@gigzen/populace 1.3.1 → 1.3.2

package/package.json

@@ -1,60 +1,60 @@
-{
-  "name": "@gigzen/populace",
-  "version": "1.3.1",
-  "description": "A simulated population that uses your app through its real API, so you can test what needs more than one person.",
-  "type": "module",
-  "bin": {
-    "populace": "./src/cli.mjs"
-  },
-  "main": "./src/index.mjs",
-  "exports": {
-    ".": "./src/index.mjs",
-    "./engine": "./src/engine/index.mjs"
-  },
-  "files": [
-    "src",
-    "adapters",
-    "examples",
-    "!**/populace-report.json",
-    "!**/populace-report.html",
-    "!examples/buzzbuzz/run-test.ps1",
-    "populace.config.example.mjs",
-    "README.md",
-    "LICENSE",
-    "action.yml"
-  ],
-  "scripts": {
-    "demo": "node src/cli.mjs demo",
-    "doctor": "node src/cli.mjs doctor",
-    "test": "node src/selftest.mjs",
-    "prepublishOnly": "node src/selftest.mjs"
-  },
-  "engines": {
-    "node": ">=18"
-  },
-  "keywords": [
-    "simulation",
-    "testing",
-    "load-testing",
-    "multi-user",
-    "synthetic-users",
-    "qa"
-  ],
-  "license": "AGPL-3.0-only",
-  "dependencies": {},
-  "devDependencies": {
-    "@supabase/supabase-js": "^2.45.0"
-  },
-  "author": "Sankur Kundu <sankur.kundu.tw@gmail.com>",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Shakhtar-Sankur/populace.git"
-  },
-  "homepage": "https://github.com/Shakhtar-Sankur/populace#readme",
-  "bugs": {
-    "url": "https://github.com/Shakhtar-Sankur/populace/issues"
-  },
-  "publishConfig": {
-    "access": "public"
-  }
-}
+{
+  "name": "@gigzen/populace",
+  "version": "1.3.2",
+  "description": "A simulated population that uses your app through its real API, so you can test what needs more than one person.",
+  "type": "module",
+  "bin": {
+    "populace": "./src/cli.mjs"
+  },
+  "main": "./src/index.mjs",
+  "exports": {
+    ".": "./src/index.mjs",
+    "./engine": "./src/engine/index.mjs"
+  },
+  "files": [
+    "src",
+    "adapters",
+    "examples",
+    "!**/populace-report.json",
+    "!**/populace-report.html",
+    "!examples/buzzbuzz/run-test.ps1",
+    "populace.config.example.mjs",
+    "README.md",
+    "LICENSE",
+    "action.yml"
+  ],
+  "scripts": {
+    "demo": "node src/cli.mjs demo",
+    "doctor": "node src/cli.mjs doctor",
+    "test": "node src/selftest.mjs",
+    "prepublishOnly": "node src/selftest.mjs"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "simulation",
+    "testing",
+    "load-testing",
+    "multi-user",
+    "synthetic-users",
+    "qa"
+  ],
+  "license": "AGPL-3.0-only",
+  "dependencies": {},
+  "devDependencies": {
+    "@supabase/supabase-js": "^2.45.0"
+  },
+  "author": "Sankur Kundu <sankur.kundu.tw@gmail.com>",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Shakhtar-Sankur/populace.git"
+  },
+  "homepage": "https://github.com/Shakhtar-Sankur/populace#readme",
+  "bugs": {
+    "url": "https://github.com/Shakhtar-Sankur/populace/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/src/config.mjs

@@ -16,6 +16,40 @@ export class ConfigError extends Error {}
 
 const strip = (u) => String(u || "").trim().replace(/\/+$/, "").toLowerCase();
 
+/**
+ * The hostname inside a string, however it was written.
+ *
+ * Everything here is a variation a person actually types: a trailing slash, a
+ * path on the end, no scheme at all, a port, capitals, stray whitespace. All of
+ * them must come out as the same host, because all of them are the same
+ * database.
+ *
+ * Returns null for a string that is not a host. That matters more than it
+ * looks: the denylist is compared against every string in the target block,
+ * keys and schema names included, and those must not be mistaken for hosts.
+ */
+function hostOf(value) {
+  const s = strip(value).replace(/^[a-z][a-z0-9+.-]*:\/\//, "").replace(/^[^/@]*@/, "");
+  const host = s.split(/[/?#]/)[0].split(":")[0];
+  return /^[a-z0-9.-]+\.[a-z]{2,}$/.test(host) ? host.replace(/^\.+|\.+$/g, "") : null;
+}
+
+/**
+ * Is this target one of the hosts the customer forbade?
+ *
+ * Host equality, or a subdomain of a forbidden host — so naming
+ * `example.com` also stops `api.example.com`, which is what someone listing
+ * their production domain means.
+ *
+ * It is deliberately NOT a substring test. A substring test refuses
+ * `key: "k"` because some forbidden URL happens to contain the letter k, and a
+ * guard that cries wolf over a single character is a guard people switch off.
+ */
+function sameHost(target, denied) {
+  if (!target || !denied) return false;
+  return target === denied || target.endsWith(`.${denied}`) || denied.endsWith(`.${target}`);
+}
+
 /** Pull every string out of a nested object, so we can scan a whole target block. */
 function stringsIn(value, found = []) {
   if (typeof value === "string") found.push(value);
@@ -134,14 +168,24 @@ export function guardProduction(config) {
       .split(",")
       .map((s) => s.trim())
       .filter(Boolean),
-  ].map(strip);
+  ];
+
+  // A denied entry that is not a host is kept as a literal, so a customer who
+  // writes something unusual in there still gets an exact match rather than
+  // silently nothing.
+  const deniedHosts = denied.map(hostOf).filter(Boolean);
+  const deniedLiterals = denied.filter((d) => !hostOf(d)).map(strip).filter(Boolean);
 
   if (denied.length) {
-    const targets = stringsIn(config.target).map(strip).filter(Boolean);
-    const hit = targets.find((t) => denied.some((d) => d && (t === d || t.includes(d) || d.includes(t))));
+    const targets = stringsIn(config.target);
+    const hit = targets.find((raw) => {
+      const host = hostOf(raw);
+      if (host && deniedHosts.some((d) => sameHost(host, d))) return true;
+      return deniedLiterals.includes(strip(raw));
+    });
     if (hit) {
       refuse(
-        `The target matches a host listed in neverRunAgainst:\n    ${hit}`,
+        `The target matches a host listed in neverRunAgainst:\n    ${hostOf(hit) || strip(hit)}`,
         `Simulated people must never be visible to real users.\n` +
           `  Point \`target\` at a separate test environment.`,
       );

package/src/selftest.mjs

@@ -25,6 +25,7 @@ import {
   normaliseError,
   summarise,
 } from "./instrument.mjs";
+import { guardProduction } from "./config.mjs";
 import { buildReport, renderReport } from "./report.mjs";
 import { canSignInOnly, CONTRACT_METHODS, coverageOf, isStub } from "./contract.mjs";
 import { diagnose } from "./diagnose.mjs";
@@ -506,6 +507,77 @@ check("doctor names the cleanup mode", () => {
   );
 });
 
+// --- 4c-bis. the denylist, which is the one thing that must never be wrong --
+//
+// Everything else in this file protects a report. This protects a database
+// that real people's accounts are in. It had no coverage until a substring
+// match was found refusing `key: "k"` — and the same test showed the far worse
+// half: because the comparison included the scheme, writing the forbidden host
+// as http:// instead of https:// walked straight past it.
+//
+// So the rule is hosts, not strings, and both directions are asserted: every
+// way of spelling a forbidden host is refused, and nothing else is.
+
+const FORBIDDEN = "prod.example.com";
+const guarded = (target) => {
+  try {
+    guardProduction({
+      _file: "x", environment: "test",
+      neverRunAgainst: [`https://${FORBIDDEN}`], target,
+    });
+    return "ran";
+  } catch { return "refused"; }
+};
+
+for (const [how, target] of Object.entries({
+  "written plainly": `https://${FORBIDDEN}`,
+  "with no scheme": FORBIDDEN,
+  "over http instead of https": `http://${FORBIDDEN}`,
+  "as a websocket url": `wss://${FORBIDDEN}/realtime/v1`,
+  "as a postgres connection string": `postgresql://postgres:pw@${FORBIDDEN}:5432/postgres`,
+  "with credentials in front of it": `https://user:secret@${FORBIDDEN}`,
+  "with a port": `https://${FORBIDDEN}:443`,
+  "with a path, query and hash": `https://${FORBIDDEN}/rest/v1?a=1#b`,
+  "in capitals with a trailing slash": `HTTPS://${FORBIDDEN.toUpperCase()}/`,
+  "padded with whitespace": `   https://${FORBIDDEN}   `,
+  "as a subdomain of it": `https://api.${FORBIDDEN}`,
+  "buried in a nested field": { url: "http://127.0.0.1:54321", replica: `https://${FORBIDDEN}` },
+  "hidden in an array": ["http://127.0.0.1:54321", `https://${FORBIDDEN}`],
+})) {
+  check(`a forbidden host is refused ${how}`, () => {
+    assert.equal(guarded(target), "refused",
+      "this is the guard that keeps simulated people out of a real database");
+  });
+}
+
+check("a short field value is not mistaken for a forbidden host", () => {
+  // "e", "com" and "pro" are all substrings of prod.example.com. None is a host.
+  assert.equal(guarded({ url: "http://127.0.0.1:54321", key: "e", schema: "com", pool: "pro" }), "ran");
+});
+
+check("a different host on the same domain still runs", () => {
+  assert.equal(guarded({ url: "https://staging.example.com", key: "k" }), "ran");
+});
+
+check("naming a domain also covers its subdomains", () => {
+  // Someone who forbids example.com means all of it, not the apex alone.
+  assert.equal(guarded(`https://api.${FORBIDDEN}`), "refused");
+});
+
+check("an empty denylist warns rather than silently allowing", () => {
+  const c = guardProduction({ _file: "x", environment: "test", target: { url: "https://anything.example" } });
+  assert.ok((c._warnings || []).some((w) => /neverRunAgainst is empty/.test(w)));
+});
+
+check("a non-production environment is still required", () => {
+  for (const environment of ["production", "prod", undefined, "", "live"]) {
+    assert.throws(() => guardProduction({
+      _file: "x", environment, target: { url: "http://127.0.0.1:54321" },
+      neverRunAgainst: [`https://${FORBIDDEN}`],
+    }), `environment "${environment}" must not be accepted`);
+  }
+});
+
 // --- 4d. teardown must not claim removals it did not make ------------------
 // selfDestruct() does nothing when there is no account and no deleteUser, and
 // teardown counted both as successes — so a run could print "Cleanup complete