@crewhaus/crewhaus-cloud 0.1.1 → 0.1.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crewhaus/crewhaus-cloud",
-  "version": "0.1.1",
+  "version": "0.1.2",
   "type": "module",
   "description": "Managed-as-a-service composite recipe: target-managed + helm-chart Kustomize overlay + Terraform module for GKE/EKS/AKS provisioning (Section 32)",
   "main": "src/index.ts",
@@ -12,15 +12,15 @@
     "test": "bun test src"
   },
   "dependencies": {
-    "@crewhaus/docker-images": "0.1.1",
-    "@crewhaus/errors": "0.1.1",
-    "@crewhaus/helm-chart": "0.1.1"
+    "@crewhaus/docker-images": "0.1.2",
+    "@crewhaus/errors": "0.1.2",
+    "@crewhaus/helm-chart": "0.1.2"
   },
   "license": "Apache-2.0",
   "author": {
     "name": "Max Meier",
-    "email": "max@studiomax.io",
-    "url": "https://studiomax.io"
+    "email": "max@crewhaus.ai",
+    "url": "https://crewhaus.ai"
   },
   "repository": {
     "type": "git",
@@ -32,12 +32,7 @@
     "url": "https://github.com/crewhaus/factory/issues"
   },
   "publishConfig": {
-    "access": "restricted"
+    "access": "public"
   },
-  "files": [
-    "src",
-    "README.md",
-    "LICENSE",
-    "NOTICE"
-  ]
+  "files": ["src", "README.md", "LICENSE", "NOTICE"]
 }

package/src/index.test.ts

@@ -1,4 +1,5 @@
-import { describe, expect, test } from "bun:test";
+import { describe, expect, spyOn, test } from "bun:test";
+import * as nodeCrypto from "node:crypto";
 import { mkdtempSync, readFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -64,8 +65,8 @@ describe("renderKustomizeOverlay", () => {
     const overlay = renderKustomizeOverlay(config);
     expect(overlay.kustomization).toContain("kind: Kustomization");
     expect(overlay.kustomization).toContain(`namespace: ${config.clusterName}`);
-    expect(overlay.kustomization).toContain("crewhaus.io/provider: aws");
-    expect(overlay.kustomization).toContain("crewhaus.io/region: us-east-1");
+    expect(overlay.kustomization).toContain("crewhaus.ai/provider: aws");
+    expect(overlay.kustomization).toContain("crewhaus.ai/region: us-east-1");
     expect(Object.keys(overlay.manifests).length).toBeGreaterThan(0);
     expect(Object.keys(overlay.manifests).some((k) => k.startsWith("managed-"))).toBe(true);
   });
@@ -190,6 +191,86 @@ describe("deployCloud (T2 dry-run with fake runner)", () => {
   });
 });
 
+describe("randomPassword (CWE-338 regression — CSPRNG, not Math.random)", () => {
+  function passwordFromCalls(calls: string[][]): string | undefined {
+    for (const argv of calls) {
+      const varArg = argv.find((a) => a.startsWith("spec_registry_password="));
+      if (varArg) return varArg.slice("spec_registry_password=".length);
+    }
+    return undefined;
+  }
+
+  test("deploy injects a 24-char hex password sourced from node:crypto.randomBytes", async () => {
+    const randomBytesSpy = spyOn(nodeCrypto, "randomBytes");
+    try {
+      const dir = mkdtempSync(join(tmpdir(), "crewhaus-cloud-pw-"));
+      const calls: string[][] = [];
+      const runner: CloudRunner = async (argv) => {
+        calls.push([...argv]);
+        return { exitCode: 0, stdout: "", stderr: "" };
+      };
+      await deployCloud({
+        config: defaultCloudConfig("aws", "us-east-1"),
+        workingDir: dir,
+        runner,
+      });
+      const pw = passwordFromCalls(calls);
+      expect(pw).toBeDefined();
+      // Same shape as before the fix: exactly 24 lowercase-hex characters.
+      expect(pw).toMatch(/^[0-9a-f]{24}$/);
+      // Proves the placeholder is drawn from the CSPRNG, not Math.random().
+      expect(randomBytesSpy).toHaveBeenCalled();
+    } finally {
+      randomBytesSpy.mockRestore();
+    }
+  });
+
+  test("two separate deploys produce different passwords (not a constant)", async () => {
+    const collect = async (): Promise<string | undefined> => {
+      const dir = mkdtempSync(join(tmpdir(), "crewhaus-cloud-pw-"));
+      const calls: string[][] = [];
+      const runner: CloudRunner = async (argv) => {
+        calls.push([...argv]);
+        return { exitCode: 0, stdout: "", stderr: "" };
+      };
+      await deployCloud({
+        config: defaultCloudConfig("gcp", "us-central1"),
+        workingDir: dir,
+        runner,
+      });
+      return passwordFromCalls(calls);
+    };
+    const [a, b] = [await collect(), await collect()];
+    expect(a).toMatch(/^[0-9a-f]{24}$/);
+    expect(b).toMatch(/^[0-9a-f]{24}$/);
+    expect(a).not.toBe(b);
+  });
+
+  test("teardown also injects a CSPRNG-sourced 24-char hex password", async () => {
+    const randomBytesSpy = spyOn(nodeCrypto, "randomBytes");
+    try {
+      const dir = mkdtempSync(join(tmpdir(), "crewhaus-cloud-pw-td-"));
+      await deployCloud({ config: defaultCloudConfig("aws", "us-east-1"), workingDir: dir });
+      randomBytesSpy.mockClear();
+      const calls: string[][] = [];
+      const runner: CloudRunner = async (argv) => {
+        calls.push([...argv]);
+        return { exitCode: 0, stdout: "", stderr: "" };
+      };
+      await teardownCloud({
+        config: defaultCloudConfig("aws", "us-east-1"),
+        workingDir: dir,
+        runner,
+      });
+      const pw = passwordFromCalls(calls);
+      expect(pw).toMatch(/^[0-9a-f]{24}$/);
+      expect(randomBytesSpy).toHaveBeenCalled();
+    } finally {
+      randomBytesSpy.mockRestore();
+    }
+  });
+});
+
 describe("teardownCloud", () => {
   test("refuses if working dir does not exist", async () => {
     await expect(

package/src/index.ts

@@ -1,3 +1,4 @@
+import { randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -129,10 +130,10 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: ${config.clusterName}
 commonLabels:
-  crewhaus.io/cluster: ${config.clusterName}
-  crewhaus.io/provider: ${config.provider}
-  crewhaus.io/region: ${config.region}
-  crewhaus.io/tier: ${config.tier}
+  crewhaus.ai/cluster: ${config.clusterName}
+  crewhaus.ai/provider: ${config.provider}
+  crewhaus.ai/region: ${config.region}
+  crewhaus.ai/tier: ${config.tier}
 resources:
 ${resourceFiles.map((f) => `  - ${f}`).join("\n")}
 `;
@@ -476,8 +477,10 @@ export async function teardownCloud(opts: DeployCloudOptions): Promise<void> {
 
 function randomPassword(): string {
   // 24 hex chars — only used as a placeholder so the Terraform variable is set;
-  // production users override via -var-file.
-  return Array.from({ length: 24 }, () => Math.floor(Math.random() * 16).toString(16)).join("");
+  // production users override via -var-file. Sourced from a CSPRNG so that, if
+  // an operator does not override it, the provisioned DB admin credential is not
+  // derived from a predictable Math.random() stream (CWE-338).
+  return randomBytes(12).toString("hex");
 }
 
 /** Used by the CLI subcommand to enumerate provider choices. */