@bongos/core 1.19.206 → 1.19.208

package/tests/setup_device_flow_fallback.mjs

@@ -0,0 +1,179 @@
+// tests/setup_device_flow_fallback.mjs
+//
+// W1 (task 1003051): on a wizard-born instance the GitHub App has Device Flow
+// OFF (the manifest can't enable it, GitHub offers only a settings checkbox),
+// so `bongos setup` — the documented CLI sign-in — dead-ended on a proxied
+// GitHub refusal. setup.js now detects that exact refusal and falls back to the
+// hall's CLI-token path.
+//
+// Covers the fallback branch's machinery, each leg against the stubbed refusal
+// or a stubbed instance API:
+//   • isDeviceFlowDisabled — the detector against the REAL server envelope
+//     (device_start_failed 502 carrying GitHub's device_flow_disabled), a legacy
+//     flat shape, and the shapes it must NOT match (auth_not_configured, other
+//     upstream failures, success)
+//   • deviceFlowFallbackLines — the guidance names the hall Settings page,
+//     CLI Access, and the owner's one-checkbox repair
+//   • redeemCliToken — driven in a CHILD process (hermetic HOME/USERPROFILE +
+//     GDS_API_BASE at a local stub): a good token verifies via /me and writes
+//     the session; a bad token is refused and writes NOTHING
+//
+// The interactive TTY walk (prompt → paste) is deliberately not spawned here:
+// the spawn-the-whole-CLI harness (setup_smoke.mjs) is already environment-
+// sensitive, and every seam the prompt wires together is covered above.
+//
+// Run:  node tests/setup_device_flow_fallback.mjs
+
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import { spawn } from 'node:child_process';
+import http from 'node:http';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const setup = require('../scripts/gds/setup.js');
+
+const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const SETUP_JS = path.join(REPO_ROOT, 'scripts', 'gds', 'setup.js');
+
+let passed = 0, failed = 0;
+const t = (name, fn) => {
+  try { fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+const ta = async (name, fn) => {
+  try { await fn(); passed++; console.log(`  PASS  ${name}`); }
+  catch (e) { failed++; console.log(`  FAIL  ${name}\n        ${e.message}`); }
+};
+
+console.log('isDeviceFlowDisabled — the refusal detector:');
+
+// The REAL shape: routes/auth.js res.fail('device_start_failed', {status:502,
+// message: 'GitHub rejected device-flow start: device_flow_disabled — …'}).
+const REAL_REFUSAL = {
+  ok: false, status: 502,
+  data: { error: { code: 'device_start_failed', message: 'GitHub rejected device-flow start: device_flow_disabled — terminal sign-in needs Device Flow enabled on the app: open https://github.com/settings/apps, open your app, check "Enable Device Flow", and save. Web sign-in is unaffected.' } },
+};
+
+t('matches the real device_start_failed envelope carrying device_flow_disabled', () => {
+  assert.equal(setup.isDeviceFlowDisabled(REAL_REFUSAL), true);
+});
+
+t('matches a legacy flat error shape too', () => {
+  assert.equal(setup.isDeviceFlowDisabled({ ok: false, status: 502, data: { error: 'device_start_failed', message: 'x device_flow_disabled y' } }), true);
+});
+
+t('does NOT match auth_not_configured, other upstream failures, or success', () => {
+  assert.equal(setup.isDeviceFlowDisabled({ ok: false, status: 503, data: { error: { code: 'auth_not_configured', message: 'GitHub OAuth App credentials missing on the server.' } } }), false);
+  assert.equal(setup.isDeviceFlowDisabled({ ok: false, status: 502, data: { error: { code: 'device_start_failed', message: 'GitHub rejected device-flow start: incorrect_client_credentials' } } }), false);
+  assert.equal(setup.isDeviceFlowDisabled({ ok: true, status: 200, data: { device_code: 'x' } }), false);
+  assert.equal(setup.isDeviceFlowDisabled(null), false);
+});
+
+console.log('\ndeviceFlowFallbackLines — the guidance:');
+
+t('names the Settings page, CLI Access, and the owner checkbox repair', () => {
+  const text = setup.deviceFlowFallbackLines('https://spike.cloudbongos.com').join('\n');
+  assert.match(text, /https:\/\/spike\.cloudbongos\.com\/builders\/settings/, 'points at the hall Settings page');
+  assert.match(text, /CLI Access/, 'names the section');
+  assert.match(text, /Re-issue CLI token/, 'names the button');
+  assert.match(text, /Enable Device Flow/, 'names the owner checkbox');
+  assert.match(text, /Web sign-in is unaffected/i, 'says what still works');
+});
+
+// ── redeemCliToken in a hermetic child against a stubbed instance API ────────
+// A child process because API_BASE + the session path resolve at module load:
+// the child gets GDS_API_BASE → the stub and HOME/USERPROFILE → a throwaway
+// dir, so the real session can never be touched. The driver prints the JSON
+// result and lets node exit naturally (no process.exit — the Windows async.c
+// abort gotcha), so assertions read stdout, not the exit code.
+
+const GOOD_TOKEN = 'a'.repeat(64);
+const server = http.createServer((req, res) => {
+  const send = (status, body) => {
+    res.writeHead(status, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(body));
+  };
+  if (req.method === 'GET' && req.url.endsWith('/api/gds/me')) {
+    if ((req.headers.authorization || '') === `Bearer ${GOOD_TOKEN}`) {
+      return send(200, { builder: { id: 6, github_login: 'newbuilder', display_name: 'New Builder' } });
+    }
+    return send(401, { error: { code: 'unauthenticated' } });
+  }
+  return send(404, { error: { code: 'not_found' } });
+});
+server.listen(0, '127.0.0.1');
+await new Promise((r) => server.once('listening', r));
+const BASE = `http://127.0.0.1:${server.address().port}`;
+
+const driverPath = path.join(fs.mkdtempSync(path.join(os.tmpdir(), 'w1-driver-')), 'driver.cjs');
+fs.writeFileSync(driverPath, [
+  `const s = require(${JSON.stringify(SETUP_JS)});`,
+  `s.redeemCliToken(process.argv[2]).then((r) => { console.log('RESULT ' + JSON.stringify(r)); });`,
+].join('\n'));
+
+// ASYNC spawn, not spawnSync: the stub server lives in THIS process, and a sync
+// spawn would block the event loop — the child's fetch would deadlock waiting
+// for a server that can never accept.
+function redeemInChild(token, home) {
+  return new Promise((resolve) => {
+    const child = spawn(process.execPath, [driverPath, token], {
+      env: { ...process.env, HOME: home, USERPROFILE: home, GDS_API_BASE: BASE, OTB_API_BASE: BASE },
+    });
+    let stdout = '', stderr = '';
+    child.stdout.on('data', (c) => { stdout += c; });
+    child.stderr.on('data', (c) => { stderr += c; });
+    const timer = setTimeout(() => child.kill(), 30_000);
+    child.on('close', (code, signal) => {
+      clearTimeout(timer);
+      const line = stdout.split('\n').find((l) => l.startsWith('RESULT '));
+      resolve({ result: line ? JSON.parse(line.slice(7)) : null, raw: { stdout, stderr, code, signal } });
+    });
+  });
+}
+
+function findSessions(home) {
+  const hits = [];
+  (function walk(dir) {
+    let entries = [];
+    try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return; }
+    for (const f of entries) {
+      const p = path.join(dir, f.name);
+      if (f.isDirectory()) walk(p);
+      else if (f.name === 'gds-session.json') hits.push(p);
+    }
+  })(home);
+  return hits;
+}
+
+console.log('\nredeemCliToken — verify-then-save against the stub:');
+
+await ta('a good token verifies via /me and writes the session under the hermetic HOME', async () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'w1-home-'));
+  const { result, raw } = await redeemInChild(GOOD_TOKEN, home);
+  assert.ok(result, `driver printed no RESULT\nstdout:\n${raw.stdout}\nstderr:\n${raw.stderr}`);
+  assert.equal(result.ok, true);
+  assert.equal(result.builder.github_login, 'newbuilder');
+  const sessions = findSessions(home);
+  assert.equal(sessions.length, 1, `exactly one session file expected under ${home}`);
+  const session = JSON.parse(fs.readFileSync(sessions[0], 'utf8'));
+  assert.equal(session.token, GOOD_TOKEN);
+  assert.equal(session.api_base, BASE, 'the session points at the instance that minted the token');
+});
+
+await ta('a bad token is refused (401) and NOTHING is written', async () => {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'w1-home-'));
+  const { result, raw } = await redeemInChild('b'.repeat(64), home);
+  assert.ok(result, `driver printed no RESULT\nstdout:\n${raw.stdout}\nstderr:\n${raw.stderr}`);
+  assert.equal(result.ok, false);
+  assert.equal(result.status, 401);
+  assert.match(raw.stderr, /Token rejected/, 'says the token was refused');
+  assert.equal(findSessions(home).length, 0, 'no session written for an unverified token');
+});
+
+server.close();
+console.log(`\nsetup_device_flow_fallback: ${passed} passed, ${failed} failed`);
+process.exit(failed ? 1 : 0);