@bongos/core 1.19.709 → 1.19.711

package/tests/provision.mjs

@@ -2446,5 +2446,232 @@ await ta('teardownInstance(standalone): no registered key / no token → teardow
   assert.ok(b.cmds.some((c) => /rm -f \S+\/\.git\/cloudbongos-deploy-key \S+\.pub/.test(c)), 'local key halves removed even with no credential');
 });
 
+
+console.log('\nper-instance unix account + password-authed PG role (task 1003369, audit B3):');
+
+t('instanceUser: prefixed, never the bare slug — a project called `postgres` cannot claim that account', () => {
+  assert.equal(P.instanceUser(coTenant), 'bongos-mercury');
+  assert.equal(P.instanceUser({ slug: 'postgres' }), 'bongos-postgres');
+  assert.notEqual(P.instanceUser({ slug: 'lars' }), 'lars');
+});
+
+t('instanceUser: a 40-char slug folds to a LEGAL account name — <=32 chars, no trailing/double dash', () => {
+  const slug = 'a'.repeat(39) + 'b';                       // the isValidSlug maximum
+  const u = P.instanceUser({ slug });
+  assert.ok(u.length <= 32, `account name must fit utmp's 32 chars, got ${u.length} (${u})`);
+  assert.match(u, /^[a-z][a-z0-9-]*[a-z0-9]$/, 'must satisfy useradd NAME_REGEX');
+  assert.ok(!u.includes('--'), 'no double dash');
+});
+
+t('instanceUser: two slugs sharing a long prefix get DIFFERENT accounts — a fold collision would hand each the other\'s identity', () => {
+  const a = 'production-instance-alpha-one';               // 29 chars, identical for 26 of them
+  const b = 'production-instance-alpha-two';
+  assert.notEqual(P.instanceUser({ slug: a }), P.instanceUser({ slug: b }));
+});
+
+t('instanceUser: an invalid slug THROWS rather than deriving an account name from it', () => {
+  assert.throws(() => P.instanceUser({ slug: '../../etc/passwd' }), /invalid slug/);
+  assert.throws(() => P.instanceUser({ slug: 'Has Spaces' }), /invalid slug/);
+  assert.throws(() => P.instanceUser({ slug: '' }), /invalid slug/);
+});
+
+t('instanceStateDir is NOT under /home — ProtectHome=read-only would make the first-boot secret write EROFS', () => {
+  const dir = P.instanceStateDir(coTenant);
+  assert.equal(dir, '/var/lib/bongos-mercury');
+  assert.ok(!dir.startsWith('/home'), 'the writable state dir must survive ProtectHome=read-only');
+});
+
+t('generateDbPassword: base64url only, so it needs no escaping in the env file, the SQL literal or a URL', () => {
+  for (let i = 0; i < 20; i++) {
+    const pw = P.generateDbPassword();
+    assert.match(pw, /^[A-Za-z0-9_-]+$/, `not base64url: ${pw}`);
+    assert.ok(pw.length >= 40, `too short to be 32 bytes: ${pw.length}`);
+  }
+  assert.notEqual(P.generateDbPassword(), P.generateDbPassword(), 'must not be deterministic');
+});
+
+t('ensureInstanceUserCmd: idempotent SYSTEM account, nologin, state dir re-asserted every run', () => {
+  const c = P.ensureInstanceUserCmd(coTenant, { privileged: true });
+  assert.match(c, /id -u bongos-mercury >\/dev\/null 2>&1 \|\|/, 'an existing account short-circuits');
+  assert.match(c, /useradd --system/, 'a system account, not a login user');
+  assert.match(c, /--shell \/usr\/sbin\/nologin/, 'nothing should ever log in as an instance');
+  assert.match(c, /install -d -o bongos-mercury -g bongos-mercury -m 0700 \/var\/lib\/bongos-mercury/);
+  assert.ok(!P.ensureInstanceUserCmd(coTenant).includes('sudo '), 'unprivileged renders without sudo');
+});
+
+t('grantInstanceRepoReadCmd: adds the instance account to the app-user group so the unit can exec its WorkingDirectory', () => {
+  assert.equal(P.grantInstanceRepoReadCmd(coTenant, { privileged: true }), 'sudo usermod -aG lars bongos-mercury');
+});
+
+t('dbRoleCmd: LOGIN + password, upserted — CREATE on a fresh box, ALTER on a re-provision (the rotation path)', () => {
+  const c = P.dbRoleCmd(coTenant, { password: 'pw_ABC-123', privileged: true });
+  assert.match(c, /sudo -u postgres psql -v ON_ERROR_STOP=1 -d postgres/, 'role DDL runs on `postgres`, not the instance DB');
+  assert.match(c, /SELECT 1 FROM pg_roles WHERE rolname = \$r\$bongos-mercury\$r\$/);
+  assert.match(c, /CREATE ROLE %I WITH LOGIN PASSWORD %L/);
+  assert.match(c, /ALTER ROLE %I WITH LOGIN PASSWORD %L/);
+  assert.ok(c.includes('$p$pw_ABC-123$p$'), 'the password rides a dollar-quoted literal');
+});
+
+t('dbRoleCmd: the role is NOT a superuser and gets no CREATEDB/CREATEROLE — a compromised instance reaches its own data and no further', () => {
+  const c = P.dbRoleCmd(coTenant, { password: P.generateDbPassword(), privileged: true });
+  assert.ok(!/SUPERUSER/i.test(c), 'never a superuser');
+  assert.ok(!/CREATEDB/i.test(c), 'no CREATEDB');
+  assert.ok(!/CREATEROLE/i.test(c), 'no CREATEROLE');
+  assert.ok(!/BYPASSRLS/i.test(c), 'no BYPASSRLS');
+});
+
+t('dbRoleCmd: REVOKEs CONNECT from PUBLIC — the half that isolates, since PG grants it to PUBLIC by default', () => {
+  const c = P.dbRoleCmd(coTenant, { password: 'pw', privileged: true });
+  assert.match(c, /REVOKE CONNECT ON DATABASE %I FROM PUBLIC/, 'without this a sibling peer-auths straight in');
+  assert.match(c, /ALTER DATABASE %I OWNER TO %I/, 'the role owns its own DB');
+});
+
+t('dbRoleCmd: refuses a password that is not base64url — no caller can smuggle a quote into the SQL', () => {
+  assert.throws(() => P.dbRoleCmd(coTenant, { password: "x'; DROP DATABASE mercury; --" }), /base64url/);
+  assert.throws(() => P.dbRoleCmd(coTenant, { password: '' }), /base64url/);
+  assert.throws(() => P.dbRoleCmd(coTenant, {}), /base64url/);
+});
+
+t('dbRoleGrantsCmd: runs on the INSTANCE db and grants forward too — the migrate runs as postgres, so it owns the tables', () => {
+  const c = P.dbRoleGrantsCmd(coTenant, { privileged: true });
+  assert.match(c, /-d mercury/, 'schema grants are per-database');
+  assert.match(c, /GRANT ALL ON ALL TABLES IN SCHEMA public TO %I/, 'the tables the migrate already created');
+  assert.match(c, /ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO %I/, 'and the ones the NEXT migrate will');
+  assert.match(c, /GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO %I/);
+});
+
+t('BOTH role commands render with NO double quote — they have to survive a YAML double-quoted cloud-init scalar', () => {
+  const dq = String.fromCharCode(34);
+  for (const c of [P.dbRoleCmd(coTenant, { password: 'pw_ABC-123' }), P.dbRoleGrantsCmd(coTenant)]) {
+    assert.ok(!c.includes(dq), `a double-quoted identifier silently truncates the cloud-init line: ${c}`);
+  }
+});
+
+t('serviceUnit: runs as the instance\'s OWN account, never the shared app user (the /proc/<pid>/environ vector)', () => {
+  const u = P.serviceUnit(coTenant, { etcBase: '/etc' });
+  assert.match(u, /^User=bongos-mercury$/m);
+  assert.match(u, /^Group=bongos-mercury$/m);
+  assert.ok(!/^User=lars$/m.test(u), 'a shared User= is the defect this closes');
+  assert.ok(!/^Group=lars$/m.test(u));
+});
+
+t('serviceUnit: two instances on one box get two DIFFERENT accounts — co-tenant is the default shape', () => {
+  const a = P.serviceUnit(coTenant, { etcBase: '/etc' });
+  const b = P.serviceUnit({ ...coTenant, slug: 'venus', db_name: 'venus' }, { etcBase: '/etc' });
+  assert.match(a, /^User=bongos-mercury$/m);
+  assert.match(b, /^User=bongos-venus$/m);
+});
+
+t('serviceUnit: carries the hardening block, with HOME + ReadWritePaths pointing at the state dir', () => {
+  const u = P.serviceUnit(coTenant, { etcBase: '/etc' });
+  assert.match(u, /^ProtectSystem=strict$/m);
+  assert.match(u, /^ProtectHome=read-only$/m);
+  assert.match(u, /^PrivateTmp=true$/m);
+  assert.match(u, /^NoNewPrivileges=true$/m);
+  assert.match(u, /^Environment=HOME=\/var\/lib\/bongos-mercury$/m, 'the config-home write must not land under the read-only /home');
+  assert.match(u, /^ReadWritePaths=\/var\/lib\/bongos-mercury /m, 'the state dir is writable');
+});
+
+t('serviceUnit: ReadWritePaths does NOT make the checkout the service runs writable by it', () => {
+  const inst = { ...coTenant, hosting_shape: 'standalone' };
+  const u = P.serviceUnit(inst, { etcBase: '/etc' });
+  const root = P.standaloneRoot(inst);
+  const rw = u.split('\n').find((l) => l.startsWith('ReadWritePaths='));
+  assert.ok(rw.includes(`-${root}/config`), 'only config/, and optional so a shape without one still mounts');
+  assert.ok(!rw.split(' ').includes(root), 'the code the service runs stays read-only to it');
+});
+
+t('webEnvBody: carries PGUSER + PGPASSWORD for the instance role when the runner minted one', () => {
+  const b = P.webEnvBody(coTenant, { dbPassword: 'pw_ABC-123' });
+  assert.match(b, /^PGUSER=bongos-mercury$/m);
+  assert.match(b, /^PGPASSWORD=pw_ABC-123$/m);
+  assert.match(b, /^PGDATABASE=mercury$/m);
+});
+
+t('webEnvBody: NO password ⇒ no PG credential lines — an instance provisioned before this keeps its peer auth', () => {
+  const b = P.webEnvBody(coTenant);
+  assert.doesNotMatch(b, /^PGUSER=/m);
+  assert.doesNotMatch(b, /^PGPASSWORD=/m);
+  assert.match(b, /^PGDATABASE=mercury$/m, 'the DB name is unchanged either way');
+});
+
+t('dedicatedUserData: the droplet runs the SAME account + role steps, in the same order around the migrate', () => {
+  const ud = P.dedicatedUserData(coTenant);
+  const at = (needle) => ud.indexOf(needle);
+  assert.ok(at('useradd --system') > -1, 'the droplet creates the account too');
+  assert.ok(at('usermod -aG lars') > -1);
+  assert.ok(at('useradd --system') < at('createdb mercury'), 'account before the DB');
+  assert.ok(at('migrate.sh') < at('CREATE ROLE %I'), 'the role grants must follow the migrate that created the tables');
+  assert.ok(at('CREATE ROLE %I') < at('GRANT ALL ON ALL TABLES'), 'role before its grants');
+});
+
+t('dedicatedUserData: NEVER bakes a password into cloud-init — DO retains user-data and serves it back', () => {
+  const ud = P.dedicatedUserData(coTenant);
+  // The dollar-quoted password literal dbRoleCmd uses. Its absence is the assertion.
+  assert.ok(!ud.includes('$p$'), 'a credential in user-data is a permanent copy we cannot lock down');
+  assert.match(ud, /CREATE ROLE %I WITH LOGIN\$f\$/, 'the role is still created, password-less (single-tenant droplet)');
+  assert.match(ud, /REVOKE CONNECT ON DATABASE %I FROM PUBLIC/, 'and PUBLIC still loses CONNECT');
+});
+
+t('dbRoleCmd(peerOnly): omits the PASSWORD clause entirely, and REFUSES a password', () => {
+  const c = P.dbRoleCmd(coTenant, { peerOnly: true });
+  assert.ok(!/PASSWORD/.test(c), 'no PASSWORD clause at all — not an empty one');
+  assert.match(c, /CREATE ROLE %I WITH LOGIN\$f\$/);
+  assert.match(c, /ALTER DATABASE %I OWNER TO %I/, 'ownership and the revoke are unchanged');
+  assert.throws(() => P.dbRoleCmd(coTenant, { peerOnly: true, password: 'pw_ABC' }), /peerOnly takes no password/);
+});
+
+t('dbRoleCmdShown: the label the runner logs names every effect and carries NO password', () => {
+  const pw = P.generateDbPassword();
+  const real = P.dbRoleCmd(coTenant, { password: pw });
+  const shown = P.dbRoleCmdShown(coTenant);
+  assert.ok(real.includes(pw), 'precondition: the real command does embed the secret');
+  assert.ok(!shown.includes(pw), 'the logged label must not');
+  assert.ok(!shown.includes('$p$'), 'nor the dollar-quoted literal around it');
+  for (const effect of ['bongos-mercury', 'mercury', 'revoke PUBLIC connect']) {
+    assert.ok(shown.includes(effect), `the label must still name: ${effect}`);
+  }
+});
+
+
+await ta('provisionInstance: EVERY secret-bearing command opts into `shown`, so no password reaches the runner log', async () => {
+  // The generator tests prove the label is clean; this proves the CALL SITE uses it.
+  // Stated as an invariant rather than one assertion about one line: any future command
+  // that embeds a dollar-quoted secret is caught by the same test, which is the failure
+  // mode worth pinning — the leak was not a typo, it was a call site that never opted in.
+  const { deps } = recorder();
+  const seen = [];
+  deps.exec = (cmd, opts = {}) => { seen.push({ cmd, opts }); return { ok: true, stdout: '' }; };
+  await P.provisionInstance(coTenant, deps);
+
+  const secretBearing = seen.filter((c) => c.cmd.includes('$p$'));
+  assert.ok(secretBearing.length >= 1, 'precondition: the run really does issue a password-bearing command');
+  for (const { cmd, opts } of secretBearing) {
+    assert.ok(opts.shown, `a command embedding a secret must pass \`shown\`: ${cmd.slice(0, 60)}…`);
+    assert.ok(!opts.shown.includes('$p$'), 'the label must not carry the dollar-quoted secret');
+    // The password itself, pulled back out of the real command, must not be in the label.
+    const pw = (cmd.match(/\$p\$([^$]+)\$p\$/) || [])[1];
+    assert.ok(pw && pw.length > 20, 'precondition: recovered the generated password from the command');
+    assert.ok(!opts.shown.includes(pw), 'the label must not carry the password');
+  }
+});
+
+await ta('provisionInstance: the password IS written to web.env, which makeWriteFile logs by path not body', async () => {
+  const { deps } = recorder();
+  const bodies = [];
+  deps.writeFile = (path, body, opts) => { bodies.push({ path, body, opts }); return { ok: true }; };
+  const seen = [];
+  deps.exec = (cmd, opts = {}) => { seen.push({ cmd, opts }); return { ok: true, stdout: '' }; };
+  await P.provisionInstance(coTenant, deps);
+
+  const env = bodies.find((b) => /web\.env$/.test(b.path));
+  assert.ok(env, 'wrote a web.env');
+  assert.equal(env.opts && env.opts.mode, 0o600, 'web.env stays chmod 600');
+  const pw = (seen.map((c) => c.cmd).join('\n').match(/\$p\$([^$]+)\$p\$/) || [])[1];
+  assert.ok(pw, 'recovered the run\'s generated password');
+  assert.ok(env.body.includes(`PGPASSWORD=${pw}`), 'the SAME password the role was set to reaches web.env — one mint per run');
+  assert.ok(env.body.includes('PGUSER=bongos-mercury'));
+});
+
 console.log(`\nprovision: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);