@indigoai-us/hq-cli 5.47.9 → 5.47.11

package/src/commands/secrets.test.ts

@@ -7,6 +7,10 @@ import {
   vi,
   type MockInstance,
 } from "vitest";
+import { createHash } from "node:crypto";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 
 vi.mock("../utils/cognito-session.js", async (importOriginal) => {
   const original = (await importOriginal()) as Record<string, unknown>;
@@ -45,21 +49,31 @@ vi.mock("../utils/secrets-cache.js", async (importOriginal) => {
   };
 });
 
+vi.mock("node:child_process", () => ({
+  spawn: vi.fn(() => ({
+    on: vi.fn(),
+  })),
+}));
+
 import { Command } from "commander";
 import { registerSecretsCommand, loadRevealedSecrets } from "./secrets.js";
+import { spawn } from "node:child_process";
 import { getEntityUid, vaultApiFetch } from "../utils/vault-api.js";
 import { readCache, writeCache } from "../utils/secrets-cache.js";
 
 let logSpy: MockInstance<typeof console.log>;
 let errSpy: MockInstance<typeof console.error>;
+let tempDir: string;
 
 beforeEach(() => {
   vi.clearAllMocks();
+  tempDir = mkdtempSync(join(tmpdir(), "hq-secrets-test-"));
   logSpy = vi.spyOn(console, "log").mockImplementation(() => undefined);
   errSpy = vi.spyOn(console, "error").mockImplementation(() => undefined);
 });
 
 afterEach(() => {
+  rmSync(tempDir, { recursive: true, force: true });
   vi.restoreAllMocks();
 });
 
@@ -74,6 +88,13 @@ function buildProgram(): Command {
   return program;
 }
 
+function jsonRes(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
 // HQ-4H: `hq secrets exists` — HEAD existence probe with shell-chaining exit
 // codes (0=present, 1=absent, 2=error). process.exit is spied so the command's
 // terminal exit doesn't kill the runner; we assert the code it requested.
@@ -201,8 +222,8 @@ describe("secrets exec/env batch-load (HQ-4H)", () => {
     vi.mocked(vaultApiFetch).mockResolvedValueOnce(
       jsonRes({
         secrets: [
-          { name: "MY_KEY", value: "v1" },
-          { name: "OTHER", value: "v2" },
+          { name: "MY_KEY", value: "v1", cacheTtlMs: 300000 },
+          { name: "OTHER", value: "v2", cacheTtlMs: 300000 },
         ],
         errors: [],
       }),
@@ -224,8 +245,26 @@ describe("secrets exec/env batch-load (HQ-4H)", () => {
     });
     // The crux: the capturing GET route is never touched.
     expect(vaultApiFetch).not.toHaveBeenCalledWith(CAPTURING_GET);
-    expect(writeCache).toHaveBeenCalledWith("prs_alice", "MY_KEY", "v1");
-    expect(writeCache).toHaveBeenCalledWith("prs_alice", "OTHER", "v2");
+    expect(writeCache).toHaveBeenCalledWith("prs_alice", "MY_KEY", "v1", 300000);
+    expect(writeCache).toHaveBeenCalledWith("prs_alice", "OTHER", "v2", 300000);
+  });
+
+  it("controlled secrets with cacheTtlMs=0 skip the disk cache", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [
+          { name: "LOCKED", value: "v1", cacheTtlMs: 0 },
+        ],
+        errors: [],
+      }),
+    );
+
+    const out = await loadRevealedSecrets("test-token", "prs_alice", [
+      "LOCKED",
+    ]);
+
+    expect(out.get("LOCKED")).toBe("v1");
+    expect(writeCache).not.toHaveBeenCalled();
   });
 
   it("a missing key fails cleanly WITHOUT hitting the GET-404 capture path", async () => {
@@ -286,3 +325,354 @@ describe("secrets exec/env batch-load (HQ-4H)", () => {
     ).rejects.toThrow("Failed to batch-load secrets: Internal server error");
   });
 });
+
+describe("secrets script usage", () => {
+  it("exec hashes the script and sends usage metadata on /load", async () => {
+    const scriptPath = join(tempDir, "exec-script.sh");
+    const scriptBody = "#!/usr/bin/env bash\necho exec\n";
+    writeFileSync(scriptPath, scriptBody);
+    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [{ name: "MY_KEY", value: "v1", cacheTtlMs: 300000 }],
+        errors: [],
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "exec",
+      "--only",
+      "MY_KEY",
+      "--script",
+      scriptPath,
+      "--",
+      "env",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/load",
+      method: "POST",
+      body: {
+        names: ["MY_KEY"],
+        usage: {
+          channel: "exec",
+          script: {
+            scriptId: scriptPath,
+            path: scriptPath,
+            sha256: expectedSha,
+            attestationLevel: "self-asserted-hash",
+          },
+        },
+      },
+    });
+    expect(spawn).toHaveBeenCalledWith(
+      "env",
+      [],
+      expect.objectContaining({
+        stdio: "inherit",
+        env: expect.objectContaining({ MY_KEY: "v1" }),
+      }),
+    );
+  });
+
+  it("env hashes the script and sends usage metadata on /load", async () => {
+    const scriptPath = join(tempDir, "env-script.sh");
+    const scriptBody = "#!/usr/bin/env bash\necho env\n";
+    writeFileSync(scriptPath, scriptBody);
+    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [{ name: "MY_KEY", value: "v1", cacheTtlMs: 300000 }],
+        errors: [],
+      }),
+    );
+
+    const stdoutWriteSpy = vi
+      .spyOn(process.stdout, "write")
+      .mockImplementation(() => true);
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "env",
+      "--only",
+      "MY_KEY",
+      "--script",
+      scriptPath,
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/load",
+      method: "POST",
+      body: {
+        names: ["MY_KEY"],
+        usage: {
+          channel: "env",
+          script: {
+            scriptId: scriptPath,
+            path: scriptPath,
+            sha256: expectedSha,
+            attestationLevel: "self-asserted-hash",
+          },
+        },
+      },
+    });
+    expect(stdoutWriteSpy).toHaveBeenCalledWith("export MY_KEY='v1'\n");
+  });
+});
+
+describe("secrets reveal and policy controls", () => {
+  it("get --reveal prints the backend denial message from a controlled secret", async () => {
+    const exitSpy = vi.spyOn(process, "exit").mockImplementation((() => {
+      throw new Error("__exit__");
+    }) as never);
+    vi.mocked(vaultApiFetch)
+      .mockResolvedValueOnce(
+        jsonRes({
+          secret: {
+            name: "LOCKED",
+            companyUid: "prs_alice",
+            tier: "nuclear",
+            scriptLock: { mode: "enforced" },
+          },
+        }),
+      )
+      .mockResolvedValueOnce(
+        jsonRes(
+          {
+            code: "reveal_disabled",
+            message: "Reveal is disabled for this secret.",
+          },
+          403,
+        ),
+      );
+
+    const program = buildProgram();
+    await expect(
+      program.parseAsync([
+        "node",
+        "hq",
+        "secrets",
+        "get",
+        "LOCKED",
+        "--reveal",
+      ]),
+    ).rejects.toThrow("__exit__");
+
+    expect(exitSpy.mock.calls[0]?.[0]).toBe(1);
+    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
+    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
+    expect(errSpy.mock.calls.some((call) =>
+      call.some((arg) => String(arg).includes("Reveal is disabled for this secret.")),
+    )).toBe(true);
+  });
+
+  it("policy get hits the policy endpoint and renders tier/lock", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        policy: {
+          path: "LOCKED",
+          tier: "nuclear",
+          scriptLock: { mode: "enforced" },
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "policy",
+      "get",
+      "LOCKED",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/policy",
+      query: { path: "LOCKED" },
+    });
+    expect(logSpy).toHaveBeenCalledWith(expect.stringContaining("Policy: LOCKED"));
+    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
+    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
+  });
+
+  it("list renders tier and script lock columns", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        secrets: [
+          {
+            name: "LOCKED",
+            permission: "read",
+            tier: "nuclear",
+            scriptLock: { mode: "enforced" },
+            lastModifiedDate: "2026-06-18T00:00:00.000Z",
+          },
+        ],
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync(["node", "hq", "secrets", "list"]);
+
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("SCRIPT LOCK"),
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("nuclear"),
+    );
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("enforced"),
+    );
+  });
+
+  it("policy set hits the policy endpoint with tier and script lock", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        policy: {
+          path: "LOCKED",
+          tier: "nuclear",
+          scriptLock: { mode: "enforced" },
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "policy",
+      "set",
+      "LOCKED",
+      "--tier",
+      "nuclear",
+      "--lock-script",
+      "enforce",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/policy",
+      method: "PUT",
+      body: {
+        path: "LOCKED",
+        tier: "nuclear",
+        scriptLock: { mode: "enforced" },
+      },
+    });
+    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
+    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
+  });
+
+  it("script approve hashes the local file and hits the approval endpoint", async () => {
+    const scriptPath = join(tempDir, "approved.sh");
+    const scriptBody = "#!/usr/bin/env bash\necho approved\n";
+    writeFileSync(scriptPath, scriptBody);
+    const expectedSha = createHash("sha256").update(scriptBody).digest("hex");
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "script",
+      "approve",
+      "LOCKED",
+      "--id",
+      "deploy-script",
+      "--script",
+      scriptPath,
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/policy/scripts",
+      method: "POST",
+      body: {
+        path: "LOCKED",
+        scriptId: "deploy-script",
+        scriptPath,
+        sha256: expectedSha,
+        attestationLevel: "self-asserted-hash",
+      },
+    });
+  });
+
+  it("script revoke hits the revoke endpoint", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(jsonRes({ ok: true }));
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "script",
+      "revoke",
+      "LOCKED",
+      "--id",
+      "deploy-script",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/policy/scripts",
+      method: "DELETE",
+      body: {
+        path: "LOCKED",
+        scriptId: "deploy-script",
+      },
+    });
+  });
+
+  it("script list renders the current policy and approved scripts", async () => {
+    vi.mocked(vaultApiFetch).mockResolvedValueOnce(
+      jsonRes({
+        policy: {
+          path: "LOCKED",
+          tier: "nuclear",
+          scriptLock: { mode: "enforced" },
+          scripts: [
+            {
+              scriptId: "deploy-script",
+              scriptPath: "/tmp/deploy.sh",
+              sha256: "abc123",
+              attestationLevel: "self-asserted-hash",
+            },
+          ],
+        },
+      }),
+    );
+
+    const program = buildProgram();
+    await program.parseAsync([
+      "node",
+      "hq",
+      "secrets",
+      "script",
+      "list",
+      "LOCKED",
+    ]);
+
+    expect(vaultApiFetch).toHaveBeenCalledWith({
+      token: "test-token",
+      path: "/secrets/prs_alice/policy",
+      query: { path: "LOCKED" },
+    });
+    expect(logSpy).toHaveBeenCalledWith("  Tier:          nuclear");
+    expect(logSpy).toHaveBeenCalledWith("  Script Lock:   enforced");
+    expect(logSpy).toHaveBeenCalledWith(
+      expect.stringContaining("deploy-script"),
+    );
+  });
+});