@bongos/core 1.19.735 → 1.19.737

package/tests/upgrade.mjs

@@ -9,12 +9,15 @@
 //   5. dry-run — plans without mutating package.json or spawning npm.
 //   6. full happy-path — pre-flight → pin → install → migrate → materialize → restart → verify,
 //      with every side effect injected (DB-free: the ledger is skipped when no DATABASE_URL).
+//  10. the pin push on a PRIVATE instance rides the owner's GitHub token through a chmod-600
+//      credential-store file, falls back to the remote only when none is stored, and a refused
+//      push is LOUD, naming the read-only deploy key and the fix (task 1003081, ADR 0176).
 //
 // Run:  node tests/upgrade.mjs
 
 import { strict as assert } from 'node:assert';
 import { createRequire } from 'node:module';
-import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, writeFileSync, readFileSync, existsSync, statSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 
@@ -1390,6 +1393,286 @@ t('pollServedVersion: gives up rather than spinning when the clock never advance
   assert.match(r.error, /no coreVersion/);
 });
 
+// ---- 10. the pin push rides the owner's GitHub token on a private instance (task 1003081, ADR 0176 follow-up) ----
+//
+// A PRIVATE standalone instance's origin authenticates with a deploy key GitHub registers
+// READ-ONLY, so `git push origin HEAD:main` is refused and the pin bump silently un-does
+// itself at the next pull-deploy. persistPin now prefers the owner's stored `repo` token
+// (the scaffold's + refreshStandaloneCorePin's credential-store shape), falls back to the
+// remote only when none is stored, and a refused push is LOUD. `run` is injected, so no
+// real repo, remote, or network — the assertions are on the argv persistPin CHOOSES and
+// on the credential file it writes beside it.
+
+const PIN_DIRTY = ' M package.json\n M package-lock.json\n';
+const hush = () => {};
+// A `run` fake for persistPin: `git -c <cfg> push …` is routed as the verb `push`, so a
+// handler sees the token-path push and the origin push alike. Unset config / no such
+// remote by default (exit 1), the way git answers a checkout that is not wired.
+function pinRun(handlers = {}) {
+  const calls = [];
+  const fn = (cmd, args, opts) => {
+    calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+    const verb = args[0] === '-c' ? args[2] : args[0];
+    const h = handlers[verb];
+    if (typeof h === 'function') return h(args, opts);
+    if (h) return h;
+    if (verb === 'status') return { status: 0, stdout: PIN_DIRTY };
+    if (verb === 'rev-parse') return { status: 0, stdout: 'main\n' };
+    if (verb === 'config' || verb === 'remote') return { status: 1, stdout: '' };
+    return { status: 0, stdout: '' };
+  };
+  fn.calls = calls;
+  return fn;
+}
+const pinBase = { instanceDir: '/srv/bongos/acme', fromVersion: '1.19.56', toVersion: '1.19.69', commitPin: true };
+const acme = { owner: 'acme', name: 'widgets' };
+const credFileOf = (args) => (String(args[1] || '').match(/^credential\.helper=store --file=(.+)$/) || [])[1] || null;
+
+t('persistPin: a stored owner token pushes over HTTPS through a chmod-600 credential-store file, and the token never rides argv', () => {
+  const token = 'gho_SECRET_OWNER_TOKEN';
+  let seen = null;
+  const run = pinRun({
+    push: (args, opts) => {
+      const credFile = credFileOf(args);
+      const there = !!credFile && existsSync(credFile);
+      seen = {
+        credFile, there,
+        mode: there ? statSync(credFile).mode & 0o777 : null,
+        body: there ? readFileSync(credFile, 'utf8') : null,
+        url: args[3], target: args[4],
+        noPrompt: opts && opts.env && opts.env.GIT_TERMINAL_PROMPT,
+      };
+      return { status: 0, stdout: '' };
+    },
+  });
+  const r = u.persistPin({ ...pinBase, pushAuth: { token, repo: acme } }, run, hush, hush);
+  assert.deepEqual(r, { applicable: true, committed: true, pushed: true, dirty: u.PIN_FILES, via: 'owner-token' });
+  assert.ok(seen, 'the push ran');
+  assert.ok(seen.credFile, `the push reads a credential-store file; argv was ${JSON.stringify(run.calls)}`);
+  assert.equal(seen.url, 'https://x-access-token@github.com/acme/widgets.git', 'HTTPS at the remote repo, the placeholder user in the URL');
+  assert.equal(seen.target, 'HEAD:main');
+  assert.equal(seen.there, true, 'the credential file exists while git runs');
+  if (process.platform !== 'win32') assert.equal(seen.mode, 0o600, 'chmod 600 — the secret is readable by this user only');
+  assert.equal(seen.body, `https://x-access-token:${token}@github.com\n`, 'the token lives in the file, credential-store shape');
+  assert.equal(seen.noPrompt, '0', 'a rejected credential fails instead of sitting at a password prompt');
+  assert.ok(!existsSync(seen.credFile), 'removed in finally');
+  assert.ok(run.calls.every((c) => !c.includes(token)), `the token never rides argv: ${JSON.stringify(run.calls)}`);
+  assert.ok(!run.calls.some((c) => /^git push /.test(c)), 'the SSH origin was not used');
+  assert.ok(run.calls.some((c) => c === `git add ${u.PIN_FILES.join(' ')}`) && run.calls.some((c) => c.startsWith('git commit -m pin @bongos/core 1.19.69')), 'stage + commit are unchanged');
+});
+
+t('persistPin: no stored token → the push falls back to the git remote, with no credential helper anywhere', () => {
+  const run = pinRun();
+  const r = u.persistPin({ ...pinBase }, run, hush, hush);
+  assert.deepEqual(r, { applicable: true, committed: true, pushed: true, dirty: u.PIN_FILES }, 'the origin-path result is byte-for-byte what every existing caller reads');
+  assert.ok(run.calls.some((c) => c === 'git push origin HEAD:main'), 'pushes via the remote');
+  assert.ok(!run.calls.some((c) => /credential\.helper|x-access-token/.test(c)), 'no credential helper, no token URL');
+  // `pushAuth: null` — what resolvePinPushAuth returns on every miss — is the same path.
+  const run2 = pinRun();
+  assert.equal(u.persistPin({ ...pinBase, pushAuth: null }, run2, hush, hush).pushed, true);
+  assert.ok(run2.calls.some((c) => c === 'git push origin HEAD:main'));
+});
+
+t('persistPin: a refused origin push on a WIRED private instance is loud — names the read-only key, the consequence, and the fix', () => {
+  const warnings = [];
+  const run = pinRun({
+    push: { status: 128, stdout: '', stderr: 'ERROR: The key you are authenticating with has been marked as read only.\nfatal: Could not read from remote repository.\n' },
+    config: { status: 0, stdout: 'ssh -F /dev/null -i /srv/bongos/acme/.git/cloudbongos-deploy-key -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new\n' },
+    remote: { status: 0, stdout: 'git@github.com:acme/widgets.git\n' },
+  });
+  const r = u.persistPin({ ...pinBase }, run, hush, (m) => warnings.push(m));
+  assert.equal(r.committed, true);
+  assert.equal(r.pushed, false);
+  assert.equal(r.refused, 'read-only-deploy-key');
+  // The tokenless refusal is a plain sentence, not the bare status line.
+  assert.match(r.error, /read-only deploy key at \/srv\/bongos\/acme\/\.git\/cloudbongos-deploy-key/, 'names the key');
+  assert.match(r.error, /no owner GitHub token is stored/, 'and why nothing else was tried');
+  assert.notEqual(r.error, 'git push failed');
+  const text = warnings.join('\n');
+  assert.match(text, /PIN NOT PUSHED/, 'shouts');
+  assert.match(text, /\/srv\/bongos\/acme\/\.git\/cloudbongos-deploy-key/, 'names the key on stderr too');
+  assert.match(text, /READ-ONLY/);
+  assert.match(text, /reset --hard/, 'names the mechanism that reverts it');
+  assert.match(text, /npm ci/);
+  assert.match(text, /1\.19\.56/, 'and the version it would fall back to');
+  assert.match(text, /reconnect GitHub with repository access/, 'names the fix');
+  assert.match(text, /--commit-pin/);
+  assert.match(text, /--instance '\/srv\/bongos\/acme'/, 'and where to re-run it');
+  assert.match(text, /push 'https:\/\/github\.com\/acme\/widgets\.git' 'HEAD:main'/, 'plus a by-hand push at the real repo, paste-safe');
+  assert.match(text, /marked as read only/, "git's own reason rides along");
+});
+
+t('persistPin: a refused origin push on an UN-wired checkout keeps the plain failure (no false read-only diagnosis)', () => {
+  const warnings = [];
+  const run = pinRun({ push: { status: 1, stdout: '', stderr: 'fatal: unable to access: Could not resolve host\n' } });
+  const r = u.persistPin({ ...pinBase }, run, hush, (m) => warnings.push(m));
+  assert.equal(r.pushed, false);
+  assert.equal(r.error, 'git push failed');
+  assert.equal(r.refused, undefined);
+  assert.ok(!/READ-ONLY|deploy key/.test(warnings.join('\n')), 'no read-only story when no key is pinned');
+  assert.match(warnings.join('\n'), /still not durable/i);
+});
+
+t('persistPin: a refused push OVER the token is loud too, and the credential file is still removed', () => {
+  const token = 'gho_EXPIRED_TOKEN';
+  const warnings = [];
+  let credFile = null;
+  const run = pinRun({
+    push: (args) => {
+      credFile = credFileOf(args);
+      return { status: 128, stdout: '', stderr: 'remote: Write access to repository not granted.\nfatal: unable to access \'https://github.com/acme/widgets.git/\': The requested URL returned error: 403\n' };
+    },
+  });
+  const r = u.persistPin({ ...pinBase, pushAuth: { token, repo: acme } }, run, hush, (m) => warnings.push(m));
+  assert.equal(r.committed, true);
+  assert.equal(r.pushed, false);
+  assert.equal(r.refused, 'owner-token');
+  assert.match(r.error, /over the owner's GitHub token/);
+  assert.match(r.error, /expired, or missing the repo scope/);
+  assert.ok(credFile && !existsSync(credFile), 'the credential file is gone even on failure');
+  const text = warnings.join('\n');
+  assert.match(text, /PIN NOT PUSHED/);
+  assert.match(text, /expired/);
+  assert.match(text, /repo.*scope/);
+  assert.match(text, /reconnect GitHub with repository access/, 'names the fix');
+  assert.match(text, /Write access to repository not granted/, "GitHub's own reason rides along, not git's generic fatal line");
+  assert.match(text, /push 'https:\/\/github\.com\/acme\/widgets\.git' 'HEAD:main'/, 'and a by-hand push');
+  assert.ok(!text.includes(token), 'the token is never logged');
+  assert.ok(!run.calls.some((c) => /^git push /.test(c)), 'a token refusal does not retry the read-only origin');
+});
+
+t('pinnedDeployKey / remoteGithubRepo: read the ADR 0176 wiring off the checkout, and only GitHub remotes count', () => {
+  const wired = pinRun({ config: { status: 0, stdout: 'ssh -F /dev/null -i /srv/bongos/acme/.git/cloudbongos-deploy-key -o IdentitiesOnly=yes\n' } });
+  assert.equal(u.pinnedDeployKey('/srv/bongos/acme', wired), '/srv/bongos/acme/.git/cloudbongos-deploy-key');
+  assert.equal(u.pinnedDeployKey('/srv/bongos/acme', pinRun()), null, 'unset core.sshCommand → not wired');
+  assert.equal(u.pinnedDeployKey('/srv/bongos/acme', pinRun({ config: { status: 0, stdout: 'ssh -o BatchMode=yes\n' } })), null, 'a sshCommand without -i pins no key');
+
+  const at = (url) => pinRun({ remote: { status: 0, stdout: `${url}\n` } });
+  assert.deepEqual(u.remoteGithubRepo('/srv/bongos/acme', 'origin', at('git@github.com:acme/widgets.git')), acme, 'the ADR 0176 private wiring');
+  assert.deepEqual(u.remoteGithubRepo('/srv/bongos/acme', 'origin', at('https://github.com/acme/widgets')), acme);
+  assert.deepEqual(u.remoteGithubRepo('/srv/bongos/acme', 'origin', at('https://x-access-token@github.com/acme/widgets.git')), acme);
+  const P = require('../scripts/gds/provision.js');
+  assert.deepEqual(u.remoteGithubRepo('/srv/bongos/acme', 'origin', at(P.instanceRepoRemote(acme))), acme, 'the shared SSH alias the public scaffold wires is GitHub too');
+  assert.equal(u.remoteGithubRepo('/srv/bongos/acme', 'origin', at('https://gitlab.com/acme/widgets.git')), null, 'another host is never pointed at github.com');
+  assert.equal(u.remoteGithubRepo('/srv/bongos/acme', 'origin', at('git@bitbucket.org:acme/widgets.git')), null);
+  assert.equal(u.remoteGithubRepo('/srv/bongos/acme', 'origin', pinRun()), null, 'no such remote');
+  // --git-remote is honoured: the URL of THAT remote is read.
+  const deploy = pinRun({ remote: (args) => (args[2] === 'deploy' ? { status: 0, stdout: 'git@github.com:acme/widgets.git\n' } : { status: 1, stdout: '' }) });
+  assert.deepEqual(u.remoteGithubRepo('/srv/bongos/acme', 'deploy', deploy), acme);
+});
+
+t('resolvePinPushAuth: the owner token is spent only when one is stored AND the provisioning row names the remote repo', async () => {
+  const inst = { slug: 'acme', owner_builder_id: 7, target_ref: 'acme/widgets', hosting_shape: 'standalone' };
+  const at = (url) => pinRun({ remote: { status: 0, stdout: `${url}\n` } });
+  const dir = { instanceDir: '/srv/bongos/acme' };
+
+  // stored token + matching row → { token, repo }, the repo parsed from the REMOTE
+  const a = await u.resolvePinPushAuth(dir, { log: hush, instance: inst, getGithubToken: async (bid) => (bid === 7 ? { token: 'gho_T', scope: 'read:user,repo' } : null) }, at('git@github.com:acme/widgets.git'));
+  assert.deepEqual(a, { token: 'gho_T', repo: acme });
+  // case never decides it (GitHub owner/repo names are case-insensitive)
+  const b = await u.resolvePinPushAuth(dir, { log: hush, instance: { ...inst, target_ref: 'Acme/Widgets' }, getGithubToken: async () => ({ token: 'gho_T' }) }, at('git@github.com:acme/widgets.git'));
+  assert.equal(b && b.token, 'gho_T');
+  // no token stored → null: the origin path
+  assert.equal(await u.resolvePinPushAuth(dir, { log: hush, instance: inst, getGithubToken: async () => null }, at('git@github.com:acme/widgets.git')), null);
+  // a row for ANOTHER repo → null: never another instance's credential for this checkout
+  let asked = 0;
+  const other = await u.resolvePinPushAuth(dir, { log: hush, instance: { ...inst, target_ref: 'acme/other' }, getGithubToken: async () => { asked++; return { token: 'gho_T' }; } }, at('git@github.com:acme/widgets.git'));
+  assert.equal(other, null);
+  assert.equal(asked, 0, 'the token store is not even consulted for a mismatched row');
+  // a non-GitHub remote → null, before any row or token lookup
+  let rows = 0;
+  assert.equal(await u.resolvePinPushAuth(dir, { log: hush, getInstanceBySlug: async () => { rows++; return inst; }, getGithubToken: async () => ({ token: 'gho_T' }) }, at('https://gitlab.com/acme/widgets.git')), null);
+  assert.equal(rows, 0);
+  // no row at all (an instance's own DB, a laptop) → null, and a THROWING lookup is the same answer
+  assert.equal(await u.resolvePinPushAuth(dir, { log: hush, getInstanceBySlug: async () => null, getGithubToken: async () => ({ token: 'gho_T' }) }, at('git@github.com:acme/widgets.git')), null);
+  assert.equal(await u.resolvePinPushAuth(dir, { log: hush, getInstanceBySlug: async () => { throw new Error('relation "provisioning_instances" does not exist'); }, getGithubToken: async () => ({ token: 'gho_T' }) }, at('git@github.com:acme/widgets.git')), null);
+  // the by-slug lookup uses the checkout's basename — standaloneRoot is <base>/<slug>
+  const slugs = [];
+  const c = await u.resolvePinPushAuth(dir, { log: hush, getInstanceBySlug: async (s) => { slugs.push(s); return inst; }, getGithubToken: async () => ({ token: 'gho_T' }) }, at('git@github.com:acme/widgets.git'));
+  assert.deepEqual(slugs, ['acme']);
+  assert.equal(c && c.token, 'gho_T');
+  // a row without an owner (or a token lookup that throws) is the origin path, never a crash
+  assert.equal(await u.resolvePinPushAuth(dir, { log: hush, getInstanceBySlug: async () => ({ ...inst, owner_builder_id: null }), getGithubToken: async () => ({ token: 'gho_T' }) }, at('git@github.com:acme/widgets.git')), null);
+  assert.equal(await u.resolvePinPushAuth(dir, { log: hush, instance: inst, getGithubToken: async () => { throw new Error('secret-box off'); } }, at('git@github.com:acme/widgets.git')), null);
+});
+
+t('runUpgrade --commit-pin: on a wired private instance the pin lands via the owner token, end to end', async () => {
+  const dir = scratchConsumer({ pinned: '1.14.1', installed: '1.14.1' });
+  const src = mkdtempSync(join(tmpdir(), 'otb-upgrade-src-'));
+  writeFileSync(join(src, 'bongos-core-1.15.0.tgz'), 'TGZ');
+  const token = 'gho_END_TO_END_TOKEN';
+  const calls = [];
+  let pushArgv = null;
+  const run = (cmd, args, opts) => {
+    calls.push(`${cmd} ${(args || []).join(' ')}`.trim());
+    // pre-flight `git status --porcelain` is clean; persistPin's pathspec-limited look
+    // (`-- package.json package-lock.json`) sees the moved pin.
+    if (cmd === 'git' && args[0] === 'status') return { status: 0, stdout: args.includes('--') ? PIN_DIRTY : '' };
+    if (cmd === 'git' && args[0] === 'rev-parse') return { status: 0, stdout: 'main\n' };
+    if (cmd === 'git' && args[0] === 'remote') return { status: 0, stdout: 'git@github.com:acme/widgets.git\n' };
+    if (cmd === 'git' && args[0] === 'config') return { status: 0, stdout: 'ssh -F /dev/null -i /srv/bongos/acme/.git/cloudbongos-deploy-key -o IdentitiesOnly=yes\n' };
+    if (cmd === 'git' && args[0] === '-c') { pushArgv = args; return { status: 0, stdout: '' }; }
+    if (cmd === 'npm' && args[0] === 'install') {
+      writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'), JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+    }
+    return { status: 0 }; // no stdout: resolveInstanceDb reads "could not run" (not fatal), as the happy-path test's shim does
+  };
+  const res = await u.runUpgrade(
+    { to: '1.15.0', from: join(src, 'bongos-core-1.15.0.tgz'), instance: dir, service: 'acme.service', healthCheck: false, commitPin: true },
+    {
+      log: hush, err: hush, run,
+      materialize: () => ({ skills: 35, settings: true, hooks: 3 }),
+      regenerateApiArtifacts: () => ({ ok: true, ran: ['gen-api-docs.js', 'gen-api-client.js'] }),
+      databaseUrl: '', pgDatabase: '',
+      instance: { slug: 'acme', owner_builder_id: 7, target_ref: 'acme/widgets', hosting_shape: 'standalone' },
+      getGithubToken: async () => ({ token, scope: 'read:user,repo' }),
+    },
+  );
+  assert.equal(res.ok, true, `upgrade should succeed: ${res.error}`);
+  assert.equal(res.pin && res.pin.pushed, true, 'the pin was pushed');
+  assert.equal(res.pin.via, 'owner-token', 'over the owner token, not the read-only origin');
+  assert.ok(pushArgv, 'pushed via the credential-store helper');
+  assert.equal(pushArgv[3], 'https://x-access-token@github.com/acme/widgets.git');
+  assert.equal(pushArgv[4], 'HEAD:main');
+  assert.ok(!calls.some((c) => c.includes(token)), 'the token never rides argv');
+  assert.ok(!calls.some((c) => /^git push /.test(c)), 'the read-only origin was never asked');
+});
+
+t('runUpgrade: the token store is consulted only when a push is actually coming', async () => {
+  // --pin-no-push, --dry-run, and a clean pin all skip resolvePinPushAuth entirely:
+  // nothing reads a credential it will not spend.
+  const cases = [
+    { name: 'no --commit-pin', opts: {}, dirtyPin: true },
+    { name: '--pin-no-push', opts: { commitPin: true, pinNoPush: true }, dirtyPin: true },
+    { name: '--dry-run', opts: { commitPin: true, dryRun: true }, dirtyPin: true },
+    { name: 'pin already committed', opts: { commitPin: true }, dirtyPin: false },
+  ];
+  for (const c of cases) {
+    const dir = scratchConsumer({ pinned: '1.14.1', installed: '1.14.1' });
+    const src = mkdtempSync(join(tmpdir(), 'otb-upgrade-src-'));
+    writeFileSync(join(src, 'bongos-core-1.15.0.tgz'), 'TGZ');
+    let resolved = 0;
+    const run = (cmd, args) => {
+      if (cmd === 'git' && args[0] === 'status') return { status: 0, stdout: args.includes('--') && c.dirtyPin ? PIN_DIRTY : '' };
+      if (cmd === 'git' && args[0] === 'rev-parse') return { status: 0, stdout: 'main\n' };
+      if (cmd === 'npm' && args[0] === 'install') {
+        writeFileSync(join(dir, 'node_modules', '@bongos', 'core', 'package.json'), JSON.stringify({ name: '@bongos/core', version: '1.15.0' }) + '\n');
+      }
+      return { status: 0 };
+    };
+    await u.runUpgrade(
+      { to: '1.15.0', from: join(src, 'bongos-core-1.15.0.tgz'), instance: dir, service: 'acme.service', healthCheck: false, ...c.opts },
+      {
+        log: hush, err: hush, run,
+        materialize: () => ({}), regenerateApiArtifacts: () => ({ ok: true, ran: [] }),
+        databaseUrl: '', pgDatabase: '',
+        resolvePinPushAuth: async () => { resolved++; return null; },
+      },
+    );
+    assert.equal(resolved, 0, `${c.name}: must not consult the token store`);
+  }
+});
+
 await Promise.all(pending);
 console.log(`\nupgrade: ${passed} passed, ${failed} failed`);
 process.exit(failed ? 1 : 0);