scenario that forgets to stand up
-// a mock fails with a connection error instead of quietly talking to the
-// real production API with whatever credential happened to be lying around.
-const FixtureAPIHost = "http://127.0.0.1:1"
-
-// fixtureTokenUserID is the `id` claim in FixtureToken. Scenario tests that
-// mint their own token use the same id so recordings stay interchangeable.
-const fixtureTokenUserID = 42
-
-// scenarioEnvPassthrough is the ONLY set of parent variables carried into a
-// fixture subprocess. Everything else — credentials, API hosts, proxies,
-// XDG overrides, DEBUG namespaces, colour knobs — is dropped, because the
-// suite must produce identical results on a developer laptop with live
-// credentials and in a bare CI container with none.
-//
-// Keep this list to variables the operating system and the language runtimes
-// need in order to start a process at all. If a scenario needs anything else,
-// it sets it explicitly.
-var scenarioEnvPassthrough = []string{
-	// POSIX process basics. PATH is required for the `#!/usr/bin/env node`
-	// shebang on the Node binary; HOME for per-user config/credential lookup.
-	"PATH",
-	"HOME",
-	"TMPDIR",
-	"TMP",
-	"TEMP",
-	"USER",
-	"LOGNAME",
-	"SHELL",
-	"LANG",
-	"LC_ALL",
-
-	// Windows equivalents: without these a child process cannot resolve
-	// system DLLs, the user profile, or executable extensions.
-	"SystemRoot",
-	"SystemDrive",
-	"ComSpec",
-	"PATHEXT",
-	"USERPROFILE",
-	"HOMEDRIVE",
-	"HOMEPATH",
-	"WINDIR",
-	"APPDATA",
-	"LOCALAPPDATA",
-	"PROGRAMDATA",
-	"ProgramFiles",
-	"ProgramFiles(x86)",
-}
-
-// scenarioEnvPinned is the explicitly-constructed base. These values are the
-// same on every machine; a scenario's own Env map overrides any of them.
-//
-//   - API_HOST      dead loopback (see FixtureAPIHost)
-//   - VIP_TOKEN_OVERRIDE  a deterministic fake JWT that authenticates the GO
-//     binary without touching the host keychain. It does nothing for Node and
-//     never did: the variable has never existed upstream (`git log --all -S` on
-//     Automattic/vip returns zero commits), Token.get() reads getKeychain() and
-//     nothing else. Scenarios that run the real Node binary seed a credential
-//     instead — see keychain.go and differential_test.go. Keeping the override
-//     here is what stops the ~50 mock-only scenarios from having to write
-//     credentials at all.
-//   - NODE_ENV/GO_ENV     test mode: suppresses Node's update-notifier network
-//     call, and is the gate Go still applies to the token override
-//     (internal/auth/store.go tokenOverride).
-//   - DO_NOT_TRACK        no telemetry from either CLI. Note this does NOT stop
-//     Node from creating its "<service>-uuid" keychain entry: trackEvent calls
-//     Token.uuid() (src/lib/tracker.ts:55) before any opt-out check, which is
-//     why that name is in ParityKeychainServices.
-func scenarioEnvPinned() map[string]string {
-	return map[string]string{
-		"API_HOST":           FixtureAPIHost,
-		"VIP_TOKEN_OVERRIDE": FixtureToken(),
-		"NODE_ENV":           "test",
-		"GO_ENV":             "test",
-		"DO_NOT_TRACK":       "1",
-	}
-}
-
-// ScenarioEnv builds the environment for a fixture-suite subprocess.
-//
-// It is the fixture-suite counterpart of BuildParkerEnv: a scrubbed,
-// explicitly-constructed base rather than an inherited one. Composition order
-// is passthrough allowlist → pinned base → caller overrides, so a scenario can
-// always win.
-//
-// Pass os.Environ() as parent. Anything not in scenarioEnvPassthrough and not
-// in the pinned base is ABSENT from the result — absence, not an empty value,
-// because the CLIs use LookupEnv-style presence checks in places.
-func ScenarioEnv(parent []string, overrides map[string]string) []string {
-	pinned := scenarioEnvPinned()
-
-	allow := make(map[string]bool, len(scenarioEnvPassthrough))
-	for _, key := range scenarioEnvPassthrough {
-		allow[key] = true
-	}
-
-	out := make(map[string]string, len(allow)+len(pinned)+len(overrides))
-	for _, kv := range parent {
-		key, value, ok := strings.Cut(kv, "=")
-		if !ok || !allow[key] {
-			continue
-		}
-		out[key] = value
-	}
-	for key, value := range pinned {
-		out[key] = value
-	}
-	for key, value := range overrides {
-		out[key] = value
-	}
-
-	keys := make([]string, 0, len(out))
-	for key := range out {
-		keys = append(keys, key)
-	}
-	sort.Strings(keys)
-
-	env := make([]string, 0, len(keys))
-	for _, key := range keys {
-		env = append(env, key+"="+out[key])
-	}
-	return env
-}
-
-// FixtureEnv is the call-site form of ScenarioEnv: it takes the real process
-// environment as the parent and applies the scenario's overrides.
-//
-// Every fixture scenario builds its subprocess environment through this
-// function. os.Environ() must not appear anywhere else in the package —
-// TestNoAmbientEnvInheritanceInScenarios enforces that, because a single bare
-// os.Environ() re-opens the hole where the suite passes on a laptop with live
-// credentials and fails in a bare CI container.
-func FixtureEnv(overrides map[string]string) []string {
-	return ScenarioEnv(os.Environ(), overrides)
-}
-
-// FixtureToken mints the deterministic credential pinned into every fixture
-// subprocess: an unsigned JWT with a fixed user id and a one-hour validity
-// window. Both CLIs only decode the payload (they never verify the
-// signature), so this is enough to get past the auth wall without touching a
-// keychain or a real API.
-//
-// The exp claim is relative to now, so the token cannot rot in the repo.
-func FixtureToken() string {
-	now := time.Now()
-	header, err := json.Marshal(map[string]any{"alg": "none", "typ": "JWT"})
-	if err != nil {
-		return ""
-	}
-	claims, err := json.Marshal(map[string]any{
-		"id":  fixtureTokenUserID,
-		"iat": now.Add(-time.Hour).Unix(),
-		"exp": now.Add(time.Hour).Unix(),
-	})
-	if err != nil {
-		return ""
-	}
-	enc := base64.RawURLEncoding
-	return enc.EncodeToString(header) + "." + enc.EncodeToString(claims) + "."
-}

package/internal/parity/env_test.go

@@ -1,211 +0,0 @@
-//go:build parity
-
-package parity
-
-import (
-	"os"
-	"path/filepath"
-	"strings"
-	"testing"
-)
-
-// hostileParent is the environment of a developer laptop that has live
-// credentials, a corporate proxy, and personal overrides exported — exactly
-// the ambient state the fixture suite must be immune to.
-func hostileParent() []string {
-	return []string{
-		"PATH=/usr/bin:/bin",
-		"HOME=/Users/developer",
-		"VIP_TOKEN_OVERRIDE=live.laptop.jwt",
-		"WPVIP_DEPLOY_TOKEN=live-deploy-key",
-		"API_HOST=https://api.wpvip.com",
-		"HTTP_PROXY=http://corp-proxy:8080",
-		"HTTPS_PROXY=http://corp-proxy:8080",
-		"ALL_PROXY=socks5://corp-proxy:1080",
-		"VIP_PROXY=socks5://corp-proxy:1080",
-		"SOCKS_PROXY=socks5://corp-proxy:1080",
-		"VIP_USE_SYSTEM_PROXY=1",
-		"http_proxy=http://corp-proxy:8080",
-		"https_proxy=http://corp-proxy:8080",
-		"all_proxy=socks5://corp-proxy:1080",
-		"NODE_ENV=production",
-		"DO_NOT_TRACK=0",
-		"NO_COLOR=1",
-		"XDG_DATA_HOME=/Users/developer/Library/Application Support",
-		"VIP_SEARCH_REPLACE_BIN=/opt/homebrew/bin/go-search-replace",
-		"DEBUG=*",
-		"SOME_PERSONAL_VAR=1",
-	}
-}
-
-func TestScenarioEnvPinsCredentialsRegardlessOfAmbient(t *testing.T) {
-	got := envMap(ScenarioEnv(hostileParent(), nil))
-
-	if got["VIP_TOKEN_OVERRIDE"] == "live.laptop.jwt" {
-		t.Error("ambient VIP_TOKEN_OVERRIDE leaked into the fixture environment")
-	}
-	if got["VIP_TOKEN_OVERRIDE"] == "" {
-		t.Error("fixture environment must pin a deterministic token so the Go binary never falls back " +
-			"to the host keychain (Node 4.1.0 ignores this variable; TestWhoamiBaselineParity seeds " +
-			"an ephemeral keychain entry for it instead)")
-	}
-	if _, present := got["WPVIP_DEPLOY_TOKEN"]; present {
-		t.Errorf("WPVIP_DEPLOY_TOKEN must be absent unless a scenario sets it; got %q", got["WPVIP_DEPLOY_TOKEN"])
-	}
-}
-
-func TestScenarioEnvDropsAmbientProxiesAndHost(t *testing.T) {
-	got := envMap(ScenarioEnv(hostileParent(), nil))
-
-	for _, key := range []string{
-		"HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "VIP_PROXY", "SOCKS_PROXY",
-		"VIP_USE_SYSTEM_PROXY", "http_proxy", "https_proxy", "all_proxy",
-	} {
-		if _, present := got[key]; present {
-			t.Errorf("proxy variable %s leaked into the fixture environment (value %q)", key, got[key])
-		}
-	}
-	if got["API_HOST"] == "https://api.wpvip.com" {
-		t.Error("ambient API_HOST leaked: a fixture scenario could reach the real API")
-	}
-	if !strings.Contains(got["API_HOST"], "127.0.0.1") {
-		t.Errorf("API_HOST must default to a dead loopback address, got %q", got["API_HOST"])
-	}
-}
-
-func TestScenarioEnvDropsUnlistedAmbientVariables(t *testing.T) {
-	got := envMap(ScenarioEnv(hostileParent(), nil))
-
-	for _, key := range []string{
-		"NO_COLOR", "XDG_DATA_HOME", "VIP_SEARCH_REPLACE_BIN", "DEBUG", "SOME_PERSONAL_VAR",
-	} {
-		if _, present := got[key]; present {
-			t.Errorf("unlisted ambient variable %s leaked into the fixture environment (value %q)", key, got[key])
-		}
-	}
-	// The OS-level allowlist must survive: the subprocess needs to find its
-	// interpreter and a home directory.
-	if got["PATH"] != "/usr/bin:/bin" {
-		t.Errorf("PATH = %q, want the parent's value", got["PATH"])
-	}
-	if got["HOME"] != "/Users/developer" {
-		t.Errorf("HOME = %q, want the parent's value", got["HOME"])
-	}
-}
-
-func TestScenarioEnvPinsTestModeAndTelemetryOff(t *testing.T) {
-	got := envMap(ScenarioEnv(hostileParent(), nil))
-
-	if got["NODE_ENV"] != "test" {
-		t.Errorf("NODE_ENV = %q, want test (Node gates its update-notifier on it; Go accepts it "+
-			"as an alias for GO_ENV when gating VIP_TOKEN_OVERRIDE)", got["NODE_ENV"])
-	}
-	if got["DO_NOT_TRACK"] != "1" {
-		t.Errorf("DO_NOT_TRACK = %q, want 1", got["DO_NOT_TRACK"])
-	}
-}
-
-func TestScenarioEnvOverridesWinOverPinnedValues(t *testing.T) {
-	got := envMap(ScenarioEnv(hostileParent(), map[string]string{
-		"API_HOST":           "http://127.0.0.1:65000",
-		"VIP_TOKEN_OVERRIDE": "scenario.jwt",
-		"WPVIP_DEPLOY_TOKEN": "deploy-tok",
-		"NO_COLOR":           "1",
-	}))
-
-	if got["API_HOST"] != "http://127.0.0.1:65000" {
-		t.Errorf("API_HOST = %q, want the scenario override", got["API_HOST"])
-	}
-	if got["VIP_TOKEN_OVERRIDE"] != "scenario.jwt" {
-		t.Errorf("VIP_TOKEN_OVERRIDE = %q, want the scenario override", got["VIP_TOKEN_OVERRIDE"])
-	}
-	if got["WPVIP_DEPLOY_TOKEN"] != "deploy-tok" {
-		t.Errorf("WPVIP_DEPLOY_TOKEN = %q, want the scenario override", got["WPVIP_DEPLOY_TOKEN"])
-	}
-	if got["NO_COLOR"] != "1" {
-		t.Errorf("NO_COLOR = %q, want the scenario override", got["NO_COLOR"])
-	}
-}
-
-// TestScenarioEnvIsAmbientIndependent is the property the whole slice exists
-// for: a laptop with live credentials and a bare CI container must produce
-// byte-identical subprocess environments.
-func TestScenarioEnvIsAmbientIndependent(t *testing.T) {
-	bareCI := []string{"PATH=/usr/bin:/bin", "HOME=/Users/developer"}
-
-	overrides := map[string]string{"API_HOST": "http://127.0.0.1:65000"}
-	laptop := envMap(ScenarioEnv(hostileParent(), overrides))
-	ci := envMap(ScenarioEnv(bareCI, overrides))
-
-	// The pinned token is minted per call (it carries a live exp claim), so
-	// compare everything else exactly and assert the token is merely present.
-	for _, m := range []map[string]string{laptop, ci} {
-		if m["VIP_TOKEN_OVERRIDE"] == "" {
-			t.Fatal("expected a pinned token in both environments")
-		}
-		delete(m, "VIP_TOKEN_OVERRIDE")
-	}
-	if len(laptop) != len(ci) {
-		t.Fatalf("laptop env has %d vars, CI env has %d: %v vs %v", len(laptop), len(ci), laptop, ci)
-	}
-	for k, v := range laptop {
-		if ci[k] != v {
-			t.Errorf("%s: laptop=%q CI=%q", k, v, ci[k])
-		}
-	}
-}
-
-func TestFixtureTokenIsAcceptedByTheCLI(t *testing.T) {
-	tok := FixtureToken()
-	if strings.Count(tok, ".") != 2 {
-		t.Fatalf("FixtureToken() = %q, want a three-segment JWT", tok)
-	}
-	// Two calls must both be valid; they need not be byte-identical.
-	if other := FixtureToken(); strings.Count(other, ".") != 2 {
-		t.Fatalf("second FixtureToken() = %q, want a three-segment JWT", other)
-	}
-}
-
-// TestNoAmbientEnvInheritanceInScenarios is the permanent regression guard for
-// this slice. Every fixture scenario must construct its subprocess environment
-// through ScenarioEnv; a bare os.Environ() anywhere else silently re-opens the
-// hole where the suite passes on a developer laptop and fails in CI.
-func TestNoAmbientEnvInheritanceInScenarios(t *testing.T) {
-	// env.go owns the allowlist; harness_test.go uses os.Environ() to invoke
-	// `go build` (a toolchain call, not a CLI invocation); parker_live_test.go
-	// is the live Parker gate and scrubs through BuildParkerEnv.
-	allowed := map[string]bool{
-		"env.go":              true,
-		"env_test.go":         true,
-		"harness_test.go":     true,
-		"parker_live_test.go": true,
-		"parker_test.go":      true,
-	}
-
-	entries, err := filepath.Glob("*.go")
-	if err != nil {
-		t.Fatalf("glob: %v", err)
-	}
-	if len(entries) == 0 {
-		t.Fatal("no Go sources found — did the package move?")
-	}
-	for _, path := range entries {
-		base := filepath.Base(path)
-		if allowed[base] {
-			continue
-		}
-		src, err := os.ReadFile(path)
-		if err != nil {
-			t.Fatalf("read %s: %v", path, err)
-		}
-		for i, line := range strings.Split(string(src), "\n") {
-			// Comments may legitimately name os.Environ() while explaining
-			// why it is not used; only flag code.
-			code, _, _ := strings.Cut(line, "//")
-			if strings.Contains(code, "os.Environ()") {
-				t.Errorf("%s:%d inherits the ambient environment; use FixtureEnv instead:\n\t%s",
-					base, i+1, strings.TrimSpace(line))
-			}
-		}
-	}
-}