@mycadet/credential-executor 0.0.1 → 0.12.6-dev.202610072225.d7acd73

package/src/__tests__/local-secure-key-backend.test.ts

@@ -0,0 +1,344 @@
+/**
+ * Filesystem-level tests for the CES local SecureKeyBackend.
+ *
+ * These tests exercise `createLocalSecureKeyBackend` with real files and
+ * env-var overrides, separate from the in-memory resolver/materialiser
+ * tests in `local-materializers.test.ts`.
+ */
+
+import { afterEach, describe, expect, spyOn, test } from "bun:test";
+import * as fs from "node:fs";
+import {
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  statSync,
+  writeFileSync,
+  rmSync,
+} from "node:fs";
+import { randomBytes } from "node:crypto";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import { CesRpcMethod } from "@mycadet/service-contracts/credential-rpc";
+import type { SecureKeyBackend } from "@mycadet/credential-storage";
+
+import {
+  createLocalSecureKeyBackend,
+  StoreUnavailableError,
+} from "../materializers/local-secure-key-backend.js";
+import { buildCrudHandlers } from "../main.js";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function makeTmpDir(): string {
+  const dir = join(
+    tmpdir(),
+    `ces-backend-test-${randomBytes(8).toString("hex")}`,
+  );
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe("createLocalSecureKeyBackend — filesystem", () => {
+  let tmpDir: string | undefined;
+  let savedSecurityDir: string | undefined;
+
+  afterEach(() => {
+    if (savedSecurityDir !== undefined) {
+      process.env.CREDENTIAL_SECURITY_DIR = savedSecurityDir;
+    } else {
+      delete process.env.CREDENTIAL_SECURITY_DIR;
+    }
+    if (tmpDir && existsSync(tmpDir)) {
+      rmSync(tmpDir, { recursive: true, force: true });
+    }
+    tmpDir = undefined;
+    savedSecurityDir = undefined;
+  });
+
+  function setup(): { securityDir: string; cadetRoot: string } {
+    tmpDir = makeTmpDir();
+    const securityDir = join(tmpDir, "security");
+    mkdirSync(securityDir, { recursive: true });
+    savedSecurityDir = process.env.CREDENTIAL_SECURITY_DIR;
+    process.env.CREDENTIAL_SECURITY_DIR = securityDir;
+    // cadetRoot is unused when CREDENTIAL_SECURITY_DIR is set,
+    // but we pass tmpDir for consistency
+    return { securityDir, cadetRoot: tmpDir };
+  }
+
+  test("set() on a fresh security directory creates store.key and keys.enc", async () => {
+    const { securityDir, cadetRoot } = setup();
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+
+    const result = await backend.set("test/key", "secret-value");
+    expect(result).toBe(true);
+
+    // store.key exists, is 32 bytes, mode 0o600
+    const keyPath = join(securityDir, "store.key");
+    expect(existsSync(keyPath)).toBe(true);
+    const keyBuf = readFileSync(keyPath);
+    expect(keyBuf.length).toBe(32);
+    const mode = statSync(keyPath).mode & 0o777;
+    expect(mode).toBe(0o600);
+
+    // keys.enc exists and is valid v2 JSON
+    const encPath = join(securityDir, "keys.enc");
+    expect(existsSync(encPath)).toBe(true);
+    const store = JSON.parse(readFileSync(encPath, "utf-8"));
+    expect(store.version).toBe(2);
+    expect(typeof store.entries).toBe("object");
+
+    // Round-trip
+    const value = await backend.get("test/key");
+    expect(value).toBe("secret-value");
+  });
+
+  test("subsequent set() calls append to the existing store without recreating files", async () => {
+    const { securityDir, cadetRoot } = setup();
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+
+    await backend.set("key1", "val1");
+    const keyAfterFirst = readFileSync(join(securityDir, "store.key"));
+
+    await backend.set("key2", "val2");
+    const keyAfterSecond = readFileSync(join(securityDir, "store.key"));
+
+    // store.key was not regenerated
+    expect(Buffer.compare(keyAfterFirst, keyAfterSecond)).toBe(0);
+
+    // keys.enc has exactly 2 entries
+    const store = JSON.parse(
+      readFileSync(join(securityDir, "keys.enc"), "utf-8"),
+    );
+    expect(Object.keys(store.entries).length).toBe(2);
+
+    // Both values round-trip
+    expect(await backend.get("key1")).toBe("val1");
+    expect(await backend.get("key2")).toBe("val2");
+  });
+
+  test("set() against a pre-existing v1 store preserves format and round-trips", async () => {
+    const { securityDir, cadetRoot } = setup();
+
+    // Manually write a v1 store
+    const salt = randomBytes(32).toString("hex");
+    const v1Store = { version: 1, salt, entries: {} };
+    writeFileSync(
+      join(securityDir, "keys.enc"),
+      JSON.stringify(v1Store, null, 2),
+      {
+        mode: 0o600,
+      },
+    );
+
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    const result = await backend.set("v1-key", "v1-value");
+    expect(result).toBe(true);
+
+    // Read back and verify format preserved
+    const storeAfter = JSON.parse(
+      readFileSync(join(securityDir, "keys.enc"), "utf-8"),
+    );
+    expect(storeAfter.version).toBe(1);
+    expect(storeAfter.salt).toBe(salt);
+    expect(Object.keys(storeAfter.entries)).toContain("v1-key");
+
+    // store.key was NOT created (v1 stores don't use it)
+    expect(existsSync(join(securityDir, "store.key"))).toBe(false);
+
+    // Round-trip
+    const value = await backend.get("v1-key");
+    expect(value).toBe("v1-value");
+  });
+
+  test("get() returns undefined when no store exists", async () => {
+    const { cadetRoot } = setup();
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    const value = await backend.get("anything");
+    expect(value).toBeUndefined();
+  });
+
+  test("list() returns empty array when no store exists", async () => {
+    const { cadetRoot } = setup();
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    const keys = await backend.list();
+    expect(keys).toEqual([]);
+  });
+
+  test("delete() returns error when no store exists", async () => {
+    const { cadetRoot } = setup();
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    const result = await backend.delete("anything");
+    expect(result).toBe("error");
+  });
+
+  // -------------------------------------------------------------------------
+  // UNAVAILABLE (store exists but cannot be read / decrypted) must be distinct
+  // from ABSENT (no store, or the store reads cleanly but lacks the key). The
+  // former throws so the RPC layer reports `unreachable`; the latter returns
+  // undefined/[]. This is the cold-start fix: a transiently-unreadable store or
+  // missing key material must never masquerade as "credential not found".
+  // -------------------------------------------------------------------------
+
+  test("get() THROWS (not undefined) when the store file exists but is unreadable", async () => {
+    const { securityDir, cadetRoot } = setup();
+    // A store file that exists but cannot be parsed (e.g. a partial/corrupt
+    // read) — distinct from no store at all.
+    writeFileSync(join(securityDir, "keys.enc"), "{ not valid json", {
+      mode: 0o600,
+    });
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    await expect(backend.get("anything")).rejects.toThrow(
+      StoreUnavailableError,
+    );
+  });
+
+  test("get() returns undefined when the store reads cleanly but the key is absent", async () => {
+    const { cadetRoot } = setup();
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    await backend.set("present/key", "v"); // valid store with one entry
+    // A genuinely missing key in a readable store is ABSENT, not unavailable.
+    expect(await backend.get("absent/key")).toBeUndefined();
+  });
+
+  test("get() THROWS when a v2 entry exists but store.key is missing (cold-start key-material race)", async () => {
+    const { securityDir, cadetRoot } = setup();
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    await backend.set("k", "v"); // creates the v2 store + store.key
+    expect(await backend.get("k")).toBe("v"); // sanity: warm read works
+    // Simulate the cold-start window where the key material is transiently
+    // unavailable: the entry still exists, but it cannot be decrypted yet.
+    rmSync(join(securityDir, "store.key"));
+    await expect(backend.get("k")).rejects.toThrow(StoreUnavailableError);
+  });
+
+  test("list() THROWS (not []) when the store file exists but is unreadable", async () => {
+    const { securityDir, cadetRoot } = setup();
+    writeFileSync(join(securityDir, "keys.enc"), "{ corrupt", { mode: 0o600 });
+    const backend = createLocalSecureKeyBackend(cadetRoot);
+    await expect(backend.list()).rejects.toThrow(StoreUnavailableError);
+  });
+
+  // -------------------------------------------------------------------------
+  // Store-write durability: the store is written to a temp file with
+  // `flush: true` so the ack the assistant receives follows an fsync.
+  // -------------------------------------------------------------------------
+
+  test("writeStore fsyncs the temp file (flush: true) so the ack follows a durable write", async () => {
+    const { securityDir, cadetRoot } = setup();
+    const spy = spyOn(fs, "writeFileSync");
+    try {
+      const backend = createLocalSecureKeyBackend(cadetRoot);
+      await backend.set("durable/key", "v");
+
+      const keysEncTmpPrefix = join(securityDir, "keys.enc") + ".tmp.";
+      const flushedStoreWrite = spy.mock.calls.some((call) => {
+        const [path, , opts] = call as [
+          unknown,
+          unknown,
+          { flush?: boolean } | undefined,
+        ];
+        return (
+          typeof path === "string" &&
+          path.startsWith(keysEncTmpPrefix) &&
+          !!opts &&
+          typeof opts === "object" &&
+          opts.flush === true
+        );
+      });
+      expect(flushedStoreWrite).toBe(true);
+    } finally {
+      spy.mockRestore();
+    }
+  });
+
+  test("writeStore fsyncs the parent directory so the rename is durable", async () => {
+    const { cadetRoot } = setup();
+    const fsyncSpy = spyOn(fs, "fsyncSync");
+    try {
+      const backend = createLocalSecureKeyBackend(cadetRoot);
+      await backend.set("durable/key", "v");
+      // The directory fsync runs after the rename; at least one fsyncSync call
+      // must have happened for the store write.
+      expect(fsyncSpy.mock.calls.length).toBeGreaterThan(0);
+    } finally {
+      fsyncSpy.mockRestore();
+    }
+  });
+});
+
+// ---------------------------------------------------------------------------
+// CES CRUD audit logging (buildCrudHandlers)
+// ---------------------------------------------------------------------------
+
+describe("buildCrudHandlers audit logging", () => {
+  function fakeBackend(over: Partial<SecureKeyBackend> = {}): SecureKeyBackend {
+    return {
+      get: async () => undefined,
+      set: async () => true,
+      delete: async () => "deleted",
+      list: async () => [],
+      ...over,
+    };
+  }
+
+  const ctx = { sessionId: "test-session" };
+
+  test("SetCredential emits an audit line with account + outcome, never the value", async () => {
+    const calls: Array<{ obj: unknown; msg: string }> = [];
+    const audit = {
+      info: (obj: unknown, msg: string) => {
+        calls.push({ obj, msg });
+      },
+    };
+    const handlers = buildCrudHandlers(
+      fakeBackend(),
+      audit as unknown as Parameters<typeof buildCrudHandlers>[1],
+    );
+
+    const res = await handlers[CesRpcMethod.SetCredential]!(
+      { account: "cadet:assistant_api_key", value: "super-secret-value" },
+      ctx,
+    );
+
+    expect(res).toEqual({ ok: true });
+    expect(calls).toContainEqual({
+      obj: { account: "cadet:assistant_api_key", ok: true },
+      msg: "CES credential set",
+    });
+    // The audit line must never carry the credential value.
+    expect(JSON.stringify(calls)).not.toContain("super-secret-value");
+  });
+
+  test("DeleteCredential emits an audit line with account + result", async () => {
+    const calls: Array<{ obj: unknown; msg: string }> = [];
+    const audit = {
+      info: (obj: unknown, msg: string) => {
+        calls.push({ obj, msg });
+      },
+    };
+    const handlers = buildCrudHandlers(
+      fakeBackend({ delete: async () => "deleted" }),
+      audit as unknown as Parameters<typeof buildCrudHandlers>[1],
+    );
+
+    const res = await handlers[CesRpcMethod.DeleteCredential]!(
+      { account: "github:api_token" },
+      ctx,
+    );
+
+    expect(res).toEqual({ result: "deleted" });
+    expect(calls).toContainEqual({
+      obj: { account: "github:api_token", result: "deleted" },
+      msg: "CES credential delete",
+    });
+  });
+});

package/src/__tests__/local-standalone.test.ts

@@ -0,0 +1,209 @@
+/**
+ * Local CES sibling test (real entrypoint subprocess).
+ *
+ * Spawns the actual `main.ts` entrypoint with **stdin closed** — the way the
+ * CLI launches the sibling — and verifies that CES:
+ *
+ *   1. binds its Unix socket and serves RPC despite having no stdio parent
+ *      (lifecycle anchored to SIGTERM, not stdin), and
+ *   2. survives a client disconnecting, and
+ *   3. shuts down on SIGTERM.
+ *
+ * Local mode has no TCP health server, so this runs without binding a TCP port.
+ */
+
+import { afterEach, describe, expect, test } from "bun:test";
+import { createConnection, type Socket } from "node:net";
+import { existsSync, mkdirSync, mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+
+import { resolveIpcEndpoint } from "@mycadet/ipc-server-utils";
+
+import {
+  CES_PROTOCOL_VERSION,
+  CesRpcMethod,
+  type HandshakeAck,
+  type RpcEnvelope,
+  type ListCredentialsResponse,
+} from "@mycadet/service-contracts/credential-rpc";
+
+import type { Subprocess } from "bun";
+
+function delay(ms: number): Promise<void> {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+async function waitForSocket(
+  socketPath: string,
+  timeoutMs = 10_000,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(socketPath)) return;
+    await delay(50);
+  }
+  throw new Error(`Standalone CES socket did not appear within ${timeoutMs}ms`);
+}
+
+function connectToSocket(
+  socketPath: string,
+  { maxRetries = 40, baseDelayMs = 25 } = {},
+): Promise<Socket> {
+  return new Promise((resolveConn, reject) => {
+    let attempt = 0;
+    const tryConnect = () => {
+      const sock = createConnection(socketPath, () => {
+        sock.removeAllListeners("error");
+        resolveConn(sock);
+      });
+      sock.on("error", (err: NodeJS.ErrnoException) => {
+        sock.destroy();
+        attempt++;
+        if (
+          attempt < maxRetries &&
+          (err.code === "ENOENT" || err.code === "ECONNREFUSED")
+        ) {
+          setTimeout(tryConnect, baseDelayMs);
+        } else {
+          reject(err);
+        }
+      });
+    };
+    tryConnect();
+  });
+}
+
+/** Read one newline-delimited JSON message from the socket. */
+function readOne<T>(sock: Socket, timeoutMs = 5_000): Promise<T> {
+  return new Promise((resolveMsg, reject) => {
+    let buffer = "";
+    const timer = setTimeout(() => {
+      sock.removeAllListeners("data");
+      reject(new Error("Timed out waiting for a message"));
+    }, timeoutMs);
+    const onData = (chunk: Buffer) => {
+      buffer += chunk.toString("utf-8");
+      const idx = buffer.indexOf("\n");
+      if (idx === -1) return;
+      clearTimeout(timer);
+      sock.removeListener("data", onData);
+      try {
+        resolveMsg(JSON.parse(buffer.slice(0, idx).trim()) as T);
+      } catch (err) {
+        reject(err as Error);
+      }
+    };
+    sock.on("data", onData);
+    sock.on("error", (err) => {
+      clearTimeout(timer);
+      reject(err);
+    });
+  });
+}
+
+async function handshake(
+  sock: Socket,
+  sessionId: string,
+): Promise<HandshakeAck> {
+  sock.write(
+    JSON.stringify({
+      type: "handshake_request",
+      protocolVersion: CES_PROTOCOL_VERSION,
+      sessionId,
+    }) + "\n",
+  );
+  return readOne<HandshakeAck>(sock);
+}
+
+let tmpDir: string | undefined;
+let proc: Subprocess | undefined;
+
+afterEach(async () => {
+  if (proc) {
+    proc.kill("SIGTERM");
+    await Promise.race([proc.exited, delay(3_000)]);
+    proc = undefined;
+  }
+  if (tmpDir) {
+    try {
+      rmSync(tmpDir, { recursive: true, force: true });
+    } catch {
+      /* ok */
+    }
+    tmpDir = undefined;
+  }
+});
+
+describe("local CES standalone sibling (real entrypoint)", () => {
+  test("serves over a socket with no stdio parent, survives disconnect, exits on SIGTERM", async () => {
+    tmpDir = mkdtempSync(join(tmpdir(), "ces-standalone-"));
+    const securityDir = join(tmpDir, "protected");
+    const workspaceDir = join(tmpDir, "workspace");
+    const bootstrapDir = join(securityDir, "credential-executor");
+    mkdirSync(securityDir, { recursive: true });
+    mkdirSync(workspaceDir, { recursive: true });
+    mkdirSync(bootstrapDir, { recursive: true });
+    const socketPath = resolveIpcEndpoint("ces", {
+      workspaceDir: bootstrapDir,
+    }).path;
+
+    const localMain = resolve(__dirname, "..", "main.ts");
+    const env: Record<string, string | undefined> = {
+      ...process.env,
+      CREDENTIAL_SECURITY_DIR: securityDir,
+      CADET_WORKSPACE_DIR: workspaceDir,
+      CES_BOOTSTRAP_SOCKET_DIR: bootstrapDir,
+    };
+
+    // stdin closed is how the CLI launches the sibling — CES serves over a
+    // Unix socket, not stdio.
+    proc = Bun.spawn({
+      cmd: [process.execPath, localMain],
+      env,
+      stdin: "ignore",
+      stdout: "ignore",
+      stderr: "ignore",
+    });
+
+    await waitForSocket(socketPath);
+    expect(proc.killed).toBe(false);
+
+    // First client: handshake + a real RPC.
+    const first = await connectToSocket(socketPath);
+    const ack1 = await handshake(first, "sibling-1");
+    expect(ack1.accepted).toBe(true);
+
+    first.write(
+      JSON.stringify({
+        type: "rpc",
+        id: "rpc-1",
+        kind: "request",
+        method: CesRpcMethod.ListCredentials,
+        payload: {},
+        timestamp: new Date().toISOString(),
+      }) + "\n",
+    );
+    const rpcResp = await readOne<RpcEnvelope & { type: "rpc" }>(first);
+    expect((rpcResp.payload as ListCredentialsResponse).accounts).toEqual([]);
+
+    // Disconnect — CES must stay up.
+    first.destroy();
+    await delay(200);
+    expect(proc.killed).toBe(false);
+
+    // Reconnect proves it survived.
+    const second = await connectToSocket(socketPath);
+    const ack2 = await handshake(second, "sibling-2");
+    expect(ack2.accepted).toBe(true);
+    second.destroy();
+
+    // SIGTERM shuts it down.
+    proc.kill("SIGTERM");
+    const exited = await Promise.race([
+      proc.exited.then(() => true),
+      delay(5_000).then(() => false),
+    ]);
+    expect(exited).toBe(true);
+  }, 30_000);
+});