@credibledata/cred-cli 0.0.103 → 0.0.105

package/src/commands/misc/login.spec.ts

@@ -1,371 +0,0 @@
-import { spawn } from "child_process";
-import axios from "axios";
-import { expect } from "chai";
-import fs from "fs";
-import os from "os";
-import { join, resolve } from "path";
-import sinon from "sinon";
-import * as credConstants from "../../constants";
-import { ClientConfiguration } from "../../clientconfiguration";
-import { isLoginInvocation, login } from "./login";
-import { OrganizationsApi } from "../../client/api";
-import * as loopbackOAuth from "./loopbackOAuth";
-
-function createFakeIdToken(payload: Record<string, unknown>): string {
-   const header = Buffer.from(
-      JSON.stringify({ alg: "none", typ: "JWT" }),
-   ).toString("base64url");
-   const body = Buffer.from(JSON.stringify(payload)).toString("base64url");
-   return `${header}.${body}.`;
-}
-
-describe("login", () => {
-   let tmpConfigDir: string;
-   let tmpConfigFilePath: string;
-   let axiosStub: sinon.SinonStub;
-   let orgPermissionsStub: sinon.SinonStub;
-
-   const mockDeviceCodeResponse = {
-      data: {
-         verification_uri_complete: "https://example.com",
-         user_code: "123456",
-         device_code: "device-code-123",
-         interval: 1,
-      },
-   };
-
-   const fakeJwtPayload = {
-      name: "Test User",
-      email: "test@example.com",
-   };
-
-   const mockedAccessTokenResponse = {
-      data: {
-         id_token: createFakeIdToken(fakeJwtPayload),
-         access_token: "mock-access-token",
-         refresh_token: "mock-refresh-token",
-      },
-   };
-
-   const mockOrgPermissionsResponse = {
-      status: 200,
-      data: {},
-   };
-
-   beforeEach(() => {
-      // mkdtempSync atomically creates a private (mode 0700) directory
-      // with an unguessable suffix, sidestepping the symlink / clobber
-      // class that CodeQL flags as js/insecure-temporary-file when a
-      // fixed name is reused inside the shared OS tmpdir.
-      tmpConfigDir = fs.mkdtempSync(join(os.tmpdir(), "cred-login-spec-"));
-      tmpConfigFilePath = join(tmpConfigDir, "cred.json");
-      // Seed with a valid ConfigFile. loadConfig now throws on malformed
-      // input rather than silently resetting, so an empty `{}` is no longer
-      // an acceptable starting state.
-      fs.writeFileSync(
-         tmpConfigFilePath,
-         JSON.stringify({
-            configPerEnvironment: {
-               production: {},
-               staging: {},
-               localhost: {},
-            },
-            activeEnvironment: "production",
-         }),
-      );
-      axiosStub = sinon.stub(axios, "request");
-      orgPermissionsStub = sinon
-         .stub(OrganizationsApi.prototype, "getOrganization")
-         .resolves(mockOrgPermissionsResponse as any);
-   });
-
-   afterEach(() => {
-      fs.rmSync(tmpConfigDir, { recursive: true, force: true });
-      sinon.restore();
-   });
-
-   it("should not delete config properties on login", async function () {
-      this.timeout(2000);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("localhost");
-      config.setOrganization("foo");
-      config.setProject("bar");
-      axiosStub
-         .onFirstCall()
-         .resolves(mockDeviceCodeResponse)
-         .onSecondCall()
-         .resolves(mockedAccessTokenResponse);
-      await login("foo", "http://localhost", tmpConfigFilePath);
-      expect(config.getOrganization()).to.equal("foo");
-      expect(config.getProject()).to.equal("bar");
-   });
-
-   it("should change the active organization when login succeeds", async function () {
-      this.timeout(2000);
-      axiosStub
-         .onFirstCall()
-         .resolves(mockDeviceCodeResponse)
-         .onSecondCall()
-         .resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("localhost");
-      config.setOrganization("foo");
-      config.setProject("bar");
-      await login("test", "http://localhost", tmpConfigFilePath);
-      expect(config.getOrganization()).to.equal("test");
-   });
-
-   it("should set an access token when login succeeds", async function () {
-      this.timeout(2000);
-      axiosStub
-         .onFirstCall()
-         .resolves(mockDeviceCodeResponse)
-         .onSecondCall()
-         .resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("localhost");
-      await login("test", "http://localhost", tmpConfigFilePath);
-      expect(config.getAccessToken()).to.equal(
-         mockedAccessTokenResponse.data.access_token,
-      );
-   });
-
-   it("should unset the project field when switching organizations", async function () {
-      this.timeout(2000);
-      axiosStub
-         .onFirstCall()
-         .resolves(mockDeviceCodeResponse)
-         .onSecondCall()
-         .resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("localhost");
-      config.setOrganization("foo");
-      config.setProject("bar");
-      await login("not-foo", "http://localhost", tmpConfigFilePath);
-      expect(config.getProject()).to.equal(undefined);
-   });
-
-   it("should not unset the project field when logging in with the same organization", async function () {
-      this.timeout(2000);
-      axiosStub
-         .onFirstCall()
-         .resolves(mockDeviceCodeResponse)
-         .onSecondCall()
-         .resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("localhost");
-      config.setOrganization("foo");
-      config.setProject("bar");
-      await login("foo", "http://localhost", tmpConfigFilePath);
-      expect(config.getProject()).to.equal("bar");
-   });
-
-   it("uses auth-code + PKCE with organization in authorize URL for mapped CLI orgs", async function () {
-      this.timeout(2000);
-      const orgIdStub = sinon
-         .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
-         .returns("org_nMRKafeSuxOiuJeG");
-      const loopbackStub = sinon
-         .stub(loopbackOAuth, "authorizationCodeViaLoopback")
-         .callsFake(async (opts) => {
-            opts.onListening?.();
-            return { code: "test-pkce-auth-code" };
-         });
-      axiosStub.onFirstCall().resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("videoamp");
-      await login(
-         "videoamp",
-         "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
-         tmpConfigFilePath,
-      );
-      expect(orgIdStub.calledOnceWithExactly("videoamp", undefined)).to.be.true;
-      expect(loopbackStub.calledOnce).to.be.true;
-      const call = loopbackStub.getCall(0);
-      expect(call.args[0].authorizeUrl).to.contain(
-         "organization=org_nMRKafeSuxOiuJeG",
-      );
-   });
-
-   it("uses mapped org id for PKCE flow regardless of org name casing", async function () {
-      this.timeout(2000);
-      const orgIdStub = sinon
-         .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
-         .callsFake((name: string) =>
-            name.toLowerCase() === "videoamp"
-               ? "org_nMRKafeSuxOiuJeG"
-               : undefined,
-         );
-      const loopbackStub = sinon
-         .stub(loopbackOAuth, "authorizationCodeViaLoopback")
-         .callsFake(async (opts) => {
-            opts.onListening?.();
-            return { code: "test-pkce-auth-code" };
-         });
-      axiosStub.onFirstCall().resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("videoamp");
-      await login(
-         "VideoAmp",
-         "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
-         tmpConfigFilePath,
-      );
-      expect(orgIdStub.calledOnceWithExactly("VideoAmp", undefined)).to.be.true;
-      expect(loopbackStub.getCall(0).args[0].authorizeUrl).to.contain(
-         "organization=org_nMRKafeSuxOiuJeG",
-      );
-   });
-
-   it("forwards the cluster arg to getAuth0OrganizationIdForCliLogin (so -c aws triggers PKCE)", async function () {
-      this.timeout(2000);
-      const orgIdStub = sinon
-         .stub(credConstants, "getAuth0OrganizationIdForCliLogin")
-         .returns("org_nMRKafeSuxOiuJeG");
-      sinon
-         .stub(loopbackOAuth, "authorizationCodeViaLoopback")
-         .callsFake(async (opts) => {
-            opts.onListening?.();
-            return { code: "test-pkce-auth-code" };
-         });
-      axiosStub.onFirstCall().resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("videoamp");
-      await login(
-         "videoamp",
-         "https://admin.videoamp-aws-us-east-1.credibledata.com/api/v0",
-         tmpConfigFilePath,
-         "aws",
-      );
-      expect(orgIdStub.calledOnceWithExactly("videoamp", "aws")).to.be.true;
-   });
-
-   it("should not pass Auth0 organization for unmapped org names", async function () {
-      this.timeout(2000);
-      axiosStub
-         .onFirstCall()
-         .resolves(mockDeviceCodeResponse)
-         .onSecondCall()
-         .resolves(mockedAccessTokenResponse);
-      const config = new ClientConfiguration(tmpConfigFilePath);
-      config.setEnvironment("localhost");
-      await login("test", "http://localhost", tmpConfigFilePath);
-      expect(axiosStub.getCall(0).args[0].data).to.not.have.property(
-         "organization",
-      );
-   });
-});
-
-describe("isLoginInvocation", () => {
-   it("is true for a `cred login <org>` invocation", () => {
-      expect(isLoginInvocation(["node", "/x/index.js", "login", "myorg"])).to.be
-         .true;
-   });
-
-   it("is false for other commands (they stay fail-loud on a corrupt config)", () => {
-      expect(isLoginInvocation(["node", "/x/index.js", "status"])).to.be.false;
-      expect(isLoginInvocation(["node", "/x/index.js", "publish"])).to.be.false;
-      expect(isLoginInvocation(["node", "/x/index.js"])).to.be.false;
-   });
-});
-
-// Drives the real binary entrypoint (src/index.ts), not recoverIfCorrupt() in
-// isolation. index.ts reads the active environment at module load (axios
-// baseURL + command registration), so a corrupt ~/.cred used to throw before
-// the login action ran — dead-ending the documented recovery path. This guards
-// that ordering: with HOME pointed at a fixture dir holding a corrupt config,
-// `index.ts login <org>` must reset the file rather than crash with the
-// structure error.
-describe("entrypoint recovery for a corrupt ~/.cred (real index.ts)", () => {
-   let tmpHome: string;
-   const indexPath = resolve(__dirname, "../../index.ts");
-   const cliRoot = resolve(__dirname, "../../..");
-
-   beforeEach(() => {
-      tmpHome = fs.mkdtempSync(join(os.tmpdir(), "cred-entrypoint-"));
-   });
-
-   afterEach(() => {
-      fs.rmSync(tmpHome, { recursive: true, force: true });
-   });
-
-   const findBackup = (): string | undefined =>
-      fs.readdirSync(tmpHome).find((f) => f.startsWith(".cred.corrupt-"));
-
-   it("backs up the corrupt file and resets instead of crashing", async function () {
-      this.timeout(60000);
-
-      // A structurally-invalid config: parses as JSON but has neither
-      // activeEnvironment nor configPerEnvironment — exactly what triggered the
-      // customer's "re-run cred login" loop.
-      const credPath = join(tmpHome, ".cred");
-      fs.writeFileSync(credPath, JSON.stringify({ garbage: true }));
-
-      const child = spawn(
-         process.execPath,
-         ["-r", "ts-node/register", indexPath, "login", "testorg"],
-         {
-            cwd: cliRoot,
-            env: {
-               ...process.env,
-               HOME: tmpHome,
-               USERPROFILE: tmpHome,
-               // Runtime behavior is what we're testing; skip type-checking the
-               // whole import graph so an unrelated type error can't derail it.
-               TS_NODE_TRANSPILE_ONLY: "1",
-            },
-         },
-      );
-
-      let output = "";
-      child.stdout.on("data", (d) => (output += d.toString()));
-      child.stderr.on("data", (d) => (output += d.toString()));
-
-      // Recovery runs synchronously at module load, before login() touches the
-      // network. It renames the corrupt file aside (.cred.corrupt-*) and THEN
-      // rewrites .cred to a valid default. Gate on the rewrite, not the backup:
-      // the backup appears first, so killing the instant it shows can catch the
-      // child in the gap before .cred is rewritten — a flaky ENOENT on the read
-      // below. resetComplete() only goes true once .cred is the valid default
-      // (which implies the backup already happened). Then stop the process
-      // (login otherwise blocks on the device-code flow).
-      const resetComplete = (): boolean => {
-         try {
-            return (
-               JSON.parse(fs.readFileSync(credPath, "utf8"))
-                  .activeEnvironment === "production"
-            );
-         } catch {
-            return false; // .cred absent or mid-rewrite
-         }
-      };
-      await new Promise<void>((resolveWait) => {
-         const deadline = Date.now() + 55000;
-         const timer = setInterval(() => {
-            if (resetComplete() || Date.now() > deadline) {
-               clearInterval(timer);
-               resolveWait();
-            }
-         }, 200);
-         child.on("exit", () => {
-            clearInterval(timer);
-            resolveWait();
-         });
-      });
-      child.kill("SIGKILL");
-
-      const backup = findBackup();
-      expect(backup, "corrupt config should be backed up aside").to.be.a(
-         "string",
-      );
-      // The bad contents are preserved in the backup, not destroyed.
-      expect(
-         JSON.parse(fs.readFileSync(join(tmpHome, backup!), "utf8")),
-      ).to.deep.equal({ garbage: true });
-      // ~/.cred is rewritten to a valid default the next read can load.
-      const reset = JSON.parse(fs.readFileSync(credPath, "utf8"));
-      expect(reset.activeEnvironment).to.equal("production");
-      expect(reset.configPerEnvironment).to.be.an("object");
-      // The startup read no longer dead-ends on the structure error.
-      expect(output).to.not.match(/Invalid config structure/);
-   });
-});