@norskvideo/ctl-test-harness 0.1.35 → 0.1.36

package/demo/run.js

@@ -36,7 +36,7 @@ import { ctlSupportsNoPublish, runnerContainerUser } from "../launch.js";
 import { pollUntil } from "../poll.js";
 import { nukePathAsRoot, reportForeignOwners } from "../root-nuke.js";
 import { startSrtSources } from "../source-pump.js";
-import { makeStoreDir } from "../temp-dir.js";
+import { makeStoreDir, TEST_TMP_BASE } from "../temp-dir.js";
 const DEMO_PORT_BASE = 35000;
 const DEMO_BAND_WIDTH = 20;
 const DEMO_BANDS = 50;
@@ -290,7 +290,7 @@ export function defaultDemoDeps(cwd) {
                 await h.stop();
         },
         cleanup: (opts) => cleanupDaemon({ ...opts, stopProxy: async () => { }, proxy: false }),
-        nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir),
+        nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir, TEST_TMP_BASE),
         storeExists: (storeDir) => existsSync(storeDir),
         ensureNetwork: () => ensureRunnerOnNetwork(),
         supportsNoPublish: ctlSupportsNoPublish,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@norskvideo/ctl-test-harness",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "type": "module",
   "exports": {
     ".": {

package/root-nuke.d.ts

@@ -3,12 +3,20 @@ export type NukeSpawn = (cmd: string, argv: string[], opts?: unknown) => {
     error?: unknown;
     status?: number | null;
 };
-/** Refuse a target that would turn the nuke into something catastrophic. The
- *  mount is the target's PARENT, so a target with no leaf ("/" or a trailing
- *  slash) means "delete the mount", and a relative path resolves against a cwd
- *  the container does not share. These are programming errors, not runtime
- *  conditions: throw loudly rather than run a root rm against a guess. */
-export declare function assertNukeTarget(target: string): void;
+/** Refuse a target that would turn the nuke into something catastrophic.
+ *
+ *  `allowedBase` is the containment: the target must sit strictly INSIDE it.
+ *  Nothing else here is sufficient on its own, because the worst case passes
+ *  every structural check. Under `--daemon reuse` the harness's storeDir is the
+ *  developer's real `~/.norsk-ctl` -- absolute, ordinary leaf, no glob,
+ *  non-root parent -- and nuking it mounts $HOME into a root container and
+ *  removes the daemon's entire state: config, products, templates, instances.
+ *  Today only an early return in teardown keeps the nuke away from it, and a
+ *  guard that depends on a `return` staying put is not a guard.
+ *
+ *  The base itself is refused too: it is shared by concurrently running tiers,
+ *  so removing it would delete sibling runs' live stores. */
+export declare function assertNukeTarget(target: string, allowedBase: string): void;
 /** Docker argv for the nuke. Two things matter here:
  *
  *  1. The PARENT is mounted and the leaf removed by name -- mounting the target
@@ -23,7 +31,7 @@ export declare function nukeArgv(target: string): string[];
  *  reports a missing docker in its RESULT rather than throwing, and a caller
  *  that retries a doomed spawn forever (silently) is the failure mode to avoid.
  *  Throws only for an unsafe target -- see {@link assertNukeTarget}. */
-export declare function nukePathAsRoot(target: string, spawn?: NukeSpawn): boolean;
+export declare function nukePathAsRoot(target: string, allowedBase: string, spawn?: NukeSpawn): boolean;
 export interface OwnerScanDeps {
     readdir: (path: string) => string[];
     isDir: (path: string) => boolean;

package/root-nuke.js

@@ -7,27 +7,44 @@
 // prevention half.
 import { spawnSync } from "node:child_process";
 import { lstatSync, readdirSync } from "node:fs";
-import { basename, dirname, isAbsolute } from "node:path";
+import { basename, dirname, isAbsolute, resolve, sep } from "node:path";
 const NUKE_IMAGE = "alpine:3";
 const NUKE_TIMEOUT_MS = 60_000;
-/** Refuse a target that would turn the nuke into something catastrophic. The
- *  mount is the target's PARENT, so a target with no leaf ("/" or a trailing
- *  slash) means "delete the mount", and a relative path resolves against a cwd
- *  the container does not share. These are programming errors, not runtime
- *  conditions: throw loudly rather than run a root rm against a guess. */
-export function assertNukeTarget(target) {
+/** Refuse a target that would turn the nuke into something catastrophic.
+ *
+ *  `allowedBase` is the containment: the target must sit strictly INSIDE it.
+ *  Nothing else here is sufficient on its own, because the worst case passes
+ *  every structural check. Under `--daemon reuse` the harness's storeDir is the
+ *  developer's real `~/.norsk-ctl` -- absolute, ordinary leaf, no glob,
+ *  non-root parent -- and nuking it mounts $HOME into a root container and
+ *  removes the daemon's entire state: config, products, templates, instances.
+ *  Today only an early return in teardown keeps the nuke away from it, and a
+ *  guard that depends on a `return` staying put is not a guard.
+ *
+ *  The base itself is refused too: it is shared by concurrently running tiers,
+ *  so removing it would delete sibling runs' live stores. */
+export function assertNukeTarget(target, allowedBase) {
     if (!isAbsolute(target))
         throw new Error(`refusing to nuke a relative path: ${target}`);
     const leaf = basename(target);
     if (leaf === "" || leaf === "." || leaf === "..")
         throw new Error(`refusing to nuke a path with no leaf: ${target}`);
-    if (leaf === "*" || leaf.includes("*"))
+    if (leaf.includes("*"))
         throw new Error(`refusing to nuke a glob: ${target}`);
     // dirname is what gets bind-mounted; "/" would hand the whole host to a root
-    // container. Every real target (a store under test-temp) is nested deeper.
+    // container. Every real target (a store under the temp base) is nested deeper.
     if (dirname(target) === "/" || dirname(target) === target) {
         throw new Error(`refusing to nuke a top-level path (its parent would be the mount): ${target}`);
     }
+    // resolve() first so `..` cannot walk out, and compare with a trailing
+    // separator so `/x/test-temp-evil` does not pass as inside `/x/test-temp`.
+    const t = resolve(target);
+    const base = resolve(allowedBase);
+    if (t === base)
+        throw new Error(`refusing to nuke the temp base itself (concurrent runs live here): ${t}`);
+    if (!t.startsWith(base.endsWith(sep) ? base : base + sep)) {
+        throw new Error(`refusing to nuke ${t}: outside the test temp base ${base}`);
+    }
 }
 /** Docker argv for the nuke. Two things matter here:
  *
@@ -59,8 +76,8 @@ export function nukeArgv(target) {
  *  reports a missing docker in its RESULT rather than throwing, and a caller
  *  that retries a doomed spawn forever (silently) is the failure mode to avoid.
  *  Throws only for an unsafe target -- see {@link assertNukeTarget}. */
-export function nukePathAsRoot(target, spawn = spawnSync) {
-    assertNukeTarget(target);
+export function nukePathAsRoot(target, allowedBase, spawn = spawnSync) {
+    assertNukeTarget(target, allowedBase);
     const r = spawn("docker", nukeArgv(target), { timeout: NUKE_TIMEOUT_MS });
     return !r?.error;
 }

package/smoke.js

@@ -28,7 +28,7 @@ import { pollUntil } from "./poll.js";
 import { nukePathAsRoot, reportForeignOwners } from "./root-nuke.js";
 import { startSrtSources } from "./source-pump.js";
 import { applyTestHost, fetchComponentState, fetchComponents, fetchStreamMappings, isSrtListenerState, } from "./studio-state.js";
-import { makeStoreDir } from "./temp-dir.js";
+import { makeStoreDir, TEST_TMP_BASE } from "./temp-dir.js";
 const SMOKE_PORT_BASE = 33000;
 const SMOKE_BAND_WIDTH = 20;
 const SMOKE_BANDS = 50;
@@ -62,7 +62,7 @@ export const defaultSmokeDeps = {
         fetch: (url) => fetch(url, { signal: AbortSignal.timeout(5000) }),
     },
     cleanup: (opts) => cleanupDaemon({ ...opts, stopProxy: async () => { }, proxy: false }),
-    nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir),
+    nukeStoreAsRoot: (storeDir) => nukePathAsRoot(storeDir, TEST_TMP_BASE),
     storeExists: (storeDir) => existsSync(storeDir),
     ensureNetwork: () => ensureRunnerOnNetwork(),
     supportsNoPublish: ctlSupportsNoPublish,

package/temp-dir.js

@@ -122,7 +122,7 @@ function pruneStaleTempDirs(base) {
         nukeAsRoot: (p) => {
             if (nukeKnownUnavailable)
                 return false;
-            const ran = nukePathAsRoot(p);
+            const ran = nukePathAsRoot(p, base);
             if (!ran)
                 nukeKnownUnavailable = true;
             return ran;