@indigoai-us/hq-cloud 6.15.97 → 6.15.99

package/dist/bin/sync-runner.test.js

@@ -11,6 +11,7 @@ import * as fs from "fs";
 import * as os from "os";
 import * as path from "path";
 import { runRunner, runRunnerWithLoop, resolveDeletePolicy, resolveSkipPersonal, resolveSkipCompanies, selectObjectIOFactory, routeChangeToTarget, buildTargetedPushArgv, resolvePullScope, readPinnedPrefixes, SESSIONS_SCOPE_PREFIX, defaultCollectTelemetry, AUTH_REQUIRED_PASS_EXIT, } from "./sync-runner.js";
+import { AUTH_WAIT_INITIAL_RECHECK_MS, AUTH_WAIT_RESUME_MESSAGE, AUTH_WAIT_START_MESSAGE, AUTH_WAIT_STEADY_RECHECK_MS, } from "./sync-runner-auth-wait.js";
 import { PresignObjectIO, S3SdkObjectIO } from "../object-io.js";
 import { setBandwidthGovernorForTesting } from "../bandwidth.js";
 import { FakeClock, TreeWatcher, } from "../watcher.js";
@@ -25,7 +26,7 @@ import { getStateStoreSnapshotRecoveryCountForTest, resetStateStoreSnapshotRecov
 import { PARTIAL_SYNC_EXIT } from "../lib/exit-codes.js";
 import { isCoveredByAny } from "../prefix-coalesce.js";
 import { VaultAuthError, VaultNotFoundError } from "../vault-client.js";
-import { CognitoRefreshError } from "../cognito-auth.js";
+import { CognitoAuthError, CognitoRefreshError } from "../cognito-auth.js";
 import { reconcileCompanyManifest, } from "../manifest-reconcile.js";
 import yaml from "js-yaml";
 // ---------------------------------------------------------------------------
@@ -323,6 +324,20 @@ describe("auth", () => {
         ]);
         expect(deps.stdout.events()).toEqual([]);
     });
+    it("honors authRequiredExitCode when token fetch fails", async () => {
+        const deps = makeDeps({
+            getAccessToken: vi.fn().mockRejectedValue(new Error("no cached tokens")),
+            authRequiredExitCode: 18,
+        });
+        const code = await runRunner(["--companies"], deps);
+        expect(code).toBe(18);
+        expect(deps.stderr.events()).toEqual([
+            {
+                type: "auth-error",
+                message: "Your HQ session needs a quick refresh. Sign in again to keep sync moving.",
+            },
+        ]);
+    });
     it("keeps the watch pass retryable when initial refresh fails transiently", async () => {
         const deps = makeDeps({
             getAccessToken: vi
@@ -403,6 +418,123 @@ describe("auth", () => {
     });
 });
 // ---------------------------------------------------------------------------
+// mid-pass identity refusal (HQ-DESKTOP-5S)
+//
+// The up-front token resolves fine; the Cognito refusal surfaces LATER — while
+// planning the personal target, or mid-fanout when the pull leg re-resolves the
+// bearer through the getter. A terminal refusal (reauth required) must clear the
+// session and emit exactly one auth-error, exiting 0. A retryable refusal must
+// exit TRANSIENT_NETWORK_EXIT (75) without clearing the session, and NEITHER may
+// ever be recorded as a per-file/per-company error (which would exit 2).
+// ---------------------------------------------------------------------------
+describe("mid-pass identity refusal", () => {
+    const REAUTH = "Your HQ session needs a quick refresh. Sign in again to keep sync moving.";
+    const personalEntity = {
+        uid: "ent_person_1",
+        type: "person",
+        bucketName: "hq-vault-personal-1",
+        status: "active",
+    };
+    it("planning: a terminal refusal clears the session and exits 0 with one auth-error", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.reject(new CognitoRefreshError(REAUTH, true, 401, "fp-planning")),
+            }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        expect(deps.clearSession).toHaveBeenCalledTimes(1);
+        expect(deps.clearSession).toHaveBeenCalledWith("fp-planning");
+        expect(deps.stderr.events()).toEqual([
+            { type: "auth-error", message: REAUTH },
+        ]);
+    });
+    it("planning: a retryable refusal exits TRANSIENT_NETWORK_EXIT and keeps the session", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                listPersons: () => Promise.reject(new CognitoRefreshError("Cognito refresh failed (503): service unavailable", false, 503, "fp-planning-retry")),
+            }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(TRANSIENT_NETWORK_EXIT);
+        expect(deps.clearSession).not.toHaveBeenCalled();
+        // Never an auth-error: a retryable blip must not sign the user out.
+        expect(deps.stderr.events().some((e) => e.type === "auth-error")).toBe(false);
+    });
+    it("mid-fanout: a terminal refusal from the pull leg clears the session and exits 0", async () => {
+        const refusal = new CognitoRefreshError(REAUTH, true, 401, "fp-fanout");
+        const deps = makeDeps({
+            sync: vi.fn().mockRejectedValue(refusal),
+            createVaultClient: () => makeVaultStub({ listPersons: () => Promise.resolve([personalEntity]) }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        expect(deps.clearSession).toHaveBeenCalledTimes(1);
+        expect(deps.clearSession).toHaveBeenCalledWith("fp-fanout");
+        const stderr = deps.stderr.events();
+        expect(stderr.filter((e) => e.type === "auth-error")).toEqual([
+            { type: "auth-error", message: REAUTH },
+        ]);
+        // The refusal is NEVER fanned out into a per-file/per-company error event.
+        expect(stderr.some((e) => e.type === "error")).toBe(false);
+    });
+    it("mid-fanout: a bare CognitoAuthError from the pull leg is terminal too", async () => {
+        const refusal = new CognitoAuthError("interactive login required");
+        const deps = makeDeps({
+            sync: vi.fn().mockRejectedValue(refusal),
+            createVaultClient: () => makeVaultStub({ listPersons: () => Promise.resolve([personalEntity]) }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(0);
+        expect(deps.clearSession).toHaveBeenCalledTimes(1);
+        expect(deps.stderr.events().filter((e) => e.type === "auth-error")).toEqual([{ type: "auth-error", message: REAUTH }]);
+        expect(deps.stderr.events().some((e) => e.type === "error")).toBe(false);
+    });
+    it("mid-fanout: a retryable refusal exits TRANSIENT_NETWORK_EXIT, keeps the session, and never exits 2", async () => {
+        const refusal = new CognitoRefreshError("Cognito refresh failed (503): service unavailable", false, 503, "fp-fanout-retry");
+        const deps = makeDeps({
+            sync: vi.fn().mockRejectedValue(refusal),
+            createVaultClient: () => makeVaultStub({ listPersons: () => Promise.resolve([personalEntity]) }),
+        });
+        const code = await runRunner(["--personal"], deps);
+        expect(code).toBe(TRANSIENT_NETWORK_EXIT);
+        expect(code).not.toBe(PARTIAL_SYNC_EXIT);
+        expect(deps.clearSession).not.toHaveBeenCalled();
+        const stderr = deps.stderr.events();
+        expect(stderr.some((e) => e.type === "auth-error")).toBe(false);
+        // A session-level refusal must not be recorded as a company error (exit 2).
+        expect(stderr.some((e) => e.type === "error")).toBe(false);
+    });
+    it("company planning: a terminal refusal from entity lookup clears the session and exits 0", async () => {
+        // buildFanoutPlan resolves each company via entity.get through the bearer
+        // getter; a refusal there must propagate to the run-level boundary, not be
+        // swallowed into a deferred/best-effort target.
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                memberships: [{ companyUid: "cmp_x" }],
+                entityGet: () => Promise.reject(new CognitoRefreshError(REAUTH, true, 401, "fp-plan")),
+            }),
+        });
+        const code = await runRunner(["--companies"], deps);
+        expect(code).toBe(0);
+        expect(deps.clearSession).toHaveBeenCalledTimes(1);
+        expect(deps.clearSession).toHaveBeenCalledWith("fp-plan");
+        expect(deps.stderr.events().filter((e) => e.type === "auth-error")).toEqual([{ type: "auth-error", message: REAUTH }]);
+    });
+    it("company planning: a retryable refusal from entity lookup exits 75 and keeps the session", async () => {
+        const deps = makeDeps({
+            createVaultClient: () => makeVaultStub({
+                memberships: [{ companyUid: "cmp_x" }],
+                entityGet: () => Promise.reject(new CognitoRefreshError("Cognito refresh failed (503): service unavailable", false, 503)),
+            }),
+        });
+        const code = await runRunner(["--companies"], deps);
+        expect(code).toBe(TRANSIENT_NETWORK_EXIT);
+        expect(deps.clearSession).not.toHaveBeenCalled();
+        expect(deps.stderr.events().some((e) => e.type === "auth-error")).toBe(false);
+    });
+});
+// ---------------------------------------------------------------------------
 // memberships retry (3x with backoff, then abort)
 // ---------------------------------------------------------------------------
 //
@@ -6814,21 +6946,49 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         expect(code).toBe(1);
         expect(watcher.disposed).toBe(false);
     });
-    it("an exit-0 auth-required pass stops the unattended loop without reporting a crash", async () => {
+    it("an auth-required watch pass parks in-process instead of exiting", async () => {
         const watcher = makeWatcherStub();
         const runPass = vi.fn().mockResolvedValue(AUTH_REQUIRED_PASS_EXIT);
-        const sleep = vi.fn().mockResolvedValue(undefined);
-        const code = await runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+        const delays = [];
+        const waiters = [];
+        const sleep = (ms) => {
+            delays.push(ms);
+            return new Promise((resolve) => {
+                waiters.push(resolve);
+            });
+        };
+        const authWaitLog = vi.fn();
+        const getAccessToken = vi.fn(async () => {
+            throw new Error("invalid_grant");
+        });
+        let triggerShutdown = () => { };
+        let settled;
+        const loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
             runPass,
             sleep,
+            authWaitLog,
+            getAccessToken,
             clock: new FakeClock(),
             createWatcher: () => watcher,
-            onShutdownSignal: () => () => { },
+            startEventSync: vi.fn().mockResolvedValue(null),
+            onShutdownSignal: (handler) => {
+                triggerShutdown = handler;
+                return () => { };
+            },
+        }).then((code) => {
+            settled = code;
+            return code;
         });
-        expect(code).toBe(0);
+        await flushLoopMicrotasks(30);
+        expect(settled).toBeUndefined();
         expect(runPass).toHaveBeenCalledTimes(1);
-        expect(sleep).not.toHaveBeenCalled();
-        expect(watcher.disposed).toBe(false);
+        expect(authWaitLog).toHaveBeenCalledWith(AUTH_WAIT_START_MESSAGE);
+        expect(delays).toEqual([AUTH_WAIT_INITIAL_RECHECK_MS]);
+        expect(getAccessToken).not.toHaveBeenCalled();
+        triggerShutdown();
+        await expect(loop).resolves.toBe(0);
+        expect(runPass).toHaveBeenCalledTimes(1);
+        expect(getAccessToken).not.toHaveBeenCalled();
     });
     it("a TRANSIENT_NETWORK_EXIT poll pass does NOT surface as a crash — the loop retries (HQ-SYNC-1W)", async () => {
         // A transient offline blip must keep the watcher alive: the loop logs and
@@ -6985,6 +7145,165 @@ describe("runRunnerWithLoop — event-push wiring", () => {
         await loop;
     });
 });
+describe("runRunnerWithLoop — watch-mode auth-wait", () => {
+    function makePendingSleep() {
+        const delays = [];
+        const waiters = [];
+        return {
+            delays,
+            sleep: (ms) => {
+                delays.push(ms);
+                return new Promise((resolve) => {
+                    waiters.push(resolve);
+                });
+            },
+            tick() {
+                const resolve = waiters.shift();
+                if (!resolve)
+                    throw new Error("auth-wait sleep was not pending");
+                resolve();
+            },
+        };
+    }
+    async function waitUntil(pred, label) {
+        for (let i = 0; i < 200; i++) {
+            if (pred())
+                return;
+            await Promise.resolve();
+            if (i % 10 === 9) {
+                await new Promise((resolve) => setImmediate(resolve));
+            }
+        }
+        throw new Error(`timed out waiting for ${label}`);
+    }
+    it("one-shot auth failure still exits with authRequiredExitCode and never waits", async () => {
+        const clock = makePendingSleep();
+        const authWaitLog = vi.fn();
+        const runPass = vi.fn().mockResolvedValue(AUTH_REQUIRED_PASS_EXIT);
+        const startEventSync = vi.fn().mockResolvedValue(null);
+        const code = await runRunnerWithLoop(["--companies", "--hq-root", "/tmp/hq"], {
+            runPass,
+            sleep: clock.sleep,
+            authWaitLog,
+            startEventSync,
+            getAccessToken: async () => {
+                throw new Error("invalid_grant");
+            },
+            onShutdownSignal: () => () => { },
+        });
+        expect(code).toBe(AUTH_REQUIRED_PASS_EXIT);
+        expect(runPass).toHaveBeenCalledTimes(1);
+        expect(authWaitLog).not.toHaveBeenCalled();
+        expect(clock.delays).toEqual([]);
+        expect(startEventSync).not.toHaveBeenCalled();
+    });
+    it("watch-mode auth failure waits in-process, rechecks on the injected cadence, and resumes a full startup", async () => {
+        const previousCoordinator = process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+        const previousEventSync = process.env.HQ_SYNC_EVENT_SYNC;
+        process.env.HQ_SYNC_PARALLEL_COORDINATOR = "0";
+        delete process.env.HQ_SYNC_EVENT_SYNC;
+        const clock = makePendingSleep();
+        const authWaitLog = vi.fn();
+        const startEventSync = vi.fn().mockResolvedValue(null);
+        const listMyMemberships = vi.fn(async () => []);
+        let sessionValid = false;
+        const getAccessToken = vi.fn(async () => {
+            if (!sessionValid)
+                throw new Error("invalid_grant");
+            return "tok";
+        });
+        const runnerDeps = makeDeps({
+            getAccessToken,
+            createVaultClient: () => ({
+                ...makeVaultStub(),
+                listMyMemberships,
+            }),
+        });
+        const runPass = vi.fn(async (argv) => runRunner(argv, {
+            ...runnerDeps,
+            authRequiredExitCode: AUTH_REQUIRED_PASS_EXIT,
+        }));
+        let triggerShutdown = () => { };
+        let settled;
+        let loop;
+        try {
+            loop = runRunnerWithLoop(["--companies", "--watch", "--event-push", "--hq-root", "/tmp/hq"], {
+                runPass,
+                sleep: clock.sleep,
+                authWaitLog,
+                getAccessToken,
+                startEventSync,
+                createWatcher: () => makeWatcherStub(),
+                createReceiver: () => ({
+                    start: async () => { },
+                    dispose: async () => { },
+                    connected: false,
+                }),
+                onShutdownSignal: (handler) => {
+                    triggerShutdown = handler;
+                    return () => { };
+                },
+            }).then((code) => {
+                settled = code;
+                return code;
+            });
+            await waitUntil(() => clock.delays.length === 1 && authWaitLog.mock.calls.length >= 1, "auth-wait start");
+            expect(settled).toBeUndefined();
+            expect(runPass).toHaveBeenCalledTimes(1);
+            expect(listMyMemberships).not.toHaveBeenCalled();
+            expect(startEventSync).not.toHaveBeenCalled();
+            expect(getAccessToken).toHaveBeenCalledTimes(1);
+            expect(authWaitLog).toHaveBeenCalledWith(AUTH_WAIT_START_MESSAGE);
+            expect(clock.delays).toEqual([AUTH_WAIT_INITIAL_RECHECK_MS]);
+            expect(runnerDeps.stderr.events()).toEqual([
+                {
+                    type: "auth-error",
+                    message: "Your HQ session needs a quick refresh. Sign in again to keep sync moving.",
+                },
+            ]);
+            clock.tick();
+            await waitUntil(() => clock.delays.length === 2 && getAccessToken.mock.calls.length >= 2, "steady auth-wait recheck");
+            expect(settled).toBeUndefined();
+            expect(runPass).toHaveBeenCalledTimes(1);
+            expect(listMyMemberships).not.toHaveBeenCalled();
+            expect(startEventSync).not.toHaveBeenCalled();
+            expect(getAccessToken).toHaveBeenCalledTimes(2);
+            expect(clock.delays).toEqual([
+                AUTH_WAIT_INITIAL_RECHECK_MS,
+                AUTH_WAIT_STEADY_RECHECK_MS,
+            ]);
+            sessionValid = true;
+            clock.tick();
+            await waitUntil(() => runPass.mock.calls.length >= 2 &&
+                listMyMemberships.mock.calls.length >= 1 &&
+                startEventSync.mock.calls.length >= 1, "resumed watch startup");
+            expect(settled).toBeUndefined();
+            expect(authWaitLog).toHaveBeenCalledWith(AUTH_WAIT_RESUME_MESSAGE);
+            expect(runPass).toHaveBeenCalledTimes(2);
+            expect(listMyMemberships).toHaveBeenCalled();
+            expect(startEventSync).toHaveBeenCalledTimes(1);
+            triggerShutdown();
+            await expect(loop).resolves.toBe(0);
+        }
+        finally {
+            triggerShutdown();
+            if (loop)
+                await loop.catch(() => undefined);
+            if (previousCoordinator === undefined) {
+                delete process.env.HQ_SYNC_PARALLEL_COORDINATOR;
+            }
+            else {
+                process.env.HQ_SYNC_PARALLEL_COORDINATOR = previousCoordinator;
+            }
+            if (previousEventSync === undefined) {
+                delete process.env.HQ_SYNC_EVENT_SYNC;
+            }
+            else {
+                process.env.HQ_SYNC_EVENT_SYNC = previousEventSync;
+            }
+        }
+    });
+});
 describe("runRunnerWithLoop — U58 realtime scheduler guard", () => {
     it("feeds a watcher-originated V2 drain through the same single-flight guard as the poll", async () => {
         const watcher = makeWatcherStub();