@bongos/core 1.19.936 → 1.19.938

package/tests/provision.mjs

@@ -18,6 +18,8 @@ import { join } from 'node:path';
 
 const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
+const AP = require('../scripts/gds/instance-apex.js');
+const RP = require('../scripts/gds/provision-repo.js');
 
 // The env-var prefix a provisioned instance resolves = the envPrefix an instance INHERITS from
 // the neutral pack (task 1003740: webEnvBody no longer pins a branding pack anywhere — the
@@ -40,6 +42,11 @@ process.env.PROVISION_GIT_SSH_ALIAS = 'github-deploy';
 // The probe itself is covered directly, with an injected fs.
 process.env.PROVISION_PROCESS_MANAGER = 'systemd';
 
+// And the app user (task 1002719): unpinned it is whoever runs the suite. Pinned to a name
+// that is nobody's real account, so an assertion passes only if the value came through the
+// resolver — a leftover literal cannot produce it.
+process.env.PROVISION_APP_USER = 'appsvc';
+
 let passed = 0, failed = 0;
 function t(name, fn) {
   try { fn(); passed++; console.log(`  PASS  ${name}`); }
@@ -167,11 +174,16 @@ t('buildCorePinRefreshCommit (the commit step): git sequence, token-URL push, an
   // must not attribute its commits to the hub. Assert against the resolver so
   // this pins the behaviour, not one instance's literal.
   assert.deepEqual(withTok.config, [
-    'git -C /srv/bongos/spike-harbor config user.name "Cloud Bongos"',
+    `git -C /srv/bongos/spike-harbor config user.name "${AP.provisionerBotName()}"`,
     `git -C /srv/bongos/spike-harbor config user.email "${P.provisionerBotEmail()}"`,
   ]);
   assert.equal(P.provisionerBotEmail({ PROVISION_BOT_EMAIL: 'ops@acme.test' }), 'ops@acme.test', 'env override wins');
   assert.doesNotMatch(P.provisionerBotEmail({}), /example/i, 'never a founder-host address');
+  // task 1002719: the NAME comes from the pack too, and one the shell cannot quote falls back.
+  assert.equal(AP.provisionerBotName('Acme Forge'), 'Acme Forge', 'the pack\'s product name');
+  for (const unsafe of ['Acme "Forge"', 'a$(id)', 'a`id`', 'a\\b', 'a\nb', '']) {
+    assert.equal(AP.provisionerBotName(unsafe), 'Cloud Bongos', `falls back on ${JSON.stringify(unsafe)}`);
+  }
   assert.equal(withTok.add, 'git -C /srv/bongos/spike-harbor add -A');
   assert.match(withTok.commit, /@bongos\/core 1\.19\.2 -> 1\.19\.196 \(task 1003050\)/);
   assert.match(withTok.push, /store --file=\/tmp\/cred.*x-access-token@github\.com\/jaxri\/spike-harbor\.git HEAD:main/);
@@ -199,7 +211,7 @@ t('backup units: per-instance names + the DB set on the unit (fixes the task-221
   // the DB is pinned on the unit → no fallback to the nonexistent example default
   assert.match(svc, /Environment=GDS_BACKUP_DB=mercury/);
   assert.match(svc, /Environment=GDS_BACKUP_DIR=\/var\/backups\/gds/);
-  assert.match(svc, new RegExp(`User=${reEsc('lars')}`), 'runs as the app user (mirrors serviceUnit)');
+  assert.match(svc, new RegExp(`User=${reEsc('appsvc')}`), 'runs as the app user (mirrors serviceUnit)');
   assert.match(svc, /ReadWritePaths=\/var\/backups\/gds/, 'the only writable path is the backup dir');
   const timer = P.backupTimer(coTenant);
   assert.match(timer, /OnCalendar=\*-\*-\* 04:00:00 UTC/);
@@ -466,7 +478,7 @@ await ta('provisionInstance(co-tenant) composes db → migrate → service → h
   assert.ok(writes.some((w) => /\/mercury\.service$/.test(w)), 'wrote systemd unit');
   assert.ok(writes.some((w) => /\/mercury\.caddy$/.test(w)), 'wrote per-instance Caddy snippet');
   // task 2213: EVERY instance is born with backups — dir + per-instance timer/service
-  assert.match(joined, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/, 'creates the backup dir');
+  assert.match(joined, /install -d -o appsvc -g \$\(id -gn appsvc\) -m 0750 \/var\/backups\/gds/, 'creates the backup dir');
   assert.match(joined, /systemctl enable --now mercury-db-backup\.timer/, 'enables the per-instance backup timer');
   assert.ok(writes.some((w) => /\/mercury-db-backup\.service$/.test(w)), 'wrote backup service unit');
   assert.ok(writes.some((w) => /\/mercury-db-backup\.timer$/.test(w)), 'wrote backup timer unit');
@@ -626,7 +638,8 @@ t('systemd manager: emits byte-identical commands + unit paths to the inline str
   PM.systemd.installBackup(INST, io2);
   // The backup DIR moved in here with the schedule it serves: a manager that installs no
   // schedule must not create it either. Order is unchanged — dir, units, reload, enable.
-  assert.match(io2.cmds[0], /^sudo install -d -o \S+ -g \S+ -m 0750 /);
+  // The group is the app user's PRIMARY group, looked up on the box (task 1002719).
+  assert.match(io2.cmds[0], /^sudo install -d -o appsvc -g \$\(id -gn appsvc\) -m 0750 /);
   assert.deepEqual(io2.cmds.slice(1), ['sudo systemctl daemon-reload', 'sudo systemctl enable --now demo-db-backup.timer']);
   assert.deepEqual(io2.files.map((f) => f.path),
     ['/etc/systemd/system/demo-db-backup.service', '/etc/systemd/system/demo-db-backup.timer']);
@@ -1329,7 +1342,7 @@ await ta('dedicatedUserData bakes the nightly backup: unit files (b64) + dir + t
   const b64 = cloudInit.match(/content: ([A-Za-z0-9+/=]+)/)[1];
   assert.match(Buffer.from(b64, 'base64').toString('utf8'), /Environment=GDS_BACKUP_DB=mercury/);
   // and the dir is created + the timer enabled on first boot
-  assert.match(cloudInit, /install -d -o lars -g lars -m 0750 \/var\/backups\/gds/);
+  assert.match(cloudInit, /install -d -o appsvc -g \$\(id -gn appsvc\) -m 0750 \/var\/backups\/gds/);
   assert.match(cloudInit, /enable --now mercury mercury-db-backup\.timer/);
 });
 
@@ -2932,7 +2945,31 @@ t('ensureInstanceUserCmd: idempotent SYSTEM account, nologin, state dir re-asser
 });
 
 t('grantInstanceRepoReadCmd: adds the instance account to the app-user group so the unit can exec its WorkingDirectory', () => {
-  assert.equal(P.grantInstanceRepoReadCmd(coTenant, { privileged: true }), 'sudo usermod -aG lars bongos-mercury');
+  assert.equal(P.grantInstanceRepoReadCmd(coTenant, { privileged: true }), 'sudo usermod -aG $(id -gn appsvc) bongos-mercury');
+});
+
+t('appUser: PROVISION_APP_USER, else the account the runner runs as — never a named founder (task 1002719)', () => {
+  const runner = (username) => () => ({ username });
+  assert.equal(RP.appUser({ env: { PROVISION_APP_USER: 'ops' }, userInfo: runner('deploy') }), 'ops', 'the pin wins');
+  assert.equal(RP.appUser({ env: {}, userInfo: runner('deploy') }), 'deploy', "unpinned: the runner's own account");
+  assert.equal(RP.appUser(), 'appsvc', 'the suite pin is what every generator above rendered');
+});
+
+t('appUser: refuses root and any name a shell command or unit file could not carry', () => {
+  const runner = (username) => () => ({ username });
+  assert.throws(() => RP.appUser({ env: {}, userInfo: runner('root') }), /is root — set PROVISION_APP_USER/);
+  assert.throws(() => RP.appUser({ env: {}, userInfo: () => { throw new Error('ENOENT'); } }),
+    /"" is not a usable unix account name/, 'a uid with no passwd entry names the knob');
+  for (const bad of ['a b', 'x;rm -rf /', '$(id)', 'Admin', '-o', 'a'.repeat(33)]) {
+    assert.throws(() => RP.appUser({ env: { PROVISION_APP_USER: bad }, userInfo: runner('deploy') }),
+      /not a usable unix account name/, `refuses ${JSON.stringify(bad)}`);
+  }
+  // …and the generators go through it rather than rendering the bad value.
+  process.env.PROVISION_APP_USER = 'root';
+  try {
+    assert.throws(() => P.backupService(coTenant), /is root/);
+    assert.throws(() => P.grantInstanceRepoReadCmd(coTenant), /is root/);
+  } finally { process.env.PROVISION_APP_USER = 'appsvc'; }
 });
 
 t('dbRoleCmd: LOGIN + password, upserted — CREATE on a fresh box, ALTER on a re-provision (the rotation path)', () => {
@@ -3052,7 +3089,7 @@ t('dedicatedUserData: the droplet runs the SAME account + role steps, in the sam
   const ud = P.dedicatedUserData(coTenant);
   const at = (needle) => ud.indexOf(needle);
   assert.ok(at('useradd --system') > -1, 'the droplet creates the account too');
-  assert.ok(at('usermod -aG lars') > -1);
+  assert.ok(at('usermod -aG $(id -gn appsvc)') > -1);
   assert.ok(at('useradd --system') < at('createdb mercury'), 'account before the DB');
   assert.ok(at('migrate.sh') < at('CREATE ROLE %I'), 'the role grants must follow the migrate that created the tables');
   assert.ok(at('CREATE ROLE %I') < at('GRANT ALL ON ALL TABLES'), 'role before its grants');

package/tests/provision_account_identity.mjs

@@ -12,6 +12,9 @@ const require = createRequire(import.meta.url);
 const P = require('../scripts/gds/provision.js');
 const { accountPlaneGap, accountPreflight } = require('../scripts/gds/provision-repo.js');
 
+// The app user is derived from whoever runs the suite unless pinned (task 1002719).
+process.env.PROVISION_APP_USER = 'appsvc';
+
 const PROBE = `sh -c 'test "$(id -u)" = 0'`;
 const isRoot = () => ({ ok: true, stdout: '' });
 // What a shell that RAN reports: exit 1 from `test`, or 127 when sudo is not installed.
@@ -133,3 +136,16 @@ test('provision: a box where the runner reaches root is unchanged — the live s
   const idx = (re) => h.cmds.findIndex((c) => re.test(c));
   assert.ok(idx(/id -u.*= 0/) < idx(/useradd --system/), 'the probe precedes the account it guards');
 });
+
+test('provision: an app user that resolves to root is refused before a single write (task 1002719)', async () => {
+  const h = harness();
+  process.env.PROVISION_APP_USER = 'root';   // what an unpinned runner running as root resolves
+  try {
+    const r = await P.provisionInstance(coTenant, h.deps);
+    assert.equal(r.ok, false);
+    assert.match(r.error, /is root — set PROVISION_APP_USER/);
+    assert.ok(!h.ran(/useradd/), 'refused before step 1c makes an account the run could not finish');
+    assert.equal(h.writes.length, 0);
+    assert.deepEqual(h.statuses, [], 'the instance never flips to provisioning');
+  } finally { process.env.PROVISION_APP_USER = 'appsvc'; }
+});