@bongos/core 1.19.910 → 1.19.912

package/tests/provision_caddy_wiring.mjs

@@ -9,7 +9,7 @@ import { createRequire } from 'node:module';
 
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
-const { caddyWiringGap, checkCaddyWiring } = require('../scripts/gds/provision-net.js');
+const { caddyWiringGap, checkCaddyWiring, ingressPlaneGap } = require('../scripts/gds/provision-net.js');
 
 const DOMAIN = 'mercury.example.com';
 // What `caddy adapt` prints: 2.7 writes the ask as a string, 2.8+ as a permission module.
@@ -63,11 +63,13 @@ const WEB_ENV = 'PORT=3010\nBONGOS_PUBLIC_ORIGIN=https://old.example.com\n';
 
 // `served` = the hosts Caddy's resolved config carries once a snippet is written — the
 // fake flips to them after the first .caddy write, like the real import would.
-function harness({ onDemand = ASK_27, importsSnippets = true, reloadFails = false } = {}) {
+function harness({ onDemand = ASK_27, importsSnippets = true, reloadFails = false, noProxy = false } = {}) {
   const cmds = [], writes = [], statuses = [];
   let snippetWritten = null;
   const exec = (cmd, opts = {}) => {
     cmds.push({ cmd, opts });
+    // A plane with no proxy at all: the self-host image installs no caddy binary.
+    if (noProxy && /^caddy /.test(cmd)) { const e = new Error('Command failed'); e.stderr = Buffer.from('bash: caddy: command not found'); throw e; }
     if (cmd.startsWith('caddy adapt')) return { ok: true, stdout: adapted({ onDemand, hosts: importsSnippets && snippetWritten ? [snippetWritten] : [] }) };
     if (/cat\b.*web\.env/.test(cmd)) return { ok: true, stdout: WEB_ENV };
     if (/reload caddy/.test(cmd) && reloadFails) throw new Error('Job for caddy.service failed');
@@ -146,3 +148,75 @@ test('domain-attach: refused before the env patch without the ask; fails loudly
   assert.equal((await P.domainAttachInstance(activeStandalone, wired.deps)).ok, true);
   assert.notEqual(wired.cmds.find((c) => /reload caddy/.test(c.cmd)).opts.allowFail, true);
 });
+
+// -- the plane has no reverse proxy AT ALL (task 1004017) -------------------
+// ADR 0303 asks whether a box's Caddy is wired right. This is the prior question:
+// the self-host image ships no proxy, so a child instance provisioned inside it gets
+// a snippet write and a `systemctl reload caddy` that cannot work.
+
+test('ingressPlaneGap: a plane that answers `caddy version` is wired; one that cannot is named as lacking a proxy', () => {
+  const cmds = [];
+  assert.equal(ingressPlaneGap((c) => { cmds.push(c); return { ok: true, stdout: 'v2.8.4' }; }), null);
+  assert.deepEqual(cmds, ['caddy version'], 'one cheap, unprivileged probe — no config read, no running server');
+  const boom = () => { const e = new Error('Command failed'); e.stderr = Buffer.from('bash: caddy: command not found'); throw e; };
+  const gap = ingressPlaneGap(boom);
+  assert.match(gap, /no reverse proxy/, 'names what the plane lacks');
+  assert.match(gap, /command not found/, 'carries the real reason');
+});
+
+test('ingressPlaneGap: only a MISSING BINARY proves there is no proxy — a transport failure says it could not confirm', () => {
+  // boxExec is `ssh <host> bash -s` for a co-tenant, so an unreachable box throws here too.
+  // Diagnosing that as "this platform has no proxy, provision elsewhere" would be a confident
+  // wrong answer, and the intent would burn its retry budget on it.
+  const unreachable = () => { const e = new Error('Command failed'); e.status = 255; e.stderr = Buffer.from('ssh: connect to host box.example.com port 22: Connection timed out'); throw e; };
+  const unsure = ingressPlaneGap(unreachable);
+  assert.match(unsure, /could not confirm a reverse proxy/);
+  assert.match(unsure, /Connection timed out/, 'the real cause leads, not a parenthetical');
+  assert.doesNotMatch(unsure, /has no reverse proxy/, 'never asserts a diagnosis it cannot support');
+  // Exit 127 still means "no caddy" across the ssh hop — ssh reports its OWN failures as 255
+  // and otherwise propagates the remote command's status.
+  const remoteMissing = () => { const e = new Error('Command failed'); e.status = 127; e.stderr = Buffer.from(''); throw e; };
+  assert.match(ingressPlaneGap(remoteMissing), /has no reverse proxy/);
+  const cmdExe = () => { const e = new Error("'caddy' is not recognized as an internal or external command"); throw e; };
+  assert.match(ingressPlaneGap(cmdExe), /has no reverse proxy/, 'cmd.exe words it differently');
+});
+
+test('provision: a DOMAINLESS child on a plane with no reverse proxy is refused before a single write', async () => {
+  // The hole ADR 0303 leaves open: its preflight is gated on inst.domain, so a domainless
+  // child walked all the way to step 6 and died on the snippet write instead of being refused.
+  const h = harness({ noProxy: true });
+  const r = await P.provisionInstance({ ...coTenant, domain: null }, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /no reverse proxy/);
+  assert.equal(h.writes.length, 0, 'nothing written — not the snippet, not web.env');
+  assert.ok(!h.ran(/reload caddy/), 'the reload that cannot work is never attempted');
+  assert.deepEqual(h.statuses, [], 'the instance never flips to provisioning');
+});
+
+test('provision: a domained child on a proxyless plane names the missing proxy, not a Caddyfile to edit', async () => {
+  const h = harness({ noProxy: true });
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /no reverse proxy/);
+  assert.doesNotMatch(r.error, /add 'import|add 'on_demand_tls/, 'a plane that will never have Caddy is not told to edit a Caddyfile it does not have');
+  assert.equal(h.writes.length, 0);
+});
+
+test('domain-attach: a plane with no reverse proxy is refused before the env patch', async () => {
+  const h = harness({ noProxy: true });
+  const r = await P.domainAttachInstance(activeStandalone, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /no reverse proxy/);
+  assert.equal(h.writes.length, 0, 'web.env untouched');
+  assert.ok(!h.ran(/reload caddy/));
+});
+
+test('a dry run never probes the plane, and a wired box still reloads Caddy loudly', async () => {
+  const dry = harness({ noProxy: true });
+  dry.deps.apply = false;
+  await P.provisionInstance(coTenant, dry.deps);
+  assert.ok(!dry.ran(/caddy version/), 'a dry run changes nothing and asks nothing of the box');
+  const wired = harness();
+  assert.equal((await P.provisionInstance(coTenant, wired.deps)).ok, true, 'ADR 0303 behaviour on a real box is unchanged');
+  assert.ok(wired.ran(/reload caddy/));
+});

package/tests/quarantine_canonical.mjs

@@ -22,11 +22,39 @@ const q = require('../modules/security/artifact-scan/quarantine.js');
 const SHORT = os.tmpdir();
 const LONG = fs.realpathSync.native(SHORT);
 
-test('canonical expands an 8.3 short name — plain realpathSync does not', () => {
+// eightDotThreeReason — why the 8.3 case cannot be evaluated on THIS box, or null (task 1004051).
+//
+// The assertion below it is a statement about one specific divergence: a Windows 8.3 short name,
+// which plain fs.realpathSync does NOT expand. Asking "do the two spellings differ?" is a
+// different question, and macOS is where the two come apart — there os.tmpdir() is /var/folders/…
+// against a real /private/var/folders/…, a SYMLINK divergence that plain realpathSync resolves
+// perfectly well, so the notEqual fails and the suite goes red over a fact that was never claimed
+// about that platform. So ask for the 8.3 signature itself (a `~N` component) rather than
+// inferring it from inequality.
+//
+// It must not read as a PASS either — the task 1003993 contract. This returns a REASON for
+// node:test's own skip, never a bare early `return`, which prints as ✔ over a case that never
+// ran. Same shape as shallowCloneReason() in tests/helpers.mjs (task 1004049); kept local
+// because the 8.3 question belongs to this file alone.
+function eightDotThreeReason() {
+  if (SHORT === LONG) {
+    return `${process.platform}: os.tmpdir() is already its canonical spelling, so there is no `
+      + 'second spelling to expand here';
+  }
+  if (!/~\d/.test(SHORT)) {
+    return `${process.platform}: os.tmpdir() (${SHORT}) diverges from its real path (${LONG}) for `
+      + 'a reason that is not an 8.3 short name — plain realpathSync resolves that kind, so the '
+      + '8.3 fact cannot be evaluated here';
+  }
+  return null;
+}
+const NO_8_3 = eightDotThreeReason();
+
+test('canonical reports where os.tmpdir() really points, whatever its spelling', () => {
   assert.equal(q.canonical(SHORT), LONG);
-  // The premise, stated so this test explains itself on a machine where it does not apply:
-  // if the two spellings are identical here, the rest is trivially true rather than wrong.
-  if (SHORT === LONG) return;
+});
+
+test('plain realpathSync does NOT expand an 8.3 short name', { skip: NO_8_3 ?? false }, () => {
   assert.notEqual(fs.realpathSync(SHORT), LONG, 'this is the fact the obvious fix gets wrong');
 });