@bongos/core 1.19.1080 → 1.19.1081

package/tests/render_api.mjs

@@ -0,0 +1,153 @@
+// tests/render_api.mjs — the Render client's workspace guard (task 1004183; ADR 0327).
+//
+// The load-bearing assertions:
+//   • a client cannot exist without the workspace it acts in — never defaulted
+//   • a response from ANOTHER workspace is refused (RenderOwnerMismatch), and so is a
+//     response carrying no workspace — in both of Render's shapes (service `ownerId`,
+//     Postgres `owner.id`) and on every element that carries one
+//   • the calls whose answer carries no owner (connection-info, env-var PUT, deploy) are
+//     only sent after the parent resource was read through the guard — so a service in
+//     another workspace gets NO write
+//   • there is no delete, and the verb is refused outright
+//   • a dry-run sends nothing and never prints an env var value
+//
+// Hermetic: a recording fake fetch. Run:  node tests/render_api.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { RenderApi, RenderApiError, RenderOwnerMismatch, ownerOf } = require('../scripts/gds/render-api.js');
+
+let passed = 0, failed = 0;
+async function ta(name, fn) {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+}
+
+const OURS = 'tea-ours00000001';
+const THEIRS = 'tea-theirs000001';
+
+// A fake Render: `routes` maps "METHOD path" to the JSON it answers.
+function fakeFetch(routes) {
+  const calls = [];
+  const fetchImpl = async (url, init) => {
+    const path = url.replace('https://api.render.com/v1', '');
+    calls.push({ method: init.method, path, body: init.body ? JSON.parse(init.body) : null, auth: init.headers.Authorization });
+    const key = `${init.method} ${path}`;
+    if (!(key in routes)) return { ok: false, status: 404, text: async () => JSON.stringify({ message: 'not found' }) };
+    return { ok: true, status: 200, text: async () => JSON.stringify(routes[key]) };
+  };
+  return { fetchImpl, calls };
+}
+const live = (routes, ownerId = OURS) => {
+  const f = fakeFetch(routes);
+  return { api: new RenderApi({ token: 'rnd_test', ownerId, dryRun: false, fetchImpl: f.fetchImpl }), calls: f.calls };
+};
+
+console.log('the workspace is required:');
+await ta('no ownerId → the client refuses to exist, even in dry-run', () => {
+  assert.throws(() => new RenderApi({ token: 'rnd_x', dryRun: false, fetchImpl: () => {} }), RenderApiError);
+  assert.throws(() => new RenderApi({}), /never defaulted/);
+  assert.throws(() => new RenderApi({ ownerId: '   ' }), RenderApiError);
+});
+await ta('live with no key → refuses', () => {
+  assert.throws(() => new RenderApi({ ownerId: OURS, dryRun: false, fetchImpl: () => {} }), /no API key/);
+});
+
+console.log('\nthe guard is on the RESPONSE:');
+await ta('a service from another workspace is refused', async () => {
+  const { api } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: THEIRS } });
+  await assert.rejects(api.getService('srv-1'), RenderOwnerMismatch);
+});
+await ta('a service carrying no workspace is refused', async () => {
+  const { api } = live({ 'GET /services/srv-1': { id: 'srv-1' } });
+  await assert.rejects(api.getService('srv-1'), /no workspace/);
+});
+await ta('a service from our workspace passes, in either envelope', async () => {
+  const { api } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: OURS }, 'GET /services/srv-2': { service: { id: 'srv-2', ownerId: OURS } } });
+  assert.equal((await api.getService('srv-1')).id, 'srv-1');
+  assert.equal((await api.getService('srv-2')).id, 'srv-2');
+});
+await ta('a Postgres carries its owner as owner.id — a mismatch there is refused too', async () => {
+  const { api } = live({ 'GET /postgres/dpg-1': { id: 'dpg-1', owner: { id: THEIRS } } });
+  await assert.rejects(api.getPostgres('dpg-1'), RenderOwnerMismatch);
+  assert.equal(ownerOf({ owner: { id: OURS } }), OURS);
+  assert.equal(ownerOf({ ownerId: OURS }), OURS);
+  assert.equal(ownerOf({}), null);
+});
+await ta('a create answered from another workspace is refused', async () => {
+  const { api } = live({
+    'POST /services': { deployId: 'dep-1', service: { id: 'srv-9', ownerId: THEIRS } },
+    'POST /postgres': { id: 'dpg-9', owner: { id: THEIRS } },
+  });
+  await assert.rejects(api.createService({ ownerId: OURS, name: 'x' }), RenderOwnerMismatch);
+  await assert.rejects(api.createPostgres({ ownerId: OURS, name: 'x' }), RenderOwnerMismatch);
+});
+await ta('a payload naming another workspace is never sent', async () => {
+  const { api, calls } = live({});
+  await assert.rejects(api.createService({ ownerId: THEIRS, name: 'x' }), /this client's workspace/);
+  await assert.rejects(api.createPostgres({ name: 'x' }), /this client's workspace/);
+  assert.equal(calls.length, 0);
+});
+
+console.log('\nownerless answers are reached only through a checked parent:');
+await ta('an env var for a service in another workspace is never PUT', async () => {
+  const { api, calls } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: THEIRS }, 'PUT /services/srv-1/env-vars/K': { key: 'K' } });
+  await assert.rejects(api.putEnvVar('srv-1', 'K', 'v'), RenderOwnerMismatch);
+  assert.deepEqual(calls.map((c) => c.method), ['GET'], 'the PUT is never sent');
+});
+await ta('a deploy for a service in another workspace is never triggered', async () => {
+  const { api, calls } = live({ 'GET /services/srv-1': { id: 'srv-1', ownerId: THEIRS } });
+  await assert.rejects(api.triggerDeploy('srv-1'), RenderOwnerMismatch);
+  assert.deepEqual(calls.map((c) => c.method), ['GET']);
+});
+await ta('connection-info for a database in another workspace is never read', async () => {
+  const { api, calls } = live({ 'GET /postgres/dpg-1': { id: 'dpg-1', owner: { id: THEIRS } }, 'GET /postgres/dpg-1/connection-info': { internalConnectionString: 'postgres://leak' } });
+  await assert.rejects(api.postgresConnectionInfo('dpg-1'), RenderOwnerMismatch);
+  assert.equal(calls.length, 1);
+});
+await ta('on our own resources they go through, with the key as a bearer', async () => {
+  const { api, calls } = live({
+    'GET /services/srv-1': { id: 'srv-1', ownerId: OURS },
+    'PUT /services/srv-1/env-vars/K': { key: 'K' },
+    'POST /services/srv-1/deploys': { id: 'dep-2' },
+  });
+  await api.putEnvVar('srv-1', 'K', 'v');
+  await api.triggerDeploy('srv-1');
+  assert.deepEqual(calls.map((c) => `${c.method} ${c.path}`), ['GET /services/srv-1', 'PUT /services/srv-1/env-vars/K', 'GET /services/srv-1', 'POST /services/srv-1/deploys']);
+  assert.deepEqual(calls[1].body, { value: 'v' });
+  assert.ok(calls.every((c) => c.auth === 'Bearer rnd_test'));
+});
+
+console.log('\nthe workspace list is for membership, never selection:');
+await ta('listOwners returns every workspace the key reaches, unwrapped', async () => {
+  const { api } = live({ 'GET /owners?limit=100': [{ owner: { id: THEIRS, type: 'team' }, cursor: 'a' }, { owner: { id: OURS, type: 'team' }, cursor: 'b' }] });
+  assert.deepEqual((await api.listOwners()).map((o) => o.id), [THEIRS, OURS]);
+});
+
+console.log('\nno delete:');
+await ta('there is no delete method, and the verb is refused', async () => {
+  const { api, calls } = live({});
+  const methods = Object.getOwnPropertyNames(RenderApi.prototype);
+  assert.ok(!methods.some((m) => /delete|destroy|remove|suspend/i.test(m)), `no destructive method: ${methods.join(', ')}`);
+  await assert.rejects(api._req('DELETE', '/services/srv-1'), /never deletes/);
+  assert.equal(calls.length, 0);
+});
+
+console.log('\ndry-run:');
+await ta('dry-run is the default, sends nothing, and prints no env var value', async () => {
+  const lines = [];
+  let sent = 0;
+  const api = new RenderApi({ ownerId: OURS, fetchImpl: () => { sent++; }, log: (l) => lines.push(l) });
+  const r = await api.createService({ ownerId: OURS, name: 'demo', envVars: [{ key: 'DATABASE_URL', value: 'postgres://secret' }] });
+  assert.equal(sent, 0);
+  assert.equal(r.service.ownerId, OURS);
+  await api.putEnvVar('srv-1', 'BUILDER_SECRET_KEY', 'deadbeef');
+  const out = lines.join('\n');
+  assert.ok(!out.includes('postgres://secret') && !out.includes('deadbeef'), out);
+  assert.match(out, /DATABASE_URL/, 'the name is still shown');
+});
+
+console.log(`\n${passed} passed, ${failed} failed`);
+if (failed) process.exit(1);