@celilo/cli 0.1.0

package/src/capabilities/secrets.test.ts

@@ -0,0 +1,750 @@
+import type { Database } from 'bun:sqlite';
+import { describe, expect, test } from 'bun:test';
+import type { ModuleManifest } from '../manifest/schema';
+import {
+  checkCapabilitySecretAccess,
+  getCapabilitySecret,
+  isCapabilityFieldSecret,
+} from './secrets';
+
+describe('Capability Secret Access', () => {
+  describe('isCapabilityFieldSecret', () => {
+    test('should return true when field is marked as secret', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                  description: 'TSIG secret',
+                  readable_by: ['public_web'],
+                },
+                {
+                  name: 'api_key',
+                  type: 'string',
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = isCapabilityFieldSecret('dns_external', 'tsig', mockDb);
+
+      expect(result).toBe(true);
+    });
+
+    test('should return true for any secret in the list', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'api_key',
+                  type: 'string',
+                },
+                {
+                  name: 'db_password',
+                  type: 'string',
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      expect(isCapabilityFieldSecret('test_capability', 'api_key', mockDb)).toBe(true);
+      expect(isCapabilityFieldSecret('test_capability', 'db_password', mockDb)).toBe(true);
+    });
+
+    test('should return false when field is not in secrets list', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = isCapabilityFieldSecret('dns_external', 'nameserver', mockDb);
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when capability has no secrets', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'monitoring',
+              version: '1.0.0',
+              data: {},
+              // No secrets defined
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      const result = isCapabilityFieldSecret('monitoring', 'any_field', mockDb);
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when provider manifest not found', () => {
+      const mockDb = {
+        prepare: () => ({
+          get: () => undefined,
+        }),
+      } as unknown as Database;
+
+      const result = isCapabilityFieldSecret('unknown_capability', 'any_field', mockDb);
+
+      expect(result).toBe(false);
+    });
+
+    test('should match exact secret name', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'api_key',
+                  type: 'string',
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: () => ({
+          get: () => ({
+            manifest_data: JSON.stringify(providerManifest),
+          }),
+        }),
+      } as unknown as Database;
+
+      // Exact match
+      expect(isCapabilityFieldSecret('test_capability', 'api_key', mockDb)).toBe(true);
+
+      // Substring should not match
+      expect(isCapabilityFieldSecret('test_capability', 'api', mockDb)).toBe(false);
+      expect(isCapabilityFieldSecret('test_capability', 'api_key_v2', mockDb)).toBe(false);
+    });
+  });
+
+  describe('checkCapabilitySecretAccess', () => {
+    test('should return true when consumer matches allowlist', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                  readable_by: ['public_web'],
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const consumerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'caddy',
+        name: 'Caddy',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'public_web',
+              version: '1.0.0',
+              data: {},
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: (_param: string) => {
+            // Provider manifest query
+            if (query.includes('JOIN capabilities')) {
+              return {
+                manifest_data: JSON.stringify(providerManifest),
+              };
+            }
+            // Consumer manifest query
+            if (query.includes('WHERE id = ?')) {
+              return {
+                manifest_data: JSON.stringify(consumerManifest),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess('caddy', 'dns_external', 'tsig', mockDb);
+
+      expect(result).toBe(true);
+    });
+
+    test('should return false when consumer does not match allowlist', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'dns-external',
+        name: 'DNS External',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'tsig',
+                  type: 'string',
+                  readable_by: ['public_web'],
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const consumerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'some-app',
+        name: 'Some App',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'monitoring',
+              version: '1.0.0',
+              data: {},
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: () => {
+            if (query.includes('JOIN capabilities')) {
+              return {
+                manifest_data: JSON.stringify(providerManifest),
+              };
+            }
+            if (query.includes('WHERE id = ?')) {
+              return {
+                manifest_data: JSON.stringify(consumerManifest),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess('some-app', 'dns_external', 'tsig', mockDb);
+
+      expect(result).toBe(false);
+    });
+
+    test('should return true when secret has no readable_by restriction', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'api_key',
+                  type: 'string',
+                  // No readable_by - accessible to all
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const consumerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'consumer',
+        name: 'Consumer',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+        // No capabilities provided
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: () => {
+            if (query.includes('JOIN capabilities')) {
+              return {
+                manifest_data: JSON.stringify(providerManifest),
+              };
+            }
+            if (query.includes('WHERE id = ?')) {
+              return {
+                manifest_data: JSON.stringify(consumerManifest),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess('consumer', 'test_capability', 'api_key', mockDb);
+
+      expect(result).toBe(true);
+    });
+
+    test('should return true when readable_by is empty array', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'api_key',
+                  type: 'string',
+                  readable_by: [], // Empty array - no restrictions
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const consumerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'consumer',
+        name: 'Consumer',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: () => {
+            if (query.includes('JOIN capabilities')) {
+              return {
+                manifest_data: JSON.stringify(providerManifest),
+              };
+            }
+            if (query.includes('WHERE id = ?')) {
+              return {
+                manifest_data: JSON.stringify(consumerManifest),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess('consumer', 'test_capability', 'api_key', mockDb);
+
+      expect(result).toBe(true);
+    });
+
+    test('should return false when provider not found', () => {
+      const mockDb = {
+        prepare: (_query: string) => ({
+          get: () => undefined,
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess(
+        'consumer',
+        'unknown_capability',
+        'secret',
+        mockDb,
+      );
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when consumer not found', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'secret',
+                  type: 'string',
+                  readable_by: ['public_web'],
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: () => {
+            if (query.includes('JOIN capabilities')) {
+              return {
+                manifest_data: JSON.stringify(providerManifest),
+              };
+            }
+            // Consumer not found
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess(
+        'unknown_consumer',
+        'test_capability',
+        'secret',
+        mockDb,
+      );
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when secret not found in capability', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: {},
+              secrets: [
+                {
+                  name: 'api_key',
+                  type: 'string',
+                },
+              ],
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const consumerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'consumer',
+        name: 'Consumer',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: () => {
+            if (query.includes('JOIN capabilities')) {
+              return {
+                manifest_data: JSON.stringify(providerManifest),
+              };
+            }
+            if (query.includes('WHERE id = ?')) {
+              return {
+                manifest_data: JSON.stringify(consumerManifest),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess(
+        'consumer',
+        'test_capability',
+        'unknown_secret',
+        mockDb,
+      );
+
+      expect(result).toBe(false);
+    });
+
+    test('should return false when capability has no secrets', () => {
+      const providerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'provider',
+        name: 'Provider',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: {
+          capabilities: [
+            {
+              name: 'test_capability',
+              version: '1.0.0',
+              data: {},
+              // No secrets
+            },
+          ],
+        },
+        variables: { owns: [], imports: [] },
+      };
+
+      const consumerManifest: ModuleManifest = {
+        celilo_contract: '1.0',
+        id: 'consumer',
+        name: 'Consumer',
+        version: '1.0.0',
+        description: 'Test',
+        requires: { capabilities: [] },
+        provides: { capabilities: [] },
+        variables: { owns: [], imports: [] },
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: () => {
+            if (query.includes('JOIN capabilities')) {
+              return {
+                manifest_data: JSON.stringify(providerManifest),
+              };
+            }
+            if (query.includes('WHERE id = ?')) {
+              return {
+                manifest_data: JSON.stringify(consumerManifest),
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      const result = checkCapabilitySecretAccess('consumer', 'test_capability', 'api_key', mockDb);
+
+      expect(result).toBe(false);
+    });
+  });
+
+  describe('getCapabilitySecret', () => {
+    test('should throw error when capability not found', async () => {
+      const mockDb = {
+        prepare: () => ({
+          get: () => undefined,
+        }),
+      } as unknown as Database;
+
+      await expect(getCapabilitySecret('unknown_capability', 'secret', mockDb)).rejects.toThrow(
+        "Provider manifest not found for capability 'unknown_capability'",
+      );
+    });
+
+    test('should throw error when secret not found', async () => {
+      // Mock manifest with capability but without the requested secret
+      const manifest = {
+        provides: {
+          capabilities: [
+            {
+              name: 'dns_external',
+              version: '1.0.0',
+              secrets: [{ name: 'tsig_key', description: 'TSIG key' }],
+            },
+          ],
+        },
+      };
+
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: (_param?: unknown) => {
+            // Return manifest data for getProviderManifest
+            if (query.includes('SELECT p.manifest_data')) {
+              return { manifest_data: JSON.stringify(manifest) };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      await expect(getCapabilitySecret('dns_external', 'unknown_secret', mockDb)).rejects.toThrow(
+        "Secret 'unknown_secret' not defined in capability 'dns_external'",
+      );
+    });
+
+    test('should decrypt and return secret when found', async () => {
+      // Note: This test would require mocking the encryption module
+      // For now, we test that it queries correctly and attempts decryption
+      const mockDb = {
+        prepare: (query: string) => ({
+          get: (_param1?: unknown, _param2?: unknown) => {
+            if (query.includes('SELECT id FROM capabilities')) {
+              return { id: 1 };
+            }
+            if (query.includes('SELECT encrypted_value')) {
+              return {
+                encrypted_value: 'encrypted_data',
+                iv: 'initialization_vector',
+                auth_tag: 'auth_tag',
+              };
+            }
+            return undefined;
+          },
+        }),
+      } as unknown as Database;
+
+      // This will fail at decryption with actual master key
+      // but proves the query logic works
+      await expect(getCapabilitySecret('dns_external', 'tsig', mockDb)).rejects.toThrow();
+    });
+  });
+});