@geekmidas/cli 9.0.2 → 10.0.0-alpha.1

package/src/secrets/__tests__/storage.spec.ts

@@ -1,645 +0,0 @@
-import { existsSync } from 'node:fs';
-import { mkdir, rm } from 'node:fs/promises';
-import { homedir, tmpdir } from 'node:os';
-import { basename, join } from 'node:path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import {
-	getSecretsDir,
-	getSecretsPath,
-	maskPassword,
-	readStageSecrets,
-	secretsExist,
-	setCustomSecret,
-	toEmbeddableSecrets,
-	validateEnvironmentVariables,
-	writeStageSecrets,
-} from '../storage';
-import type { StageSecrets } from '../types';
-
-describe('path utilities', () => {
-	describe('getSecretsDir', () => {
-		it('should return .gkm/secrets relative to cwd', () => {
-			const dir = getSecretsDir('/project');
-			expect(dir).toBe('/project/.gkm/secrets');
-		});
-	});
-
-	describe('getSecretsPath', () => {
-		it('should return path for stage file', () => {
-			const path = getSecretsPath('production', '/project');
-			expect(path).toBe('/project/.gkm/secrets/production.json');
-		});
-
-		it('should handle stage names with special characters', () => {
-			const path = getSecretsPath('dev-local', '/project');
-			expect(path).toBe('/project/.gkm/secrets/dev-local.json');
-		});
-	});
-
-	describe('secretsExist', () => {
-		it('should return false for non-existent secrets', () => {
-			const exists = secretsExist('nonexistent', '/nonexistent-path');
-			expect(exists).toBe(false);
-		});
-	});
-});
-
-describe('file operations', () => {
-	let tempDir: string;
-
-	beforeEach(async () => {
-		tempDir = join(tmpdir(), `gkm-test-${Date.now()}`);
-		await mkdir(tempDir, { recursive: true });
-	});
-
-	afterEach(async () => {
-		if (existsSync(tempDir)) {
-			await rm(tempDir, { recursive: true });
-		}
-
-		// Clean up keystore directory created at ~/.gkm/{tempDir-basename}
-		const keystoreDir = join(homedir(), '.gkm', basename(tempDir));
-		await rm(keystoreDir, { recursive: true, force: true });
-	});
-
-	describe('writeStageSecrets / readStageSecrets', () => {
-		it('should write and read secrets', async () => {
-			const secrets: StageSecrets = {
-				stage: 'production',
-				createdAt: '2024-01-01T00:00:00.000Z',
-				updatedAt: '2024-01-01T00:00:00.000Z',
-				services: {
-					postgres: {
-						host: 'postgres',
-						port: 5432,
-						username: 'app',
-						password: 'secret123',
-						database: 'app',
-					},
-				},
-				urls: {
-					DATABASE_URL: 'postgresql://app:secret123@postgres:5432/app',
-				},
-				custom: {},
-			};
-
-			await writeStageSecrets(secrets, tempDir);
-			const read = await readStageSecrets('production', tempDir);
-
-			expect(read).toEqual(secrets);
-		});
-
-		it('should create directory if it does not exist', async () => {
-			const secrets: StageSecrets = {
-				stage: 'staging',
-				createdAt: new Date().toISOString(),
-				updatedAt: new Date().toISOString(),
-				services: {},
-				urls: {},
-				custom: {},
-			};
-
-			await writeStageSecrets(secrets, tempDir);
-
-			expect(existsSync(join(tempDir, '.gkm/secrets'))).toBe(true);
-			expect(existsSync(join(tempDir, '.gkm/secrets/staging.json'))).toBe(true);
-		});
-
-		it('should return null for non-existent stage', async () => {
-			const read = await readStageSecrets('nonexistent', tempDir);
-			expect(read).toBeNull();
-		});
-	});
-
-	describe('secretsExist', () => {
-		it('should return true when secrets file exists', async () => {
-			const secrets: StageSecrets = {
-				stage: 'test',
-				createdAt: new Date().toISOString(),
-				updatedAt: new Date().toISOString(),
-				services: {},
-				urls: {},
-				custom: {},
-			};
-
-			await writeStageSecrets(secrets, tempDir);
-			expect(secretsExist('test', tempDir)).toBe(true);
-		});
-
-		it('should return false when secrets file does not exist', () => {
-			expect(secretsExist('nonexistent', tempDir)).toBe(false);
-		});
-	});
-
-	describe('setCustomSecret', () => {
-		it('should add custom secret to existing secrets', async () => {
-			const secrets: StageSecrets = {
-				stage: 'production',
-				createdAt: new Date().toISOString(),
-				updatedAt: new Date().toISOString(),
-				services: {},
-				urls: {},
-				custom: {},
-			};
-
-			await writeStageSecrets(secrets, tempDir);
-			const updated = await setCustomSecret(
-				'production',
-				'API_KEY',
-				'sk_test_123',
-				tempDir,
-			);
-
-			expect(updated.custom.API_KEY).toBe('sk_test_123');
-		});
-
-		it('should update existing custom secret', async () => {
-			const secrets: StageSecrets = {
-				stage: 'production',
-				createdAt: new Date().toISOString(),
-				updatedAt: new Date().toISOString(),
-				services: {},
-				urls: {},
-				custom: { API_KEY: 'old-value' },
-			};
-
-			await writeStageSecrets(secrets, tempDir);
-			const updated = await setCustomSecret(
-				'production',
-				'API_KEY',
-				'new-value',
-				tempDir,
-			);
-
-			expect(updated.custom.API_KEY).toBe('new-value');
-		});
-
-		it('should update updatedAt timestamp', async () => {
-			const originalTime = '2024-01-01T00:00:00.000Z';
-			const secrets: StageSecrets = {
-				stage: 'production',
-				createdAt: originalTime,
-				updatedAt: originalTime,
-				services: {},
-				urls: {},
-				custom: {},
-			};
-
-			await writeStageSecrets(secrets, tempDir);
-			const updated = await setCustomSecret(
-				'production',
-				'KEY',
-				'value',
-				tempDir,
-			);
-
-			expect(updated.updatedAt).not.toBe(originalTime);
-		});
-
-		it('should throw if secrets do not exist for stage', async () => {
-			await expect(
-				setCustomSecret('nonexistent', 'KEY', 'value', tempDir),
-			).rejects.toThrow('Secrets not found for stage "nonexistent"');
-		});
-
-		it('should persist changes to disk', async () => {
-			const secrets: StageSecrets = {
-				stage: 'production',
-				createdAt: new Date().toISOString(),
-				updatedAt: new Date().toISOString(),
-				services: {},
-				urls: {},
-				custom: {},
-			};
-
-			await writeStageSecrets(secrets, tempDir);
-			await setCustomSecret('production', 'NEW_KEY', 'new-value', tempDir);
-
-			const read = await readStageSecrets('production', tempDir);
-			expect(read!.custom.NEW_KEY).toBe('new-value');
-		});
-	});
-});
-
-describe('toEmbeddableSecrets', () => {
-	it('should include URLs', () => {
-		const secrets: StageSecrets = {
-			stage: 'production',
-			createdAt: new Date().toISOString(),
-			updatedAt: new Date().toISOString(),
-			services: {},
-			urls: {
-				DATABASE_URL: 'postgresql://...',
-				REDIS_URL: 'redis://...',
-			},
-			custom: {},
-		};
-
-		const embeddable = toEmbeddableSecrets(secrets);
-
-		expect(embeddable.DATABASE_URL).toBe('postgresql://...');
-		expect(embeddable.REDIS_URL).toBe('redis://...');
-	});
-
-	it('should include custom secrets', () => {
-		const secrets: StageSecrets = {
-			stage: 'production',
-			createdAt: new Date().toISOString(),
-			updatedAt: new Date().toISOString(),
-			services: {},
-			urls: {},
-			custom: {
-				API_KEY: 'sk_test_123',
-				WEBHOOK_SECRET: 'whsec_abc',
-			},
-		};
-
-		const embeddable = toEmbeddableSecrets(secrets);
-
-		expect(embeddable.API_KEY).toBe('sk_test_123');
-		expect(embeddable.WEBHOOK_SECRET).toBe('whsec_abc');
-	});
-
-	it('should include postgres service credentials', () => {
-		const secrets: StageSecrets = {
-			stage: 'production',
-			createdAt: new Date().toISOString(),
-			updatedAt: new Date().toISOString(),
-			services: {
-				postgres: {
-					host: 'postgres',
-					port: 5432,
-					username: 'app',
-					password: 'secret123',
-					database: 'mydb',
-				},
-			},
-			urls: {},
-			custom: {},
-		};
-
-		const embeddable = toEmbeddableSecrets(secrets);
-
-		expect(embeddable.POSTGRES_USER).toBe('app');
-		expect(embeddable.POSTGRES_PASSWORD).toBe('secret123');
-		expect(embeddable.POSTGRES_DB).toBe('mydb');
-		expect(embeddable.POSTGRES_HOST).toBe('postgres');
-		expect(embeddable.POSTGRES_PORT).toBe('5432');
-	});
-
-	it('should include redis service credentials', () => {
-		const secrets: StageSecrets = {
-			stage: 'production',
-			createdAt: new Date().toISOString(),
-			updatedAt: new Date().toISOString(),
-			services: {
-				redis: {
-					host: 'redis',
-					port: 6379,
-					username: 'default',
-					password: 'redis-pass',
-				},
-			},
-			urls: {},
-			custom: {},
-		};
-
-		const embeddable = toEmbeddableSecrets(secrets);
-
-		expect(embeddable.REDIS_PASSWORD).toBe('redis-pass');
-		expect(embeddable.REDIS_HOST).toBe('redis');
-		expect(embeddable.REDIS_PORT).toBe('6379');
-	});
-
-	it('should include rabbitmq service credentials', () => {
-		const secrets: StageSecrets = {
-			stage: 'production',
-			createdAt: new Date().toISOString(),
-			updatedAt: new Date().toISOString(),
-			services: {
-				rabbitmq: {
-					host: 'rabbitmq',
-					port: 5672,
-					username: 'app',
-					password: 'rmq-pass',
-					vhost: '/myapp',
-				},
-			},
-			urls: {},
-			custom: {},
-		};
-
-		const embeddable = toEmbeddableSecrets(secrets);
-
-		expect(embeddable.RABBITMQ_USER).toBe('app');
-		expect(embeddable.RABBITMQ_PASSWORD).toBe('rmq-pass');
-		expect(embeddable.RABBITMQ_HOST).toBe('rabbitmq');
-		expect(embeddable.RABBITMQ_PORT).toBe('5672');
-		expect(embeddable.RABBITMQ_VHOST).toBe('/myapp');
-	});
-
-	it('should include minio service credentials', () => {
-		const secrets: StageSecrets = {
-			stage: 'production',
-			createdAt: new Date().toISOString(),
-			updatedAt: new Date().toISOString(),
-			services: {
-				minio: {
-					host: 'localhost',
-					port: 9000,
-					username: 'myaccesskey',
-					password: 'mysecretkey',
-					bucket: 'my-bucket',
-				},
-			},
-			urls: {
-				STORAGE_ENDPOINT: 'http://localhost:9000',
-			},
-			custom: {},
-		};
-
-		const embeddable = toEmbeddableSecrets(secrets);
-
-		expect(embeddable.STORAGE_ENDPOINT).toBe('http://localhost:9000');
-		expect(embeddable.STORAGE_ACCESS_KEY_ID).toBe('myaccesskey');
-		expect(embeddable.STORAGE_SECRET_ACCESS_KEY).toBe('mysecretkey');
-		expect(embeddable.STORAGE_BUCKET).toBe('my-bucket');
-		expect(embeddable.STORAGE_REGION).toBe('eu-west-1');
-		expect(embeddable.STORAGE_FORCE_PATH_STYLE).toBe('true');
-	});
-
-	it('should handle all services and custom secrets together', () => {
-		const secrets: StageSecrets = {
-			stage: 'production',
-			createdAt: new Date().toISOString(),
-			updatedAt: new Date().toISOString(),
-			services: {
-				postgres: {
-					host: 'postgres',
-					port: 5432,
-					username: 'app',
-					password: 'pg-pass',
-					database: 'app',
-				},
-				redis: {
-					host: 'redis',
-					port: 6379,
-					username: 'default',
-					password: 'redis-pass',
-				},
-			},
-			urls: {
-				DATABASE_URL: 'postgresql://...',
-				REDIS_URL: 'redis://...',
-			},
-			custom: {
-				API_KEY: 'key123',
-			},
-		};
-
-		const embeddable = toEmbeddableSecrets(secrets);
-
-		// URLs
-		expect(embeddable.DATABASE_URL).toBe('postgresql://...');
-		expect(embeddable.REDIS_URL).toBe('redis://...');
-
-		// Custom
-		expect(embeddable.API_KEY).toBe('key123');
-
-		// Postgres
-		expect(embeddable.POSTGRES_PASSWORD).toBe('pg-pass');
-
-		// Redis
-		expect(embeddable.REDIS_PASSWORD).toBe('redis-pass');
-	});
-});
-
-describe('maskPassword', () => {
-	it('should mask middle characters', () => {
-		const masked = maskPassword('abcdefghijklmnop');
-		expect(masked).toBe('abcd**********op');
-	});
-
-	it('should show first 4 and last 2 characters', () => {
-		const masked = maskPassword('1234567890');
-		expect(masked.slice(0, 4)).toBe('1234');
-		expect(masked.slice(-2)).toBe('90');
-	});
-
-	it('should return all asterisks for short passwords', () => {
-		expect(maskPassword('short')).toBe('********');
-		expect(maskPassword('12345678')).toBe('********');
-	});
-
-	it('should handle exactly 9 character password', () => {
-		const masked = maskPassword('123456789');
-		expect(masked).toBe('1234***89');
-	});
-});
-
-describe('validateEnvironmentVariables', () => {
-	const baseSecrets: StageSecrets = {
-		stage: 'production',
-		createdAt: new Date().toISOString(),
-		updatedAt: new Date().toISOString(),
-		services: {},
-		urls: {},
-		custom: {},
-	};
-
-	it('should return valid when no variables are required', () => {
-		const result = validateEnvironmentVariables([], baseSecrets);
-
-		expect(result.valid).toBe(true);
-		expect(result.missing).toEqual([]);
-		expect(result.provided).toEqual([]);
-		expect(result.required).toEqual([]);
-	});
-
-	it('should return valid when all required variables are present', () => {
-		const secrets: StageSecrets = {
-			...baseSecrets,
-			urls: {
-				DATABASE_URL: 'postgresql://...',
-			},
-			custom: {
-				API_KEY: 'sk_test_123',
-			},
-		};
-
-		const result = validateEnvironmentVariables(
-			['DATABASE_URL', 'API_KEY'],
-			secrets,
-		);
-
-		expect(result.valid).toBe(true);
-		expect(result.missing).toEqual([]);
-		expect(result.provided).toEqual(['API_KEY', 'DATABASE_URL']);
-		expect(result.required).toEqual(['API_KEY', 'DATABASE_URL']);
-	});
-
-	it('should return invalid when some variables are missing', () => {
-		const secrets: StageSecrets = {
-			...baseSecrets,
-			urls: {
-				DATABASE_URL: 'postgresql://...',
-			},
-			custom: {},
-		};
-
-		const result = validateEnvironmentVariables(
-			['DATABASE_URL', 'API_KEY', 'JWT_SECRET'],
-			secrets,
-		);
-
-		expect(result.valid).toBe(false);
-		expect(result.missing).toEqual(['API_KEY', 'JWT_SECRET']);
-		expect(result.provided).toEqual(['DATABASE_URL']);
-		expect(result.required).toEqual(['API_KEY', 'DATABASE_URL', 'JWT_SECRET']);
-	});
-
-	it('should return invalid when all variables are missing', () => {
-		const result = validateEnvironmentVariables(
-			['API_KEY', 'JWT_SECRET'],
-			baseSecrets,
-		);
-
-		expect(result.valid).toBe(false);
-		expect(result.missing).toEqual(['API_KEY', 'JWT_SECRET']);
-		expect(result.provided).toEqual([]);
-	});
-
-	it('should recognize service credentials as provided', () => {
-		const secrets: StageSecrets = {
-			...baseSecrets,
-			services: {
-				postgres: {
-					host: 'postgres',
-					port: 5432,
-					username: 'app',
-					password: 'secret',
-					database: 'app',
-				},
-				redis: {
-					host: 'redis',
-					port: 6379,
-					username: 'default',
-					password: 'redis-pass',
-				},
-			},
-			urls: {},
-			custom: {},
-		};
-
-		const result = validateEnvironmentVariables(
-			['POSTGRES_PASSWORD', 'REDIS_HOST', 'POSTGRES_DB'],
-			secrets,
-		);
-
-		expect(result.valid).toBe(true);
-		expect(result.missing).toEqual([]);
-		expect(result.provided).toEqual([
-			'POSTGRES_DB',
-			'POSTGRES_PASSWORD',
-			'REDIS_HOST',
-		]);
-	});
-
-	it('should sort missing and provided arrays alphabetically', () => {
-		const secrets: StageSecrets = {
-			...baseSecrets,
-			custom: {
-				ZEBRA: 'value',
-				ALPHA: 'value',
-			},
-		};
-
-		const result = validateEnvironmentVariables(
-			['ZEBRA', 'ALPHA', 'YELLOW', 'BETA'],
-			secrets,
-		);
-
-		expect(result.missing).toEqual(['BETA', 'YELLOW']);
-		expect(result.provided).toEqual(['ALPHA', 'ZEBRA']);
-		expect(result.required).toEqual(['ALPHA', 'BETA', 'YELLOW', 'ZEBRA']);
-	});
-
-	it('should handle duplicate required variables', () => {
-		const secrets: StageSecrets = {
-			...baseSecrets,
-			custom: {
-				API_KEY: 'value',
-			},
-		};
-
-		const result = validateEnvironmentVariables(
-			['API_KEY', 'API_KEY', 'MISSING'],
-			secrets,
-		);
-
-		expect(result.valid).toBe(false);
-		expect(result.missing).toEqual(['MISSING']);
-		// Note: duplicates in input are preserved in required list
-		expect(result.required).toEqual(['API_KEY', 'API_KEY', 'MISSING']);
-	});
-
-	it('should work with complex service configurations', () => {
-		const secrets: StageSecrets = {
-			...baseSecrets,
-			services: {
-				postgres: {
-					host: 'postgres',
-					port: 5432,
-					username: 'app',
-					password: 'pg-secret',
-					database: 'mydb',
-				},
-				redis: {
-					host: 'redis',
-					port: 6379,
-					username: 'default',
-					password: 'redis-secret',
-				},
-				rabbitmq: {
-					host: 'rabbitmq',
-					port: 5672,
-					username: 'guest',
-					password: 'guest',
-					vhost: '/',
-				},
-			},
-			urls: {
-				DATABASE_URL: 'postgresql://...',
-				REDIS_URL: 'redis://...',
-				RABBITMQ_URL: 'amqp://...',
-			},
-			custom: {
-				JWT_SECRET: 'jwt-secret-value',
-			},
-		};
-
-		const result = validateEnvironmentVariables(
-			[
-				'DATABASE_URL',
-				'REDIS_URL',
-				'RABBITMQ_URL',
-				'JWT_SECRET',
-				'POSTGRES_PASSWORD',
-				'REDIS_PASSWORD',
-				'RABBITMQ_USER',
-				'MISSING_VAR',
-			],
-			secrets,
-		);
-
-		expect(result.valid).toBe(false);
-		expect(result.missing).toEqual(['MISSING_VAR']);
-		expect(result.provided).toContain('DATABASE_URL');
-		expect(result.provided).toContain('REDIS_URL');
-		expect(result.provided).toContain('RABBITMQ_URL');
-		expect(result.provided).toContain('JWT_SECRET');
-		expect(result.provided).toContain('POSTGRES_PASSWORD');
-		expect(result.provided).toContain('REDIS_PASSWORD');
-		expect(result.provided).toContain('RABBITMQ_USER');
-	});
-});