@cldmv/gh-broker 0.8.0 → 0.9.0

package/tests/run-vitest.mjs

@@ -1,51 +0,0 @@
-/**
- *
- *	@Project: @cldmv/gh-broker
- *	@Filename: /tests/run-vitest.mjs
- *	@Date: 2026-08-02T16:55:52-07:00 (1785714952)
- *	@Author: Nate Corcoran <CLDMV>
- *	@Email: <Shinrai@users.noreply.github.com>
- *	-----
- *	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
- *	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
- *	-----
- *	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
- *
- */
-
-/**
- * @fileoverview OOM-safe Vitest runner — delegates to @cldmv/vitest-runner, which
- * spawns each test file in its own child process and (under coverage) uses a
- * blob-per-file + `--mergeReports` strategy so a single process never holds
- * coverage for the whole suite.
- */
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-import { run } from "@cldmv/vitest-runner";
-
-const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-const argv = process.argv.slice(2);
-
-const delimiter = argv.indexOf("--");
-const forwarded = delimiter === -1 ? argv.filter((a) => a.startsWith("-")) : argv.slice(0, delimiter);
-const testPatterns = delimiter === -1 ? argv.filter((a) => !a.startsWith("-")) : argv.slice(delimiter + 1);
-
-const coverageQuiet = forwarded.includes("--coverage-quiet");
-const coverage = coverageQuiet || forwarded.includes("--coverage");
-const passthrough = forwarded.filter((a) => a !== "--coverage" && a !== "--coverage-quiet");
-
-const parsedWorkers = parseInt(process.env.VITEST_WORKERS ?? "", 10);
-const workers = Number.isInteger(parsedWorkers) && parsedWorkers > 0 ? parsedWorkers : 4;
-
-const code = await run({
-	cwd: root,
-	testDir: "tests",
-	vitestConfig: ".configs/vitest.config.mjs",
-	testFilePattern: /\.test\.vitest\.mts$/,
-	testPatterns,
-	workers,
-	coverageQuiet,
-	vitestArgs: [...(coverage ? ["--coverage"] : []), ...passthrough],
-	nodeEnv: process.env.NODE_ENV || "development"
-});
-process.exit(code);

package/tests/secret-store.test.vitest.mts

@@ -1,167 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-
-vi.mock("node:fs", () => ({
-	existsSync: vi.fn(() => true),
-	readFileSync: vi.fn(),
-	writeFileSync: vi.fn(),
-	statSync: vi.fn(() => ({ size: 8 })),
-	rmSync: vi.fn(),
-	chmodSync: vi.fn(),
-	chownSync: vi.fn()
-}));
-
-import { readFileSync, existsSync, writeFileSync, rmSync, chmodSync, chownSync } from "node:fs";
-import { writeSecretsFile, readSecretsFile, removeSecretsFile, referencedCredNames, optionalCredNames, detectSecretsProvider } from "../deploy/lib/secret-store.mjs";
-
-const mockRead = vi.mocked(readFileSync);
-const mockExists = vi.mocked(existsSync);
-const mockWrite = vi.mocked(writeFileSync);
-const mockRm = vi.mocked(rmSync);
-
-describe("writeSecretsFile", () => {
-	beforeEach(() => {
-		vi.mocked(writeFileSync).mockReset();
-		vi.mocked(chmodSync).mockReset();
-		vi.mocked(chownSync).mockReset();
-	});
-
-	it("writes tab-indented JSON at 0640 and chowns to root:<gid> when a gid is given", () => {
-		writeSecretsFile("/etc/s.json", { a: "tok" }, { gid: 42 });
-		expect(writeFileSync).toHaveBeenCalledWith("/etc/s.json", '{\n\t"a": "tok"\n}\n', { mode: 0o640 });
-		expect(chmodSync).toHaveBeenCalledWith("/etc/s.json", 0o640);
-		expect(chownSync).toHaveBeenCalledWith("/etc/s.json", 0, 42);
-	});
-
-	it("honours a custom uid/mode, and skips chown without a gid (including no options at all)", () => {
-		writeSecretsFile("/etc/s.json", {}, { uid: 7, gid: 9, mode: 0o600 });
-		expect(chmodSync).toHaveBeenCalledWith("/etc/s.json", 0o600);
-		expect(chownSync).toHaveBeenCalledWith("/etc/s.json", 7, 9);
-		vi.mocked(chownSync).mockClear();
-		writeSecretsFile("/etc/s.json", {});
-		expect(chownSync).not.toHaveBeenCalled();
-	});
-});
-
-describe("readSecretsFile", () => {
-	beforeEach(() => mockRead.mockReset());
-
-	it("keeps only non-empty string values (drops numbers/objects/empties)", () => {
-		mockRead.mockReturnValue(JSON.stringify({ a: "tok", b: 123, c: "", d: { x: 1 }, e: "ok" }) as any);
-		expect(readSecretsFile("/x")).toEqual({ a: "tok", e: "ok" });
-	});
-
-	it("returns {} when the file is absent", () => {
-		mockExists.mockReturnValueOnce(false);
-		expect(readSecretsFile("/x")).toEqual({});
-		expect(mockRead).not.toHaveBeenCalled();
-	});
-
-	it("returns {} for a non-object or unparseable file", () => {
-		mockRead.mockReturnValue("[1,2,3]" as any);
-		expect(readSecretsFile("/x")).toEqual({});
-		mockRead.mockReturnValue("not json" as any);
-		expect(readSecretsFile("/x")).toEqual({});
-	});
-});
-
-describe("removeSecretsFile", () => {
-	beforeEach(() => {
-		mockExists.mockReset().mockReturnValue(true);
-		mockWrite.mockReset();
-		mockRm.mockReset();
-	});
-
-	it("zero-overwrites then unlinks an existing file", () => {
-		removeSecretsFile("/x/secrets.json");
-		expect(mockWrite).toHaveBeenCalledTimes(1);
-		const buf = mockWrite.mock.calls[0][1] as Buffer;
-		expect(Buffer.isBuffer(buf)).toBe(true);
-		expect(buf.every((b) => b === 0)).toBe(true);
-		expect(mockRm).toHaveBeenCalledWith("/x/secrets.json", { force: true });
-	});
-
-	it("is a no-op when the file is absent", () => {
-		mockExists.mockReturnValue(false);
-		removeSecretsFile("/x/secrets.json");
-		expect(mockWrite).not.toHaveBeenCalled();
-		expect(mockRm).not.toHaveBeenCalled();
-	});
-});
-
-describe("optionalCredNames", () => {
-	it("lists the npm token and nothing required", () => {
-		const cfg = { owners: { o: { read: "cred:a", write: "cred:b" } }, app: { privateKey: "cred:k" }, npm: { token: "cred:npm-token", scopes: ["@cldmv"] } };
-		expect(optionalCredNames(cfg)).toEqual(["npm-token"]);
-		expect(optionalCredNames({ owners: cfg.owners })).toEqual([]);
-		expect(optionalCredNames({ npm: { token: "npm_inline" } })).toEqual([]);
-		expect(optionalCredNames({ ...cfg, ghcr: { owners: { cldmv: { credential: "cred:cldmv-packages" }, x: { credential: "inline" } } } })).toEqual(["npm-token", "cldmv-packages"]);
-	});
-
-	it("rejects an unsafe cred name", () => {
-		expect(() => optionalCredNames({ npm: { token: "cred:../x" } })).toThrow(/unsafe credential name/);
-	});
-});
-
-describe("referencedCredNames", () => {
-	it("collects distinct cred names from owners + app, ignoring non-cred refs", () => {
-		const cfg = {
-			owners: { o1: { read: "cred:a", write: "cred:b" }, o2: { read: "cred:a", write: "cred:c" } },
-			app: { privateKey: "cred:k" }
-		};
-		expect(referencedCredNames(cfg).sort()).toEqual(["a", "b", "c", "k"]);
-		expect(referencedCredNames({ owners: { o: { read: "plain-token", write: 5 } } })).toEqual([]);
-	});
-
-	it("includes the npm token ref", () => {
-		const cfg = { owners: { o: { read: "cred:a", write: "cred:b" } }, npm: { token: "cred:npm-token", scopes: ["@cldmv"] } };
-		expect(referencedCredNames(cfg).sort()).toEqual(["a", "b", "npm-token"]);
-	});
-
-	it("includes each ghcr owner's credential, so the installer prompts for it", () => {
-		const cfg = {
-			owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } },
-			ghcr: { owners: { cldmv: { credential: "cred:cldmv-packages" } } }
-		};
-		expect(referencedCredNames(cfg).sort()).toEqual(["cldmv-packages", "cldmv-read", "cldmv-write"]);
-		expect(() => referencedCredNames({ ghcr: { owners: { o: { credential: "cred:../x" } } } })).toThrow(/unsafe credential name/);
-	});
-
-	it("returns [] with no owners", () => {
-		expect(referencedCredNames({})).toEqual([]);
-	});
-
-	it("rejects an unsafe cred name (path separator / traversal)", () => {
-		expect(() => referencedCredNames({ owners: { o: { read: "cred:../x", write: "cred:ok" } } })).toThrow(/unsafe credential name/);
-		expect(() => referencedCredNames({ owners: { o: { read: "cred:a/b", write: "cred:ok" } } })).toThrow(/unsafe credential name/);
-	});
-});
-
-describe("detectSecretsProvider", () => {
-	it("trusts the provider recorded in the deployed config, whatever is on disk", () => {
-		expect(detectSecretsProvider({ configured: "file", credNames: ["a"], fileTokenNames: [] })).toBe("file");
-		expect(detectSecretsProvider({ configured: "systemd-creds", credNames: [], fileTokenNames: ["a"] })).toBe("systemd-creds");
-	});
-
-	it("ignores an unrecognised configured value and falls back to what is on disk", () => {
-		expect(detectSecretsProvider({ configured: "vault", credNames: ["a"] })).toBe("systemd-creds");
-		expect(detectSecretsProvider({ configured: 42, fileTokenNames: ["a"] })).toBe("file");
-	});
-
-	it("infers systemd-creds from encrypted .cred files when nothing is recorded", () => {
-		expect(detectSecretsProvider({ credNames: ["cldmv-read", "cldmv-write"] })).toBe("systemd-creds");
-	});
-
-	it("infers file from tokens in the secrets file when nothing is recorded", () => {
-		expect(detectSecretsProvider({ fileTokenNames: ["cldmv-read"] })).toBe("file");
-	});
-
-	it("returns undefined on a first install, so the installer asks", () => {
-		expect(detectSecretsProvider({})).toBeUndefined();
-		expect(detectSecretsProvider()).toBeUndefined();
-		expect(detectSecretsProvider({ credNames: [], fileTokenNames: [] })).toBeUndefined();
-	});
-
-	it("returns undefined when both backends hold credentials and nothing is recorded (ambiguous)", () => {
-		expect(detectSecretsProvider({ credNames: ["a"], fileTokenNames: ["a"] })).toBeUndefined();
-	});
-});

package/tests/secrets.test.vitest.mts

@@ -1,208 +0,0 @@
-import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-
-// secrets.ts reads the JSON secrets file via node:fs.readFileSync.
-vi.mock("node:fs", () => ({ readFileSync: vi.fn() }));
-
-import { readFileSync } from "node:fs";
-import { loadSecretStore } from "../src/secrets.ts";
-
-const mockRead = vi.mocked(readFileSync);
-const SECRETS = "/x/secrets.json";
-
-function config(owners: Record<string, unknown> = { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } }, extra: Record<string, unknown> = {}): any {
-	return { listen: "unix:/x", upstream: "https://x", tools: [], owners, secrets: { provider: "file", path: SECRETS }, ...extra };
-}
-
-/**
- * Serve the secrets file body (object → JSON, or a raw string). fileStore reads
- * exactly one file, so this returns the body unconditionally.
- */
-function secretsFile(obj: Record<string, unknown> | string) {
-	const body = typeof obj === "string" ? obj : JSON.stringify(obj);
-	mockRead.mockReset();
-	mockRead.mockReturnValue(body as any);
-}
-
-describe("loadSecretStore (file provider)", () => {
-	beforeEach(() => mockRead.mockReset());
-
-	it("resolves cred refs from the secrets file", () => {
-		secretsFile({ "cldmv-read": "readtok", "cldmv-write": "writetok" });
-		const store = loadSecretStore(config());
-		expect(store.resolve("cred:cldmv-read")).toBe("readtok");
-		expect(store.resolve("cred:cldmv-write")).toBe("writetok");
-	});
-
-	it("reads the secrets file once, not per credential", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		const store = loadSecretStore(config());
-		expect(mockRead).toHaveBeenCalledTimes(1);
-		store.resolve("cred:cldmv-read");
-		store.resolve("cred:cldmv-read");
-		expect(mockRead).toHaveBeenCalledTimes(1);
-	});
-
-	it("throws when the secrets file is unreadable", () => {
-		mockRead.mockReset();
-		// Only the fileStore read throws; later reads (e.g. vitest error formatting)
-		// must not, or they'd mask the wrapped message under test.
-		mockRead.mockImplementationOnce(() => {
-			throw new Error("ENOENT");
-		});
-		expect(() => loadSecretStore(config())).toThrow(/cannot read\/parse secrets file/);
-	});
-
-	it("throws when the file is not a JSON object", () => {
-		secretsFile("[1,2,3]");
-		expect(() => loadSecretStore(config())).toThrow(/must be a JSON object/);
-	});
-
-	it("throws (eager) when a referenced credential is missing in the file", () => {
-		secretsFile({ "cldmv-write": "w" });
-		expect(() => loadSecretStore(config())).toThrow(/credential "cldmv-read" missing or empty/);
-	});
-
-	it("throws when a referenced credential is empty", () => {
-		secretsFile({ "cldmv-read": "", "cldmv-write": "w" });
-		expect(() => loadSecretStore(config())).toThrow(/credential "cldmv-read" missing or empty/);
-	});
-
-	it("strips a single trailing newline (matches the systemd-creds provider)", () => {
-		secretsFile({ "cldmv-read": "readtok\n", "cldmv-write": "writetok\r\n" });
-		const store = loadSecretStore(config());
-		expect(store.resolve("cred:cldmv-read")).toBe("readtok");
-		expect(store.resolve("cred:cldmv-write")).toBe("writetok");
-	});
-
-	it("rejects a credential that is only a newline (empty after normalization)", () => {
-		secretsFile({ "cldmv-read": "\n", "cldmv-write": "w" });
-		expect(() => loadSecretStore(config())).toThrow(/credential "cldmv-read" missing or empty/);
-	});
-
-	it("rejects an owner ref that is not cred:<name>", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		expect(() => loadSecretStore(config({ cldmv: { read: "plain-ref", write: "cred:cldmv-write" } }))).toThrow(/must be "cred:<name>"/);
-	});
-
-	it("rejects a malformed ref at resolve time", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		const store = loadSecretStore(config());
-		expect(() => store.resolve("not-a-cred-ref")).toThrow(/bad credential ref/);
-	});
-
-	it("rejects an owner cred name with a path separator (traversal guard)", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		expect(() => loadSecretStore(config({ cldmv: { read: "cred:../../etc/shadow", write: "cred:cldmv-write" } }))).toThrow(/unsafe credential name/);
-	});
-
-	it("rejects an unsafe cred name at resolve time", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		const store = loadSecretStore(config());
-		expect(() => store.resolve("cred:..")).toThrow(/unsafe credential name/);
-		expect(() => store.resolve("cred:a/b")).toThrow(/unsafe credential name/);
-	});
-
-	it("rejects an unknown provider", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		expect(() => loadSecretStore(config(undefined, { secrets: { provider: "vault", path: SECRETS } }))).toThrow(/unknown provider/);
-	});
-
-	it("treats the ghcr credentials as optional: startup does not need them, has() reports them", () => {
-		const ghcr = { dropDir: "/srv/x/y", protectReleaseTags: true, maxArchiveBytes: 1, owners: { cldmv: { username: "u", credential: "cred:cldmv-packages", images: ["hoot"] } } };
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		expect(loadSecretStore(config(undefined, { ghcr })).has("cred:cldmv-packages")).toBe(false);
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w", "cldmv-packages": "p" });
-		const store = loadSecretStore(config(undefined, { ghcr }));
-		expect(store.has("cred:cldmv-packages")).toBe(true);
-		expect(store.resolve("cred:cldmv-packages")).toBe("p");
-		const bad = { ...ghcr, owners: { cldmv: { ...ghcr.owners.cldmv, credential: "cred:../x" } } };
-		expect(() => loadSecretStore(config(undefined, { ghcr: bad }))).toThrow(/unsafe credential name/);
-	});
-
-	it("rejects a non-cred config.app.privateKey (would inline a secret in the config)", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		expect(() => loadSecretStore(config(undefined, { app: { appId: 1, privateKey: "-----BEGIN PRIVATE KEY-----" } }))).toThrow(
-			/config.app.privateKey must be a "cred:<name>" ref/
-		);
-	});
-
-	it("requires a valid config.app.privateKey cred to be stored", () => {
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w", "app-key": "pem" });
-		const store = loadSecretStore(config(undefined, { app: { appId: 1, privateKey: "cred:app-key" } }));
-		expect(store.resolve("cred:app-key")).toBe("pem");
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		expect(() => loadSecretStore(config(undefined, { app: { appId: 1, privateKey: "cred:app-key" } }))).toThrow(/app-key/);
-	});
-
-	it("treats the npm token as optional: has() reports it, startup does not require it", () => {
-		const npm = { token: "cred:npm-token", scopes: ["@cldmv"] };
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w", "npm-token": "npm_x" });
-		const store = loadSecretStore(config(undefined, { npm }));
-		expect(store.has("cred:npm-token")).toBe(true);
-		expect(store.resolve("cred:npm-token")).toBe("npm_x");
-		secretsFile({ "cldmv-read": "r", "cldmv-write": "w" });
-		const without = loadSecretStore(config(undefined, { npm }));
-		expect(without.has("cred:npm-token")).toBe(false);
-		expect(without.has("cred:cldmv-read")).toBe(true);
-		expect(() => loadSecretStore(config(undefined, { npm: { ...npm, token: "npm_inline" } }))).toThrow(/config.npm.token must be a "cred:<name>" ref/);
-		expect(() => loadSecretStore(config(undefined, { npm: { ...npm, token: "cred:../x" } }))).toThrow(/unsafe credential name/);
-	});
-});
-
-describe("loadSecretStore (systemd-creds provider, the default)", () => {
-	const CREDS = "/run/creds";
-	const original = process.env.CREDENTIALS_DIRECTORY;
-	function scConfig(): any {
-		return {
-			listen: "unix:/x",
-			upstream: "https://x",
-			tools: [],
-			owners: { cldmv: { read: "cred:cldmv-read", write: "cred:cldmv-write" } },
-			secrets: { provider: "systemd-creds" }
-		};
-	}
-
-	beforeEach(() => {
-		mockRead.mockReset();
-		process.env.CREDENTIALS_DIRECTORY = CREDS;
-	});
-	afterEach(() => {
-		if (original === undefined) delete process.env.CREDENTIALS_DIRECTORY;
-		else process.env.CREDENTIALS_DIRECTORY = original;
-	});
-
-	it("throws when $CREDENTIALS_DIRECTORY is unset", () => {
-		delete process.env.CREDENTIALS_DIRECTORY;
-		expect(() => loadSecretStore(scConfig())).toThrow(/\$CREDENTIALS_DIRECTORY unset/);
-	});
-
-	it("resolves creds from $CREDENTIALS_DIRECTORY, stripping a trailing newline", () => {
-		mockRead.mockImplementation((p: any) => {
-			if (String(p).endsWith("cldmv-read")) return "rtok\n" as any;
-			if (String(p).endsWith("cldmv-write")) return "wtok" as any;
-			throw new Error(`ENOENT: ${p}`);
-		});
-		const store = loadSecretStore(scConfig());
-		expect(store.resolve("cred:cldmv-read")).toBe("rtok");
-		expect(store.resolve("cred:cldmv-write")).toBe("wtok");
-	});
-
-	it("defaults to systemd-creds when config.secrets is absent", () => {
-		mockRead.mockReturnValue("tok" as any);
-		const cfg = scConfig();
-		delete cfg.secrets;
-		expect(loadSecretStore(cfg).resolve("cred:cldmv-read")).toBe("tok");
-	});
-
-	it("fails startup when a required credential cannot be read", () => {
-		mockRead.mockImplementation(() => {
-			throw new Error("ENOENT");
-		});
-		expect(() => loadSecretStore(scConfig())).toThrow(/credential "cldmv-read" not available: ENOENT/);
-	});
-
-	it("fails startup when a required credential is empty", () => {
-		mockRead.mockReturnValue("\n" as any);
-		expect(() => loadSecretStore(scConfig())).toThrow(/credential "cldmv-read" is empty/);
-	});
-});