@gigzen/populace 1.3.0 → 1.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gigzen/populace",
-  "version": "1.3.0",
+  "version": "1.3.2",
   "description": "A simulated population that uses your app through its real API, so you can test what needs more than one person.",
   "type": "module",
   "bin": {

package/src/cli.mjs

@@ -336,7 +336,17 @@ async function run() {
     });
     process.stdin.on("error", () => {});   // a closed pipe is not a reason to fail a run
     process.stdin.resume();
-    process.stdin.unref();
+    /* unref() is NOT on every stdin. Node hands you a different stream
+       depending on what stdin is attached to, and only some of them are
+       sockets: with stdin redirected from a file or the null device — CI
+       runners, `docker run` without -i, most automation — it is an
+       fs.ReadStream, which has no unref, and calling it threw
+       "process.stdin.unref is not a function" before the run had started.
+       This whole branch exists to make non-interactive use work, so it was
+       failing in exactly the case it was written for. Nothing is lost when it
+       is absent: those streams reach EOF immediately and never hold the loop
+       open, which is all unref was buying. */
+    process.stdin.unref?.();
   }
 
   await world.populate();

package/src/config.mjs

@@ -16,6 +16,40 @@ export class ConfigError extends Error {}
 
 const strip = (u) => String(u || "").trim().replace(/\/+$/, "").toLowerCase();
 
+/**
+ * The hostname inside a string, however it was written.
+ *
+ * Everything here is a variation a person actually types: a trailing slash, a
+ * path on the end, no scheme at all, a port, capitals, stray whitespace. All of
+ * them must come out as the same host, because all of them are the same
+ * database.
+ *
+ * Returns null for a string that is not a host. That matters more than it
+ * looks: the denylist is compared against every string in the target block,
+ * keys and schema names included, and those must not be mistaken for hosts.
+ */
+function hostOf(value) {
+  const s = strip(value).replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^[^/@]*@/, "");
+  const host = s.split(/[/?#]/)[0].split(":")[0];
+  return /^[a-z0-9.-]+\.[a-z]{2,}$/.test(host) ? host.replace(/^\.+|\.+$/g, "") : null;
+}
+
+/**
+ * Is this target one of the hosts the customer forbade?
+ *
+ * Host equality, or a subdomain of a forbidden host — so naming
+ * `example.com` also stops `api.example.com`, which is what someone listing
+ * their production domain means.
+ *
+ * It is deliberately NOT a substring test. A substring test refuses
+ * `key: "k"` because some forbidden URL happens to contain the letter k, and a
+ * guard that cries wolf over a single character is a guard people switch off.
+ */
+function sameHost(target, denied) {
+  if (!target || !denied) return false;
+  return target === denied || target.endsWith(`.${denied}`) || denied.endsWith(`.${target}`);
+}
+
 /** Pull every string out of a nested object, so we can scan a whole target block. */
 function stringsIn(value, found = []) {
   if (typeof value === "string") found.push(value);
@@ -134,14 +168,24 @@ export function guardProduction(config) {
       .split(",")
       .map((s) => s.trim())
       .filter(Boolean),
-  ].map(strip);
+  ];
+
+  // A denied entry that is not a host is kept as a literal, so a customer who
+  // writes something unusual in there still gets an exact match rather than
+  // silently nothing.
+  const deniedHosts = denied.map(hostOf).filter(Boolean);
+  const deniedLiterals = denied.filter((d) => !hostOf(d)).map(strip).filter(Boolean);
 
   if (denied.length) {
-    const targets = stringsIn(config.target).map(strip).filter(Boolean);
-    const hit = targets.find((t) => denied.some((d) => d && (t === d || t.includes(d) || d.includes(t))));
+    const targets = stringsIn(config.target);
+    const hit = targets.find((raw) => {
+      const host = hostOf(raw);
+      if (host && deniedHosts.some((d) => sameHost(host, d))) return true;
+      return deniedLiterals.includes(strip(raw));
+    });
     if (hit) {
       refuse(
-        `The target matches a host listed in neverRunAgainst:\n    ${hit}`,
+        `The target matches a host listed in neverRunAgainst:\n    ${hostOf(hit) || strip(hit)}`,
         `Simulated people must never be visible to real users.\n` +
           `  Point \`target\` at a separate test environment.`,
       );

package/src/html-report.mjs

@@ -78,20 +78,20 @@ export function renderHtmlReport(report) {
 <style>
 :root{
   --paper:#F4F5F7;--card:#fff;--ink:#12181D;--body:#3A454E;--muted:#6B7883;
-  --rule:#DDE2E7;--accent:#A85A0B;--ok:#2C6E4C;--bad:#A63127;--warn:#9A6A08;
+  --rule:#DDE2E7;--accent:#4338CA;--ok:#2C6E4C;--bad:#A63127;--warn:#9A6A08;
   --bar:#C9D4DC;--barbad:#E0A99F;
   --mono:ui-monospace,"SF Mono","Cascadia Mono",Menlo,Consolas,monospace;
   --sans:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Arial,sans-serif;
 }
 @media (prefers-color-scheme:dark){:root{
   --paper:#0E1418;--card:#161E24;--ink:#E8EEF3;--body:#B0BDC7;--muted:#7B8994;
-  --rule:#26323A;--accent:#E0A45C;--ok:#5FAB80;--bad:#DE7568;--warn:#D2A24E;
+  --rule:#26323A;--accent:#A5B4FC;--ok:#5FAB80;--bad:#DE7568;--warn:#D2A24E;
   --bar:#2E3A43;--barbad:#5C332C;}}
 :root[data-theme="dark"]{--paper:#0E1418;--card:#161E24;--ink:#E8EEF3;--body:#B0BDC7;
-  --muted:#7B8994;--rule:#26323A;--accent:#E0A45C;--ok:#5FAB80;--bad:#DE7568;
+  --muted:#7B8994;--rule:#26323A;--accent:#A5B4FC;--ok:#5FAB80;--bad:#DE7568;
   --warn:#D2A24E;--bar:#2E3A43;--barbad:#5C332C;}
 :root[data-theme="light"]{--paper:#F4F5F7;--card:#fff;--ink:#12181D;--body:#3A454E;
-  --muted:#6B7883;--rule:#DDE2E7;--accent:#A85A0B;--ok:#2C6E4C;--bad:#A63127;
+  --muted:#6B7883;--rule:#DDE2E7;--accent:#4338CA;--ok:#2C6E4C;--bad:#A63127;
   --warn:#9A6A08;--bar:#C9D4DC;--barbad:#E0A99F;}
 *{box-sizing:border-box}
 body{margin:0;background:var(--paper);color:var(--body);font-family:var(--sans);

package/src/selftest.mjs

@@ -25,6 +25,7 @@ import {
   normaliseError,
   summarise,
 } from "./instrument.mjs";
+import { guardProduction } from "./config.mjs";
 import { buildReport, renderReport } from "./report.mjs";
 import { canSignInOnly, CONTRACT_METHODS, coverageOf, isStub } from "./contract.mjs";
 import { diagnose } from "./diagnose.mjs";
@@ -506,6 +507,77 @@ check("doctor names the cleanup mode", () => {
   );
 });
 
+// --- 4c-bis. the denylist, which is the one thing that must never be wrong --
+//
+// Everything else in this file protects a report. This protects a database
+// that real people's accounts are in. It had no coverage until a substring
+// match was found refusing `key: "k"` — and the same test showed the far worse
+// half: because the comparison included the scheme, writing the forbidden host
+// as http:// instead of https:// walked straight past it.
+//
+// So the rule is hosts, not strings, and both directions are asserted: every
+// way of spelling a forbidden host is refused, and nothing else is.
+
+const FORBIDDEN = "prod.example.com";
+const guarded = (target) => {
+  try {
+    guardProduction({
+      _file: "x", environment: "test",
+      neverRunAgainst: [`https://${FORBIDDEN}`], target,
+    });
+    return "ran";
+  } catch { return "refused"; }
+};
+
+for (const [how, target] of Object.entries({
+  "written plainly": `https://${FORBIDDEN}`,
+  "with no scheme": FORBIDDEN,
+  "over http instead of https": `http://${FORBIDDEN}`,
+  "as a websocket url": `wss://${FORBIDDEN}/realtime/v1`,
+  "as a postgres connection string": `postgresql://postgres:pw@${FORBIDDEN}:5432/postgres`,
+  "with credentials in front of it": `https://user:secret@${FORBIDDEN}`,
+  "with a port": `https://${FORBIDDEN}:443`,
+  "with a path, query and hash": `https://${FORBIDDEN}/rest/v1?a=1#b`,
+  "in capitals with a trailing slash": `HTTPS://${FORBIDDEN.toUpperCase()}/`,
+  "padded with whitespace": `   https://${FORBIDDEN}   `,
+  "as a subdomain of it": `https://api.${FORBIDDEN}`,
+  "buried in a nested field": { url: "http://127.0.0.1:54321", replica: `https://${FORBIDDEN}` },
+  "hidden in an array": ["http://127.0.0.1:54321", `https://${FORBIDDEN}`],
+})) {
+  check(`a forbidden host is refused ${how}`, () => {
+    assert.equal(guarded(target), "refused",
+      "this is the guard that keeps simulated people out of a real database");
+  });
+}
+
+check("a short field value is not mistaken for a forbidden host", () => {
+  // "e", "com" and "pro" are all substrings of prod.example.com. None is a host.
+  assert.equal(guarded({ url: "http://127.0.0.1:54321", key: "e", schema: "com", pool: "pro" }), "ran");
+});
+
+check("a different host on the same domain still runs", () => {
+  assert.equal(guarded({ url: "https://staging.example.com", key: "k" }), "ran");
+});
+
+check("naming a domain also covers its subdomains", () => {
+  // Someone who forbids example.com means all of it, not the apex alone.
+  assert.equal(guarded(`https://api.${FORBIDDEN}`), "refused");
+});
+
+check("an empty denylist warns rather than silently allowing", () => {
+  const c = guardProduction({ _file: "x", environment: "test", target: { url: "https://anything.example" } });
+  assert.ok((c._warnings || []).some((w) => /neverRunAgainst is empty/.test(w)));
+});
+
+check("a non-production environment is still required", () => {
+  for (const environment of ["production", "prod", undefined, "", "live"]) {
+    assert.throws(() => guardProduction({
+      _file: "x", environment, target: { url: "http://127.0.0.1:54321" },
+      neverRunAgainst: [`https://${FORBIDDEN}`],
+    }), `environment "${environment}" must not be accepted`);
+  }
+});
+
 // --- 4d. teardown must not claim removals it did not make ------------------
 // selfDestruct() does nothing when there is no account and no deleteUser, and
 // teardown counted both as successes — so a run could print "Cleanup complete