@bongos/core 1.19.916 → 1.19.917

package/tests/provision_account_identity.mjs

@@ -0,0 +1,135 @@
+// tests/provision_account_identity.mjs — a plane that cannot create a per-instance unix
+// account is refused, not handed a shared uid (task 1004018, ADR 0317). ADR 0281 makes an
+// instance's identity its own account; the self-host image runs `USER node` with no sudo,
+// where `useradd` cannot run at all. Before this, that plane crashed mid-provision at step
+// 1c — or, once someone gives the container a front door, would have quietly co-located
+// every child under one uid. Hermetic: exec is a fake, nothing touches a box.
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const P = require('../scripts/gds/provision.js');
+const { accountPlaneGap, accountPreflight } = require('../scripts/gds/provision-repo.js');
+
+const PROBE = `sh -c 'test "$(id -u)" = 0'`;
+const isRoot = () => ({ ok: true, stdout: '' });
+// What a shell that RAN reports: exit 1 from `test`, or 127 when sudo is not installed.
+// execSync ALWAYS sets stderr to a Buffer, empty when the command failed silently — the
+// fakes carry it because a fake that omits it hides a message with no cause in it.
+const answered = (status, msg, stderr = '') => () => {
+  const e = new Error(msg); e.status = status; e.stderr = Buffer.from(stderr); throw e;
+};
+const unreachable = () => {
+  const e = new Error('Command failed'); e.status = 255;
+  e.stderr = Buffer.from('ssh: connect to host box port 22: Connection timed out'); throw e;
+};
+
+test('accountPlaneGap: a runner that reaches root passes; one that cannot is named as sharing a uid', () => {
+  const cmds = [];
+  assert.equal(accountPlaneGap((c) => { cmds.push(c); return isRoot(); }), null);
+  assert.deepEqual(cmds, [PROBE], 'one read-only command, no mutation');
+  const gap = accountPlaneGap(answered(1, 'Command failed'));
+  assert.match(gap, /cannot create a per-instance unix account/);
+  assert.match(gap, /one uid/, 'names the consequence, not just the failed command');
+  assert.match(gap, /ADR 0281/);
+});
+
+test('accountPlaneGap: the probe runs the SAME escalation step 1c will, so a pass is evidence', () => {
+  const cmds = [];
+  const rec = (c) => { cmds.push(c); return isRoot(); };
+  accountPlaneGap(rec, { privileged: true });
+  accountPlaneGap(rec, { privileged: false });
+  assert.deepEqual(cmds, [`sudo ${PROBE}`, PROBE]);
+  // sh -c, not a bare `test`: under sudo an outer-shell expansion would answer about the
+  // unprivileged user and pass on exactly the plane this refuses.
+  assert.ok(cmds.every((c) => /sh -c '/.test(c)), 'the command substitution runs INSIDE the escalation');
+});
+
+test('accountPlaneGap: only a shell that answered proves it — a transport failure says it could not confirm', () => {
+  const unsure = accountPlaneGap(unreachable);
+  assert.match(unsure, /could not confirm/);
+  assert.doesNotMatch(unsure, /Provision from a host/, 'a network blip is never diagnosed as a plane property');
+  assert.match(unsure, /Connection timed out/, 'the real cause leads');
+  // The container's two real shapes, both proof.
+  assert.match(accountPlaneGap(answered(127, 'Command failed', 'sh: 1: sudo: not found'), { privileged: true }), /sudo: not found/);
+  assert.match(accountPlaneGap(answered(1, 'Command failed')), /cannot create a per-instance unix account/);
+});
+
+test('accountPlaneGap: a SILENT failure still names a cause — an empty stderr is not a blank reason', () => {
+  // The commonest refusal there is: `test` exits 1 and writes nothing. execSync hands back a
+  // zero-length stderr Buffer, which is truthy and String()s to '' — so a naive
+  // `e.stderr || e.message` prints "failed ()" and tells the operator nothing.
+  const gap = accountPlaneGap(answered(1, 'Command failed: sh -c'));
+  assert.doesNotMatch(gap, /failed \(\)/, 'the parenthetical exists to name the cause');
+  assert.match(gap, /failed \(Command failed: sh -c\)/, 'falls through the empty Buffer to the message');
+});
+
+test('accountPreflight: a dedicated droplet skips it, and a dry run asks the box nothing', () => {
+  const cmds = [];
+  const rec = (c) => { cmds.push(c); return isRoot(); };
+  assert.equal(accountPreflight({ exec: rec, apply: true, log: () => {}, shape: 'dedicated' }), null);
+  assert.deepEqual(cmds, [], 'cloud-init creates that account as root — nothing to ask');
+  const lines = [];
+  assert.equal(accountPreflight({ exec: rec, apply: false, log: (m) => lines.push(m), shape: 'co-tenant' }), null);
+  assert.deepEqual(cmds, [], 'a dry run changes nothing and asks nothing');
+  assert.match(lines.join('\n'), /would probe/, 'the plan says the probe is coming, rather than printing step 1c as though it works');
+});
+
+// -- the runner leg ---------------------------------------------------------
+
+const coTenant = { id: 1, slug: 'mercury', hosting_shape: 'co-tenant', status: 'requested', owner_builder_id: 7, port: 3003, db_name: 'mercury', domain: null };
+
+// `noRoot` is the self-host image: USER node, no sudo, so the probe's shell answers 127.
+function harness({ noRoot = false } = {}) {
+  const cmds = [], writes = [], statuses = [];
+  const exec = (cmd) => {
+    cmds.push(cmd);
+    if (noRoot && cmd.includes('id -u')) { const e = new Error('sh: 1: sudo: not found'); e.status = 127; throw e; }
+    return { ok: true, stdout: '' };
+  };
+  const deps = {
+    apply: true, privileged: true, log: () => {}, sleep: async () => {},
+    db: { query: async () => ({ rows: [] }) },
+    provisioning: {
+      setInstanceStatus: async (_db, _id, s) => { statuses.push(s); }, recordEvent: async () => {},
+      recordDnsNote: async () => {}, clearReleasedDomains: async () => {},
+    },
+    exec,
+    writeFile: (p) => { writes.push(p); return { ok: true }; },
+    doApi: null,
+    checkDnsTokenScope: async () => ({ reachable: true, zone: 'example.com' }),
+    checkCaddyWiring: () => null,
+    getGithubToken: async () => null,
+  };
+  return { deps, cmds, writes, statuses, ran: (re) => cmds.some((c) => re.test(c)) };
+}
+
+test('provision: a plane that cannot give the child its own account is refused before a single write', async () => {
+  const h = harness({ noRoot: true });
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, false);
+  assert.match(r.error, /^Account preflight failed: /);
+  assert.match(r.error, /one uid/);
+  assert.equal(h.writes.length, 0, 'nothing written — not web.env, not the unit');
+  assert.ok(!h.ran(/useradd/), 'the useradd that cannot work is never attempted');
+  assert.ok(!h.ran(/createdb/), 'no database either — the refusal precedes every mutation');
+  assert.deepEqual(h.statuses, [], 'the instance never flips to provisioning');
+});
+
+test('provision: the probe runs BEFORE step 1c, so the refusal replaces the crash rather than following it', async () => {
+  const h = harness({ noRoot: true });
+  await P.provisionInstance(coTenant, h.deps);
+  assert.equal(h.cmds.filter((c) => c.includes('id -u')).length, 1, 'asked once');
+  assert.ok(h.cmds[h.cmds.length - 1].includes('id -u'), 'the probe is the last thing the box was asked');
+});
+
+test('provision: a box where the runner reaches root is unchanged — the live server still provisions', async () => {
+  const h = harness();
+  const r = await P.provisionInstance(coTenant, h.deps);
+  assert.equal(r.ok, true);
+  assert.ok(h.ran(/useradd --system/), 'step 1c still creates the per-instance account');
+  assert.ok(h.ran(/createdb mercury/));
+  const idx = (re) => h.cmds.findIndex((c) => re.test(c));
+  assert.ok(idx(/id -u.*= 0/) < idx(/useradd --system/), 'the probe precedes the account it guards');
+});