@bongos/core 1.21.125 → 1.21.127

package/tests/provision_resource_caps.mjs

@@ -0,0 +1,117 @@
+// tests/provision_resource_caps.mjs
+//
+// Every hosted project's service is capped (task 1004414). A cloud-host project runs its
+// owner's code on the box that also serves the hub, and ADR 0354 lets any signed-in
+// builder host one, so one runaway project must not starve the others or the hub.
+//
+// Covers:
+//   • the numbers are the owner's (2026-10-15): MemoryHigh 160M, MemoryMax 256M,
+//     CPUQuota 50%, TasksMax 256 — pinned here so a change is a decision, not a drift
+//   • a NEW unit carries all four, rendered from the same table
+//   • an EXISTING unit takes them live with `systemctl set-property` (no restart, and no
+//     rewrite of a unit whose User= predates the per-instance accounts)
+//   • `provision.js apply-caps` reaches every ACTIVE cloud-host project, on the control
+//     plane, carries on past one that fails, and says which failed
+//   • teardown removes the drop-in set-property wrote
+//
+// Run:  node tests/provision_resource_caps.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+// ESM named imports, so knip credits these exports to their test (a createRequire read is not)
+import { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps } from '../scripts/gds/provision-caps.js';
+
+const require = createRequire(import.meta.url);
+const CAPS = { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps };
+const { serviceUnit } = require('../scripts/gds/provision-units.js');
+const PM = require('../scripts/gds/provision-process.js');
+// the REAL shape makeExec answers an allowFail'd failure with: ok:true, softFailed:true
+const { softFailResult } = require('../scripts/gds/provision-config.js');
+
+const CLOUD = { id: 18, slug: 'mercury', hosting_shape: 'cloud-host', port: 4100, db_name: 'mercury', target_ref: 'owner/mercury' };
+const OWNER_NUMBERS = ['MemoryHigh=160M', 'MemoryMax=256M', 'CPUQuota=50%', 'TasksMax=256'];
+
+test('the caps are the owner’s numbers (2026-10-15)', () => {
+  assert.deepEqual(CAPS.capDirectives(), OWNER_NUMBERS);
+  assert.ok(Object.isFrozen(CAPS.RESOURCE_CAPS), 'the table cannot be edited at runtime');
+});
+
+test('a new hosted project’s unit carries all four caps in [Service]', () => {
+  const unit = serviceUnit(CLOUD, { etcBase: '/etc' });
+  const service = unit.slice(unit.indexOf('[Service]'), unit.indexOf('[Install]'));
+  for (const d of OWNER_NUMBERS) assert.match(service, new RegExp(`^${d.replace(/[.*+?^${}()|[\]\\%]/g, '\\$&')}$`, 'm'), d);
+});
+
+test('an existing unit takes the caps live through set-property', () => {
+  assert.equal(CAPS.setCapsCmd(CLOUD, { sudoP: 'sudo ' }),
+    'sudo systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256');
+  assert.equal(CAPS.setCapsCmd(CLOUD), 'systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256');
+});
+
+function fleet(rows, failSlug = null) {
+  const queries = [];
+  const ran = [];
+  const logs = [];
+  const exec = (cmd, opts = {}) => {
+    ran.push({ cmd, allowFail: !!opts.allowFail, on: 'control' });
+    return cmd.includes(` ${failSlug}.service `) ? softFailResult(new Error(`Unit ${failSlug}.service not loaded.`), false) : { ok: true, stdout: '' };
+  };
+  const deps = {
+    db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows }; } },
+    controlExec: exec,
+    exec: () => { throw new Error('the box executor is for co-tenant; a cloud-host runs on the control plane'); },
+    privileged: true,
+    log: (s) => logs.push(s),
+  };
+  return { deps, queries, ran, logs };
+}
+
+test('apply-caps reaches every active cloud-host project on the control plane', async () => {
+  const f = fleet([{ slug: 'mercury' }, { slug: 'venus' }]);
+  const r = await CAPS.cmdApplyCaps(f.deps);
+  assert.match(f.queries[0].sql, /hosting_shape = 'cloud-host'/);
+  assert.match(f.queries[0].sql, /status = 'active'/);
+  assert.deepEqual(f.ran.map((x) => x.cmd), [
+    'sudo systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256',
+    'sudo systemctl set-property venus.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256',
+  ]);
+  assert.ok(f.ran.every((x) => x.allowFail), 'one project that refuses must not stop the rest');
+  assert.deepEqual(r, { ok: true, capped: ['mercury', 'venus'], failed: [] });
+});
+
+test('apply-caps carries on past a failure and names it', async () => {
+  const f = fleet([{ slug: 'mercury' }, { slug: 'venus' }, { slug: 'pluto' }], 'venus');
+  const r = await CAPS.cmdApplyCaps(f.deps);
+  assert.equal(f.ran.length, 3);
+  assert.deepEqual(r, { ok: false, capped: ['mercury', 'pluto'], failed: ['venus'] });
+  assert.ok(f.logs.some((l) => /venus/.test(l)), 'the failure is said out loud');
+});
+
+test('a slug outside the create route’s charset is refused, never run as root', () => {
+  for (const slug of ['a;rm -rf /', '../etc', 'Mercury', '-x']) assert.throws(() => CAPS.setCapsCmd({ slug }), /unsafe slug/, slug);
+});
+
+test('apply-caps on an empty fleet does nothing and succeeds', async () => {
+  const f = fleet([]);
+  assert.deepEqual(await CAPS.cmdApplyCaps(f.deps), { ok: true, capped: [], failed: [] });
+  assert.equal(f.ran.length, 0);
+});
+
+test('provision.js lists apply-caps as a command', () => {
+  const r = spawnSync(process.execPath, ['scripts/gds/provision.js', 'help'], { encoding: 'utf8' });
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /apply-caps/);
+});
+
+test('teardown removes the drop-in set-property wrote, before the reload', () => {
+  const cmds = [];
+  const exec = (cmd, opts = {}) => { cmds.push(cmd); return { ok: true }; };
+  PM.systemd.removeService(CLOUD, { exec, sudoP: 'sudo ' });
+  const rm = cmds.indexOf('sudo rm -f /etc/systemd/system.control/mercury.service.d/50-*.conf');
+  assert.ok(rm >= 0, cmds.join('\n'));
+  assert.ok(cmds.includes('sudo rmdir /etc/systemd/system.control/mercury.service.d'), 'the emptied dir goes too');
+  assert.ok(!cmds.some((c) => /rm -rf/.test(c)), 'never a recursive delete');
+  assert.ok(rm < cmds.indexOf('sudo systemctl daemon-reload'), 'removed before the reload that forgets the unit');
+});

package/tests/provisioning_module_selection.mjs

@@ -494,7 +494,7 @@ await ta('PATCH /detail: a body with only a null modules key is still nothing to
 });
 
 await ta('PATCH /detail: another builder’s project is a 404, not a module change', async () => {
-  // The ownership wall is instanceAccessDenied's, shared with every sibling
+  // The ownership wall is requireProjectOwner's, shared with every sibling
   // route — pinned here because this key is new on it.
   detailRow = { id: 41, owner_builder_id: 99, slug: 'not-mine', status: 'active', type: 'game', modules: null, detail: {} };
   lastUpdatedRow = null;

package/tests/provisioning_project_owner_gate.mjs

@@ -0,0 +1,271 @@
+// tests/provisioning_project_owner_gate.mjs
+//
+// requireProjectOwner — the one owner-or-archon gate on the 14 own-scoped
+// /provisioning/instances/:id routes (task 1004159, ADR 0328 decision 2). It replaced three
+// hand-written copies of the rule and gave teardown, domain and github-app the archon
+// override they lacked.
+//
+// Covers:
+//   • the gate itself: the owner and an archon are admitted; a metic is NOT (the gate is a
+//     plain rank test, never provisioning.fleet.manage, whose floor is metic); a missing row
+//     and a foreign row are the same 404; archonOverride:false; a bad id is a 400 that never
+//     reaches the loader; a loader failure is an opaque 500
+//   • the three WIDENED routes: an archon acts on another builder's project, and the intent,
+//     the event's actor and the event's owner all say so — never 'api:self'
+//   • the gate runs before the body validator, so a stranger's malformed request is a 404
+//   • the structure: every /provisioning/instances/:id route in the three files mounts the
+//     gate (force-teardown excepted), and the old copies are gone
+//
+// DB-free: data access is stubbed on the cached module object (the provisioning_restart.mjs
+// pattern), over the real router and the real error envelope.
+//
+// Run:  node tests/provisioning_project_owner_gate.mjs
+
+import assert from 'node:assert/strict';
+import { test, before, after } from 'node:test';
+import fs from 'node:fs';
+import http from 'node:http';
+import path from 'node:path';
+import { createRequire } from 'node:module';
+import { fileURLToPath } from 'node:url';
+
+const require = createRequire(import.meta.url);
+const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+const api = require(path.join(ROOT, 'src/module-api.js'));
+const provisioning = require(path.join(ROOT, 'modules/provisioning/provisioning.js'));
+const { requireProjectOwner, projectActor } = require(path.join(ROOT, 'modules/provisioning/route-helpers.js'));
+
+const OWNER = { id: 7, github_login: 'owner', rank: 'thetes' };
+const ARCHON = { id: 999, github_login: 'fleet-support', rank: 'archon' };
+const METIC = { id: 55, github_login: 'stranger', rank: 'metic' };
+const ROW = { id: 18, owner_builder_id: 7, slug: 'mercury', status: 'active', hosting_shape: 'cloud-host', domain: null, target_ref: 'owner/mercury' };
+
+// ── the gate, called directly ───────────────────────────────────────────────────────
+function fakeRes() {
+  return { out: null, fail(code, opts) { this.out = { code, status: typeof opts === 'number' ? opts : opts.status, message: opts && opts.message }; } };
+}
+async function runGate(gate, { builder, id = '18' }) {
+  const req = { params: { id }, builder, method: 'POST', path: `/provisioning/instances/${id}/teardown` };
+  const res = fakeRes();
+  let nexted = false;
+  await gate(req, res, () => { nexted = true; });
+  return { req, res, nexted };
+}
+const loads = [];
+const loader = (rows) => async (id) => { loads.push(id); return rows[id] ? { ...rows[id] } : null; };
+
+test('the owner is admitted and the row rides on req.project', async () => {
+  const { req, res, nexted } = await runGate(requireProjectOwner(loader({ 18: ROW })), { builder: OWNER });
+  assert.equal(nexted, true);
+  assert.equal(res.out, null);
+  assert.equal(req.project.slug, 'mercury');
+  assert.equal(projectActor(req), 'api:self');
+});
+
+test('an archon is admitted on another builder’s project, and the actor names that archon', async () => {
+  const { req, nexted } = await runGate(requireProjectOwner(loader({ 18: ROW })), { builder: ARCHON });
+  assert.equal(nexted, true);
+  assert.equal(projectActor(req), 'api:archon:999');
+});
+
+test('a metic is NOT admitted: the gate is a rank test, not provisioning.fleet.manage (floor metic)', async () => {
+  const { req, res, nexted } = await runGate(requireProjectOwner(loader({ 18: ROW })), { builder: METIC });
+  assert.equal(nexted, false);
+  assert.deepEqual([res.out.code, res.out.status], ['instance_not_found', 404]);
+  assert.equal(req.project, undefined, 'a refused request carries no row');
+});
+
+test('a missing row is the same 404 a foreign one gets — for an archon too', async () => {
+  for (const builder of [OWNER, ARCHON]) {
+    const { res, nexted } = await runGate(requireProjectOwner(loader({})), { builder });
+    assert.equal(nexted, false);
+    assert.deepEqual([res.out.code, res.out.status], ['instance_not_found', 404]);
+  }
+});
+
+test('archonOverride:false refuses an archon on a foreign project and still admits the owner', async () => {
+  const gate = requireProjectOwner(loader({ 18: ROW }), { archonOverride: false });
+  assert.equal((await runGate(gate, { builder: ARCHON })).res.out.status, 404);
+  assert.equal((await runGate(gate, { builder: OWNER })).nexted, true);
+});
+
+test('a malformed id is 400 bad_id and never reaches the loader', async () => {
+  loads.length = 0;
+  const { res, nexted } = await runGate(requireProjectOwner(loader({ 18: ROW })), { builder: OWNER, id: 'not-a-number' });
+  assert.equal(nexted, false);
+  assert.deepEqual([res.out.code, res.out.status], ['bad_id', 400]);
+  assert.deepEqual(loads, []);
+});
+
+test('a loader that throws is an opaque 500 — neither the 404 nor the error text', async () => {
+  const gate = requireProjectOwner(async () => { throw new Error('relation "provisioning_instances" does not exist'); });
+  const { res, nexted } = await runGate(gate, { builder: OWNER });
+  assert.equal(nexted, false);
+  assert.deepEqual(res.out, { code: 'instance_read_failed', status: 500, message: 'internal error' });
+});
+
+// ── the three widened routes, over the real router ──────────────────────────────────
+let builder = OWNER;
+let row = null;
+const events = [];
+const enqueues = [];
+const manifests = [];
+api.requireBuilder = (req, _res, next) => { req.builder = { ...builder }; next(); };
+api.requirePermission = () => (_req, _res, next) => next();
+api.branding = () => ({ domains: { publicOrigin: 'https://cb.test', instanceBase: 'cb.test' }, identity: { productName: 'Cloud Bongos' } });
+provisioning.getInstanceById = async (_db, id) => (row && String(id) === String(row.id) ? { ...row } : null);
+provisioning.recordEvent = async (_db, e) => { events.push(e); };
+provisioning.enqueueTeardown = async (_db, id, requestedBy) => { enqueues.push({ action: 'teardown', id, requestedBy }); return { created: true, superseded: false }; };
+provisioning.enqueueIntent = async (_db, id, action, requestedBy) => { enqueues.push({ action, id, requestedBy }); return { intent: { id: 9, action, state: 'pending' }, created: true }; };
+provisioning.getOpenIntent = async () => null;
+provisioning.getInstanceByDomain = async () => null;
+provisioning.updateInstanceDomain = async (_db, id, domain) => ({ ...row, id, domain });
+provisioning.createOAuthManifest = async (_db, m) => { manifests.push(m); return { id: 1, ...m }; };
+provisioning.getLatestOAuthManifestForInstance = async () => null;
+
+const express = require('express');
+const { attachFail } = require(path.join(ROOT, 'src/bongos/middleware/error-envelope.js'));
+let server, base;
+before(async () => {
+  const app = express();
+  app.use(express.json());
+  app.use(attachFail);
+  app.use('/api/bongos', require(path.join(ROOT, 'modules/provisioning/routes/provisioning.js'))());
+  server = app.listen(0);
+  await new Promise((r) => server.once('listening', r));
+  base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+});
+after(() => server.close());
+
+function post(p, body = {}) {
+  return new Promise((resolve, reject) => {
+    const payload = JSON.stringify(body);
+    const req = http.request(`${base}${p}`, {
+      method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(payload) },
+    }, (res) => {
+      let d = '';
+      res.on('data', (c) => { d += c; });
+      res.on('end', () => resolve({ status: res.statusCode, body: JSON.parse(d), raw: d }));
+    });
+    req.on('error', reject);
+    req.end(payload);
+  });
+}
+function as(who, inst) {
+  builder = who;
+  row = inst;
+  events.length = 0; enqueues.length = 0; manifests.length = 0;
+}
+
+test('teardown: an archon tears down another builder’s project, audited as the archon', async () => {
+  as(ARCHON, { ...ROW });
+  const r = await post('/provisioning/instances/18/teardown');
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(enqueues, [{ action: 'teardown', id: 18, requestedBy: 'api:archon:999' }]);
+  assert.equal(events.length, 1);
+  assert.equal(events[0].actor, 'api:archon:999');
+  assert.equal(events[0].ownerBuilderId, 7, 'the event belongs to the project’s owner, not the archon');
+  assert.match(events[0].detail, /teardown requested by archon fleet-support/);
+  assert.doesNotMatch(events[0].detail, /by owner/);
+});
+
+test('teardown: the owner’s own request still reads as the owner’s', async () => {
+  as(OWNER, { ...ROW });
+  const r = await post('/provisioning/instances/18/teardown');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(enqueues[0].requestedBy, 'api:self');
+  assert.equal(events[0].actor, 'api:self');
+  assert.equal(events[0].detail, 'teardown requested by owner');
+});
+
+test('domain: an archon sets another builder’s address, and the intent and events name the archon', async () => {
+  as(ARCHON, { ...ROW });
+  const r = await post('/provisioning/instances/18/domain', { domain: 'mercury.example.com' });
+  assert.equal(r.status, 200, r.raw);
+  assert.deepEqual(enqueues, [{ action: 'domain-attach', id: 18, requestedBy: 'api:archon:999' }]);
+  assert.ok(events.length >= 1);
+  for (const e of events) {
+    assert.equal(e.actor, 'api:archon:999');
+    assert.equal(e.ownerBuilderId, 7);
+  }
+});
+
+test('domain: an archon’s re-kick of a stopped address is recorded as the archon’s', async () => {
+  as(ARCHON, { ...ROW, domain: 'mercury.example.com', last_verified_up: false });
+  const r = await post('/provisioning/instances/18/domain', { domain: 'mercury.example.com' });
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(r.body.queued, true);
+  assert.equal(enqueues[0].requestedBy, 'api:archon:999');
+  assert.equal(events[0].actor, 'api:archon:999');
+  assert.match(events[0].detail, /archon re-kick/);
+});
+
+test('github-app: an archon mints the link for another builder’s project, audited as the archon', async () => {
+  as(ARCHON, { ...ROW, domain: 'mercury.example.com' });
+  const r = await post('/provisioning/instances/18/github-app');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(manifests.length, 1);
+  assert.equal(manifests[0].requestedBy, 7, 'requested_by is the owner every later manifest event is filed under');
+  assert.equal(events.length, 1);
+  assert.equal(events[0].actor, 'api:archon:999');
+  assert.equal(events[0].ownerBuilderId, 7);
+});
+
+test('github-app: the owner’s own mint is still api:self', async () => {
+  as(OWNER, { ...ROW, domain: 'mercury.example.com' });
+  const r = await post('/provisioning/instances/18/github-app');
+  assert.equal(r.status, 200, r.raw);
+  assert.equal(events[0].actor, 'api:self');
+});
+
+test('the three widened routes stay closed to a non-archon stranger: 404, nothing queued or recorded', async () => {
+  for (const [p, body] of [['teardown', {}], ['domain', { domain: 'mercury.example.com' }], ['github-app', {}]]) {
+    as(METIC, { ...ROW, domain: 'mercury.example.com' });
+    const r = await post(`/provisioning/instances/18/${p}`, body);
+    assert.equal(r.status, 404, `${p}: ${r.raw}`);
+    assert.equal(r.body.error.code, 'instance_not_found');
+    assert.deepEqual([enqueues.length, events.length, manifests.length], [0, 0, 0], p);
+  }
+});
+
+test('the gate runs before the body validator: a stranger’s malformed request is the same 404', async () => {
+  as(METIC, { ...ROW });
+  const bad = await post('/provisioning/instances/18/domain', { domain: 'not a hostname' });
+  assert.equal(bad.status, 404, bad.raw);
+  as(OWNER, { ...ROW });
+  const own = await post('/provisioning/instances/18/domain', { domain: 'not a hostname' });
+  assert.equal(own.status, 400, 'the owner still gets the validator’s answer');
+  assert.equal(own.body.error.code, 'bad_domain');
+});
+
+// ── the structure ───────────────────────────────────────────────────────────────────
+const ROUTE_FILES = ['provisioning.js', 'disconnect.js', 'env-manifest.js']
+  .map((f) => path.join(ROOT, 'modules/provisioning/routes', f));
+const read = (f) => fs.readFileSync(f, 'utf8').replace(/\r\n/g, '\n');
+
+test('every /provisioning/instances/:id route in the three files mounts the gate (force-teardown excepted)', () => {
+  const declared = [];
+  for (const f of ROUTE_FILES) {
+    for (const line of read(f).split('\n')) {
+      const m = /router\.(get|post|patch|put|delete)\('(\/provisioning\/instances\/:id[^']*)'/.exec(line);
+      if (!m || m[2].endsWith('/force-teardown')) continue;
+      declared.push(`${m[1]} ${m[2]}`);
+      assert.match(line, /requireBuilder, (?:\w+, )?requireProjectOwner\(loadInstance\), async \(req, res\) =>/, `${m[1]} ${m[2]}`);
+    }
+  }
+  assert.equal(declared.length, 14, `the 14 own-scoped routes, found: ${declared.join(' · ')}`);
+});
+
+test('the three old copies of the rule are gone', () => {
+  const dir = path.join(ROOT, 'modules/provisioning');
+  const src = fs.readdirSync(dir, { recursive: true }).map(String)
+    .filter((f) => f.endsWith('.js') && !f.split(path.sep).includes('tests'))
+    .map((f) => read(path.join(dir, f))).join('\n');
+  assert.doesNotMatch(src, /function instanceAccessDenied|function resolveOwnInstance/);
+  for (const f of ROUTE_FILES) {
+    // `inst.` only: the create route's re-request check compares its NEW row, which no gate can load
+    assert.doesNotMatch(read(f), /\binst\.owner_builder_id\) [!=]== String\(req\.builder\.id\)/, `${path.basename(f)} compares owners inline`);
+    assert.doesNotMatch(read(f), /rank [!=]== 'archon'/, `${path.basename(f)} tests the rank inline`);
+  }
+});