@caelo-cms/provisioning 0.10.47 → 0.10.49

package/src/wizards/gcp-pulumi.test.ts

@@ -0,0 +1,246 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import {
+  alignedStackSettings,
+  assertStackRegion,
+  deployedStackRegion,
+  pulumiGcpEnv,
+  resolveSecretReplication,
+  stateOnlyEnv,
+} from "./gcp-pulumi.js";
+
+const SECRET = "gcp:secretmanager/secret:Secret";
+
+describe("resolveSecretReplication", () => {
+  it("new stack (empty state) gets regional secrets (regression: `auto` = location global, rejected by gcp.resourceLocations)", () => {
+    expect(resolveSecretReplication(undefined, [])).toBe("regional");
+  });
+
+  it("a failed first run without any created secret still gets regional", () => {
+    const partial = [
+      { type: "gcp:storage/bucket:Bucket", outputs: {} },
+      { type: SECRET, outputs: undefined },
+    ];
+    expect(resolveSecretReplication(undefined, partial)).toBe("regional");
+  });
+
+  it("stack whose secrets already exist with auto replication keeps auto (no secret replacement)", () => {
+    const deployed = [{ type: SECRET, outputs: { replication: { auto: {} } } }];
+    expect(resolveSecretReplication(undefined, deployed)).toBe("auto");
+  });
+
+  it("an explicit config value wins", () => {
+    const deployed = [{ type: SECRET, outputs: { replication: { auto: {} } } }];
+    expect(resolveSecretReplication("regional", deployed)).toBe("regional");
+    expect(resolveSecretReplication("auto", [])).toBe("auto");
+  });
+
+  it("rejects an unknown config value", () => {
+    expect(() => resolveSecretReplication("global", [])).toThrow(/secretReplication/);
+  });
+});
+
+describe("deployedStackRegion / assertStackRegion (#607)", () => {
+  const provider = (region: string) => ({ type: "pulumi:providers:gcp", inputs: { region } });
+
+  it("reads the region from the stack's GCP provider in state", () => {
+    expect(deployedStackRegion([provider("europe-west1"), { type: SECRET }])).toBe("europe-west1");
+  });
+
+  it("is null for a stack with nothing deployed", () => {
+    expect(deployedStackRegion([])).toBeNull();
+    expect(deployedStackRegion([{ type: "pulumi:providers:gcp", inputs: {} }])).toBeNull();
+  });
+
+  it("refuses an ambiguous state", () => {
+    expect(() => deployedStackRegion([provider("europe-west1"), provider("us-central1")])).toThrow(
+      /several regions/,
+    );
+  });
+
+  it("refuses to up a deployed stack into another region", () => {
+    expect(() => assertStackRegion("europe-west1", "us-central1")).toThrow(/fixed after install/);
+    expect(() => assertStackRegion("europe-west1", "europe-west1")).not.toThrow();
+    expect(() => assertStackRegion(null, "us-central1")).not.toThrow();
+  });
+});
+
+describe("stacks require the region (#607, no silent default)", () => {
+  for (const provider of ["gcp", "gcp-firebase", "aws", "azure"]) {
+    const dir = resolve(import.meta.dir, `../../stacks/${provider}`);
+    it(`${provider} stack: cfg.require("region"), no fallback`, () => {
+      const src = readFileSync(resolve(dir, "index.ts"), "utf8");
+      expect(src).toContain('cfg.require("region")');
+      expect(src).not.toMatch(/cfg\.get\("region"\)|\?\? "(us-central1|us-east-1|westeurope)"/);
+    });
+    if (provider === "azure") {
+      it("azure stack: the pre-#607 `location` key is refused with the move, not mapped", () => {
+        const src = readFileSync(resolve(dir, "index.ts"), "utf8");
+        expect(src).toContain("caelo-azure:location was renamed to caelo-azure:region");
+        expect(src).not.toMatch(/cfg\.get\("location"\) \?\?/);
+      });
+    }
+    it(`${provider} Pulumi.yaml: region has no default`, () => {
+      const yaml = readFileSync(resolve(dir, "Pulumi.yaml"), "utf8");
+      const entry = yaml.match(new RegExp(`caelo-${provider}:region:\\n((?: {4}.*\\n)+)`))?.[1];
+      expect(entry).toBeDefined();
+      expect(entry).not.toContain("default:");
+    });
+  }
+});
+
+describe("GCP stacks", () => {
+  for (const provider of ["gcp", "gcp-firebase"]) {
+    it(`${provider} stack takes secret replication from config, not hard-coded auto`, () => {
+      const src = readFileSync(
+        resolve(import.meta.dir, `../../stacks/${provider}/index.ts`),
+        "utf8",
+      );
+      expect(src).toContain('cfg.require("secretReplication")');
+      expect(src).toContain("replication: secretReplication");
+      expect(src).not.toContain("replication: { auto: {} }");
+    });
+  }
+});
+
+describe("GCP stack DNS + certificates (go-live split)", () => {
+  const stack = (provider: string) =>
+    readFileSync(resolve(import.meta.dir, `../../stacks/${provider}/index.ts`), "utf8");
+
+  it("gcp gives the admin its own certificate, so it gets HTTPS before the main domain moves", () => {
+    const src = stack("gcp");
+    expect(src).toContain("{ managed: { domains: [adminDomain] } }");
+    expect(src).toContain("sslCertificates: [adminCert.id, managedCert.id]");
+  });
+
+  it("gcp-firebase reports each record under its own name and drops records to remove", () => {
+    const src = stack("gcp-firebase");
+    expect(src).toContain('if (v.requiredAction === "REMOVE") continue;');
+    expect(src).toContain("v.domainName ?? desired.domainName ?? domain");
+  });
+});
+
+describe("pulumiGcpEnv (#696 — keyless provisioner)", () => {
+  const SA = "caelo-provisioner@acme.iam.gserviceaccount.com";
+  const env = pulumiGcpEnv(
+    {
+      PATH: "/usr/bin",
+      HOME: "/home/op",
+      GOOGLE_APPLICATION_CREDENTIALS: "/home/op/.caelo-gcp-acme/secrets/sa-key.json",
+      GOOGLE_CREDENTIALS: "{}",
+      GOOGLE_OAUTH_ACCESS_TOKEN: "ya29.static",
+      GOOGLE_IMPERSONATE_SERVICE_ACCOUNT: "someone-else@x.iam.gserviceaccount.com",
+    },
+    {
+      backend: {
+        kind: "local",
+        url: "file:///home/op/.caelo-gcp-acme/state",
+        secretsProvider: "passphrase",
+        envVars: {
+          PULUMI_BACKEND_URL: "file:///home/op/.caelo-gcp-acme/state",
+          PULUMI_CONFIG_PASSPHRASE: "pp",
+        },
+      },
+      impersonateServiceAccount: SA,
+    },
+  );
+
+  it("impersonates the provisioner SA", () => {
+    expect(env.GOOGLE_IMPERSONATE_SERVICE_ACCOUNT).toBe(SA);
+  });
+
+  it("blanks every ambient credential (the Automation API merges process.env into the child)", () => {
+    expect(env.GOOGLE_APPLICATION_CREDENTIALS).toBe("");
+    expect(env.GOOGLE_CREDENTIALS).toBe("");
+    expect(env.GOOGLE_CLOUD_KEYFILE_JSON).toBe("");
+    expect(env.GCLOUD_KEYFILE_JSON).toBe("");
+    expect(env.GOOGLE_OAUTH_ACCESS_TOKEN).toBe("");
+    expect(Object.values(env).some((v) => v.includes("sa-key.json"))).toBe(false);
+  });
+
+  it("keeps the rest of the environment and scopes the backend to the install", () => {
+    expect(env.PATH).toBe("/usr/bin");
+    expect(env.PULUMI_CONFIG_PASSPHRASE).toBe("pp");
+    expect(env.PULUMI_BACKEND_URL).toBe("file:///home/op/.caelo-gcp-acme/state");
+  });
+});
+
+describe("pulumiGcpEnv with the install's ops bucket (#696)", () => {
+  it("passes the bucket backend and no passphrase", () => {
+    const env = pulumiGcpEnv(
+      { PATH: "/usr/bin" },
+      {
+        backend: {
+          kind: "gcs",
+          url: "gs://acme-caelo-ops/pulumi",
+          secretsProvider:
+            "gcpkms://projects/acme/locations/europe-west1/keyRings/caelo/cryptoKeys/pulumi-state",
+          envVars: {
+            PULUMI_BACKEND_URL: "gs://acme-caelo-ops/pulumi",
+            PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER: "true",
+          },
+        },
+        impersonateServiceAccount: "caelo-provisioner@acme.iam.gserviceaccount.com",
+      },
+    );
+    expect(env.PULUMI_BACKEND_URL).toBe("gs://acme-caelo-ops/pulumi");
+    expect(env.PULUMI_FALLBACK_TO_STATE_SECRETS_MANAGER).toBe("true");
+    expect(env.PULUMI_CONFIG_PASSPHRASE).toBeUndefined();
+  });
+});
+
+describe("alignedStackSettings (#696 — the package's stale Pulumi.production.yaml)", () => {
+  const KMS =
+    "gcpkms://projects/acme/locations/europe-west1/keyRings/caelo/cryptoKeys/pulumi-state";
+  const gcs = { kind: "gcs" as const, secretsProvider: KMS };
+
+  it("strips another install's passphrase salt and the secure values encrypted under it", () => {
+    const aligned = alignedStackSettings(
+      {
+        encryptionSalt: "v1:abc",
+        config: {
+          "caelo-gcp:domain": "caelo-cms.com",
+          "caelo-gcp:anthropicApiKey": { secure: "v1:cipher" },
+        },
+      },
+      gcs,
+    );
+    expect(aligned).toEqual({ config: { "caelo-gcp:domain": "caelo-cms.com" } });
+  });
+
+  it("replaces a different KMS key's settings", () => {
+    const aligned = alignedStackSettings(
+      { secretsProvider: "gcpkms://projects/other/x", encryptedKey: "ek", config: {} },
+      gcs,
+    );
+    expect(aligned).toEqual({ config: {} });
+  });
+
+  it("leaves a file that already names the install's key alone", () => {
+    expect(
+      alignedStackSettings({ secretsProvider: KMS, encryptedKey: "ek", config: {} }, gcs),
+    ).toBeNull();
+  });
+
+  it("a local install's file loses another install's KMS key (its own salt comes from its state)", () => {
+    const local = { kind: "local" as const, secretsProvider: "passphrase" };
+    expect(
+      alignedStackSettings({ secretsProvider: KMS, encryptedKey: "ek", config: { a: "1" } }, local),
+    ).toEqual({ config: { a: "1" } });
+    expect(alignedStackSettings({ encryptionSalt: "v1:other" }, local)).toEqual({ config: {} });
+    expect(alignedStackSettings({ config: { a: "1" } }, local)).toBeNull();
+  });
+});
+
+describe("stateOnlyEnv (#696)", () => {
+  it("blanks ambient Google credentials so the bucket + KMS key are reached with the operator's ADC", () => {
+    const env = stateOnlyEnv({ envVars: { PULUMI_BACKEND_URL: "gs://acme-caelo-ops/pulumi" } });
+    expect(env.GOOGLE_APPLICATION_CREDENTIALS).toBe("");
+    expect(env.GOOGLE_OAUTH_ACCESS_TOKEN).toBe("");
+    expect(env.GOOGLE_IMPERSONATE_SERVICE_ACCOUNT).toBe("");
+    expect(env.PULUMI_BACKEND_URL).toBe("gs://acme-caelo-ops/pulumi");
+  });
+});