@bongos/core 1.19.665 → 1.19.667

package/tests/session_rename_fallback.mjs

@@ -0,0 +1,383 @@
+// tests/session_rename_fallback.mjs — the C3b rename keeps every OLD name readable (task 1003704).
+//
+// Two artefacts get renamed here, and the whole risk is in the fallback, not the rename:
+//
+//   1. ~/.config/<instance>/gds-session.json → bongos-session.json. This file is on disk on every
+//      builder machine and every live dev box. Renaming it with no fallback signs all of them out
+//      at once and every /builder-* command dies with 'no Bongos session'.
+//   2. The `gds_session` browser cookie → `bongos_session`. Renaming it logs out every signed-in
+//      session, the owner's included. The read-list is THREE names, because `pms_session` predates
+//      the previous rename and is still in the wild.
+//
+// So these tests assert the FALLBACK path fires — a happy-path test on the new name alone would
+// pass just as well with the back-compat deleted, which is exactly the regression that matters.
+//
+// Three of the read-lists are DUPLICATED rather than imported, because their modules cannot reach
+// the canonical one (dependency-free middleware, a separately-bundled Electron app). Those copies
+// are pinned here against the real list by parsing the source — an unpinned copy is how a rename
+// half-lands.
+
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import path from 'node:path';
+import os from 'node:os';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { spawnSync } from 'node:child_process';
+
+const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+const require = createRequire(import.meta.url);
+const ic = require(path.join(REPO_ROOT, 'src', 'instance-config.js'));
+const lib = require(path.join(REPO_ROOT, 'scripts', 'gds', 'cli-lib.js'));
+const auth = require(path.join(REPO_ROOT, 'src', 'bongos', 'auth.js'));
+
+const read = (rel) => fs.readFileSync(path.join(REPO_ROOT, rel), 'utf8');
+
+// ── the home sandbox ────────────────────────────────────────────────────────────────────────
+//
+// SESSION_PATH is frozen at module load from os.homedir(), so anything touching a real save path
+// runs in a child with its own home. SETTING `HOME` ALONE IS NOT ISOLATION: on Windows os.homedir()
+// reads USERPROFILE and never consults HOME, and the miss cost real credentials once already
+// (task 1003760 — a suite like this one overwrote the developer's live CLI session). CI is Linux,
+// where HOME *is* honoured, so a miss here can never go red there. Hence both layers, copied
+// deliberately from tests/cli_sessions.mjs: override every variable a platform might read, AND
+// fail closed in the child before any module load can have a side effect.
+function sandboxEnv(home) {
+  const { root } = path.parse(home);
+  return {
+    ...process.env,
+    HOME: home,
+    USERPROFILE: home,
+    HOMEDRIVE: root.replace(/[\\/]+$/, ''),
+    HOMEPATH: home.slice(root.length - 1) || '\\',
+  };
+}
+
+function inSandbox(body) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-rename-'));
+  try {
+    const code = `const R=${JSON.stringify(REPO_ROOT)};
+      const SANDBOX=${JSON.stringify(home)};
+      const os=require('node:os');
+      if (os.homedir() !== SANDBOX) {
+        console.error('ERR sandbox-escape: os.homedir()=' + os.homedir() + ' but the sandbox is ' + SANDBOX);
+        process.exit(2);
+      }
+      const fs=require('node:fs'), path=require('node:path');
+      const ic=require(R+'/src/instance-config.js');
+      const lib=require(R+'/scripts/gds/cli-lib.js');
+      const CFG=path.dirname(ic.configPath('x'));
+      const w=(name,obj)=>{fs.mkdirSync(CFG,{recursive:true});fs.writeFileSync(path.join(CFG,name),JSON.stringify(obj,null,2));};
+      const has=(name)=>fs.existsSync(path.join(CFG,name));
+      const slurp=(name)=>fs.readFileSync(path.join(CFG,name),'utf8');
+      (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
+    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: sandboxEnv(home) });
+    return { home, out: `${r.stdout || ''}${r.stderr || ''}`, status: r.status };
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+const NEW_FILE = 'bongos-session.json';
+const OLD_FILES = ['gds-session.json', 'pms-session.json'];
+
+// ── 1. the session-file read-list ───────────────────────────────────────────────────────────
+
+test('SESSION_FILENAMES is newest-first, frozen, and still carries every old name', () => {
+  assert.deepEqual(ic.SESSION_FILENAMES, [NEW_FILE, ...OLD_FILES]);
+  assert.ok(Object.isFrozen(ic.SESSION_FILENAMES), 'the read-list must not be mutable at runtime');
+  // cli-lib must not keep a SECOND copy — it reads instance-config's.
+  assert.equal(lib.SESSION_FILENAMES, ic.SESSION_FILENAMES, 'cli-lib must share the one list object');
+});
+
+test('SESSION_READ_PATHS[0] IS SESSION_PATH — migration detection depends on it', () => {
+  // loadSession migrates when the hit path !== SESSION_PATH. If the configured dir's new-name file
+  // were not first, the common case would rewrite the file on every single command.
+  assert.equal(lib.SESSION_READ_PATHS[0], lib.SESSION_PATH);
+  assert.ok(lib.SESSION_PATH.endsWith(NEW_FILE), `SESSION_PATH must be the new name, got ${lib.SESSION_PATH}`);
+});
+
+test('SESSION_READ_PATHS is filename-major: the newest name in ANY dir beats an older name', () => {
+  const idx = (name) => lib.SESSION_READ_PATHS.findIndex((p) => p.endsWith(name));
+  for (const old of OLD_FILES) {
+    assert.ok(idx(old) > -1, `${old} must still be readable`);
+    assert.ok(idx(NEW_FILE) < idx(old), `${NEW_FILE} must be tried before ${old}`);
+  }
+  // gds- before pms-: the order of the rename chain.
+  assert.ok(idx('gds-session.json') < idx('pms-session.json'));
+});
+
+// ── 2. the fallback actually fires, and migrates (acceptance 1 + 2) ─────────────────────────
+
+for (const old of OLD_FILES) {
+  test(`with ONLY ${old}: the session loads, migrates to the new name, and the old file is LEFT INTACT`, () => {
+    const { out, status } = inSandbox(`
+      w(${JSON.stringify(old)}, { token:'TOK-OLD', api_base:'https://x.example.com', gemini_api_key:'KEEP' });
+      const before = slurp(${JSON.stringify(old)});
+      const s = await lib.loadSession();
+      console.log(JSON.stringify({
+        token: s && s.token,
+        kept: s && s.gemini_api_key,
+        migrated: has(${JSON.stringify(NEW_FILE)}),
+        oldStillThere: has(${JSON.stringify(old)}),
+        oldUnchanged: slurp(${JSON.stringify(old)}) === before,
+        newMatches: has(${JSON.stringify(NEW_FILE)}) && JSON.parse(slurp(${JSON.stringify(NEW_FILE)})).token === 'TOK-OLD',
+      }));`);
+    assert.equal(status, 0, out);
+    const r = JSON.parse(out.trim().split('\n').pop());
+    assert.equal(r.token, 'TOK-OLD', 'the old-name session must still resolve');
+    assert.equal(r.kept, 'KEEP', 'unknown fields must ride through the fallback read');
+    assert.equal(r.migrated, true, `a read through ${old} must write ${NEW_FILE}`);
+    assert.equal(r.newMatches, true, 'the migrated file must carry the same token');
+    // The old file is deliberately NOT deleted: a builder may roll back to an older CLI, which can
+    // only see the old name. Part 4 (task 1003706) deletes it.
+    assert.equal(r.oldStillThere, true, `${old} must NOT be deleted by the migration`);
+    assert.equal(r.oldUnchanged, true, `${old} must be byte-identical after the migration`);
+  });
+}
+
+test(`with ONLY ${NEW_FILE}: it loads and NOTHING is rewritten`, () => {
+  const { out, status } = inSandbox(`
+    w(${JSON.stringify(NEW_FILE)}, { token:'TOK-NEW', api_base:'https://x.example.com' });
+    const before = fs.statSync(path.join(CFG, ${JSON.stringify(NEW_FILE)})).mtimeMs;
+    const s = await lib.loadSession();
+    console.log(JSON.stringify({
+      token: s && s.token,
+      untouched: fs.statSync(path.join(CFG, ${JSON.stringify(NEW_FILE)})).mtimeMs === before,
+      noOldFilesInvented: ${JSON.stringify(OLD_FILES)}.every((f) => !has(f)),
+    }));`);
+  assert.equal(status, 0, out);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.token, 'TOK-NEW');
+  assert.equal(r.untouched, true, 'the common path must not rewrite the file on every command');
+  assert.equal(r.noOldFilesInvented, true, 'a forward rename must never create the old names');
+});
+
+test('the NEW name wins when both are present, even with a different token', () => {
+  const { out, status } = inSandbox(`
+    w('gds-session.json', { token:'TOK-STALE', api_base:'https://x.example.com' });
+    w(${JSON.stringify(NEW_FILE)}, { token:'TOK-FRESH', api_base:'https://x.example.com' });
+    const s = await lib.loadSession();
+    console.log(JSON.stringify({ token: s && s.token }));`);
+  assert.equal(status, 0, out);
+  assert.equal(JSON.parse(out.trim().split('\n').pop()).token, 'TOK-FRESH');
+});
+
+test('readSessionConfigSync falls back too — it is what resolveApiBase reads', () => {
+  // instance-config cannot import cli-lib (cli-lib imports IT), so it has its own reader; a
+  // fallback that only existed in cli-lib would leave api_base resolution blind on an
+  // un-migrated machine.
+  const { out, status } = inSandbox(`
+    w('gds-session.json', { token:'T', api_base:'https://fallback.example.com' });
+    console.log(JSON.stringify({
+      raw: !!ic.readSessionConfigSync(),
+      base: ic.resolveApiBase({ env: {} }),
+    }));`);
+  assert.equal(status, 0, out);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.raw, true, 'readSessionConfigSync must find the old name');
+  assert.equal(r.base, 'https://fallback.example.com', 'api_base must resolve from an old-name session');
+});
+
+// ── 3. the cookie read-list (acceptance 3) ──────────────────────────────────────────────────
+
+const req = (cookie, authz) => ({ headers: { cookie, ...(authz ? { authorization: authz } : {}) } });
+
+test('SESSION_COOKIE_NAMES is newest-first and frozen', () => {
+  assert.deepEqual(auth.SESSION_COOKIE_NAMES, ['bongos_session', 'gds_session', 'pms_session']);
+  assert.ok(Object.isFrozen(auth.SESSION_COOKIE_NAMES));
+});
+
+for (const name of ['bongos_session', 'gds_session', 'pms_session']) {
+  test(`a request carrying ONLY ${name} still resolves a token`, () => {
+    assert.deepEqual(auth.extractTokens(req(`${name}=TOKEN-X`)), ['TOKEN-X']);
+  });
+}
+
+test('all three names present → newest first, regardless of header order', () => {
+  // Header order deliberately reversed: preference must come from the read-list, not the browser.
+  assert.deepEqual(
+    auth.extractTokens(req('pms_session=P; gds_session=G; bongos_session=B')),
+    ['B', 'G', 'P'],
+  );
+});
+
+test('a name appearing TWICE still surfaces both values (#851 must not regress)', () => {
+  // A browser can carry a stale host-only cookie AND the current apex-scoped one under the same
+  // name. Grouping by name must keep a LIST, or the stale duplicate shadows the live session and
+  // 401s the builder — the exact bug tests/auth_duplicate_cookie.mjs was written for.
+  assert.deepEqual(auth.extractTokens(req('gds_session=STALE; gds_session=LIVE')), ['STALE', 'LIVE']);
+  assert.deepEqual(
+    auth.extractTokens(req('bongos_session=B1; gds_session=G1; bongos_session=B2')),
+    ['B1', 'B2', 'G1'],
+  );
+});
+
+test('a non-session cookie is never mistaken for one', () => {
+  assert.deepEqual(auth.extractTokens(req('gds_oauth_state=NOPE; gds_return=NOPE2')), []);
+});
+
+// ── 4. the router sets the new name and clears the old ones ─────────────────────────────────
+
+test('routes/auth.js sets ONLY the head name and derives the clear-list from the tail', () => {
+  const src = read('src/bongos/routes/auth.js');
+  assert.match(src, /const SESSION_COOKIE = auth\.SESSION_COOKIE_NAMES\[0\];/,
+    'the SET name must be the read-list head, not a second literal');
+  assert.match(src, /const SESSION_COOKIE_OLD = auth\.SESSION_COOKIE_NAMES\.slice\(1\);/,
+    'the clear-list must be the read-list tail');
+  assert.doesNotMatch(src, /'gds_session'|"gds_session"|'pms_session'|"pms_session"/,
+    'no session-cookie name may be re-declared as a literal here — that is how the lists drift');
+  // Superseded names must be cleared on BOTH the sign-in write and the logout, or a stale cookie
+  // outlives the session it belonged to.
+  const clears = src.split('clearSupersededSessionCookies(req, res)').length - 1;
+  assert.ok(clears >= 3, `expected the clear helper defined + used at sign-in and logout, saw ${clears}`);
+});
+
+// ── 5. the duplicated copies are pinned to the canonical lists ──────────────────────────────
+
+test('rate-limit.js — its dependency-free copy of the cookie names matches the real list', () => {
+  const src = read('src/bongos/middleware/rate-limit.js');
+  const m = /const SESSION_COOKIE_RES = \[([^\]]*)\]/.exec(src);
+  assert.ok(m, 'SESSION_COOKIE_RES not found — did the limiter stop reading session cookies?');
+  const names = [...m[1].matchAll(/'([a-z_]+)'/g)].map((x) => x[1]);
+  assert.deepEqual(names, auth.SESSION_COOKIE_NAMES,
+    'the limiter’s copy drifted from src/bongos/auth.js SESSION_COOKIE_NAMES');
+});
+
+test('dev-box session-store — its bundled copy of the filenames matches the real list', () => {
+  const src = read('modules/dev-box/app/src/session-store.js');
+  const head = /const FILE = path\.join\(DIR, '([^']+)'\)/.exec(src);
+  assert.ok(head, 'FILE not found in the dev-box session store');
+  const legacy = /const FILES_LEGACY = \[([^\]]*)\]/.exec(src);
+  assert.ok(legacy, 'FILES_LEGACY not found — the app would stop reading un-migrated sessions');
+  const names = [head[1], ...[...legacy[1].matchAll(/'([^']+\.json)'/g)].map((x) => x[1])];
+  assert.deepEqual(names, ic.SESSION_FILENAMES,
+    'the dev-box app’s copy drifted from src/instance-config.js SESSION_FILENAMES');
+  // It must WRITE only the head name.
+  assert.doesNotMatch(src, /writeFileSync\(\s*FILES_LEGACY/, 'the app must never write a legacy name');
+});
+
+test('the browser logout clears every session-cookie name', () => {
+  // Three static surfaces expire the cookie client-side. One that misses the current name leaves a
+  // live cookie behind after "sign out".
+  for (const rel of ['modules/hall-ui/public/shell.js',
+    'modules/public-landing/public/index.html',
+    'modules/public-landing/public/projects.html']) {
+    const m = /\[((?:'[a-z_]+',?\s*)+)\]\.forEach\(function \(name\) \{/.exec(read(rel));
+    assert.ok(m, `${rel}: cookie-clearing list not found`);
+    const names = [...m[1].matchAll(/'([a-z_]+)'/g)].map((x) => x[1]);
+    assert.deepEqual(names, auth.SESSION_COOKIE_NAMES, `${rel}: clear-list drifted`);
+  }
+});
+
+// ── 6. the box scripts read both names ──────────────────────────────────────────────────────
+
+test('the baked box scripts scan BOTH session filenames', () => {
+  // These run on live dev boxes and are baked at provision time, so they cannot import anything.
+  // A box provisioned AFTER the rename writes only the new name; one provisioned before has only
+  // the old. Missing either silently breaks heartbeat/reporting on half the fleet.
+  for (const rel of ['infra/box-heartbeat.sh', 'infra/box-report-host-keys.sh',
+    'infra/box-report-terminal.sh', 'infra/box-report-version.sh']) {
+    const src = read(rel);
+    const glob = src.split('\n').find((l) => l.includes('for _sess in'));
+    assert.ok(glob, `${rel}: session glob not found`);
+    for (const name of [NEW_FILE, 'gds-session.json']) {
+      assert.ok(glob.includes(name), `${rel}: glob must scan ${name} — got: ${glob.trim()}`);
+    }
+  }
+});
+
+// ── 7. the dev-box app's own copy of the fallback, and its sign-out ─────────────────────────
+//
+// The Electron app shares the CLI's session file on purpose (ADR 0045). It ships as its own
+// bundle, so it cannot import instance-config and carries its own read-list — which means its
+// fallback needs exercising, not just pinning.
+function inDevBoxSandbox(body) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'bongos-devbox-'));
+  try {
+    const code = `const R=${JSON.stringify(REPO_ROOT)};
+      const SANDBOX=${JSON.stringify(home)};
+      const os=require('node:os');
+      if (os.homedir() !== SANDBOX) {
+        console.error('ERR sandbox-escape: os.homedir()=' + os.homedir() + ' but the sandbox is ' + SANDBOX);
+        process.exit(2);
+      }
+      const fs=require('node:fs'), path=require('node:path');
+      const brand=require(R+'/modules/dev-box/app/src/brand.js');
+      const CFG=path.join(os.homedir(), '.config', brand.CONFIG_DIR);
+      const store=require(R+'/modules/dev-box/app/src/session-store.js');
+      const w=(name,obj)=>{fs.mkdirSync(CFG,{recursive:true});fs.writeFileSync(path.join(CFG,name),JSON.stringify(obj,null,2));};
+      const has=(name)=>fs.existsSync(path.join(CFG,name));
+      const j=(name)=>JSON.parse(fs.readFileSync(path.join(CFG,name),'utf8'));
+      (async()=>{ ${body} })().catch((e)=>{ console.error('ERR '+e.message); process.exit(1); });`;
+    const r = spawnSync(process.execPath, ['-e', code], { encoding: 'utf8', env: sandboxEnv(home) });
+    return { out: `${r.stdout || ''}${r.stderr || ''}`, status: r.status };
+  } finally {
+    fs.rmSync(home, { recursive: true, force: true });
+  }
+}
+
+test('dev-box: reads an old-name session, and writes migrate to the new name', () => {
+  const { out, status } = inDevBoxSandbox(`
+    w('gds-session.json', { token:'TOK-OLD', api_base:'https://x.example.com', gemini_api_key:'KEEP' });
+    const got = store.read();
+    store.write({ token:'TOK-NEW', apiBase:'https://x.example.com' });
+    console.log(JSON.stringify({
+      readOld: got && got.token,
+      newFile: has('bongos-session.json') && j('bongos-session.json').token,
+      keptExtra: has('bongos-session.json') && j('bongos-session.json').gemini_api_key,
+      oldKept: has('gds-session.json'),
+    }));`);
+  assert.equal(status, 0, out);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.readOld, 'TOK-OLD', 'the app must still read an un-migrated session');
+  assert.equal(r.newFile, 'TOK-NEW', 'a write must land on the new name');
+  assert.equal(r.keptExtra, 'KEEP', 'merge-preserving write must carry unknown fields across the rename');
+  assert.equal(r.oldKept, true, 'the app must not delete the old file either');
+});
+
+test('dev-box: sign-out strips the credential from EVERY accepted filename', () => {
+  // THE BUG THIS PINS. clear() rewrote only the CURRENT filename, but read() falls through to an
+  // older name when the current file carries no token — so sign-out left a live token in the
+  // superseded file and the very next read signed the builder straight back in. Harmless while
+  // the only legacy name was the long-dead pms-session.json; the common case the moment
+  // gds-session.json joined the read-list (task 1003704).
+  const { out, status } = inDevBoxSandbox(`
+    w('bongos-session.json', { token:'TOK-NEW', api_base:'https://x.example.com' });
+    w('gds-session.json',    { token:'TOK-OLD', api_base:'https://x.example.com', gemini_api_key:'KEEP' });
+    store.clear();
+    console.log(JSON.stringify({
+      stillSignedIn: !!store.read(),
+      newToken: j('bongos-session.json').token ?? null,
+      oldToken: j('gds-session.json').token ?? null,
+      keptExtra: j('gds-session.json').gemini_api_key,
+    }));`);
+  assert.equal(status, 0, out);
+  const r = JSON.parse(out.trim().split('\n').pop());
+  assert.equal(r.stillSignedIn, false, 'sign-out must not leave a readable session under ANY name');
+  assert.equal(r.newToken, null, 'the current file must lose its token');
+  assert.equal(r.oldToken, null, 'the superseded file must lose its token too — this is the bug');
+  // Sign-out drops credentials only; CLI-adjacent config must survive in every file it touches.
+  assert.equal(r.keptExtra, 'KEEP', 'clear() must preserve non-credential fields');
+});
+
+// ── 8. the credential detector follows the rename ───────────────────────────────────────────
+
+test('the artifact-scan credential detector flags a read of EVERY session filename', () => {
+  // A rename that moved the file but not the detector would open a hole rather than close one:
+  // scanned third-party code reaching for bongos-session.json would score no credential hit at
+  // all on an instance whose configDir is not 'otb' (the rule's second alternative only covers
+  // ~/.config/otb). Both directions matter — the old names are still live credentials.
+  const src = read('modules/security/artifact-scan/detectors/credentials.js');
+  const rule = src.split('\n').find((l) => l.includes('CLI session token'));
+  assert.ok(rule, 'the session-token credential rule is gone');
+  for (const name of ic.SESSION_FILENAMES) {
+    const stem = name.replace('-session.json', '');
+    assert.ok(rule.includes(stem), `the detector must still match ${name} — got: ${rule.trim()}`);
+  }
+});
+// The box resolver is EXECUTED — a post-rename box and a migrated one — in
+// tests/lib_sh_resolution.mjs, which already owns the extraction harness for that shell
+// block. Deliberately not duplicated here: two harnesses on one block is two things to
+// fix when the names next move (task 1003704).

package/tests/setup_device_flow_fallback.mjs

@@ -35,6 +35,7 @@ import { fileURLToPath } from 'node:url';
 
 const require = createRequire(import.meta.url);
 const setup = require('../scripts/gds/setup.js');
+const ic = require('../src/instance-config.js');
 
 const REPO_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
 const SETUP_JS = path.join(REPO_ROOT, 'scripts', 'gds', 'setup.js');
@@ -149,7 +150,9 @@ function findSessions(home) {
     for (const f of entries) {
       const p = path.join(dir, f.name);
       if (f.isDirectory()) walk(p);
-      else if (f.name === 'gds-session.json') hits.push(p);
+      // The CURRENT session filename, read off the canonical list — not a literal, which is
+      // how this walk came to report 0 files for a perfectly good write (task 1003704).
+      else if (f.name === ic.SESSION_FILENAMES[0]) hits.push(p);
     }
   })(home);
   return hits;