@bongos/core 1.19.101 → 1.19.102

package/src/module-api.js

@@ -629,8 +629,10 @@ const { validateOrRespond, LIMITS, parseId, asyncHandler, corsPublicGet, parsePa
 //         landed since 1.19.99 with no explicit bump. run 31751275973. (task 1002620)
 //   1.19.101 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
 //         landed since 1.19.100 with no explicit bump. run 31752022322. (task 1002620)
+//   1.19.102 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+//         landed since 1.19.101 with no explicit bump. run 31753496152. (task 1002620)
 // ---------------------------------------------------------------------------
-const CORE_VERSION = '1.19.101'; // CI auto-patch carrier (ADR 0161); see changelog above
+const CORE_VERSION = '1.19.102'; // CI auto-patch carrier (ADR 0161); see changelog above
 
 // A namespaced logger so a module's log lines are attributable + consistent.
 // Usage: const log = api.logger('dev-box'); log.info('mounted');

package/tests/bongos_cli.mjs

@@ -47,8 +47,10 @@ test('VERBS: selfHelp is only claimed by scripts that really print their own usa
   // Verified by reading each script (they all branch on --help/-h to a usage()
   // printer). If a verb is added here, verify its script first — a wrong
   // selfHelp:true recreates the blocking-interview bug for that verb.
+  // `serve` is dev.js with --server pinned on, so it inherits dev's own usage()
+  // printer — verified: `bongos serve --help` prints the card and exits 0.
   const selfHelp = Object.entries(cli.VERBS).filter(([, d]) => d.selfHelp).map(([v]) => v).sort();
-  assert.deepEqual(selfHelp, ['dev', 'module', 'status', 'task', 'upgrade']);
+  assert.deepEqual(selfHelp, ['dev', 'module', 'serve', 'status', 'task', 'upgrade']);
 });
 
 // ---- spawned: the dispatcher answers --help without touching the script ----

package/tests/dev_lib.mjs

@@ -20,12 +20,18 @@ async function ta(name, fn) {
   catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.stack || e.message}`); }
 }
 
+// The lib builds paths with path.join, so on Windows they come back with `\`
+// while these fixtures are written POSIX-style. Compare on a normalized form —
+// otherwise every fixture silently "misses" and the lib reads its neutral
+// fallback, which looks like a logic failure and is really a separator mismatch.
+const norm = (p) => String(p).replace(/\\/g, '/');
+
 // A fake fs.readFileSync that maps by path suffix; unknown paths throw ENOENT.
 function fakeFs(map) {
   return {
     readFileSync(p) {
       for (const [suffix, body] of Object.entries(map)) {
-        if (String(p).endsWith(suffix)) return body;
+        if (norm(p).endsWith(suffix)) return body;
       }
       const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e;
     },
@@ -184,7 +190,7 @@ t('startDetached: spawns the server entry with the server env, detached', () =>
   const r = lib.startDetached(params, deps);
   assert.equal(r.already, false);
   assert.equal(r.pid, 555);
-  assert.equal(spawnCall.args[0], '/core/src/platform-server.js');
+  assert.equal(norm(spawnCall.args[0]), '/core/src/platform-server.js');
   assert.equal(spawnCall.opts.cwd, '/x/test4');
   assert.equal(spawnCall.opts.detached, true);
   assert.equal(spawnCall.opts.env.PORT, '3006');
@@ -249,5 +255,189 @@ t('depsInstallPlan: no node_modules + no lockfile → npm install', () => {
   assert.deepEqual(plan.args, ['install']);
 });
 
+// ---------- server mode (task 1002398) ----------
+// A fake `has(bin)`: the named binaries are on PATH, nothing else is.
+const hasOnly = (...bins) => (b) => bins.includes(b);
+
+t('parseSub: flag order never changes the verb', () => {
+  assert.equal(lib.parseSub([]), 'up');
+  assert.equal(lib.parseSub(['--server']), 'up');
+  assert.equal(lib.parseSub(['--server', 'stop']), 'stop');       // what `bongos serve stop` sends
+  assert.equal(lib.parseSub(['status', '--server']), 'status');
+  assert.equal(lib.parseSub(['--port', '3006', 'status']), 'status'); // 3006 is a VALUE, not the verb
+  assert.equal(lib.parseSub(['--db', 'stop', 'status']), 'status');   // a db literally named "stop"
+  assert.equal(lib.parseSub(['--foreground']), 'up');             // boolean flag consumes nothing
+});
+
+t('deriveBindHost: local is always loopback; server derives from the origin', () => {
+  assert.equal(lib.deriveBindHost({ publicOrigin: 'https://example.com', mode: 'local' }), '127.0.0.1');
+  // https => something terminates TLS in front of us => stay off the public NIC.
+  assert.equal(lib.deriveBindHost({ publicOrigin: 'https://example.com', mode: 'server' }), '127.0.0.1');
+  // plain http on a public name => nothing is in front yet => serve it ourselves.
+  assert.equal(lib.deriveBindHost({ publicOrigin: 'http://example.com:3006', mode: 'server' }), '0.0.0.0');
+  assert.equal(lib.deriveBindHost({ publicOrigin: 'http://localhost:3006', mode: 'server' }), '127.0.0.1');
+  assert.equal(lib.deriveBindHost({ publicOrigin: 'garbage', mode: 'server' }), '127.0.0.1');
+  assert.equal(lib.deriveBindHost({ publicOrigin: 'http://example.com', mode: 'server', override: '10.0.0.4' }), '10.0.0.4');
+});
+
+t('probeHost: probe what we bound (0.0.0.0 still answers on loopback)', () => {
+  assert.equal(lib.probeHost({ host: '0.0.0.0' }), '127.0.0.1');
+  assert.equal(lib.probeHost({ host: '10.0.0.4' }), '10.0.0.4');
+  assert.equal(lib.probeHost({}), '127.0.0.1');
+});
+
+t('resolveRunParams: --server flips mode and the bind address', () => {
+  const f = fakeFs({
+    'config/branding.json': JSON.stringify({ domains: { publicOrigin: 'http://box.example.com:3006' } }),
+    'config/branding.neutral.json': NEUTRAL,
+    'config/modules.json': JSON.stringify({ modules: {} }),
+  });
+  const base = { instanceRoot: '/srv/app', coreRoot: '/core', f, env: {}, userInfo: () => ({ username: 'deploy' }) };
+  const local = lib.resolveRunParams({ ...base, argv: [] });
+  assert.equal(local.mode, 'local');
+  assert.equal(local.host, '127.0.0.1');
+  const server = lib.resolveRunParams({ ...base, argv: ['--server'] });
+  assert.equal(server.mode, 'server');
+  assert.equal(server.host, '0.0.0.0');
+  assert.equal(server.port, 3006);
+});
+
+t('resolveRunParams: an https origin keeps the server on loopback (proxy in front)', () => {
+  const f = fakeFs({
+    'config/branding.json': JSON.stringify({ domains: { publicOrigin: 'https://app.example.com' } }),
+    'config/branding.neutral.json': NEUTRAL,
+    'config/modules.json': JSON.stringify({ modules: {} }),
+  });
+  const p = lib.resolveRunParams({ instanceRoot: '/srv/app', coreRoot: '/core', f, env: {}, userInfo: () => ({ username: 'deploy' }), argv: ['--server'] });
+  assert.equal(p.host, '127.0.0.1');
+  assert.equal(p.port, 3000);                      // no explicit port => the proxy's upstream
+  assert.equal(p.publicOrigin, 'https://app.example.com');
+});
+
+// ---------- systemd unit ----------
+const UNIT_PARAMS = {
+  instanceRoot: '/srv/app', coreRoot: '/core', dbName: 'app', port: 3006, host: '127.0.0.1',
+  pgHost: 'localhost', pgUser: 'deploy', gdsOnly: true, envPrefix: 'CLOUDBONGOS',
+  publicOrigin: 'https://app.example.com', mode: 'server',
+};
+
+t('serviceName / unitPath / envFilePath are keyed per instance', () => {
+  assert.equal(lib.serviceName(UNIT_PARAMS), 'bongos-app');
+  assert.equal(lib.unitPath(UNIT_PARAMS), '/etc/systemd/system/bongos-app.service');
+  assert.equal(lib.envFilePath(UNIT_PARAMS), '/etc/bongos/bongos-app.env');
+  assert.notEqual(lib.serviceName({ dbName: 'other' }), lib.serviceName(UNIT_PARAMS));
+});
+
+t('unitEnvironment: only resolved keys — never the caller’s environment', () => {
+  const keys = lib.unitEnvironment(UNIT_PARAMS).map(([k]) => k);
+  assert.deepEqual(keys.sort(), ['CLOUDBONGOS_INSTANCE_ROOT', 'HOST', 'MEDUSA_GDS_ONLY', 'NODE_ENV', 'PGDATABASE', 'PGHOST', 'PGUSER', 'PORT']);
+  const env = Object.fromEntries(lib.unitEnvironment(UNIT_PARAMS));
+  assert.equal(env.PORT, '3006');
+  assert.equal(env.NODE_ENV, 'production');
+  assert.equal(env.CLOUDBONGOS_INSTANCE_ROOT, '/srv/app');
+});
+
+t('unitEnvironment: no secret ever lands in an Environment= line', () => {
+  const withSecret = { ...UNIT_PARAMS, pgPassword: 'hunter2' };
+  const rendered = lib.renderSystemdUnit(withSecret, { nodePath: '/usr/bin/node', user: 'deploy' });
+  assert.ok(!rendered.includes('hunter2'), 'PGPASSWORD must go to the 0600 EnvironmentFile, not the unit');
+  assert.match(rendered, /EnvironmentFile=-\/etc\/bongos\/bongos-app\.env/);
+});
+
+t('renderSystemdUnit: boot-survival + restart policy + the right ExecStart', () => {
+  // The unit is only ever GENERATED on the host that runs it (linux), so
+  // serverEntry's separators are native there; normalize for a Windows test box.
+  const u = norm(lib.renderSystemdUnit(UNIT_PARAMS, { nodePath: '/usr/bin/node', user: 'deploy' }));
+  assert.match(u, /ExecStart=\/usr\/bin\/node \/core\/src\/platform-server\.js/);
+  assert.match(u, /WorkingDirectory=\/srv\/app/);
+  assert.match(u, /^Restart=always$/m);
+  assert.match(u, /^WantedBy=multi-user\.target$/m);   // = survives reboot
+  assert.match(u, /^User=deploy$/m);
+  assert.match(u, /Environment="PORT=3006"/);
+  assert.match(u, /After=network-online\.target postgresql\.service/);
+});
+
+t('renderSystemdUnit: values are quoted, so a path with a space cannot split the line', () => {
+  const u = lib.renderSystemdUnit({ ...UNIT_PARAMS, instanceRoot: '/srv/my app' }, { nodePath: '/usr/bin/node' });
+  assert.match(u, /Environment="CLOUDBONGOS_INSTANCE_ROOT=\/srv\/my app"/);
+  assert.ok(!/^User=/m.test(u), 'no User= line when no user was given (runs as root)');
+});
+
+t('systemdPlan: available only on linux with systemctl; sudo unless root', () => {
+  assert.equal(lib.systemdPlan({ platform: 'darwin', has: hasOnly('systemctl') }).available, false);
+  assert.equal(lib.systemdPlan({ platform: 'linux', has: hasOnly() }).available, false);
+  assert.deepEqual(lib.systemdPlan({ platform: 'linux', has: hasOnly('systemctl'), isRoot: true }), { available: true, sudo: false });
+  assert.deepEqual(lib.systemdPlan({ platform: 'linux', has: hasOnly('systemctl', 'sudo') }), { available: true, sudo: true });
+  // systemctl present but no way to become root -> unavailable, with a reason.
+  const p = lib.systemdPlan({ platform: 'linux', has: hasOnly('systemctl') });
+  assert.equal(p.available, false);
+  assert.match(p.reason, /sudo/);
+});
+
+// ---------- Postgres bring-up ----------
+t('pgStartPlan: platform-correct candidates, sudo-prefixed when not root', () => {
+  const mac = lib.pgStartPlan({ platform: 'darwin', has: hasOnly('brew'), env: {} });
+  assert.equal(mac[0].cmd, 'brew');
+  assert.equal(mac[0].needsFormula, true);
+
+  const linux = lib.pgStartPlan({ platform: 'linux', has: hasOnly('systemctl', 'sudo'), env: {} });
+  assert.deepEqual(linux[0].args, ['-n', 'systemctl', 'start', 'postgresql']);
+  assert.equal(linux[0].cmd, 'sudo');
+
+  const asRoot = lib.pgStartPlan({ platform: 'linux', has: hasOnly('systemctl'), env: {}, isRoot: true });
+  assert.equal(asRoot[0].cmd, 'systemctl');
+
+  // No systemd: fall back to SysV, then to pg_ctl when PGDATA names a cluster.
+  const sysv = lib.pgStartPlan({ platform: 'linux', has: hasOnly('service'), env: {}, isRoot: true });
+  assert.equal(sysv[0].cmd, 'service');
+  const ctl = lib.pgStartPlan({ platform: 'linux', has: hasOnly('pg_ctl'), env: { PGDATA: '/var/lib/pg' }, isRoot: true });
+  assert.deepEqual(ctl[0].args, ['start', '-w', '-D', '/var/lib/pg']);
+  assert.deepEqual(lib.pgStartPlan({ platform: 'linux', has: hasOnly('pg_ctl'), env: {} }), []); // pg_ctl needs PGDATA
+});
+
+t('pgBootstrapPlan: creates the login role + its db as the postgres superuser', () => {
+  const plan = lib.pgBootstrapPlan({ pgUser: 'deploy', dbName: 'app', has: hasOnly('sudo') });
+  assert.equal(plan.ok, true);
+  const byId = Object.fromEntries(plan.steps.map((s) => [s.id, s]));
+  assert.deepEqual(byId['check-role'].args.slice(0, 4), ['-n', '-u', 'postgres', 'psql']);
+  assert.ok(byId['create-role'].args.join(' ').includes('CREATE ROLE "deploy" LOGIN CREATEDB'));
+  assert.deepEqual(byId['create-db'].args, ['-n', '-u', 'postgres', 'createdb', '-O', 'deploy', 'app']);
+});
+
+t('pgBootstrapPlan: root on a sudo-less image uses `su postgres -c`', () => {
+  const plan = lib.pgBootstrapPlan({ pgUser: 'deploy', dbName: 'app', isRoot: true, has: hasOnly() });
+  assert.equal(plan.ok, true);
+  assert.equal(plan.steps[0].cmd, 'su');
+  assert.equal(plan.steps[0].args[0], 'postgres');
+  assert.equal(plan.steps[0].args[1], '-c');
+});
+
+t('pgBootstrapPlan: refuses injection-shaped identifiers and a rootless host', () => {
+  assert.equal(lib.pgBootstrapPlan({ pgUser: 'a"; DROP DATABASE x; --', dbName: 'app', has: hasOnly('sudo') }).ok, false);
+  assert.equal(lib.pgBootstrapPlan({ pgUser: 'deploy', dbName: 'bad-name', has: hasOnly('sudo') }).ok, false);
+  assert.equal(lib.pgBootstrapPlan({ pgUser: '', dbName: 'app', has: hasOnly('sudo') }).ok, false);
+  const noRoot = lib.pgBootstrapPlan({ pgUser: 'deploy', dbName: 'app', isRoot: false, has: hasOnly() });
+  assert.equal(noRoot.ok, false);
+  assert.match(noRoot.reason, /root or sudo/);
+});
+
+// ---------- outward health ----------
+await ta('publicHealth: proves the path THROUGH the proxy, not just loopback', async () => {
+  const params = { publicOrigin: 'https://app.example.com' };
+  const up = await lib.publicHealth(params, { fetchImpl: async (u) => { assert.equal(u, 'https://app.example.com/healthz'); return { status: 200 }; } });
+  assert.equal(up.reachable, true);
+  const down = await lib.publicHealth(params, { fetchImpl: async () => { throw new Error('ENOTFOUND'); } });
+  assert.equal(down.reachable, false);
+  assert.match(down.error, /ENOTFOUND/);
+  const bad = await lib.publicHealth(params, { fetchImpl: async () => ({ status: 502 }) });
+  assert.equal(bad.reachable, false);   // proxy up, app not wired through it
+});
+
+await ta('health: probes the address we actually bound', async () => {
+  let seen = null;
+  await lib.health({ port: 3006, host: '0.0.0.0' }, { fetchImpl: async (u) => { seen = u; return { status: 200, json: async () => ({}) }; } });
+  assert.match(seen, /^http:\/\/127\.0\.0\.1:3006\//);
+});
+
 console.log(`\n${passed} passed, ${failed} failed`);
 process.exit(failed > 0 ? 1 : 0);