@google-cloud/cloud-run-mcp 1.9.0 → 1.11.0

package/test/local/cloud-api/secrets.test.js

@@ -0,0 +1,291 @@
+/*
+Copyright 2025 Google LLC
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    https://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+import assert from 'node:assert/strict';
+import { describe, it, mock, beforeEach, afterEach } from 'node:test';
+import esmock from 'esmock';
+
+describe('secrets.js', () => {
+  let mockSecretManagerClient;
+  let getSecretMock, getSecretImpl;
+  let createSecretMock, createSecretImpl;
+  let addSecretVersionMock, addSecretVersionImpl;
+  let getIamPolicyMock, getIamPolicyImpl;
+  let setIamPolicyMock, setIamPolicyImpl;
+  let logAndProgressMock;
+  let secrets;
+
+  const projectId = 'test-project';
+  const secretName = 'test-secret';
+  const accessToken = 'test-token';
+
+  beforeEach(async () => {
+    getSecretImpl = () => Promise.reject({ code: 5 });
+    getSecretMock = mock.fn((...args) => getSecretImpl(...args));
+
+    createSecretImpl = () => Promise.resolve([{}]);
+    createSecretMock = mock.fn((...args) => createSecretImpl(...args));
+
+    addSecretVersionImpl = () => Promise.resolve([{}]);
+    addSecretVersionMock = mock.fn((...args) => addSecretVersionImpl(...args));
+
+    getIamPolicyImpl = () => Promise.resolve([{}]);
+    getIamPolicyMock = mock.fn((...args) => getIamPolicyImpl(...args));
+
+    setIamPolicyImpl = () => Promise.resolve([{}]);
+    setIamPolicyMock = mock.fn((...args) => setIamPolicyImpl(...args));
+
+    logAndProgressMock = mock.fn();
+
+    mockSecretManagerClient = {
+      getSecret: getSecretMock,
+      createSecret: createSecretMock,
+      addSecretVersion: addSecretVersionMock,
+      getIamPolicy: getIamPolicyMock,
+      setIamPolicy: setIamPolicyMock,
+    };
+
+    secrets = await esmock('../../../lib/cloud-api/secrets.js', {
+      '../../../lib/clients.js': {
+        getSecretManagerClient: () => Promise.resolve(mockSecretManagerClient),
+      },
+      '../../../lib/util/helpers.js': {
+        logAndProgress: logAndProgressMock,
+      },
+    });
+  });
+
+  afterEach(() => {
+    mock.restoreAll();
+  });
+
+  describe('getSecret', () => {
+    it('should return secret metadata if it exists', async () => {
+      const mockSecret = {
+        name: `projects/${projectId}/secrets/${secretName}`,
+      };
+      getSecretImpl = () => Promise.resolve([mockSecret]);
+
+      const result = await secrets.getSecret(
+        projectId,
+        secretName,
+        accessToken
+      );
+
+      assert.deepEqual(result, mockSecret);
+      assert.equal(getSecretMock.mock.callCount(), 1);
+      assert.deepEqual(getSecretMock.mock.calls[0].arguments[0], {
+        name: `projects/${projectId}/secrets/${secretName}`,
+      });
+    });
+
+    it('should return null if secret does not exist (error code 5)', async () => {
+      getSecretImpl = () => Promise.reject({ code: 5 });
+
+      const result = await secrets.getSecret(
+        projectId,
+        secretName,
+        accessToken
+      );
+
+      assert.strictEqual(result, null);
+    });
+
+    it('should throw error for other error codes', async () => {
+      getSecretImpl = () => Promise.reject({ code: 3 });
+
+      await assert.rejects(
+        () => secrets.getSecret(projectId, secretName, accessToken),
+        { code: 3 }
+      );
+    });
+  });
+
+  describe('createSecret', () => {
+    it('should create a secret successfully', async () => {
+      const mockSecret = {
+        name: `projects/${projectId}/secrets/${secretName}`,
+      };
+      createSecretImpl = () => Promise.resolve([mockSecret]);
+
+      const result = await secrets.createSecret(
+        projectId,
+        secretName,
+        accessToken,
+        undefined,
+        () => {}
+      );
+
+      assert.deepEqual(result, mockSecret);
+      assert.equal(createSecretMock.mock.callCount(), 1);
+      assert.deepEqual(createSecretMock.mock.calls[0].arguments[0], {
+        parent: `projects/${projectId}`,
+        secretId: secretName,
+        secret: {
+          replication: {
+            automatic: {},
+          },
+        },
+      });
+    });
+
+    it('should create a secret with labels successfully', async () => {
+      const mockSecret = {
+        name: `projects/${projectId}/secrets/${secretName}`,
+      };
+      createSecretImpl = () => Promise.resolve([mockSecret]);
+      const labels = { key: 'value' };
+
+      const result = await secrets.createSecret(
+        projectId,
+        secretName,
+        accessToken,
+        labels,
+        () => {}
+      );
+
+      assert.deepEqual(result, mockSecret);
+      assert.equal(createSecretMock.mock.callCount(), 1);
+      assert.deepEqual(createSecretMock.mock.calls[0].arguments[0], {
+        parent: `projects/${projectId}`,
+        secretId: secretName,
+        secret: {
+          replication: {
+            automatic: {},
+          },
+          labels: labels,
+        },
+      });
+    });
+  });
+
+  describe('addSecretVersion', () => {
+    it('should add a secret version successfully', async () => {
+      const mockVersion = {
+        name: `projects/${projectId}/secrets/${secretName}/versions/1`,
+      };
+      addSecretVersionImpl = () => Promise.resolve([mockVersion]);
+      const content = 'secret-content';
+
+      const result = await secrets.addSecretVersion(
+        projectId,
+        secretName,
+        content,
+        accessToken,
+        () => {}
+      );
+
+      assert.deepEqual(result, mockVersion);
+      assert.equal(addSecretVersionMock.mock.callCount(), 1);
+      assert.deepEqual(addSecretVersionMock.mock.calls[0].arguments[0], {
+        parent: `projects/${projectId}/secrets/${secretName}`,
+        payload: {
+          data: Buffer.from(content),
+        },
+      });
+    });
+  });
+
+  describe('getSecretIamPolicy', () => {
+    it('should return IAM policy successfully', async () => {
+      const mockPolicy = { bindings: [] };
+      getIamPolicyImpl = () => Promise.resolve([mockPolicy]);
+
+      const result = await secrets.getSecretIamPolicy(
+        projectId,
+        secretName,
+        accessToken
+      );
+
+      assert.deepEqual(result, mockPolicy);
+      assert.equal(getIamPolicyMock.mock.callCount(), 1);
+    });
+  });
+
+  describe('setSecretIamPolicy', () => {
+    it('should set IAM policy successfully', async () => {
+      const mockPolicy = { bindings: [] };
+      setIamPolicyImpl = () => Promise.resolve([mockPolicy]);
+
+      const result = await secrets.setSecretIamPolicy(
+        projectId,
+        secretName,
+        mockPolicy,
+        accessToken,
+        () => {}
+      );
+
+      assert.deepEqual(result, mockPolicy);
+      assert.equal(setIamPolicyMock.mock.callCount(), 1);
+    });
+  });
+
+  describe('addSecretAccessorBinding', () => {
+    it('should add binding if it does not exist', async () => {
+      const initialPolicy = { bindings: [] };
+      const updatedPolicy = {
+        bindings: [
+          {
+            role: 'roles/secretmanager.secretAccessor',
+            members: ['serviceAccount:test-sa'],
+          },
+        ],
+      };
+
+      getIamPolicyImpl = () => Promise.resolve([initialPolicy]);
+      setIamPolicyImpl = () => Promise.resolve([updatedPolicy]);
+
+      const result = await secrets.addSecretAccessorBinding(
+        projectId,
+        secretName,
+        'serviceAccount:test-sa',
+        accessToken,
+        () => {}
+      );
+
+      assert.deepEqual(result, updatedPolicy);
+      assert.equal(setIamPolicyMock.mock.callCount(), 1);
+      assert.deepEqual(
+        setIamPolicyMock.mock.calls[0].arguments[0].policy,
+        updatedPolicy
+      );
+    });
+
+    it('should not update if binding already exists', async () => {
+      const existingPolicy = {
+        bindings: [
+          {
+            role: 'roles/secretmanager.secretAccessor',
+            members: ['serviceAccount:test-sa'],
+          },
+        ],
+      };
+
+      getIamPolicyImpl = () => Promise.resolve([existingPolicy]);
+
+      const result = await secrets.addSecretAccessorBinding(
+        projectId,
+        secretName,
+        'serviceAccount:test-sa',
+        accessToken,
+        () => {}
+      );
+
+      assert.deepEqual(result, existingPolicy);
+      assert.equal(setIamPolicyMock.mock.callCount(), 0);
+    });
+  });
+});

package/test/local/cloud-api/storage.test.js

@@ -0,0 +1,405 @@
+import assert from 'node:assert/strict';
+import { describe, it, mock, beforeEach, afterEach } from 'node:test';
+import esmock from 'esmock';
+
+describe('Storage API', () => {
+  let storageApi;
+  let logAndProgressMock;
+  let callWithRetryMock;
+  let getStorageClientMock;
+  let getProjectNumberMock;
+  let mockStorage;
+  let mockBucket;
+
+  beforeEach(async () => {
+    logAndProgressMock = mock.fn();
+    callWithRetryMock = mock.fn((fn) => fn());
+    getProjectNumberMock = mock.fn(() => Promise.resolve('123456'));
+
+    mockBucket = {
+      name: 'test-bucket',
+      exists: mock.fn(() => Promise.resolve([false])),
+      getMetadata: mock.fn(() =>
+        Promise.resolve([{ projectNumber: '123456' }])
+      ),
+      file: mock.fn((blobName) => ({
+        name: blobName,
+        save: mock.fn(() => Promise.resolve()),
+      })),
+      iam: {
+        getPolicy: mock.fn(() => Promise.resolve([{ bindings: [] }])),
+        setPolicy: mock.fn(() => Promise.resolve()),
+      },
+    };
+
+    mockStorage = {
+      bucket: mock.fn(() => mockBucket),
+      createBucket: mock.fn(() => Promise.resolve([mockBucket])),
+    };
+
+    getStorageClientMock = mock.fn(() => Promise.resolve(mockStorage));
+
+    storageApi = await esmock('../../../lib/cloud-api/storage.js', {
+      '../../../lib/util/helpers.js': {
+        logAndProgress: logAndProgressMock,
+        getProjectNumber: getProjectNumberMock,
+      },
+      '../../../lib/cloud-api/helpers.js': {
+        callWithRetry: callWithRetryMock,
+      },
+      '../../../lib/clients.js': {
+        getStorageClient: getStorageClientMock,
+      },
+    });
+  });
+
+  afterEach(() => {
+    mock.restoreAll();
+  });
+
+  describe('grantBucketAccess', () => {
+    it('should grant access if member does not have role', async () => {
+      const testBucket = {
+        name: 'test-bucket',
+        iam: {
+          getPolicy: mock.fn(() => Promise.resolve([{ bindings: [] }])),
+          setPolicy: mock.fn(() => Promise.resolve()),
+        },
+      };
+      await storageApi.grantBucketAccess(
+        testBucket,
+        'roles/storage.objectAdmin',
+        'serviceAccount:test@example.com'
+      );
+
+      assert.strictEqual(testBucket.iam.getPolicy.mock.callCount(), 1);
+      assert.strictEqual(testBucket.iam.setPolicy.mock.callCount(), 1);
+
+      const setPolicyCall = testBucket.iam.setPolicy.mock.calls[0];
+      const updatedPolicy = setPolicyCall.arguments[0];
+      assert.deepStrictEqual(updatedPolicy.bindings, [
+        {
+          role: 'roles/storage.objectAdmin',
+          members: ['serviceAccount:test@example.com'],
+        },
+      ]);
+    });
+
+    it('should add to existing role bindings if role exists but member is missing', async () => {
+      const testBucket = {
+        name: 'test-bucket',
+        iam: {
+          getPolicy: mock.fn(() =>
+            Promise.resolve([
+              {
+                bindings: [
+                  {
+                    role: 'roles/storage.objectAdmin',
+                    members: ['serviceAccount:existing@example.com'],
+                  },
+                ],
+              },
+            ])
+          ),
+          setPolicy: mock.fn(() => Promise.resolve()),
+        },
+      };
+
+      await storageApi.grantBucketAccess(
+        testBucket,
+        'roles/storage.objectAdmin',
+        'serviceAccount:test@example.com'
+      );
+
+      assert.strictEqual(testBucket.iam.setPolicy.mock.callCount(), 1);
+      const updatedPolicy = testBucket.iam.setPolicy.mock.calls[0].arguments[0];
+      const binding = updatedPolicy.bindings.find(
+        (b) => b.role === 'roles/storage.objectAdmin'
+      );
+      assert.ok(binding.members.includes('serviceAccount:test@example.com'));
+      assert.ok(
+        binding.members.includes('serviceAccount:existing@example.com')
+      );
+    });
+
+    it('should not call setPolicy if member already has role', async () => {
+      const testBucket = {
+        name: 'test-bucket',
+        iam: {
+          getPolicy: mock.fn(() =>
+            Promise.resolve([
+              {
+                bindings: [
+                  {
+                    role: 'roles/storage.objectAdmin',
+                    members: ['serviceAccount:test@example.com'],
+                  },
+                ],
+              },
+            ])
+          ),
+          setPolicy: mock.fn(() => Promise.resolve()),
+        },
+      };
+
+      await storageApi.grantBucketAccess(
+        testBucket,
+        'roles/storage.objectAdmin',
+        'serviceAccount:test@example.com'
+      );
+
+      assert.strictEqual(testBucket.iam.getPolicy.mock.callCount(), 1);
+      assert.strictEqual(testBucket.iam.setPolicy.mock.callCount(), 0);
+    });
+
+    it('should handle errors gracefully by logging a warning instead of throwing', async () => {
+      const testBucket = {
+        name: 'test-bucket',
+        iam: {
+          getPolicy: mock.fn(() =>
+            Promise.reject(new Error('IAM Permission Denied'))
+          ),
+          setPolicy: mock.fn(),
+        },
+      };
+
+      await storageApi.grantBucketAccess(
+        testBucket,
+        'roles/storage.objectAdmin',
+        'serviceAccount:test@example.com'
+      );
+
+      const errorLogs = logAndProgressMock.mock.calls.filter(
+        (c) => c.arguments[2] === 'warn'
+      );
+      assert.ok(errorLogs.length > 0);
+      assert.ok(errorLogs[0].arguments[0].includes('IAM Permission Denied'));
+    });
+  });
+
+  describe('ensureStorageBucketExists', () => {
+    it('should return bucket if it exists and ownership matches', async () => {
+      mockBucket.exists.mock.mockImplementation(() => Promise.resolve([true]));
+      mockBucket.getMetadata.mock.mockImplementation(() =>
+        Promise.resolve([{ projectNumber: '123456' }])
+      );
+
+      const result = await storageApi.ensureStorageBucketExists(
+        'test-project',
+        'test-bucket',
+        'us-central1',
+        'token'
+      );
+
+      assert.strictEqual(result, mockBucket);
+      assert.strictEqual(mockStorage.createBucket.mock.callCount(), 0);
+    });
+
+    it('should create bucket without labels if none provided', async () => {
+      mockBucket.exists.mock.mockImplementation(() => Promise.resolve([false]));
+      mockStorage.createBucket.mock.mockImplementation((name, options) =>
+        Promise.resolve([mockBucket])
+      );
+
+      const result = await storageApi.ensureStorageBucketExists(
+        'test-project',
+        'test-bucket',
+        'us-central1',
+        'token'
+      );
+
+      assert.strictEqual(result, mockBucket);
+      assert.strictEqual(mockStorage.createBucket.mock.callCount(), 1);
+      const call = mockStorage.createBucket.mock.calls[0];
+      assert.strictEqual(call.arguments[0], 'test-bucket');
+      assert.deepStrictEqual(call.arguments[1], { location: 'us-central1' });
+    });
+
+    it('should create bucket with labels if provided', async () => {
+      mockBucket.exists.mock.mockImplementation(() => Promise.resolve([false]));
+      mockStorage.createBucket.mock.mockImplementation((name, options) =>
+        Promise.resolve([mockBucket])
+      );
+
+      const labels = { key: 'value' };
+      const result = await storageApi.ensureStorageBucketExists(
+        'test-project',
+        'test-bucket',
+        'us-central1',
+        'token',
+        labels,
+        false
+      );
+
+      assert.strictEqual(result, mockBucket);
+      assert.strictEqual(mockStorage.createBucket.mock.callCount(), 1);
+      const call = mockStorage.createBucket.mock.calls[0];
+      assert.strictEqual(call.arguments[0], 'test-bucket');
+      assert.deepStrictEqual(call.arguments[1], {
+        location: 'us-central1',
+        metadata: { labels: labels },
+      });
+    });
+
+    it('should fall back to randomized bucket if primary bucket belongs to a different project', async () => {
+      let callCount = 0;
+      mockBucket.exists.mock.mockImplementation(() => {
+        callCount++;
+        return Promise.resolve([callCount === 1]);
+      });
+      mockBucket.getMetadata.mock.mockImplementation(() =>
+        Promise.resolve([{ projectNumber: '999999' }])
+      );
+
+      mockStorage.createBucket.mock.mockImplementation((name) =>
+        Promise.resolve([{ name }])
+      );
+
+      const result = await storageApi.ensureStorageBucketExists(
+        'test-project',
+        'test-bucket',
+        'us-central1',
+        'token'
+      );
+
+      assert.ok(result.name.startsWith('test-bucket-'));
+      assert.notStrictEqual(result.name, 'test-bucket');
+      assert.strictEqual(mockStorage.createBucket.mock.callCount(), 1);
+    });
+
+    it('should fall back to randomized bucket and preserve labels if exists check throws 403 (bucket squatting)', async () => {
+      let callCount = 0;
+      mockBucket.exists.mock.mockImplementation(() => {
+        callCount++;
+        if (callCount === 1) {
+          return Promise.reject({ code: 403 });
+        }
+        return Promise.resolve([false]);
+      });
+      mockBucket.getMetadata.mock.mockImplementation(() =>
+        Promise.reject({ code: 403 })
+      );
+
+      mockStorage.createBucket.mock.mockImplementation((name, options) =>
+        Promise.resolve([{ name, options }])
+      );
+
+      const labels = { app: 'my-app' };
+      const result = await storageApi.ensureStorageBucketExists(
+        'test-project',
+        'test-bucket',
+        'us-central1',
+        'token',
+        labels
+      );
+
+      assert.ok(result.name.startsWith('test-bucket-'));
+      assert.notStrictEqual(result.name, 'test-bucket');
+      assert.strictEqual(mockStorage.createBucket.mock.callCount(), 1);
+      const call = mockStorage.createBucket.mock.calls[0];
+      assert.deepStrictEqual(call.arguments[1], {
+        location: 'us-central1',
+        metadata: { labels: labels },
+      });
+    });
+
+    it('should preserve labels when falling back to randomized bucket due to ownership mismatch', async () => {
+      let callCount = 0;
+      mockBucket.exists.mock.mockImplementation(() => {
+        callCount++;
+        return Promise.resolve([callCount === 1]);
+      });
+      mockBucket.getMetadata.mock.mockImplementation(() =>
+        Promise.resolve([{ projectNumber: '999999' }])
+      );
+
+      mockStorage.createBucket.mock.mockImplementation((name, options) =>
+        Promise.resolve([{ name, options }])
+      );
+
+      const labels = { app: 'my-app' };
+      const result = await storageApi.ensureStorageBucketExists(
+        'test-project',
+        'test-bucket',
+        'us-central1',
+        'token',
+        labels
+      );
+
+      assert.ok(result.name.startsWith('test-bucket-'));
+      assert.notStrictEqual(result.name, 'test-bucket');
+      assert.strictEqual(mockStorage.createBucket.mock.callCount(), 1);
+      const call = mockStorage.createBucket.mock.calls[0];
+      assert.deepStrictEqual(call.arguments[1], {
+        location: 'us-central1',
+        metadata: { labels: labels },
+      });
+    });
+
+    it('should preserve labels when falling back to randomized bucket due to createBucket already exists error', async () => {
+      mockBucket.exists.mock.mockImplementation(() => Promise.resolve([false]));
+
+      let createCallCount = 0;
+      mockStorage.createBucket.mock.mockImplementation((name, options) => {
+        createCallCount++;
+        if (createCallCount === 1) {
+          return Promise.reject(
+            new Error('The requested bucket name already exists')
+          );
+        }
+        return Promise.resolve([{ name, options }]);
+      });
+
+      const labels = { tier: 'frontend' };
+      const result = await storageApi.ensureStorageBucketExists(
+        'test-project',
+        'test-bucket',
+        'us-central1',
+        'token',
+        labels
+      );
+
+      assert.ok(result.name.startsWith('test-bucket-'));
+      assert.notStrictEqual(result.name, 'test-bucket');
+      assert.strictEqual(mockStorage.createBucket.mock.callCount(), 2);
+      const secondCall = mockStorage.createBucket.mock.calls[1];
+      assert.deepStrictEqual(secondCall.arguments[1], {
+        location: 'us-central1',
+        metadata: { labels: labels },
+      });
+    });
+
+    it('should rethrow error if exists check throws non-403 error', async () => {
+      mockBucket.exists.mock.mockImplementation(() =>
+        Promise.reject(new Error('Network failure'))
+      );
+
+      await assert.rejects(async () => {
+        await storageApi.ensureStorageBucketExists(
+          'test-project',
+          'test-bucket',
+          'us-central1',
+          'token'
+        );
+      }, /Network failure/);
+    });
+
+    it('should throw security error if fallback bucket also fails project ownership check', async () => {
+      mockBucket.exists.mock.mockImplementation(() => Promise.resolve([true]));
+      mockBucket.getMetadata.mock.mockImplementation(() =>
+        Promise.resolve([{ projectNumber: '999999' }])
+      );
+
+      await assert.rejects(async () => {
+        await storageApi.ensureStorageBucketExists(
+          'test-project',
+          'test-bucket',
+          'us-central1',
+          'token',
+          undefined,
+          true
+        );
+      }, /Security Error: Fallback bucket test-bucket belongs to project number 999999/);
+    });
+  });
+});