@marcusrbrown/infra 0.13.0 → 0.13.2

package/src/commands/vpn/shared.test.ts

@@ -1,454 +0,0 @@
-import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
-
-import {getVpnStatusSummary, parseWgShowOutput, type WgShowResult} from './shared'
-
-// ─── parseWgShowOutput ────────────────────────────────────────────────────────
-
-describe('parseWgShowOutput', () => {
-  it('parses wg show output with interface and peers', () => {
-    const output = [
-      'interface: wg0',
-      '  public key: abc123pubkey==',
-      '  private key: (hidden)',
-      '  listening port: 51820',
-      '',
-      'peer: PEER1PUBKEY==',
-      '  endpoint: 10.0.0.1:12345',
-      '  allowed ips: 10.8.0.2/32',
-      '  latest handshake: 1 minute, 30 seconds ago',
-      '  transfer: 1.23 MiB received, 4.56 MiB sent',
-    ].join('\n')
-
-    const result = parseWgShowOutput(output)
-
-    expect(result.interfaceUp).toBe(true)
-    expect(result.serverPublicKey).toBe('abc123pubkey==')
-    expect(result.peerCount).toBe(1)
-  })
-
-  it('parses wg show output with no peers', () => {
-    const output = [
-      'interface: wg0',
-      '  public key: serverpubkey==',
-      '  private key: (hidden)',
-      '  listening port: 51820',
-    ].join('\n')
-
-    const result = parseWgShowOutput(output)
-
-    expect(result.interfaceUp).toBe(true)
-    expect(result.serverPublicKey).toBe('serverpubkey==')
-    expect(result.peerCount).toBe(0)
-  })
-
-  it('parses wg show output with multiple peers', () => {
-    const output = [
-      'interface: wg0',
-      '  public key: serverpubkey==',
-      '  private key: (hidden)',
-      '  listening port: 51820',
-      '',
-      'peer: PEER1PUBKEY==',
-      '  allowed ips: 10.8.0.2/32',
-      '',
-      'peer: PEER2PUBKEY==',
-      '  allowed ips: 10.8.0.3/32',
-      '',
-      'peer: PEER3PUBKEY==',
-      '  allowed ips: 10.8.0.4/32',
-    ].join('\n')
-
-    const result = parseWgShowOutput(output)
-
-    expect(result.interfaceUp).toBe(true)
-    expect(result.peerCount).toBe(3)
-  })
-
-  it('returns interfaceUp=false for empty output', () => {
-    const result = parseWgShowOutput('')
-
-    expect(result.interfaceUp).toBe(false)
-    expect(result.serverPublicKey).toBeUndefined()
-    expect(result.peerCount).toBe(0)
-  })
-
-  it('returns interfaceUp=false when output has no interface: line', () => {
-    const result = parseWgShowOutput('some random output without interface line')
-
-    expect(result.interfaceUp).toBe(false)
-  })
-})
-
-// ─── getVpnStatusSummary — SSH-only (no AWS client) ──────────────────────────
-
-type SpawnFn = (
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
-) => {
-  stdout: ReadableStream<Uint8Array>
-  stderr: ReadableStream<Uint8Array>
-  exited: Promise<number>
-}
-
-function makeSpawnOk(output: string): SpawnFn {
-  return (_cmd, _opts) => {
-    const encoder = new TextEncoder()
-    return {
-      stdout: new ReadableStream({
-        start(controller) {
-          controller.enqueue(encoder.encode(output))
-          controller.close()
-        },
-      }),
-      stderr: new ReadableStream({
-        start(controller) {
-          controller.close()
-        },
-      }),
-      exited: Promise.resolve(0),
-    }
-  }
-}
-
-function makeSpawnError(message: string): SpawnFn {
-  return (_cmd, _opts) => {
-    const encoder = new TextEncoder()
-    return {
-      stdout: new ReadableStream({
-        start(controller) {
-          controller.close()
-        },
-      }),
-      stderr: new ReadableStream({
-        start(controller) {
-          controller.enqueue(encoder.encode(message))
-          controller.close()
-        },
-      }),
-      exited: Promise.resolve(1),
-    }
-  }
-}
-
-describe('getVpnStatusSummary', () => {
-  it('returns a structured summary with app=vpn when wg show succeeds', async () => {
-    const wgOutput = [
-      'interface: wg0',
-      '  public key: serverpubkey==',
-      '  private key: (hidden)',
-      '  listening port: 51820',
-      '',
-      'peer: PEER1PUBKEY==',
-      '  allowed ips: 10.8.0.2/32',
-    ].join('\n')
-
-    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnOk(wgOutput))
-
-    expect(summary.app).toBe('vpn')
-    expect(summary.http).toContain('OK')
-  })
-
-  it('includes the server public key in the http field', async () => {
-    const wgOutput = [
-      'interface: wg0',
-      '  public key: MYPUBLICKEY==',
-      '  private key: (hidden)',
-      '  listening port: 51820',
-    ].join('\n')
-
-    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnOk(wgOutput))
-
-    expect(summary.http).toContain('MYPUBLICKEY==')
-  })
-
-  it('returns error summary when SSH fails', async () => {
-    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnError('Connection refused'))
-
-    expect(summary.app).toBe('vpn')
-    expect(summary.http).toContain('ERROR')
-  })
-
-  it('rejects an invalid host before spawning SSH', async () => {
-    const neverSpawn: SpawnFn = () => {
-      throw new Error('spawn must not be called for an invalid host')
-    }
-
-    await expect(getVpnStatusSummary('-oProxyCommand=evil', neverSpawn)).rejects.toThrow('Invalid VPN_HOST')
-  })
-
-  it('rejects a host with shell metacharacters before spawning SSH', async () => {
-    const neverSpawn: SpawnFn = () => {
-      throw new Error('spawn must not be called for an invalid host')
-    }
-
-    await expect(getVpnStatusSummary('vpn.example.com;rm -rf', neverSpawn)).rejects.toThrow('Invalid VPN_HOST')
-  })
-
-  it('does NOT import or construct a Lightsail/AWS client (SSH-only)', async () => {
-    // This test verifies the module source does not reference AWS SDK.
-    // We import the module and check it doesn't have AWS client construction.
-    // The real assertion is structural: getVpnStatusSummary only uses SSH.
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    const summary = await getVpnStatusSummary('1.2.3.4', makeSpawnOk(wgOutput))
-
-    // If this resolves without AWS credentials, it's SSH-only.
-    expect(summary.app).toBe('vpn')
-  })
-
-  it('SSH user contract: connects as ubuntu@host, not root@host', async () => {
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    let capturedCmd: string[] = []
-
-    const capturingSpawn: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      const encoder = new TextEncoder()
-      return {
-        stdout: new ReadableStream({
-          start(controller) {
-            controller.enqueue(encoder.encode(wgOutput))
-            controller.close()
-          },
-        }),
-        stderr: new ReadableStream({
-          start(c) {
-            c.close()
-          },
-        }),
-        exited: Promise.resolve(0),
-      }
-    }
-
-    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
-
-    const destination = capturedCmd.find(arg => arg.includes('@'))
-    expect(destination).toBeDefined()
-    expect(destination).toMatch(/^ubuntu@/)
-    expect(destination).not.toMatch(/^root@/)
-  })
-
-  it('privilege contract: wg show wg0 is prefixed with sudo', async () => {
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    let capturedCmd: string[] = []
-
-    const capturingSpawn: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      const encoder = new TextEncoder()
-      return {
-        stdout: new ReadableStream({
-          start(controller) {
-            controller.enqueue(encoder.encode(wgOutput))
-            controller.close()
-          },
-        }),
-        stderr: new ReadableStream({
-          start(c) {
-            c.close()
-          },
-        }),
-        exited: Promise.resolve(0),
-      }
-    }
-
-    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
-
-    // The last element of the SSH command is the remote command to run
-    const remoteCmd = capturedCmd.at(-1)
-    expect(remoteCmd).toMatch(/^sudo wg show wg0/)
-  })
-
-  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    let capturedCmd: string[] = []
-
-    const capturingSpawn: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      const encoder = new TextEncoder()
-      return {
-        stdout: new ReadableStream({
-          start(controller) {
-            controller.enqueue(encoder.encode(wgOutput))
-            controller.close()
-          },
-        }),
-        stderr: new ReadableStream({
-          start(c) {
-            c.close()
-          },
-        }),
-        exited: Promise.resolve(0),
-      }
-    }
-
-    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
-
-    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
-    expect(knownHostsIdx).toBeGreaterThan(-1)
-    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
-    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
-  })
-
-  it('does not weaken StrictHostKeyChecking', async () => {
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    let capturedCmd: string[] = []
-
-    const capturingSpawn: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      const encoder = new TextEncoder()
-      return {
-        stdout: new ReadableStream({
-          start(controller) {
-            controller.enqueue(encoder.encode(wgOutput))
-            controller.close()
-          },
-        }),
-        stderr: new ReadableStream({
-          start(c) {
-            c.close()
-          },
-        }),
-        exited: Promise.resolve(0),
-      }
-    }
-
-    await getVpnStatusSummary('1.2.3.4', capturingSpawn)
-
-    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
-    expect(strictIdx).toBeGreaterThan(-1)
-    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
-  })
-})
-
-// ─── WgShowResult type export check ──────────────────────────────────────────
-
-describe('WgShowResult type', () => {
-  it('has the expected shape', () => {
-    const result: WgShowResult = {
-      interfaceUp: true,
-      serverPublicKey: 'key==',
-      peerCount: 2,
-    }
-    expect(result.interfaceUp).toBe(true)
-    expect(result.serverPublicKey).toBe('key==')
-    expect(result.peerCount).toBe(2)
-  })
-})
-
-// ─── SSH identity injection (VPN_SSH_KEY) ─────────────────────────────────────
-
-describe('getVpnWgStatus — SSH identity injection', () => {
-  let originalEnv: Record<string, string | undefined>
-
-  beforeEach(() => {
-    originalEnv = {VPN_SSH_KEY: process.env.VPN_SSH_KEY}
-  })
-
-  afterEach(() => {
-    if (originalEnv.VPN_SSH_KEY === undefined) {
-      delete process.env.VPN_SSH_KEY
-    } else {
-      process.env.VPN_SSH_KEY = originalEnv.VPN_SSH_KEY
-    }
-  })
-
-  it('includes -i <path> and IdentitiesOnly=yes in ssh argv when VPN_SSH_KEY is set', async () => {
-    const {getVpnWgStatus} = await import('./shared')
-    process.env.VPN_SSH_KEY = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    let capturedCmd: string[] = []
-    const capturingSpawn: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      const enc = new TextEncoder()
-      return {
-        stdout: new ReadableStream({
-          start(c) {
-            c.enqueue(enc.encode(wgOutput))
-            c.close()
-          },
-        }),
-        stderr: new ReadableStream({
-          start(c) {
-            c.close()
-          },
-        }),
-        exited: Promise.resolve(0),
-      }
-    }
-
-    await getVpnWgStatus('1.2.3.4', capturingSpawn)
-
-    const iIdx = capturedCmd.indexOf('-i')
-    expect(iIdx).toBeGreaterThan(-1)
-    expect(capturedCmd[iIdx + 1]).toBeTruthy()
-
-    const identitiesOnlyIdx = capturedCmd.indexOf('IdentitiesOnly=yes')
-    expect(identitiesOnlyIdx).toBeGreaterThan(-1)
-  })
-
-  it('does not include -i or IdentitiesOnly=yes when VPN_SSH_KEY is absent', async () => {
-    const {getVpnWgStatus} = await import('./shared')
-    delete process.env.VPN_SSH_KEY
-
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    let capturedCmd: string[] = []
-    const capturingSpawn: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      const enc = new TextEncoder()
-      return {
-        stdout: new ReadableStream({
-          start(c) {
-            c.enqueue(enc.encode(wgOutput))
-            c.close()
-          },
-        }),
-        stderr: new ReadableStream({
-          start(c) {
-            c.close()
-          },
-        }),
-        exited: Promise.resolve(0),
-      }
-    }
-
-    await getVpnWgStatus('1.2.3.4', capturingSpawn)
-
-    expect(capturedCmd.indexOf('-i')).toBe(-1)
-    expect(capturedCmd.indexOf('IdentitiesOnly=yes')).toBe(-1)
-  })
-
-  it('cleans up the temp key file after the SSH command completes', async () => {
-    const {getVpnWgStatus} = await import('./shared')
-    const {statSync} = await import('node:fs')
-    process.env.VPN_SSH_KEY = '-----BEGIN OPENSSH PRIVATE KEY-----\nfakekey\n-----END OPENSSH PRIVATE KEY-----\n'
-
-    const wgOutput = 'interface: wg0\n  public key: key==\n  private key: (hidden)\n  listening port: 51820\n'
-    let capturedKeyPath: string | undefined
-    const capturingSpawn: SpawnFn = (cmd, _opts) => {
-      const iIdx = cmd.indexOf('-i')
-      if (iIdx !== -1) capturedKeyPath = cmd[iIdx + 1]
-      const enc = new TextEncoder()
-      return {
-        stdout: new ReadableStream({
-          start(c) {
-            c.enqueue(enc.encode(wgOutput))
-            c.close()
-          },
-        }),
-        stderr: new ReadableStream({
-          start(c) {
-            c.close()
-          },
-        }),
-        exited: Promise.resolve(0),
-      }
-    }
-
-    await getVpnWgStatus('1.2.3.4', capturingSpawn)
-
-    expect(capturedKeyPath).toBeTruthy()
-    const keyPath = capturedKeyPath
-    if (keyPath) {
-      expect(() => statSync(keyPath)).toThrow()
-    }
-  })
-})

package/src/commands/vpn/shared.ts

@@ -1,170 +0,0 @@
-import type {StatusSummary} from '../status'
-
-import {buildKnownHostsArgs} from '../../lib/known-hosts'
-import {redactHost} from '../../lib/redact'
-import {buildIdentityArgs} from '../../lib/ssh-identity'
-import {validateVpnHost} from './host'
-
-declare const process: {
-  env: Record<string, string | undefined>
-}
-
-// ─── Types ────────────────────────────────────────────────────────────────────
-
-export interface WgShowResult {
-  interfaceUp: boolean
-  serverPublicKey?: string
-  peerCount: number
-}
-
-export type SpawnFn = (
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
-) => {
-  stdout: ReadableStream<Uint8Array>
-  stderr: ReadableStream<Uint8Array>
-  exited: Promise<number>
-}
-
-// ─── Pure helpers ─────────────────────────────────────────────────────────────
-
-/**
- * Parse `wg show wg0` output into a structured result.
- *
- * Pure function — no IO.
- */
-export function parseWgShowOutput(output: string): WgShowResult {
-  const trimmed = output.trim()
-
-  if (!trimmed || !trimmed.includes('interface:')) {
-    return {interfaceUp: false, peerCount: 0}
-  }
-
-  // Extract server public key from "  public key: <key>" line
-  // Use a possessive-style pattern to avoid backtracking: match leading spaces,
-  // then the literal label, then capture the key (non-space chars).
-  const pubKeyMatch = /^ +public key: +(\S+)/m.exec(trimmed)
-  const serverPublicKey = pubKeyMatch?.[1]?.trim()
-
-  // Count peer blocks
-  const peerCount = (trimmed.match(/^peer:/gm) ?? []).length
-
-  return {
-    interfaceUp: true,
-    serverPublicKey,
-    peerCount,
-  }
-}
-
-// ─── SSH-backed status fetch ──────────────────────────────────────────────────
-
-function defaultSpawn(
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'pipe'; stderr: 'pipe'},
-): ReturnType<SpawnFn> {
-  return Bun.spawn(cmd, opts) as ReturnType<SpawnFn>
-}
-
-export interface VpnStatusResult {
-  ok: boolean
-  wgShow?: WgShowResult
-  error?: string
-}
-
-/**
- * Fetch VPN status via SSH + `wg show wg0`.
- *
- * SSH-only — never calls the Lightsail/AWS API.
- * Validates host before constructing any SSH argv.
- */
-export async function getVpnWgStatus(host: string, spawn: SpawnFn = defaultSpawn): Promise<VpnStatusResult> {
-  validateVpnHost(host)
-
-  const knownHostsArgs = buildKnownHostsArgs()
-  const {args: identityArgs, cleanup} = buildIdentityArgs(process.env.VPN_SSH_KEY)
-
-  const sshCmd = [
-    'ssh',
-    '-o',
-    'BatchMode=yes',
-    '-o',
-    'StrictHostKeyChecking=yes',
-    ...knownHostsArgs,
-    ...identityArgs,
-    `ubuntu@${host}`,
-    'sudo wg show wg0',
-  ]
-
-  const env: Record<string, string> = {
-    PATH: process.env.PATH ?? '/usr/bin:/bin',
-    HOME: process.env.HOME ?? '/tmp',
-    ...(process.env.SSH_AUTH_SOCK ? {SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK} : {}),
-  }
-
-  let stdoutText: string
-  let stderrText: string
-  let exitCode: number
-
-  try {
-    const child = spawn(sshCmd, {env, stdout: 'pipe', stderr: 'pipe'})
-    ;[stdoutText, stderrText, exitCode] = await Promise.all([
-      new Response(child.stdout).text(),
-      new Response(child.stderr).text(),
-      child.exited,
-    ])
-  } finally {
-    cleanup()
-  }
-
-  if (exitCode !== 0) {
-    const redacted = redactHost(stderrText.trim(), host) || 'unknown error'
-    return {
-      ok: false,
-      error: `SSH command failed (exit ${exitCode}): ${redacted}`,
-    }
-  }
-
-  const wgShow = parseWgShowOutput(stdoutText)
-
-  return {ok: wgShow.interfaceUp, wgShow}
-}
-
-// ─── Unified status aggregator export ────────────────────────────────────────
-
-/**
- * Get a structured VPN status summary for the unified status dashboard.
- *
- * SSH + `wg show` only — never calls the Lightsail/AWS API.
- * The MCP runtime needs no AWS credentials to call this function.
- *
- * @param host - The VPN box hostname or IP (validated before SSH).
- * @param spawn - Injectable spawn function (defaults to Bun.spawn).
- */
-export async function getVpnStatusSummary(host: string, spawn?: SpawnFn): Promise<StatusSummary> {
-  const result = await getVpnWgStatus(host, spawn)
-
-  if (!result.ok || !result.wgShow) {
-    const errorMsg = result.error ?? 'WireGuard interface not up'
-    return {
-      app: 'vpn',
-      http: `ERROR: ${errorMsg}`,
-      lastDeploy: '—',
-      version: '—',
-      contentHash: '—',
-      usageStats: '—',
-    }
-  }
-
-  const {wgShow} = result
-  const pubKeyInfo = wgShow.serverPublicKey ? ` pubkey:${wgShow.serverPublicKey}` : ''
-  const peerInfo = `${wgShow.peerCount} peer(s)`
-
-  return {
-    app: 'vpn',
-    http: `OK: wg0 up,${pubKeyInfo} ${peerInfo}`,
-    lastDeploy: '—',
-    version: '—',
-    contentHash: '—',
-    usageStats: '—',
-  }
-}