@bongos/core 1.19.1052 → 1.19.1054

package/tests/provision_settings_apply.mjs

@@ -315,6 +315,90 @@ await ta('the shape refusal: dedicated → ok:false with guidance naming the val
   assert.equal(writes.length, 0);
 });
 
+console.log('\nthe control plane\'s own row — the platform pushes a setting to itself (task 1004334):');
+
+const U = require('../scripts/gds/provision-units.js');
+const { FALLBACK_ENV_PREFIX } = require('../src/instance-config.js');
+
+t('selfEnvPrefix: the web.env BRANDING_FILE line wins, then the instance pack, then the neutral pack, then the fallback', () => {
+  const packs = (map) => (p) => {
+    const hit = Object.keys(map).find((k) => p.replace(/\\/g, '/').endsWith(k));
+    if (!hit) { const e = new Error('ENOENT'); e.code = 'ENOENT'; throw e; }
+    return JSON.stringify(map[hit]);
+  };
+  const neutral = { 'config/branding.neutral.json': { envPrefix: 'NEUTRALX' } };
+  const withOwn = { ...neutral, 'config/branding.json': { envPrefix: 'OWNPACK' }, 'packs/site.json': { envPrefix: 'OVERRIDE' } };
+  const root = '/srv/instance';
+  assert.equal(U.selfEnvPrefix({ envBody: 'PORT=1\nBONGOS_BRANDING_FILE=packs/site.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'OVERRIDE');
+  assert.equal(U.selfEnvPrefix({ envBody: 'GDS_BRANDING_FILE=packs/site.json\r\n', instanceRoot: root, readFile: packs(withOwn) }), 'OVERRIDE', 'a legacy spelling still names the pack, as loadBranding reads it');
+  assert.equal(U.selfEnvPrefix({ envBody: 'PORT=1\n', instanceRoot: root, readFile: packs(withOwn) }), 'OWNPACK', 'no override → the instance root\'s config/branding.json');
+  assert.equal(U.selfEnvPrefix({ envBody: 'FOO_BRANDING_FILE=packs/site.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'OWNPACK', 'an unknown prefix is not the branding knob');
+  assert.equal(U.selfEnvPrefix({ envBody: '# BONGOS_BRANDING_FILE=packs/site.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'OWNPACK', 'a commented line is not set');
+  // loadBranding's own rule: an override that names a missing file loads NO instance pack,
+  // so the neutral one answers — config/branding.json is not consulted as a second chance.
+  assert.equal(U.selfEnvPrefix({ envBody: 'BONGOS_BRANDING_FILE=packs/gone.json\n', instanceRoot: root, readFile: packs(withOwn) }), 'NEUTRALX');
+  assert.equal(U.selfEnvPrefix({ envBody: '', instanceRoot: root, readFile: packs({ ...neutral, 'config/branding.json': { name: 'no prefix here' } }) }), 'NEUTRALX', 'a pack that names no envPrefix inherits the neutral one');
+  assert.equal(U.selfEnvPrefix({ envBody: '', instanceRoot: root, readFile: packs({}) }), FALLBACK_ENV_PREFIX, 'nothing readable → the fallback');
+});
+
+t('settingsEnvVarsFor: only the control-plane row reads the self prefix — every other shape is byte-identical to before', () => {
+  const body = 'BONGOS_BRANDING_FILE=/nowhere/at/all.json\n';
+  for (const shape of ['cloud-host', 'co-tenant']) {
+    assert.deepEqual(P.settingsEnvVarsFor({ ...activeStandalone, hosting_shape: shape }, body), P.settingsEnvVarsFor({ ...activeStandalone, hosting_shape: shape }), shape);
+    assert.ok(Object.keys(P.settingsEnvVarsFor({ ...activeStandalone, hosting_shape: shape }, body)).every((k) => k.startsWith(`${NEUTRAL_PREFIX}_`)), shape);
+  }
+});
+
+const selfRow = {
+  id: 41, slug: 'cloudbongos', hosting_shape: 'control-plane', status: 'active', owner_builder_id: 3,
+  port: 3002, domain: 'cloudbongos.com', settings: { artist_gate: 'off' },
+};
+
+await ta('--apply, the control-plane row: its OWN /etc/<slug>/web.env on the control-plane pair, under ITS pack\'s prefix, then restart <slug>; nothing else moves', async () => {
+  const fs = await import('node:fs');
+  const os = await import('node:os');
+  const path = await import('node:path');
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'cp-pack-'));
+  const pack = path.join(dir, 'site.json');
+  fs.writeFileSync(pack, JSON.stringify({ envPrefix: 'CPSELF' }));
+  const selfEnv = `CPSELF_GITHUB_CLIENT_SECRET=keepme0123456789\nBONGOS_BRANDING_FILE=${pack}\nPORT=3002\nCPSELF_ARTIST_GATE=strict\nGITHUB_PUSH_TOKEN=keepme-too\n`;
+  const seen = { box: [], control: [] };
+  const mk = (bucket) => (cmd) => {
+    seen[bucket].push(cmd);
+    if (/\bcat /.test(cmd)) return { ok: true, stdout: selfEnv };
+    if (/api\/bongos\/instance/.test(cmd)) return { ok: true, stdout: manifestWith({ platformVisibility: 'public', joinability: 'apply', visibility: 'public', joinGrant: 'full', artistGate: 'off', spendPayer: 'none' }) };
+    return { ok: true, stdout: '{"ok":true}' };
+  };
+  try {
+    const { deps, writes, events } = recorder({ apply: true });
+    deps.exec = mk('box'); deps.controlExec = mk('control');
+    const r = await P.settingsApplyInstance(selfRow, deps);
+    assert.equal(r.ok, true, JSON.stringify(r));
+    assert.equal(r.consumed, true, 'the read-back saw the live site report the new value');
+    assert.equal(seen.box.length, 0, 'nothing runs on the co-hosting box executor — the self row IS the control plane');
+    assert.ok(seen.control.some((c) => /^cat \/etc\/cloudbongos\/web\.env$/.test(c)), seen.control.join(' | '));
+    assert.ok(seen.control.some((c) => /^systemctl restart cloudbongos$/.test(c)), 'the service the core-upgrade door already restarts');
+    assert.deepEqual(writes.map((w) => [w.via, w.path]), [['control', '/etc/cloudbongos/web.env']]);
+    const out = writes[0].body;
+    assert.match(out, /^CPSELF_ARTIST_GATE=off$/m, 'replaced IN PLACE under the prefix the site resolves');
+    assert.doesNotMatch(out, /^BONGOS_ARTIST_GATE=/m, 'not written under the provisioned floor, which this site would never read');
+    assert.match(out, /^CPSELF_GITHUB_CLIENT_SECRET=keepme0123456789$/m, 'creds untouched');
+    assert.match(out, /^GITHUB_PUSH_TOKEN=keepme-too$/m);
+    assert.match(out, /^PORT=3002$/m);
+    assert.ok(![...seen.control].some((c) => /systemctl (stop|disable)|caddy|box-dns|rm -|upgrade\.js|npm/.test(c)), 'settings only — no teardown, DNS, Caddy or pin legs');
+    assert.match(events[0].detail, /reads the new values/);
+  } finally { fs.rmSync(dir, { recursive: true, force: true }); }
+});
+
+await ta('the control-plane row keeps every refusal of the leg: an unreadable web.env writes nothing and restarts nothing', async () => {
+  const { deps, cmds, writes } = recorder({ apply: true, readFails: true });
+  const r = await P.settingsApplyInstance(selfRow, deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /cannot read \/etc\/cloudbongos\/web\.env/);
+  assert.equal(writes.length, 0);
+  assert.ok(!cmds.some((c) => /restart/.test(c)), 'the platform is never restarted over a file it could not read');
+});
+
 console.log('\nthe verdict — recorded only when earned:');
 
 await ta('--apply success, manifest matches: consumed=true, event says it reads the new values, F19 latch released, domain-bearing PASS records no liveness verdict', async () => {

package/tests/provisioning_settings_apply.mjs

@@ -72,19 +72,30 @@ t('SETTINGS_APPLY_FROM is exactly {active} — the provision intent cannot stand
   assert.ok(!provisioning.PROVISION_ENQUEUE_FROM.has('active'), 'the premise the gate rests on');
 });
 
-t('SETTINGS_APPLY_SHAPES is the reachable pair, and the set is a subset of HOSTING_SHAPES', () => {
-  assert.deepEqual([...provisioning.SETTINGS_APPLY_SHAPES].sort(), ['cloud-host', 'co-tenant']);
+t('SETTINGS_APPLY_SHAPES is the reachable three, and the set is a subset of HOSTING_SHAPES', () => {
+  // 'control-plane' joined in task 1004334: the runner's OWN box, admitted by name in
+  // control-plane-guard.js, so a setting saved on the platform's row reaches the live site.
+  assert.deepEqual([...provisioning.SETTINGS_APPLY_SHAPES].sort(), ['cloud-host', 'co-tenant', 'control-plane']);
   for (const s of provisioning.SETTINGS_APPLY_SHAPES) assert.ok(provisioning.HOSTING_SHAPES.includes(s), s);
   // The exclusion this used to assert was 'dedicated', which task 1004182 removed from
   // HOSTING_SHAPES entirely — so that assertion became vacuously true and stopped testing
-  // anything. Name the shapes that DO exist and are still deliberately unreachable: nothing
-  // of ours runs a byo-host, and the control plane is not pushed settings by this path.
-  for (const unreachable of ['byo-host', 'control-plane']) {
+  // anything. Name the shape that DOES exist and is still deliberately unreachable:
+  // nothing of ours runs a byo-host.
+  for (const unreachable of ['byo-host']) {
     assert.ok(provisioning.HOSTING_SHAPES.includes(unreachable), `${unreachable} must be a real shape or this assertion is vacuous`);
     assert.ok(!provisioning.SETTINGS_APPLY_SHAPES.has(unreachable), unreachable);
   }
 });
 
+t('the two gates agree: every settings-apply shape is one the self-row guard lets a settings-apply through', () => {
+  // A shape on SETTINGS_APPLY_SHAPES that the guard refuses would make the route say
+  // "a restart is coming" and then answer the owner with control_plane_protected.
+  const G = require('../modules/provisioning/control-plane-guard.js');
+  for (const s of provisioning.SETTINGS_APPLY_SHAPES) assert.equal(G.intentAllowedForShape('settings-apply', s), true, s);
+  // and the restart door was NOT opened on the self row as a side effect
+  assert.ok(!provisioning.RESTART_SHAPES.has('control-plane'), 'task 1004334 widened the settings push only');
+});
+
 await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carries the settings-apply action', async () => {
   const calls = [];
   const db = { query: async (sql, params) => { calls.push({ sql, params }); return { rows: [{ id: 1, action: params[1], state: 'pending' }] }; } };
@@ -104,6 +115,26 @@ await ta('enqueueSettingsApply: a fresh intent → created:true; the INSERT carr
   assert.deepEqual(insert.params, [18, 'settings-apply', 'api:self', null]);
 });
 
+await ta('enqueueSettingsApply on the CONTROL-PLANE row passes the self-row guard and INSERTs; a teardown on the same row is still refused (task 1004334)', async () => {
+  const selfRow = (calls) => ({ query: async (sql, params) => {
+    calls.push({ sql, params });
+    if (/SELECT hosting_shape FROM provisioning_instances/.test(sql)) return { rows: [{ hosting_shape: 'control-plane' }] };
+    return { rows: [{ id: 3, action: params[1], state: 'pending' }] };
+  } });
+  const calls = [];
+  const r = await provisioning.enqueueSettingsApply(selfRow(calls), 41, 'api:self');
+  assert.equal(r.created, true, 'the real guard (not a stub) admits the push onto the self row');
+  const insert = calls.find((c) => /INSERT INTO provisioning_intents/.test(c.sql));
+  assert.deepEqual(insert.params, [41, 'settings-apply', 'api:self', null]);
+  // Everything the guard existed to refuse is still refused through the same door.
+  for (const destructive of ['teardown', 'disconnect', 'provision', 'domain-attach', 'repo-private']) {
+    const seen = [];
+    await assert.rejects(provisioning.enqueueIntent(selfRow(seen), 41, destructive, 'api:self'),
+      (e) => e.code === 'control_plane_protected' && e.status === 409, destructive);
+    assert.ok(!seen.some((c) => /INSERT/.test(c.sql)), `${destructive}: nothing written`);
+  }
+});
+
 await ta('enqueueSettingsApply: an identical PENDING push already open → created:false, no conflict (it carries this change)', async () => {
   const db = { query: async (sql) => {
     if (/INSERT/.test(sql)) { const e = new Error('dup'); e.code = '23505'; throw e; }
@@ -260,6 +291,20 @@ await ta('ACTIVE co-tenant queues too; the Archon override names WHICH archon on
   assert.equal(events[0].actor, 'api:archon:999');
 });
 
+await ta('ACTIVE control-plane row (the platform itself): artist_gate off QUEUES a push and says a restart is coming (task 1004334)', async () => {
+  // The case TW01 hit: this save used to answer "runs on a machine the platform doesn't
+  // manage", stored 'off', and left the live site reading 'strict' with no way to apply it.
+  reset({ inst: { owner_builder_id: 7, slug: 'cloudbongos', status: 'active', hosting_shape: 'control-plane', domain: 'cloudbongos.com', port: 3002, settings: {} } });
+  const r = await patch('/provisioning/instances/41/settings', { artist_gate: 'off' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.saved.artist_gate, 'off');
+  assert.deepEqual(updateCalls.map((c) => c.patch), [{ artist_gate: 'off' }]);
+  assert.equal(updateCalls[0].enqueuedSoFar, 0, 'the row is written before the intent the runner reads it through');
+  assert.deepEqual(enqueueCalls, [{ id: 41, requestedBy: 'api:self' }]);
+  receiptShape(r.body.push, { queued: true, restart: true, reachable: true });
+  assert.doesNotMatch(r.body.push.message, /doesn.t manage/, 'no longer the unreachable-machine sentence');
+});
+
 await ta('an identical PENDING push already open → 200, queued:false, "already queued … will carry this change"', async () => {
   reset();
   enqueueResult = { intent: { id: 5, action: 'settings-apply', state: 'pending' }, created: false };