@marcusrbrown/infra 0.9.18 → 0.10.0

package/src/commands/vpn/host.test.ts

@@ -0,0 +1,89 @@
+import {describe, expect, it} from 'bun:test'
+
+import {validateVpnHost} from './host'
+
+// ─── validateVpnHost ──────────────────────────────────────────────────────────
+
+describe('validateVpnHost', () => {
+  // ── Valid inputs ────────────────────────────────────────────────────────────
+
+  it('accepts a standard FQDN', () => {
+    expect(() => validateVpnHost('vpn.example.com')).not.toThrow()
+    expect(validateVpnHost('vpn.example.com')).toBe('vpn.example.com')
+  })
+
+  it('accepts localhost', () => {
+    expect(() => validateVpnHost('localhost')).not.toThrow()
+  })
+
+  it('accepts an IPv4 address', () => {
+    expect(() => validateVpnHost('1.2.3.4')).not.toThrow()
+  })
+
+  it('accepts a single-character hostname', () => {
+    expect(() => validateVpnHost('a')).not.toThrow()
+  })
+
+  it('accepts a hostname with hyphens', () => {
+    expect(() => validateVpnHost('my-vpn.prod.example.com')).not.toThrow()
+  })
+
+  // ── Injection attacks ───────────────────────────────────────────────────────
+
+  it('rejects a leading-hyphen value (ProxyCommand injection vector)', () => {
+    expect(() => validateVpnHost('-oProxyCommand=evil')).toThrow('Invalid VPN_HOST')
+  })
+
+  it('rejects a value with shell metacharacters (semicolon)', () => {
+    expect(() => validateVpnHost('vpn.example.com;rm -rf')).toThrow('Invalid VPN_HOST')
+  })
+
+  it('rejects a value with shell metacharacters (backtick)', () => {
+    expect(() => validateVpnHost('vpn.example.com`id`')).toThrow('Invalid VPN_HOST')
+  })
+
+  it('rejects a value with spaces', () => {
+    expect(() => validateVpnHost('vpn example.com')).toThrow('Invalid VPN_HOST')
+  })
+
+  it('rejects a value with an at-sign', () => {
+    expect(() => validateVpnHost('user@vpn.example.com')).toThrow('Invalid VPN_HOST')
+  })
+
+  // ── Empty / blank ───────────────────────────────────────────────────────────
+
+  it('rejects an empty string', () => {
+    expect(() => validateVpnHost('')).toThrow('Invalid VPN_HOST')
+  })
+
+  // ── Error message sanitization ──────────────────────────────────────────────
+
+  it('omits the rejected value entirely from the error message', () => {
+    const longMalicious = `-oProxyCommand=${'A'.repeat(100)}`
+    let message = ''
+    try {
+      validateVpnHost(longMalicious)
+    } catch (error) {
+      message = error instanceof Error ? error.message : String(error)
+    }
+    // The value is never echoed (it may be a misdirected secret) — only the constraint is shown.
+    expect(message).toContain('Invalid VPN_HOST')
+    expect(message).not.toContain('ProxyCommand')
+    expect(message).not.toContain('AAAA')
+  })
+
+  // ── Secret value redaction ───────────────────────────────────────────────────
+
+  it('does not echo the rejected value in the error message', () => {
+    const secretValue = 'AWS_SECRET_KEY=AKIA1234567890EXAMPLE'
+    let message = ''
+    try {
+      validateVpnHost(secretValue)
+    } catch (error) {
+      message = error instanceof Error ? error.message : String(error)
+    }
+    expect(message).toContain('Invalid VPN_HOST')
+    expect(message).not.toContain('AKIA1234567890EXAMPLE')
+    expect(message).not.toContain('AWS_SECRET_KEY')
+  })
+})

package/src/commands/vpn/host.ts

@@ -0,0 +1,36 @@
+// ─── VPN CLI host validation ──────────────────────────────────────────────────
+//
+// Validates VPN_HOST values before they are passed as ssh argv arguments.
+// A value starting with `-` would be interpreted by ssh as an option flag,
+// enabling ProxyCommand injection and local code execution.
+//
+// This is the CLI-side validator. The deploy-side validator lives at
+// apps/vpn/src/host.ts. Both enforce the same rules.
+
+const VALID_HOST_RE = /^[a-z\d][a-z\d.\-]*$/i
+
+/**
+ * Validates a candidate VPN_HOST value against a strict hostname allowlist.
+ *
+ * Accepts: hostnames, FQDNs, IPv4 addresses, `localhost`.
+ * Rejects: empty strings, values starting with `-`, and anything containing
+ * characters outside `[A-Za-z0-9.-]`.
+ *
+ * @throws {Error} when empty or not a valid hostname. The rejected value is
+ *   never included in the message (it may be a misdirected secret).
+ * @returns The validated host string (unchanged).
+ */
+export function validateVpnHost(host: string): string {
+  if (!host) {
+    throw new Error('Invalid VPN_HOST: value is empty')
+  }
+
+  if (!VALID_HOST_RE.test(host)) {
+    // Do NOT echo the value — it may be a secret that was redirected via --key
+    throw new Error(
+      `Invalid VPN_HOST: value is not a valid hostname (must match ${String.raw`[A-Za-z0-9][A-Za-z0-9.\-]*`})`,
+    )
+  }
+
+  return host
+}

package/src/commands/vpn/index.ts

@@ -0,0 +1,15 @@
+import type {goke} from 'goke'
+
+import {registerVpnClient} from './client'
+import {registerVpnDeploy} from './deploy'
+import {registerVpnLogs} from './logs'
+import {registerVpnStatus} from './status'
+
+export {getVpnStatusSummary} from './shared'
+
+export function registerVpnCommands(cli: ReturnType<typeof goke>): void {
+  registerVpnStatus(cli)
+  registerVpnDeploy(cli)
+  registerVpnLogs(cli)
+  registerVpnClient(cli)
+}

package/src/commands/vpn/logs.test.ts

@@ -0,0 +1,234 @@
+import {afterEach, beforeEach, describe, expect, it} from 'bun:test'
+
+import {streamVpnLogs} from './logs'
+
+// ─── SpawnFn type ─────────────────────────────────────────────────────────────
+
+type SpawnFn = (
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
+) => {
+  exited: Promise<number>
+}
+
+function makeNeverSpawn(): SpawnFn {
+  return () => {
+    throw new Error('spawn should not have been called')
+  }
+}
+
+function makeSpawnOk(): SpawnFn {
+  return (_cmd, _opts) => ({exited: Promise.resolve(0)})
+}
+
+// ─── streamVpnLogs — host validation (SEC1) ───────────────────────────────────
+
+describe('streamVpnLogs — host validation (SEC1)', () => {
+  it('rejects a leading-hyphen host and does not invoke ssh', async () => {
+    delete process.env.CI
+
+    await expect(
+      streamVpnLogs({host: '-oProxyCommand=evil', tail: 100, allowCi: false}, makeNeverSpawn()),
+    ).rejects.toThrow('Invalid VPN_HOST')
+  })
+
+  it('rejects a host with shell metacharacters and does not invoke ssh', async () => {
+    delete process.env.CI
+
+    await expect(
+      streamVpnLogs({host: 'vpn.example.com;rm -rf', tail: 100, allowCi: false}, makeNeverSpawn()),
+    ).rejects.toThrow('Invalid VPN_HOST')
+  })
+
+  it('rejects an empty host and does not invoke ssh', async () => {
+    delete process.env.CI
+
+    await expect(streamVpnLogs({host: '', tail: 100, allowCi: false}, makeNeverSpawn())).rejects.toThrow(
+      'Invalid VPN_HOST',
+    )
+  })
+
+  it('accepts a valid FQDN and invokes ssh normally', async () => {
+    delete process.env.CI
+
+    const result = await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, makeSpawnOk())
+
+    expect(result.refused).toBe(false)
+  })
+
+  it('accepts localhost as a valid host', async () => {
+    delete process.env.CI
+
+    const result = await streamVpnLogs({host: 'localhost', tail: 100, allowCi: false}, makeSpawnOk())
+
+    expect(result.refused).toBe(false)
+  })
+
+  it('accepts an IPv4 address as a valid host', async () => {
+    delete process.env.CI
+
+    const result = await streamVpnLogs({host: '1.2.3.4', tail: 100, allowCi: false}, makeSpawnOk())
+
+    expect(result.refused).toBe(false)
+  })
+})
+
+// ─── CI guard ────────────────────────────────────────────────────────────────
+
+describe('CI guard', () => {
+  let originalCI: string | undefined
+
+  beforeEach(() => {
+    originalCI = process.env.CI
+  })
+
+  afterEach(() => {
+    if (originalCI === undefined) {
+      delete process.env.CI
+    } else {
+      process.env.CI = originalCI
+    }
+  })
+
+  it('refuses to stream logs in CI without --allow-ci', async () => {
+    process.env.CI = 'true'
+
+    const messages: string[] = []
+    const result = await streamVpnLogs(
+      {host: 'vpn.example.com', tail: 100, allowCi: false},
+      makeNeverSpawn(),
+      (msg: string) => {
+        messages.push(msg)
+      },
+    )
+
+    expect(result.refused).toBe(true)
+    expect(messages.some(m => m.includes('--allow-ci'))).toBe(true)
+  })
+
+  it('streams logs in CI when --allow-ci is set, printing stderr warning first', async () => {
+    process.env.CI = 'true'
+
+    const warnings: string[] = []
+    const result = await streamVpnLogs(
+      {host: 'vpn.example.com', tail: 100, allowCi: true},
+      makeSpawnOk(),
+      undefined,
+      (msg: string) => {
+        warnings.push(msg)
+      },
+    )
+
+    expect(result.refused).toBe(false)
+    expect(warnings.some(w => w.includes('sensitive'))).toBe(true)
+  })
+
+  it('streams logs in non-CI context, printing stderr warning first', async () => {
+    delete process.env.CI
+
+    const warnings: string[] = []
+    const result = await streamVpnLogs(
+      {host: 'vpn.example.com', tail: 100, allowCi: false},
+      makeSpawnOk(),
+      undefined,
+      (msg: string) => {
+        warnings.push(msg)
+      },
+    )
+
+    expect(result.refused).toBe(false)
+    expect(warnings.some(w => w.includes('sensitive'))).toBe(true)
+  })
+})
+
+// ─── SSH user + privilege contract ───────────────────────────────────────────
+
+describe('streamVpnLogs — SSH user + privilege contract', () => {
+  it('SSH user contract: connects as ubuntu@host, not root@host', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
+
+    const destination = capturedCmd.find(arg => arg.includes('@'))
+    expect(destination).toBeDefined()
+    expect(destination).toMatch(/^ubuntu@/)
+    expect(destination).not.toMatch(/^root@/)
+  })
+
+  it('privilege contract: journalctl is prefixed with sudo', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
+
+    // The last element of the SSH command is the remote command to run
+    const remoteCmd = capturedCmd.at(-1)
+    expect(remoteCmd).toMatch(/^sudo journalctl/)
+  })
+})
+
+// ─── --tail forwarding ───────────────────────────────────────────────────────
+
+describe('tail forwarding', () => {
+  it('forwards --tail N to journalctl command', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamVpnLogs({host: 'vpn.example.com', tail: 25, allowCi: false}, spawnCapture)
+
+    expect(capturedCmd.join(' ')).toContain('25')
+  })
+})
+
+// ─── SSH command includes repo-pinned UserKnownHostsFile ─────────────────────
+
+describe('streamVpnLogs — SSH command includes UserKnownHostsFile', () => {
+  it('passes -o UserKnownHostsFile=<repo>/.github/known_hosts to ssh', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
+
+    const knownHostsIdx = capturedCmd.findIndex(arg => arg.startsWith('UserKnownHostsFile='))
+    expect(knownHostsIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[knownHostsIdx - 1]).toBe('-o')
+    expect(capturedCmd[knownHostsIdx]).toMatch(/\.github[/\\]known_hosts$/)
+  })
+
+  it('does not weaken StrictHostKeyChecking when UserKnownHostsFile is added', async () => {
+    delete process.env.CI
+
+    let capturedCmd: string[] = []
+    const spawnCapture: SpawnFn = (cmd, _opts) => {
+      capturedCmd = cmd
+      return {exited: Promise.resolve(0)}
+    }
+
+    await streamVpnLogs({host: 'vpn.example.com', tail: 100, allowCi: false}, spawnCapture)
+
+    const strictIdx = capturedCmd.findIndex(arg => arg.startsWith('StrictHostKeyChecking='))
+    expect(strictIdx).toBeGreaterThan(-1)
+    expect(capturedCmd[strictIdx]).toBe('StrictHostKeyChecking=yes')
+  })
+})

package/src/commands/vpn/logs.ts

@@ -0,0 +1,136 @@
+import type {goke} from 'goke'
+
+import {z} from 'zod'
+
+import {buildKnownHostsArgs} from '../../lib/known-hosts'
+import {validateVpnHost} from './host'
+
+declare const process: {
+  env: Record<string, string | undefined>
+  exitCode?: number
+  stderr: {write: (msg: string) => void}
+}
+
+const SENSITIVE_WARNING =
+  'Warning: Logs may contain peer IP addresses, handshake data, or other sensitive VPN information. Treat output as sensitive; do not capture in shared logs or chat.'
+
+// ─── Injectable spawn type ────────────────────────────────────────────────────
+
+export type LogsSpawnFn = (
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
+) => {
+  exited: Promise<number>
+}
+
+export interface StreamVpnLogsOpts {
+  host: string
+  tail: number
+  allowCi: boolean
+}
+
+export interface StreamVpnLogsResult {
+  refused: boolean
+  exitCode?: number
+}
+
+function defaultLogsSpawn(
+  cmd: string[],
+  opts: {env: Record<string, string>; stdout: 'inherit'; stderr: 'inherit'},
+): {exited: Promise<number>} {
+  return Bun.spawn(cmd, opts)
+}
+
+export async function streamVpnLogs(
+  opts: StreamVpnLogsOpts,
+  spawn: LogsSpawnFn = defaultLogsSpawn,
+  printOut?: (msg: string) => void,
+  printErr?: (msg: string) => void,
+): Promise<StreamVpnLogsResult> {
+  const isCI = process.env.CI === 'true'
+
+  if (isCI && !opts.allowCi) {
+    const msg = 'Refusing to stream logs in CI without --allow-ci. Logs may contain sensitive VPN data.'
+    if (printOut) {
+      printOut(msg)
+    } else {
+      console.log(msg)
+    }
+
+    return {refused: true}
+  }
+
+  // Warn on every run — logs are sensitive regardless of context
+  if (printErr) {
+    printErr(SENSITIVE_WARNING)
+  } else {
+    console.error(SENSITIVE_WARNING)
+  }
+
+  validateVpnHost(opts.host)
+
+  const sshCmd = [
+    'ssh',
+    '-o',
+    'BatchMode=yes',
+    '-o',
+    'StrictHostKeyChecking=yes',
+    ...buildKnownHostsArgs(),
+    `ubuntu@${opts.host}`,
+    `sudo journalctl -u wg-quick@wg0 --no-pager -n ${opts.tail}`,
+  ]
+
+  const env: Record<string, string> = {
+    PATH: process.env.PATH ?? '/usr/bin:/bin',
+    HOME: process.env.HOME ?? '/tmp',
+    ...(process.env.SSH_AUTH_SOCK ? {SSH_AUTH_SOCK: process.env.SSH_AUTH_SOCK} : {}),
+  }
+
+  const child = spawn(sshCmd, {env, stdout: 'inherit', stderr: 'inherit'})
+  const exitCode = await child.exited
+
+  return {refused: false, exitCode}
+}
+
+// ─── Command registration ─────────────────────────────────────────────────────
+
+export function registerVpnLogs(cli: ReturnType<typeof goke>): void {
+  cli
+    .command('vpn logs', 'Stream WireGuard VPN logs via SSH and journalctl.')
+    .option('--tail [n]', z.number().default(100).describe('Number of log lines to tail.'))
+    .option(
+      '--allow-ci',
+      z
+        .boolean()
+        .default(false)
+        .describe('Allow log streaming in CI environments. Logs may contain sensitive VPN data.'),
+    )
+    .option(
+      '--key [key]',
+      z.string().describe('Environment variable name holding the SSH host. Falls back to VPN_HOST when omitted.'),
+    )
+    .action(async options => {
+      const hostEnvKey = options.key ?? 'VPN_HOST'
+      const host = process.env[hostEnvKey]
+
+      if (!host) {
+        console.error(`VPN host not set. Export ${hostEnvKey} or pass --key <env-name> pointing to a set variable.`)
+        process.exitCode = 1
+        return
+      }
+
+      const tail = typeof options.tail === 'number' ? options.tail : 100
+      const allowCi = options.allowCi === true
+
+      const result = await streamVpnLogs({host, tail, allowCi})
+
+      if (result.refused) {
+        process.exitCode = 1
+        return
+      }
+
+      if (result.exitCode !== 0) {
+        process.exitCode = result.exitCode ?? 1
+      }
+    })
+}