@marcusrbrown/infra 0.13.1 → 0.13.3

package/src/commands/gateway/host.test.ts

@@ -1,89 +0,0 @@
-import {describe, expect, it} from 'bun:test'
-
-import {validateGatewayHost} from './host'
-
-// ─── validateGatewayHost ──────────────────────────────────────────────────────
-
-describe('validateGatewayHost', () => {
-  // ── Valid inputs ────────────────────────────────────────────────────────────
-
-  it('accepts a standard FQDN', () => {
-    expect(() => validateGatewayHost('gateway.example.com')).not.toThrow()
-    expect(validateGatewayHost('gateway.example.com')).toBe('gateway.example.com')
-  })
-
-  it('accepts localhost', () => {
-    expect(() => validateGatewayHost('localhost')).not.toThrow()
-  })
-
-  it('accepts an IPv4 address', () => {
-    expect(() => validateGatewayHost('147.182.133.210')).not.toThrow()
-  })
-
-  it('accepts a single-character hostname', () => {
-    expect(() => validateGatewayHost('a')).not.toThrow()
-  })
-
-  it('accepts a hostname with hyphens', () => {
-    expect(() => validateGatewayHost('my-gateway.prod.example.com')).not.toThrow()
-  })
-
-  // ── Injection attacks ───────────────────────────────────────────────────────
-
-  it('rejects a leading-hyphen value (ProxyCommand injection vector)', () => {
-    expect(() => validateGatewayHost('-oProxyCommand=evil')).toThrow('Invalid GATEWAY_HOST')
-  })
-
-  it('rejects a value with shell metacharacters (semicolon)', () => {
-    expect(() => validateGatewayHost('gateway.example.com;rm -rf')).toThrow('Invalid GATEWAY_HOST')
-  })
-
-  it('rejects a value with shell metacharacters (backtick)', () => {
-    expect(() => validateGatewayHost('gateway.example.com`id`')).toThrow('Invalid GATEWAY_HOST')
-  })
-
-  it('rejects a value with spaces', () => {
-    expect(() => validateGatewayHost('gateway example.com')).toThrow('Invalid GATEWAY_HOST')
-  })
-
-  it('rejects a value with an at-sign', () => {
-    expect(() => validateGatewayHost('user@gateway.example.com')).toThrow('Invalid GATEWAY_HOST')
-  })
-
-  // ── Empty / blank ───────────────────────────────────────────────────────────
-
-  it('rejects an empty string', () => {
-    expect(() => validateGatewayHost('')).toThrow('Invalid GATEWAY_HOST')
-  })
-
-  // ── Error message sanitization ──────────────────────────────────────────────
-
-  it('omits the rejected value entirely from the error message', () => {
-    const longMalicious = `-oProxyCommand=${'A'.repeat(100)}`
-    let message = ''
-    try {
-      validateGatewayHost(longMalicious)
-    } catch (error) {
-      message = error instanceof Error ? error.message : String(error)
-    }
-    // The value is never echoed (it may be a misdirected secret) — only the constraint is shown.
-    expect(message).toContain('Invalid GATEWAY_HOST')
-    expect(message).not.toContain('ProxyCommand')
-    expect(message).not.toContain('AAAA')
-  })
-
-  // ── Secret value redaction ───────────────────────────────────────────────────
-
-  it('does not echo the rejected value in the error message', () => {
-    const secretValue = 'AWS_SECRET_KEY=AKIA1234567890EXAMPLE'
-    let message = ''
-    try {
-      validateGatewayHost(secretValue)
-    } catch (error) {
-      message = error instanceof Error ? error.message : String(error)
-    }
-    expect(message).toContain('Invalid GATEWAY_HOST')
-    expect(message).not.toContain('AKIA1234567890EXAMPLE')
-    expect(message).not.toContain('AWS_SECRET_KEY')
-  })
-})

package/src/commands/gateway/host.ts

@@ -1,33 +0,0 @@
-// ─── Gateway host validation ──────────────────────────────────────────────────
-//
-// Validates GATEWAY_HOST values before they are passed as ssh argv arguments.
-// A value starting with `-` would be interpreted by ssh as an option flag,
-// enabling ProxyCommand injection and local code execution.
-
-const VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i
-
-/**
- * Validates a candidate GATEWAY_HOST value against a strict hostname allowlist.
- *
- * Accepts: hostnames, FQDNs, IPv4 addresses, `localhost`.
- * Rejects: empty strings, values starting with `-`, and anything containing
- * characters outside `[A-Za-z0-9.-]`.
- *
- * @throws {Error} when empty or not a valid hostname. The rejected value is
- *   never included in the message (it may be a misdirected secret).
- * @returns The validated host string (unchanged).
- */
-export function validateGatewayHost(host: string): string {
-  if (!host) {
-    throw new Error('Invalid GATEWAY_HOST: value is empty')
-  }
-
-  if (!VALID_HOST_RE.test(host)) {
-    // Do NOT echo the value — it may be a secret that was redirected via --key
-    throw new Error(
-      `Invalid GATEWAY_HOST: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`,
-    )
-  }
-
-  return host
-}

package/src/commands/gateway/index.ts

@@ -1,17 +0,0 @@
-import type {goke} from 'goke'
-
-import {registerGatewayBackup} from './backup'
-import {registerGatewayDeploy} from './deploy'
-import {registerGatewayLogs} from './logs'
-import {registerGatewayRestore} from './restore'
-import {registerGatewayStatus} from './status'
-
-export {getGatewayStatusSummary} from './status'
-
-export function registerGatewayCommands(cli: ReturnType<typeof goke>): void {
-  registerGatewayStatus(cli)
-  registerGatewayDeploy(cli)
-  registerGatewayLogs(cli)
-  registerGatewayBackup(cli)
-  registerGatewayRestore(cli)
-}

package/src/commands/gateway/logs.test.ts

@@ -1,263 +0,0 @@
-import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
-
-import {VALID_SERVICES, validateService} from './logs'
-
-// ─── validateService ─────────────────────────────────────────────────────────
-
-describe('validateService', () => {
-  it('accepts gateway as a valid service', () => {
-    expect(() => validateService('gateway')).not.toThrow()
-  })
-
-  it('accepts workspace as a valid service', () => {
-    expect(() => validateService('workspace')).not.toThrow()
-  })
-
-  it('accepts mitmproxy as a valid service', () => {
-    expect(() => validateService('mitmproxy')).not.toThrow()
-  })
-
-  it('rejects an unknown service name with a message listing valid services', () => {
-    expect(() => validateService('frobnicator')).toThrow(VALID_SERVICES.join(', '))
-  })
-})
-
-// ─── streamGatewayLogs — host validation (SEC1) ───────────────────────────────
-
-describe('streamGatewayLogs — host validation (SEC1)', () => {
-  it('rejects a leading-hyphen host and does not invoke ssh', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const neverSpawn: SpawnFn = () => {
-      throw new Error('spawn must not be called for an invalid host')
-    }
-
-    await expect(
-      streamGatewayLogs({host: '-oProxyCommand=evil', service: 'gateway', tail: 100, allowCi: false}, neverSpawn),
-    ).rejects.toThrow('Invalid GATEWAY_HOST')
-  })
-
-  it('rejects a host with shell metacharacters and does not invoke ssh', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const neverSpawn: SpawnFn = () => {
-      throw new Error('spawn must not be called for an invalid host')
-    }
-
-    await expect(
-      streamGatewayLogs(
-        {host: 'gateway.example.com;rm -rf', service: 'gateway', tail: 100, allowCi: false},
-        neverSpawn,
-      ),
-    ).rejects.toThrow('Invalid GATEWAY_HOST')
-  })
-
-  it('rejects an empty host and does not invoke ssh', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const neverSpawn: SpawnFn = () => {
-      throw new Error('spawn must not be called for an invalid host')
-    }
-
-    await expect(
-      streamGatewayLogs({host: '', service: 'gateway', tail: 100, allowCi: false}, neverSpawn),
-    ).rejects.toThrow('Invalid GATEWAY_HOST')
-  })
-
-  it('accepts a valid FQDN and invokes ssh normally', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const result = await streamGatewayLogs(
-      {host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false},
-      makeSpawnOk(),
-    )
-
-    expect(result.refused).toBe(false)
-  })
-
-  it('accepts localhost as a valid host', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const result = await streamGatewayLogs(
-      {host: 'localhost', service: 'gateway', tail: 100, allowCi: false},
-      makeSpawnOk(),
-    )
-
-    expect(result.refused).toBe(false)
-  })
-
-  it('accepts an IPv4 address as a valid host', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const result = await streamGatewayLogs(
-      {host: '147.182.133.210', service: 'gateway', tail: 100, allowCi: false},
-      makeSpawnOk(),
-    )
-
-    expect(result.refused).toBe(false)
-  })
-})
-
-// ─── CI guard ────────────────────────────────────────────────────────────────
-
-type SpawnFn = (
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
-) => {
-  exited: Promise<number>
-}
-
-function makeNeverSpawn(): SpawnFn {
-  return () => {
-    throw new Error('spawn should not have been called')
-  }
-}
-
-function makeSpawnOk(): SpawnFn {
-  return (_cmd, _opts) => ({exited: Promise.resolve(0)})
-}
-
-describe('CI guard', () => {
-  let originalCI: string | undefined
-
-  beforeEach(() => {
-    originalCI = process.env.CI
-  })
-
-  afterEach(() => {
-    if (originalCI === undefined) {
-      delete process.env.CI
-    } else {
-      process.env.CI = originalCI
-    }
-  })
-
-  it('refuses to stream logs in CI without --allow-ci', async () => {
-    process.env.CI = 'true'
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const messages: string[] = []
-    const result = await streamGatewayLogs(
-      {host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false},
-      makeNeverSpawn(),
-      (msg: string) => {
-        messages.push(msg)
-      },
-    )
-
-    expect(result.refused).toBe(true)
-    expect(messages.some(m => m.includes('--allow-ci'))).toBe(true)
-  })
-
-  it('streams logs in CI when --allow-ci is set, printing stderr warning first', async () => {
-    process.env.CI = 'true'
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const warnings: string[] = []
-    const result = await streamGatewayLogs(
-      {host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: true},
-      makeSpawnOk(),
-      undefined,
-      (msg: string) => {
-        warnings.push(msg)
-      },
-    )
-
-    expect(result.refused).toBe(false)
-    expect(warnings.some(w => w.includes('Discord tokens'))).toBe(true)
-  })
-
-  it('streams logs in non-CI context, printing stderr warning first', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    const warnings: string[] = []
-    const result = await streamGatewayLogs(
-      {host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false},
-      makeSpawnOk(),
-      undefined,
-      (msg: string) => {
-        warnings.push(msg)
-      },
-    )
-
-    expect(result.refused).toBe(false)
-    expect(warnings.some(w => w.includes('Discord tokens'))).toBe(true)
-  })
-})
-
-// ─── --tail forwarding ───────────────────────────────────────────────────────
-
-describe('tail forwarding', () => {
-  it('forwards --tail N to docker compose logs command', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamGatewayLogs({host: 'gateway.example.com', service: 'gateway', tail: 25, allowCi: false}, spawnCapture)
-
-    expect(capturedCmd.join(' ')).toContain('--tail=25')
-  })
-})
-
-// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
-
-describe('streamGatewayLogs — SSH command includes UserKnownHostsFile', () => {
-  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamGatewayLogs({host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false}, spawnCapture)
-
-    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
-    expect(knownHostsIdx).toBeGreaterThan(-1)
-    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
-    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
-  })
-
-  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
-    delete process.env.CI
-
-    const {streamGatewayLogs} = await import('./logs')
-
-    let capturedCmd: string[] = []
-    const spawnCapture: SpawnFn = (cmd, _opts) => {
-      capturedCmd = cmd
-      return {exited: Promise.resolve(0)}
-    }
-
-    await streamGatewayLogs({host: 'gateway.example.com', service: 'gateway', tail: 100, allowCi: false}, spawnCapture)
-
-    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
-    expect(strictIdx).toBeGreaterThan(-1)
-    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
-  })
-})

package/src/commands/gateway/logs.ts

@@ -1,160 +0,0 @@
-import type {goke} from 'goke'
-
-import {z} from 'zod'
-
-import {buildKnownHostsArgs} from '../../lib/known-hosts'
-import {validateGatewayHost} from './host'
-
-declare const process: {
-  env: Record<string, string | undefined>
-  exitCode?: number
-  stderr: {write: (msg: string) => void}
-}
-
-const COMPOSE_PROJECT_DIR = '/opt/gateway/deploy'
-const SENSITIVE_WARNING =
-  'Warning: Logs may contain Discord tokens, S3 credentials, or user data. Treat output as sensitive; do not capture in shared logs or chat.'
-
-export const VALID_SERVICES = ['gateway', 'workspace', 'mitmproxy'] as const
-
-export type ValidService = (typeof VALID_SERVICES)[number]
-
-// ─── Pure helpers ─────────────────────────────────────────────────────────────
-
-export function validateService(service: string): asserts service is ValidService {
-  if (!VALID_SERVICES.includes(service as ValidService)) {
-    throw new Error(`Invalid service "${service}". Valid services: ${VALID_SERVICES.join(', ')}`)
-  }
-}
-
-// ─── Injectable spawn type ────────────────────────────────────────────────────
-
-export type LogsSpawnFn = (
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
-) => {
-  exited: Promise<number>
-}
-
-export interface StreamLogsOpts {
-  host: string
-  service: string
-  tail: number
-  allowCi: boolean
-}
-
-export interface StreamLogsResult {
-  refused: boolean
-  exitCode?: number
-}
-
-function defaultLogsSpawn(
-  cmd: string[],
-  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
-): {exited: Promise<number>} {
-  return Bun.spawn(cmd, opts)
-}
-
-export async function streamGatewayLogs(
-  opts: StreamLogsOpts,
-  spawn: LogsSpawnFn = defaultLogsSpawn,
-  printOut?: (msg: string) => void,
-  printErr?: (msg: string) => void,
-): Promise<StreamLogsResult> {
-  const isCI = process.env.CI === 'true'
-
-  if (isCI && !opts.allowCi) {
-    const msg = 'Refusing to stream logs in CI without --allow-ci. Logs may contain sensitive tokens or user data.'
-    if (printOut) {
-      printOut(msg)
-    } else {
-      console.log(msg)
-    }
-
-    return {refused: true}
-  }
-
-  // Warn on every run — logs are sensitive regardless of context
-  if (printErr) {
-    printErr(SENSITIVE_WARNING)
-  } else {
-    console.error(SENSITIVE_WARNING)
-  }
-
-  validateGatewayHost(opts.host)
-
-  const sshCmd = [
-    'ssh',
-    '-o',
-    'BatchMode=yes',
-    '-o',
-    'StrictHostKeyChecking=yes',
-    ...buildKnownHostsArgs(),
-    `root@${opts.host}`,
-    `docker compose --project-directory ${COMPOSE_PROJECT_DIR} logs --no-color --tail=${opts.tail} ${opts.service}`,
-  ]
-
-  const env: Record<string, string> = {
-    PATH: process.env.PATH ?? '/usr/bin:/bin',
-    HOME: process.env.HOME ?? '/tmp',
-    ...(process.env.SSH_AUTH_SOCK ? {SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK} : {}),
-  }
-
-  const child = spawn(sshCmd, {env, stdout: 'inherit', stderr: 'inherit'})
-  const exitCode = await child.exited
-
-  return {refused: false, exitCode}
-}
-
-// ─── Command registration ─────────────────────────────────────────────────────
-
-export function registerGatewayLogs(cli: ReturnType<typeof goke>): void {
-  cli
-    .command('gateway logs [service]', 'Stream logs from a gateway service via SSH and docker compose.')
-    .option('--tail [n]', z.number().default(100).describe('Number of log lines to tail from each service.'))
-    .option(
-      '--allow-ci',
-      z
-        .boolean()
-        .default(false)
-        .describe('Allow log streaming in CI environments. Logs may contain sensitive credentials.'),
-    )
-    .option(
-      '--key [key]',
-      z.string().describe('Environment variable name holding the SSH host. Falls back to GATEWAY_HOST when omitted.'),
-    )
-    .action(async (service, options) => {
-      const targetService = (service as string | undefined) ?? 'gateway'
-
-      try {
-        validateService(targetService)
-      } catch (error) {
-        console.error(error instanceof Error ? error.message : String(error))
-        process.exitCode = 1
-        return
-      }
-
-      const hostEnvKey = options.key ?? 'GATEWAY_HOST'
-      const host = process.env[hostEnvKey]
-
-      if (!host) {
-        console.error(`Gateway host not set. Export ${hostEnvKey} or pass --key <env-name> pointing to a set variable.`)
-        process.exitCode = 1
-        return
-      }
-
-      const tail = typeof options.tail === 'number' ? options.tail : 100
-      const allowCi = options.allowCi === true
-
-      const result = await streamGatewayLogs({host, service: targetService, tail, allowCi})
-
-      if (result.refused) {
-        process.exitCode = 1
-        return
-      }
-
-      if (result.exitCode !== 0) {
-        process.exitCode = result.exitCode ?? 1
-      }
-    })
-}