@marcusrbrown/infra 0.13.0 → 0.13.2

package/src/commands/vpn/deploy.ts

@@ -1,143 +0,0 @@
-import type {goke} from 'goke'
-
-import {z} from 'zod'
-
-declare const process: {
-  env: Record<string, string | undefined>
-  exitCode?: number
-}
-
-const REPO = 'marcusrbrown/infra'
-const WORKFLOW_NAME = 'Deploy VPN'
-const WORKFLOW_URL = 'https://github.com/marcusrbrown/infra/actions/workflows/deploy-vpn.yaml'
-
-type CliInstance = ReturnType<typeof goke>
-
-// ─── Env helpers ─────────────────────────────────────────────────────────────
-
-export function getVpnDeployEnv(): Record<string, string> {
-  const path = process.env.PATH
-  const home = process.env.HOME
-  const sshAuthSock = process.env.SSH_AUTH_SOCK
-
-  if (!path) {
-    throw new Error('PATH is required for local deploy')
-  }
-
-  if (!home) {
-    throw new Error('HOME is required for local deploy')
-  }
-
-  if (!sshAuthSock) {
-    throw new Error('SSH_AUTH_SOCK is required for local deploy. Start ssh-agent and load your deploy key first.')
-  }
-
-  return {
-    PATH: path,
-    HOME: home,
-    SSH_AUTH_SOCK: sshAuthSock,
-    VPN_HOST: process.env.VPN_HOST ?? '',
-  }
-}
-
-export function validateVpnRemotePreconditions(): void {
-  if (!Bun.which('gh')) {
-    throw new Error('gh CLI is required for remote deploy. Install gh and run `gh auth login`.')
-  }
-}
-
-// ─── Command registration ─────────────────────────────────────────────────────
-
-export function registerVpnDeploy(cli: CliInstance): void {
-  cli
-    .command(
-      'vpn deploy',
-      'Deploy the VPN. Default mode triggers the GitHub Deploy VPN workflow, while --local runs apps/vpn deploy directly with Bun.',
-    )
-    .option(
-      '--local',
-      z
-        .boolean()
-        .default(false)
-        .describe('Run local deployment with Bun using apps/vpn instead of triggering GitHub Actions.'),
-    )
-    .option(
-      '--dry-run',
-      z
-        .boolean()
-        .default(false)
-        .describe(
-          'Validate deploy prerequisites and print planned actions without executing local deploy or dispatching workflow.',
-        ),
-    )
-    .option(
-      '--force-server-key',
-      z
-        .boolean()
-        .default(false)
-        .describe(
-          'Force regeneration of the server WireGuard keypair. WARNING: invalidates all existing client configs.',
-        ),
-    )
-    .example('# Trigger remote GitHub Actions deploy (default mode)')
-    .example('infra vpn deploy')
-    .example('# Validate local deploy preconditions and planned command')
-    .example('infra vpn deploy --local --dry-run')
-    .example('# Run local deploy with explicit SSH agent context')
-    .example('infra vpn deploy --local')
-    .action(async options => {
-      if (options.local) {
-        const command = [
-          'bun',
-          'run',
-          '--cwd',
-          'apps/vpn',
-          'deploy',
-          ...(options.forceServerKey ? ['--force-server-key'] : []),
-        ]
-
-        if (options.dryRun) {
-          console.log('Dry run: local vpn deploy')
-          console.log(`- command: ${command.join(' ')}`)
-          return
-        }
-
-        const env = getVpnDeployEnv()
-
-        const child = Bun.spawn(command, {
-          env,
-          stdout: 'inherit',
-          stderr: 'inherit',
-        })
-
-        const exitCode = await child.exited
-        if (exitCode !== 0) {
-          throw new Error(`Local deploy failed with exit code ${exitCode}`)
-        }
-
-        return
-      }
-
-      validateVpnRemotePreconditions()
-
-      if (options.dryRun) {
-        console.log('Dry run: remote vpn deploy')
-        console.log(`- command: gh workflow run "${WORKFLOW_NAME}" --repo ${REPO}`)
-        console.log(`- workflow URL: ${WORKFLOW_URL}`)
-        return
-      }
-
-      const child = Bun.spawn(['gh', 'workflow', 'run', WORKFLOW_NAME, '--repo', REPO], {
-        stdout: 'inherit',
-        stderr: 'inherit',
-      })
-
-      const exitCode = await child.exited
-      if (exitCode !== 0) {
-        throw new Error(`Failed to trigger "${WORKFLOW_NAME}" workflow (exit code ${exitCode})`)
-      }
-
-      console.log(`Workflow triggered: ${WORKFLOW_URL}`)
-      console.log('Approve the vpn environment deployment in GitHub Actions to continue.')
-    })
-}

package/src/commands/vpn/host.test.ts

@@ -1,89 +0,0 @@
-import {describe, expect, it} from 'bun:test'
-
-import {validateVpnHost} from './host'
-
-// ─── validateVpnHost ──────────────────────────────────────────────────────────
-
-describe('validateVpnHost', () => {
-  // ── Valid inputs ────────────────────────────────────────────────────────────
-
-  it('accepts a standard FQDN', () => {
-    expect(() => validateVpnHost('vpn.example.com')).not.toThrow()
-    expect(validateVpnHost('vpn.example.com')).toBe('vpn.example.com')
-  })
-
-  it('accepts localhost', () => {
-    expect(() => validateVpnHost('localhost')).not.toThrow()
-  })
-
-  it('accepts an IPv4 address', () => {
-    expect(() => validateVpnHost('1.2.3.4')).not.toThrow()
-  })
-
-  it('accepts a single-character hostname', () => {
-    expect(() => validateVpnHost('a')).not.toThrow()
-  })
-
-  it('accepts a hostname with hyphens', () => {
-    expect(() => validateVpnHost('my-vpn.prod.example.com')).not.toThrow()
-  })
-
-  // ── Injection attacks ───────────────────────────────────────────────────────
-
-  it('rejects a leading-hyphen value (ProxyCommand injection vector)', () => {
-    expect(() => validateVpnHost('-oProxyCommand=evil')).toThrow('Invalid VPN_HOST')
-  })
-
-  it('rejects a value with shell metacharacters (semicolon)', () => {
-    expect(() => validateVpnHost('vpn.example.com;rm -rf')).toThrow('Invalid VPN_HOST')
-  })
-
-  it('rejects a value with shell metacharacters (backtick)', () => {
-    expect(() => validateVpnHost('vpn.example.com`id`')).toThrow('Invalid VPN_HOST')
-  })
-
-  it('rejects a value with spaces', () => {
-    expect(() => validateVpnHost('vpn example.com')).toThrow('Invalid VPN_HOST')
-  })
-
-  it('rejects a value with an at-sign', () => {
-    expect(() => validateVpnHost('user@vpn.example.com')).toThrow('Invalid VPN_HOST')
-  })
-
-  // ── Empty / blank ───────────────────────────────────────────────────────────
-
-  it('rejects an empty string', () => {
-    expect(() => validateVpnHost('')).toThrow('Invalid VPN_HOST')
-  })
-
-  // ── Error message sanitization ──────────────────────────────────────────────
-
-  it('omits the rejected value entirely from the error message', () => {
-    const longMalicious = `-oProxyCommand=${'A'.repeat(100)}`
-    let message = ''
-    try {
-      validateVpnHost(longMalicious)
-    } catch (error) {
-      message = error instanceof Error ? error.message : String(error)
-    }
-    // The value is never echoed (it may be a misdirected secret) — only the constraint is shown.
-    expect(message).toContain('Invalid VPN_HOST')
-    expect(message).not.toContain('ProxyCommand')
-    expect(message).not.toContain('AAAA')
-  })
-
-  // ── Secret value redaction ───────────────────────────────────────────────────
-
-  it('does not echo the rejected value in the error message', () => {
-    const secretValue = 'AWS_SECRET_KEY=AKIA1234567890EXAMPLE'
-    let message = ''
-    try {
-      validateVpnHost(secretValue)
-    } catch (error) {
-      message = error instanceof Error ? error.message : String(error)
-    }
-    expect(message).toContain('Invalid VPN_HOST')
-    expect(message).not.toContain('AKIA1234567890EXAMPLE')
-    expect(message).not.toContain('AWS_SECRET_KEY')
-  })
-})

package/src/commands/vpn/host.ts

@@ -1,36 +0,0 @@
-// ─── VPN CLI host validation ──────────────────────────────────────────────────
-//
-// Validates VPN_HOST values before they are passed as ssh argv arguments.
-// A value starting with `-` would be interpreted by ssh as an option flag,
-// enabling ProxyCommand injection and local code execution.
-//
-// This is the CLI-side validator. The deploy-side validator lives at
-// apps/vpn/src/host.ts. Both enforce the same rules.
-
-const VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i
-
-/**
- * Validates a candidate VPN_HOST value against a strict hostname allowlist.
- *
- * Accepts: hostnames, FQDNs, IPv4 addresses, `localhost`.
- * Rejects: empty strings, values starting with `-`, and anything containing
- * characters outside `[A-Za-z0-9.-]`.
- *
- * @throws {Error} when empty or not a valid hostname. The rejected value is
- *   never included in the message (it may be a misdirected secret).
- * @returns The validated host string (unchanged).
- */
-export function validateVpnHost(host: string): string {
-  if (!host) {
-    throw new Error('Invalid VPN_HOST: value is empty')
-  }
-
-  if (!VALID_HOST_RE.test(host)) {
-    // Do NOT echo the value — it may be a secret that was redirected via --key
-    throw new Error(
-      `Invalid VPN_HOST: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`,
-    )
-  }
-
-  return host
-}

package/src/commands/vpn/index.ts

@@ -1,15 +0,0 @@
-import type {goke} from 'goke'
-
-import {registerVpnClient} from './client'
-import {registerVpnDeploy} from './deploy'
-import {registerVpnLogs} from './logs'
-import {registerVpnStatus} from './status'
-
-export {getVpnStatusSummary} from './shared'
-
-export function registerVpnCommands(cli: ReturnType<typeof goke>): void {
-  registerVpnStatus(cli)
-  registerVpnDeploy(cli)
-  registerVpnLogs(cli)
-  registerVpnClient(cli)
-}

package/src/commands/vpn/logs.test.ts

@@ -1,234 +0,0 @@
-import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
-
-import {streamVpnLogs} from './logs'
-
-// ─── SpawnFn type ─────────────────────────────────────────────────────────────
-
-type SpawnFn = (
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
-) => {
-  exited: Promise<number>
-}
-
-function makeNeverSpawn(): SpawnFn {
-  return () => {
-    throw new Error('spawn should not have been called')
-  }
-}
-
-function makeSpawnOk(): SpawnFn {
-  return (_cmd, _opts) => ({exited: Promise.resolve(0)})
-}
-
-// ─── streamVpnLogs — host validation (SEC1) ───────────────────────────────────
-
-describe('streamVpnLogs — host validation (SEC1)', () => {
-  it('rejects a leading-hyphen host and does not invoke ssh', async () => {
-    delete process.env.CI
-
-    await expect(
-      streamVpnLogs({host: '-oProxyCommand=evil', tail: 100, allowCi: false}, makeNeverSpawn()),
-    ).rejects.toThrow('Invalid VPN_HOST')
-  })
-
-  it('rejects a host with shell metacharacters and does not invoke ssh', async () => {
-    delete process.env.CI
-
-    await expect(
-      streamVpnLogs({host: 'vpn.example.com;rm -rf', tail: 100, allowCi: false}, makeNeverSpawn()),
-    ).rejects.toThrow('Invalid VPN_HOST')
-  })
-
-  it('rejects an empty host and does not invoke ssh', async () => {
-    delete process.env.CI
-
-    await expect(streamVpnLogs({host: '', tail: 100, allowCi: false}, makeNeverSpawn())).rejects.toThrow(
-      'Invalid VPN_HOST',
-    )
-  })
-
-  it('accepts a valid FQDN and invokes ssh normally', async () => {
-    delete process.env.CI
-
-    const result = await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, makeSpawnOk())
-
-    expect(result.refused).toBe(false)
-  })
-
-  it('accepts localhost as a valid host', async () => {
-    delete process.env.CI
-
-    const result = await streamVpnLogs({host: 'localhost', tail: 100, allowCi: false}, makeSpawnOk())
-
-    expect(result.refused).toBe(false)
-  })
-
-  it('accepts an IPv4 address as a valid host', async () => {
-    delete process.env.CI
-
-    const result = await streamVpnLogs({host: '1.2.3.4', tail: 100, allowCi: false}, makeSpawnOk())
-
-    expect(result.refused).toBe(false)
-  })
-})
-
-// ─── CI guard ────────────────────────────────────────────────────────────────
-
-describe('CI guard', () => {
-  let originalCI: string | undefined
-
-  beforeEach(() => {
-    originalCI = process.env.CI
-  })
-
-  afterEach(() => {
-    if (originalCI === undefined) {
-      delete process.env.CI
-    } else {
-      process.env.CI = originalCI
-    }
-  })
-
-  it('refuses to stream logs in CI without --allow-ci', async () => {
-    process.env.CI = 'true'
-
-    const messages: string[] = []
-    const result = await streamVpnLogs(
-      {host: 'vpn.example.com', tail: 100, allowCi: false},
-      makeNeverSpawn(),
-      (msg: string) => {
-        messages.push(msg)
-      },
-    )
-
-    expect(result.refused).toBe(true)
-    expect(messages.some(m => m.includes('--allow-ci'))).toBe(true)
-  })
-
-  it('streams logs in CI when --allow-ci is set, printing stderr warning first', async () => {
-    process.env.CI = 'true'
-
-    const warnings: string[] = []
-    const result = await streamVpnLogs(
-      {host: 'vpn.example.com', tail: 100, allowCi: true},
-      makeSpawnOk(),
-      undefined,
-      (msg: string) => {
-        warnings.push(msg)
-      },
-    )
-
-    expect(result.refused).toBe(false)
-    expect(warnings.some(w => w.includes('sensitive'))).toBe(true)
-  })
-
-  it('streams logs in non-CI context, printing stderr warning first', async () => {
-    delete process.env.CI
-
-    const warnings: string[] = []
-    const result = await streamVpnLogs(
-      {host: 'vpn.example.com', tail: 100, allowCi: false},
-      makeSpawnOk(),
-      undefined,
-      (msg: string) => {
-        warnings.push(msg)
-      },
-    )
-
-    expect(result.refused).toBe(false)
-    expect(warnings.some(w => w.includes('sensitive'))).toBe(true)
-  })
-})
-
-// ─── SSH user + privilege contract ───────────────────────────────────────────
-
-describe('streamVpnLogs — SSH user + privilege contract', () => {
-  it('SSH user contract: connects as ubuntu@host, not root@host', async () => {
-    delete process.env.CI
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
-
-    const destination = capturedCmd.find(arg => arg.includes('@'))
-    expect(destination).toBeDefined()
-    expect(destination).toMatch(/^ubuntu@/)
-    expect(destination).not.toMatch(/^root@/)
-  })
-
-  it('privilege contract: journalctl is prefixed with sudo', async () => {
-    delete process.env.CI
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
-
-    // The last element of the SSH command is the remote command to run
-    const remoteCmd = capturedCmd.at(-1)
-    expect(remoteCmd).toMatch(/^sudo journalctl/)
-  })
-})
-
-// ─── --tail forwarding ───────────────────────────────────────────────────────
-
-describe('tail forwarding', () => {
-  it('forwards --tail N to journalctl command', async () => {
-    delete process.env.CI
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamVpnLogs({host: 'vpn.example.com', tail: 25, allowCi: false}, spawnCapture)
-
-    expect(capturedCmd.join(' ')).toContain('25')
-  })
-})
-
-// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
-
-describe('streamVpnLogs — SSH command includes UserKnownHostsFile', () => {
-  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
-    delete process.env.CI
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
-
-    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
-    expect(knownHostsIdx).toBeGreaterThan(-1)
-    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
-    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
-  })
-
-  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
-    delete process.env.CI
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
-
-    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
-    expect(strictIdx).toBeGreaterThan(-1)
-    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
-  })
-})

package/src/commands/vpn/logs.ts

@@ -1,136 +0,0 @@
-import type {goke} from 'goke'
-
-import {z} from 'zod'
-
-import {buildKnownHostsArgs} from '../../lib/known-hosts'
-import {validateVpnHost} from './host'
-
-declare const process: {
-  env: Record<string, string | undefined>
-  exitCode?: number
-  stderr: {write: (msg: string) => void}
-}
-
-const SENSITIVE_WARNING =
-  'Warning: Logs may contain peer IP addresses, handshake data, or other sensitive VPN information. Treat output as sensitive; do not capture in shared logs or chat.'
-
-// ─── Injectable spawn type ────────────────────────────────────────────────────
-
-export type LogsSpawnFn = (
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
-) => {
-  exited: Promise<number>
-}
-
-export interface StreamVpnLogsOpts {
-  host: string
-  tail: number
-  allowCi: boolean
-}
-
-export interface StreamVpnLogsResult {
-  refused: boolean
-  exitCode?: number
-}
-
-function defaultLogsSpawn(
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
-): {exited: Promise<number>} {
-  return Bun.spawn(cmd, opts)
-}
-
-export async function streamVpnLogs(
-  opts: StreamVpnLogsOpts,
-  spawn: LogsSpawnFn = defaultLogsSpawn,
-  printOut?: (msg: string) => void,
-  printErr?: (msg: string) => void,
-): Promise<StreamVpnLogsResult> {
-  const isCI = process.env.CI === 'true'
-
-  if (isCI && !opts.allowCi) {
-    const msg = 'Refusing to stream logs in CI without --allow-ci. Logs may contain sensitive VPN data.'
-    if (printOut) {
-      printOut(msg)
-    } else {
-      console.log(msg)
-    }
-
-    return {refused: true}
-  }
-
-  // Warn on every run — logs are sensitive regardless of context
-  if (printErr) {
-    printErr(SENSITIVE_WARNING)
-  } else {
-    console.error(SENSITIVE_WARNING)
-  }
-
-  validateVpnHost(opts.host)
-
-  const sshCmd = [
-    'ssh',
-    '-o',
-    'BatchMode=yes',
-    '-o',
-    'StrictHostKeyChecking=yes',
-    ...buildKnownHostsArgs(),
-    `ubuntu@${opts.host}`,
-    `sudo journalctl -u wg-quick@wg0 --no-pager -n ${opts.tail}`,
-  ]
-
-  const env: Record<string, string> = {
-    PATH: process.env.PATH ?? '/usr/bin:/bin',
-    HOME: process.env.HOME ?? '/tmp',
-    ...(process.env.SSH_AUTH_SOCK ? {SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK} : {}),
-  }
-
-  const child = spawn(sshCmd, {env, stdout: 'inherit', stderr: 'inherit'})
-  const exitCode = await child.exited
-
-  return {refused: false, exitCode}
-}
-
-// ─── Command registration ─────────────────────────────────────────────────────
-
-export function registerVpnLogs(cli: ReturnType<typeof goke>): void {
-  cli
-    .command('vpn logs', 'Stream WireGuard VPN logs via SSH and journalctl.')
-    .option('--tail [n]', z.number().default(100).describe('Number of log lines to tail.'))
-    .option(
-      '--allow-ci',
-      z
-        .boolean()
-        .default(false)
-        .describe('Allow log streaming in CI environments. Logs may contain sensitive VPN data.'),
-    )
-    .option(
-      '--key [key]',
-      z.string().describe('Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.'),
-    )
-    .action(async options => {
-      const hostEnvKey = options.key ?? 'VPN_HOST'
-      const host = process.env[hostEnvKey]
-
-      if (!host) {
-        console.error(`VPN host not set. Export ${hostEnvKey} or pass --key <env-name> pointing to a set variable.`)
-        process.exitCode = 1
-        return
-      }
-
-      const tail = typeof options.tail === 'number' ? options.tail : 100
-      const allowCi = options.allowCi === true
-
-      const result = await streamVpnLogs({host, tail, allowCi})
-
-      if (result.refused) {
-        process.exitCode = 1
-        return
-      }
-
-      if (result.exitCode !== 0) {
-        process.exitCode = result.exitCode ?? 1
-      }
-    })
-}