@indigoai-us/hq-cloud 6.14.36 → 6.14.39

package/test/e2e/sync/windows-unreadable-link-leg.test.ts

@@ -0,0 +1,191 @@
+/**
+ * Artifact-level regression for the Windows EINVAL reparse-point failure.
+ *
+ * The Linux test runner cannot create the production reparse-point shape, so
+ * the fs seam makes a real symlink's readlink raise EINVAL while the actual
+ * runner → company fanout → share walk executes over a temp HQ tree.
+ */
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import * as fs from "fs";
+import * as path from "path";
+import {
+  runRunner,
+  type RunnerDeps,
+  type RunnerEvent,
+  type VaultClientSurface,
+} from "../../../src/bin/sync-runner.js";
+import { share } from "../../../src/cli/share.js";
+import type { EntityContext, EntityInfo } from "../../../src/types.js";
+import { uploadFile, uploadSymlink } from "../../../src/s3.js";
+
+vi.mock("fs", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("fs")>();
+  return { ...actual };
+});
+
+vi.mock("../../../src/s3.js", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../../../src/s3.js")>();
+  return {
+    ...actual,
+    uploadFile: vi.fn().mockResolvedValue({ etag: '"upload-etag"' }),
+    uploadSymlink: vi.fn().mockResolvedValue({ etag: '"symlink-etag"' }),
+    headRemoteFile: vi.fn().mockResolvedValue(null),
+    primeObjectTransport: vi.fn().mockResolvedValue(undefined),
+    primeUploads: vi.fn().mockResolvedValue(undefined),
+  };
+});
+
+function errnoError(code: string): NodeJS.ErrnoException {
+  const err = new Error(`${code}: invalid argument, readlink`) as NodeJS.ErrnoException;
+  err.code = code;
+  return err;
+}
+
+function makeWriter(): {
+  write: (chunk: string) => boolean;
+  events: () => RunnerEvent[];
+} {
+  let output = "";
+  return {
+    write: (chunk) => {
+      output += chunk;
+      return true;
+    },
+    events: () =>
+      output
+        .split("\n")
+        .filter(Boolean)
+        .map((line) => JSON.parse(line) as RunnerEvent),
+  };
+}
+
+let hqRoot: string;
+let stateDir: string;
+let unreadableLink: string;
+
+beforeEach(() => {
+  // Keep fixture roots inside the checkout so operator runs never create a
+  // scratch HQ tree outside the task worktree.
+  hqRoot = fs.mkdtempSync(path.join(process.cwd(), ".hqcloud-einval-e2e-"));
+  stateDir = fs.mkdtempSync(path.join(process.cwd(), ".hqcloud-einval-state-"));
+  process.env.HQ_STATE_DIR = stateDir;
+  const companyRoot = path.join(hqRoot, "companies", "acme");
+  const policiesDir = path.join(companyRoot, "policies");
+  const targetDir = path.join(hqRoot, "outside", "target");
+  fs.mkdirSync(policiesDir, { recursive: true });
+  fs.mkdirSync(targetDir, { recursive: true });
+  fs.writeFileSync(path.join(policiesDir, "safe.md"), "safe bytes");
+  fs.writeFileSync(path.join(targetDir, "must-not-upload.md"), "target bytes");
+  unreadableLink = path.join(policiesDir, "unreadable-link");
+  fs.symlinkSync(targetDir, unreadableLink, "dir");
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  fs.rmSync(hqRoot, { recursive: true, force: true });
+  fs.rmSync(stateDir, { recursive: true, force: true });
+  delete process.env.HQ_STATE_DIR;
+});
+
+describe("sync runner unreadable Windows link", () => {
+  it("keeps the leg complete and emits the offending relative path", async () => {
+    const stdout = makeWriter();
+    const stderr = makeWriter();
+    const entityContext: EntityContext = {
+      uid: "cmp_acme",
+      slug: "acme",
+      bucketName: "hq-vault-acme-test",
+      region: "us-east-1",
+      credentials: {
+        accessKeyId: "test-key",
+        secretAccessKey: "test-secret",
+        sessionToken: "test-session",
+      },
+      expiresAt: new Date(Date.now() + 15 * 60 * 1000).toISOString(),
+    };
+    const client = {
+      listMyMemberships: async () => [{ companyUid: "cmp_acme" }],
+      listMyPendingInvitesByEmail: async () => [],
+      claimPendingInvitesByEmail: async () => undefined,
+      ensureMyPersonEntity: async () => ({}) as EntityInfo,
+      entity: {
+        get: async (uid: string) => ({
+          uid,
+          type: "company",
+          slug: "acme",
+          bucketName: "hq-vault-acme-test",
+          status: "active",
+        }) as EntityInfo,
+        listByType: async () => [],
+      },
+    } as unknown as VaultClientSurface;
+    const realReadlinkSync = fs.readlinkSync;
+    const readlinkSpy = vi
+      .spyOn(fs, "readlinkSync")
+      .mockImplementation(((candidate: fs.PathLike) => {
+        if (candidate === unreadableLink) throw errnoError("EINVAL");
+        return realReadlinkSync(candidate);
+      }) as typeof fs.readlinkSync);
+    const deps: RunnerDeps = {
+      stdout,
+      stderr,
+      getAccessToken: async () => "test-access-token",
+      getIdTokenClaims: () => null,
+      createVaultClient: () => client,
+      share: async (options) => {
+        const { vaultConfig: _vaultConfig, ...shareOptions } = options;
+        return share({ ...shareOptions, entityContext });
+      },
+      reindex: () => ({ status: 0 }) as ReturnType<NonNullable<RunnerDeps["reindex"]>>,
+      qmdReindex: () => ({
+        qmdAvailable: true,
+        collectionsAdded: [],
+        pathDriftDetected: [],
+        collectionsRepaired: [],
+        updated: false,
+        embedded: false,
+        pendingDirty: false,
+        lockBusy: false,
+        timedOut: false,
+        corruptionQuarantined: false,
+        corruptionQuarantineFailed: false,
+        indexDir: null,
+      }) as ReturnType<NonNullable<RunnerDeps["qmdReindex"]>>,
+      reconcileManifest: async () => ({
+        written: false,
+        added: [],
+        updated: [],
+        skipped: [],
+      }) as Awaited<ReturnType<NonNullable<RunnerDeps["reconcileManifest"]>>>,
+      collectTelemetry: async () => undefined,
+    };
+
+    try {
+      const code = await runRunner(
+        ["--companies", "--direction", "push", "--hq-root", hqRoot],
+        deps,
+      );
+
+      expect(code).toBe(0);
+      expect(stdout.events()).toContainEqual({
+        type: "not-shipped",
+        company: "acme",
+        reason: "unreadable-link",
+        count: 1,
+        samplePaths: ["policies/unreadable-link"],
+      });
+      expect(stdout.events()).toContainEqual(
+        expect.objectContaining({
+          type: "all-complete",
+          errors: [],
+          partial: false,
+        }),
+      );
+      expect(stderr.events()).toEqual([]);
+      expect(uploadFile).toHaveBeenCalledTimes(1);
+      expect(uploadSymlink).not.toHaveBeenCalled();
+    } finally {
+      readlinkSpy.mockRestore();
+    }
+  });
+});