@bongos/core 1.21.126 → 1.21.127

package/tests/provision_resource_caps.mjs

@@ -0,0 +1,117 @@
+// tests/provision_resource_caps.mjs
+//
+// Every hosted project's service is capped (task 1004414). A cloud-host project runs its
+// owner's code on the box that also serves the hub, and ADR 0354 lets any signed-in
+// builder host one, so one runaway project must not starve the others or the hub.
+//
+// Covers:
+//   • the numbers are the owner's (2026-10-15): MemoryHigh 160M, MemoryMax 256M,
+//     CPUQuota 50%, TasksMax 256 — pinned here so a change is a decision, not a drift
+//   • a NEW unit carries all four, rendered from the same table
+//   • an EXISTING unit takes them live with `systemctl set-property` (no restart, and no
+//     rewrite of a unit whose User= predates the per-instance accounts)
+//   • `provision.js apply-caps` reaches every ACTIVE cloud-host project, on the control
+//     plane, carries on past one that fails, and says which failed
+//   • teardown removes the drop-in set-property wrote
+//
+// Run:  node tests/provision_resource_caps.mjs
+
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+// ESM named imports, so knip credits these exports to their test (a createRequire read is not)
+import { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps } from '../scripts/gds/provision-caps.js';
+
+const require = createRequire(import.meta.url);
+const CAPS = { RESOURCE_CAPS, capDirectives, setCapsCmd, cmdApplyCaps };
+const { serviceUnit } = require('../scripts/gds/provision-units.js');
+const PM = require('../scripts/gds/provision-process.js');
+// the REAL shape makeExec answers an allowFail'd failure with: ok:true, softFailed:true
+const { softFailResult } = require('../scripts/gds/provision-config.js');
+
+const CLOUD = { id: 18, slug: 'mercury', hosting_shape: 'cloud-host', port: 4100, db_name: 'mercury', target_ref: 'owner/mercury' };
+const OWNER_NUMBERS = ['MemoryHigh=160M', 'MemoryMax=256M', 'CPUQuota=50%', 'TasksMax=256'];
+
+test('the caps are the owner’s numbers (2026-10-15)', () => {
+  assert.deepEqual(CAPS.capDirectives(), OWNER_NUMBERS);
+  assert.ok(Object.isFrozen(CAPS.RESOURCE_CAPS), 'the table cannot be edited at runtime');
+});
+
+test('a new hosted project’s unit carries all four caps in [Service]', () => {
+  const unit = serviceUnit(CLOUD, { etcBase: '/etc' });
+  const service = unit.slice(unit.indexOf('[Service]'), unit.indexOf('[Install]'));
+  for (const d of OWNER_NUMBERS) assert.match(service, new RegExp(`^${d.replace(/[.*+?^${}()|[\]\\%]/g, '\\$&')}$`, 'm'), d);
+});
+
+test('an existing unit takes the caps live through set-property', () => {
+  assert.equal(CAPS.setCapsCmd(CLOUD, { sudoP: 'sudo ' }),
+    'sudo systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256');
+  assert.equal(CAPS.setCapsCmd(CLOUD), 'systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256');
+});
+
+function fleet(rows, failSlug = null) {
+  const queries = [];
+  const ran = [];
+  const logs = [];
+  const exec = (cmd, opts = {}) => {
+    ran.push({ cmd, allowFail: !!opts.allowFail, on: 'control' });
+    return cmd.includes(` ${failSlug}.service `) ? softFailResult(new Error(`Unit ${failSlug}.service not loaded.`), false) : { ok: true, stdout: '' };
+  };
+  const deps = {
+    db: { query: async (sql, params) => { queries.push({ sql, params }); return { rows }; } },
+    controlExec: exec,
+    exec: () => { throw new Error('the box executor is for co-tenant; a cloud-host runs on the control plane'); },
+    privileged: true,
+    log: (s) => logs.push(s),
+  };
+  return { deps, queries, ran, logs };
+}
+
+test('apply-caps reaches every active cloud-host project on the control plane', async () => {
+  const f = fleet([{ slug: 'mercury' }, { slug: 'venus' }]);
+  const r = await CAPS.cmdApplyCaps(f.deps);
+  assert.match(f.queries[0].sql, /hosting_shape = 'cloud-host'/);
+  assert.match(f.queries[0].sql, /status = 'active'/);
+  assert.deepEqual(f.ran.map((x) => x.cmd), [
+    'sudo systemctl set-property mercury.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256',
+    'sudo systemctl set-property venus.service MemoryHigh=160M MemoryMax=256M CPUQuota=50% TasksMax=256',
+  ]);
+  assert.ok(f.ran.every((x) => x.allowFail), 'one project that refuses must not stop the rest');
+  assert.deepEqual(r, { ok: true, capped: ['mercury', 'venus'], failed: [] });
+});
+
+test('apply-caps carries on past a failure and names it', async () => {
+  const f = fleet([{ slug: 'mercury' }, { slug: 'venus' }, { slug: 'pluto' }], 'venus');
+  const r = await CAPS.cmdApplyCaps(f.deps);
+  assert.equal(f.ran.length, 3);
+  assert.deepEqual(r, { ok: false, capped: ['mercury', 'pluto'], failed: ['venus'] });
+  assert.ok(f.logs.some((l) => /venus/.test(l)), 'the failure is said out loud');
+});
+
+test('a slug outside the create route’s charset is refused, never run as root', () => {
+  for (const slug of ['a;rm -rf /', '../etc', 'Mercury', '-x']) assert.throws(() => CAPS.setCapsCmd({ slug }), /unsafe slug/, slug);
+});
+
+test('apply-caps on an empty fleet does nothing and succeeds', async () => {
+  const f = fleet([]);
+  assert.deepEqual(await CAPS.cmdApplyCaps(f.deps), { ok: true, capped: [], failed: [] });
+  assert.equal(f.ran.length, 0);
+});
+
+test('provision.js lists apply-caps as a command', () => {
+  const r = spawnSync(process.execPath, ['scripts/gds/provision.js', 'help'], { encoding: 'utf8' });
+  assert.equal(r.status, 0, r.stderr);
+  assert.match(r.stdout, /apply-caps/);
+});
+
+test('teardown removes the drop-in set-property wrote, before the reload', () => {
+  const cmds = [];
+  const exec = (cmd, opts = {}) => { cmds.push(cmd); return { ok: true }; };
+  PM.systemd.removeService(CLOUD, { exec, sudoP: 'sudo ' });
+  const rm = cmds.indexOf('sudo rm -f /etc/systemd/system.control/mercury.service.d/50-*.conf');
+  assert.ok(rm >= 0, cmds.join('\n'));
+  assert.ok(cmds.includes('sudo rmdir /etc/systemd/system.control/mercury.service.d'), 'the emptied dir goes too');
+  assert.ok(!cmds.some((c) => /rm -rf/.test(c)), 'never a recursive delete');
+  assert.ok(rm < cmds.indexOf('sudo systemctl daemon-reload'), 'removed before the reload that forgets the unit');
+});