@homeflare/alchemy 0.1.0

package/src/talos/values.test.ts

@@ -0,0 +1,80 @@
+/**
+ * Digests and kubeconfig metadata — tested because prose does not fail a build.
+ *
+ * ⚠️ FIXTURES ONLY. No credentials, no live hosts, no talosctl.
+ *
+ * ⛔ THE BASE64 FIELDS ARE BUILT AT RUN TIME, NOT WRITTEN OUT, AND THAT IS NOT COSMETIC. A literal
+ *   `client-key-data: <base64>` is a credential to every scanner alive: gitleaks refused this
+ *   commit over `Y2xpZW50LWtleQ==`, which decodes to the words "client key". It was right to. A
+ *   fixture that has to be allowlisted teaches the next person that this scanner cries wolf, and
+ *   the allowlist entry outlives the fixture — so the fixture is built from plain words instead
+ *   and the scanner keeps its credibility for the day the hit is real.
+ */
+import assert from 'node:assert/strict';
+import { describe, it } from 'node:test';
+import { configDigest, kubeconfigMetadata, resolveConfigPath, sha256 } from './values.ts';
+
+/** Plain words, base64-encoded here rather than in the source. See the ⛔ above. */
+const b64 = (words: string) => Buffer.from(words).toString('base64');
+
+const FIXTURE_KUBECONFIG = `
+apiVersion: v1
+kind: Config
+clusters:
+  - name: hf-tb4
+    cluster:
+      server: https://10.20.10.50:6443
+      certificate-authority-data: ${b64('not a ca')}
+contexts:
+  - name: admin@hf-tb4
+    context:
+      cluster: hf-tb4
+      user: admin@hf-tb4
+users:
+  - name: admin@hf-tb4
+    user:
+      client-certificate-data: ${b64('not a certificate')}
+      client-key-data: ${b64('not a key')}
+current-context: admin@hf-tb4
+`;
+
+describe('sha256', () => {
+  it('trims trailing whitespace before hashing', () => {
+    assert.equal(sha256('abc\n'), sha256('abc'));
+    assert.notEqual(sha256(' abc'), sha256('abc'));
+  });
+});
+
+describe('configDigest', () => {
+  it('matches sha256 of canonical text', () => {
+    assert.equal(configDigest('machine:\n  type: worker\n'), sha256('machine:\n  type: worker\n'));
+  });
+});
+
+describe('kubeconfigMetadata', () => {
+  it('extracts public fields without returning PEM bytes', () => {
+    const meta = kubeconfigMetadata(FIXTURE_KUBECONFIG, 'admin@hf-tb4');
+    assert.ok(meta);
+    assert.equal(meta.endpoint, 'https://10.20.10.50:6443');
+    // ⚠️ HASHED FROM THE SAME ENCODER THE FIXTURE USES, so the assertion cannot drift from it —
+    //   and so no base64 blob has to appear in this file. See the ⛔ at the top.
+    assert.equal(meta.caFingerprint, sha256(b64('not a ca')));
+    assert.equal(meta.clientFingerprint, sha256(b64('not a certificate')));
+    // ⛔ THE POINT OF THE FAMILY: a fingerprint is not the material it fingerprints.
+    assert.ok(!JSON.stringify(meta).includes(b64('not a key')));
+  });
+
+  it('returns undefined for a missing context', () => {
+    assert.equal(kubeconfigMetadata(FIXTURE_KUBECONFIG, 'missing'), undefined);
+  });
+});
+
+describe('resolveConfigPath', () => {
+  it('passes absolute paths through', () => {
+    assert.equal(resolveConfigPath('/stack', '/etc/talos/cp.yaml'), '/etc/talos/cp.yaml');
+  });
+
+  it('joins relative paths to the stack directory', () => {
+    assert.equal(resolveConfigPath('/stack', 'configs/cp.yaml'), '/stack/configs/cp.yaml');
+  });
+});

package/src/talos/values.ts

@@ -0,0 +1,70 @@
+/**
+ * Coercions and digests for Talos resources — every function here exists because a trap does.
+ *
+ * ⚠️ NOTHING IN THIS FILE TOUCHES A LIVE CLUSTER. Digests are computed from repo files or from
+ *   kubeconfig YAML already on disk at reconcile time; tests use fixtures only.
+ */
+import { createHash } from 'node:crypto';
+
+/** Trim trailing whitespace only — leading space in YAML is meaningful. */
+export const canonicalText = (text: string) => text.trimEnd();
+
+/** SHA-256 hex digest of canonical text. Safe to persist — it is not reversible to the input. */
+export const sha256 = (text: string) =>
+  createHash('sha256').update(canonicalText(text)).digest('hex');
+
+/** Digest of a machine config file read from the repo. ⛔ Never persist the file body itself. */
+export const configDigest = (text: string) => sha256(text);
+
+type KubeconfigDoc = {
+  clusters?: {
+    cluster?: { server?: string; 'certificate-authority-data'?: string };
+    name?: string;
+  }[];
+  contexts?: { context?: { cluster?: string; user?: string }; name?: string }[];
+  users?: {
+    name?: string;
+    user?: { 'client-certificate-data'?: string; 'client-key-data'?: string };
+  }[];
+  'current-context'?: string;
+};
+
+/**
+ * Public metadata extracted from a kubeconfig file on disk.
+ *
+ * ⛔ RETURNS FINGERPRINTS ONLY. The admin kubeconfig contains a client certificate; Alchemy state
+ *   may hold the API server URL and CA/client cert digests, never the PEM bytes.
+ */
+export const kubeconfigMetadata = (
+  yamlText: string,
+  contextName: string,
+): { endpoint: string; caFingerprint: string; clientFingerprint: string } | undefined => {
+  let doc: KubeconfigDoc;
+  try {
+    doc = Bun.YAML.parse(yamlText) as KubeconfigDoc;
+  } catch {
+    return undefined;
+  }
+
+  const ctx = doc.contexts?.find((row) => row.name === contextName)?.context;
+  const clusterName = ctx?.cluster;
+  const userName = ctx?.user;
+  if (clusterName === undefined || userName === undefined) return undefined;
+
+  const cluster = doc.clusters?.find((row) => row.name === clusterName)?.cluster;
+  const user = doc.users?.find((row) => row.name === userName)?.user;
+  const endpoint = cluster?.server;
+  const ca = cluster?.['certificate-authority-data'];
+  const cert = user?.['client-certificate-data'] ?? user?.['client-key-data'];
+  if (endpoint === undefined || ca === undefined || cert === undefined) return undefined;
+
+  return {
+    caFingerprint: sha256(ca),
+    clientFingerprint: sha256(cert),
+    endpoint,
+  };
+};
+
+/** Resolve a config file path relative to the declaring stack file. */
+export const resolveConfigPath = (stackDir: string, configFile: string) =>
+  configFile.startsWith('/') ? configFile : `${stackDir}/${configFile}`;