@openparachute/hub 0.5.7 → 0.5.10-rc.10

package/src/__tests__/request-protocol.test.ts

@@ -0,0 +1,54 @@
+/**
+ * `isHttpsRequest` is the single signal cookie-mint helpers use to
+ * decide whether to set the `Secure` attribute. Wrong answer here
+ * causes browsers to silently drop cookies on HTTP localhost (Bug 1
+ * from the rc.5 fresh-machine test) OR mint Secure-less cookies behind
+ * a TLS-terminating reverse proxy (the opposite failure mode).
+ *
+ * Three signals tested, in priority order: direct URL scheme,
+ * X-Forwarded-Proto header, plain HTTP default.
+ */
+import { describe, expect, test } from "bun:test";
+import { isHttpsRequest } from "../request-protocol.ts";
+
+describe("isHttpsRequest", () => {
+  test("returns true for https:// request URL", () => {
+    expect(isHttpsRequest(new Request("https://hub.example/x"))).toBe(true);
+  });
+
+  test("returns false for http:// request URL", () => {
+    expect(isHttpsRequest(new Request("http://localhost:1939/x"))).toBe(false);
+  });
+
+  test("returns true when X-Forwarded-Proto: https on an http:// request", () => {
+    const req = new Request("http://hub.internal/x", {
+      headers: { "x-forwarded-proto": "https" },
+    });
+    expect(isHttpsRequest(req)).toBe(true);
+  });
+
+  test("returns false when X-Forwarded-Proto: http", () => {
+    const req = new Request("http://hub.internal/x", {
+      headers: { "x-forwarded-proto": "http" },
+    });
+    expect(isHttpsRequest(req)).toBe(false);
+  });
+
+  test("tolerates uppercase / whitespace / list shape in X-Forwarded-Proto", () => {
+    // Some proxies emit `https,http` (chain of two hops) or " HTTPS "
+    // with whitespace. The first token is what we honor.
+    expect(
+      isHttpsRequest(new Request("http://hub/x", { headers: { "x-forwarded-proto": " HTTPS " } })),
+    ).toBe(true);
+    expect(
+      isHttpsRequest(
+        new Request("http://hub/x", { headers: { "x-forwarded-proto": "https,http" } }),
+      ),
+    ).toBe(true);
+    expect(
+      isHttpsRequest(
+        new Request("http://hub/x", { headers: { "x-forwarded-proto": "http,https" } }),
+      ),
+    ).toBe(false);
+  });
+});

package/src/__tests__/serve-boot.test.ts

@@ -0,0 +1,193 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { bootSupervisedModules } from "../commands/serve-boot.ts";
+import { type ServiceEntry, writeManifest } from "../services-manifest.ts";
+import { type SpawnRequest, type SupervisedProc, Supervisor } from "../supervisor.ts";
+
+interface Harness {
+  dir: string;
+  manifestPath: string;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "serve-boot-"));
+  const manifestPath = join(dir, "services.json");
+  return {
+    dir,
+    manifestPath,
+    cleanup: () => rmSync(dir, { recursive: true, force: true }),
+  };
+}
+
+function makeFakeProc(pid: number): SupervisedProc & { resolveExit: (c: number | null) => void } {
+  let resolveExit!: (c: number | null) => void;
+  const exited = new Promise<number | null>((r) => {
+    resolveExit = r;
+  });
+  return {
+    pid,
+    exited,
+    stdout: null,
+    stderr: null,
+    kill: () => {},
+    resolveExit,
+  };
+}
+
+function makeRecorder(): {
+  spawn: (req: SpawnRequest) => SupervisedProc;
+  calls: SpawnRequest[];
+} {
+  const calls: SpawnRequest[] = [];
+  let nextPid = 1000;
+  return {
+    calls,
+    spawn: (req) => {
+      calls.push(req);
+      nextPid++;
+      return makeFakeProc(nextPid);
+    },
+  };
+}
+
+const VAULT_ENTRY: ServiceEntry = {
+  name: "parachute-vault",
+  port: 1940,
+  paths: ["/vault/default"],
+  health: "/vault/default/health",
+  version: "0.4.5",
+};
+
+const NOTES_ENTRY: ServiceEntry = {
+  name: "parachute-notes",
+  port: 1941,
+  paths: ["/notes"],
+  health: "/notes/health",
+  version: "0.3.15",
+};
+
+describe("bootSupervisedModules", () => {
+  let h: Harness;
+  beforeEach(() => {
+    h = makeHarness();
+  });
+  afterEach(() => h.cleanup());
+
+  test("spawns one supervisor child per first-party services.json row", async () => {
+    writeManifest({ services: [VAULT_ENTRY, NOTES_ENTRY] }, h.manifestPath);
+    const recorder = makeRecorder();
+    const sup = new Supervisor({ spawnFn: recorder.spawn });
+
+    const results = await bootSupervisedModules(sup, {
+      manifestPath: h.manifestPath,
+      configDir: h.dir,
+    });
+
+    expect(results).toHaveLength(2);
+    expect(results.every((r) => r.status === "started")).toBe(true);
+    expect(recorder.calls).toHaveLength(2);
+    const shorts = recorder.calls.map((c) => c.short).sort();
+    expect(shorts).toEqual(["notes", "vault"]);
+  });
+
+  test("empty services.json is a no-op", async () => {
+    writeManifest({ services: [] }, h.manifestPath);
+    const recorder = makeRecorder();
+    const sup = new Supervisor({ spawnFn: recorder.spawn });
+
+    const results = await bootSupervisedModules(sup, {
+      manifestPath: h.manifestPath,
+      configDir: h.dir,
+    });
+
+    expect(results).toEqual([]);
+    expect(recorder.calls).toEqual([]);
+  });
+
+  test("forwards PARACHUTE_HUB_ORIGIN to child env when set", async () => {
+    writeManifest({ services: [VAULT_ENTRY] }, h.manifestPath);
+    const recorder = makeRecorder();
+    const sup = new Supervisor({ spawnFn: recorder.spawn });
+
+    await bootSupervisedModules(sup, {
+      manifestPath: h.manifestPath,
+      configDir: h.dir,
+      hubOrigin: "https://hub.example",
+    });
+
+    expect(recorder.calls[0]?.env?.PARACHUTE_HUB_ORIGIN).toBe("https://hub.example");
+  });
+
+  test("merges per-module .env file into child env", async () => {
+    writeManifest({ services: [VAULT_ENTRY] }, h.manifestPath);
+    // Write a per-module .env at <configDir>/<short>/.env — what the
+    // on-box flow's install-time scribe-key prompt produces.
+    mkdirSync(join(h.dir, "vault"), { recursive: true });
+    writeFileSync(
+      join(h.dir, "vault", ".env"),
+      "SCRIBE_AUTH_TOKEN=secret-token\nSCRIBE_URL=http://127.0.0.1:3200\n",
+    );
+
+    const recorder = makeRecorder();
+    const sup = new Supervisor({ spawnFn: recorder.spawn });
+
+    await bootSupervisedModules(sup, {
+      manifestPath: h.manifestPath,
+      configDir: h.dir,
+    });
+
+    expect(recorder.calls[0]?.env?.SCRIBE_AUTH_TOKEN).toBe("secret-token");
+    expect(recorder.calls[0]?.env?.SCRIBE_URL).toBe("http://127.0.0.1:3200");
+  });
+
+  test("hubOrigin wins over a stale .env entry on collision", async () => {
+    writeManifest({ services: [VAULT_ENTRY] }, h.manifestPath);
+    mkdirSync(join(h.dir, "vault"), { recursive: true });
+    writeFileSync(join(h.dir, "vault", ".env"), "PARACHUTE_HUB_ORIGIN=http://stale.local\n");
+
+    const recorder = makeRecorder();
+    const sup = new Supervisor({ spawnFn: recorder.spawn });
+
+    await bootSupervisedModules(sup, {
+      manifestPath: h.manifestPath,
+      configDir: h.dir,
+      hubOrigin: "https://live.example",
+    });
+
+    // The live hub-origin from the runtime env beats the on-disk
+    // stale value — that's the resolveHubOrigin precedence carried
+    // over from lifecycle.ts.
+    expect(recorder.calls[0]?.env?.PARACHUTE_HUB_ORIGIN).toBe("https://live.example");
+  });
+
+  test("rows with no resolvable startCmd are skipped with reason", async () => {
+    // A third-party services.json entry that ALSO doesn't match a
+    // first-party fallback AND has no installDir → no spec.
+    const orphan: ServiceEntry = {
+      name: "@third-party/unknown",
+      port: 4000,
+      paths: ["/unknown"],
+      health: "/unknown/health",
+      version: "0.1.0",
+    };
+    writeManifest({ services: [orphan] }, h.manifestPath);
+    const recorder = makeRecorder();
+    const sup = new Supervisor({ spawnFn: recorder.spawn });
+    const logs: string[] = [];
+
+    const results = await bootSupervisedModules(sup, {
+      manifestPath: h.manifestPath,
+      configDir: h.dir,
+      log: (l) => logs.push(l),
+    });
+
+    expect(results).toHaveLength(1);
+    expect(results[0]?.status).toBe("skipped");
+    expect(results[0]?.reason).toBe("no-spec");
+    expect(recorder.calls).toEqual([]);
+    expect(logs.some((l) => l.includes("no startCmd resolvable"))).toBe(true);
+  });
+});

package/src/__tests__/serve.test.ts

@@ -0,0 +1,100 @@
+import { afterEach, beforeEach, describe, expect, mock, test } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { seedInitialAdminIfNeeded } from "../commands/serve.ts";
+import { openHubDb } from "../hub-db.ts";
+import { userCount } from "../users.ts";
+
+describe("seedInitialAdminIfNeeded", () => {
+  let dir: string;
+  let dbPath: string;
+
+  beforeEach(() => {
+    dir = mkdtempSync(join(tmpdir(), "parachute-serve-"));
+    dbPath = join(dir, "hub.db");
+  });
+
+  afterEach(() => {
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("returns 'needs-setup' on fresh state with no env vars", async () => {
+    const db = openHubDb(dbPath);
+    const result = await seedInitialAdminIfNeeded(db, {}, () => {});
+    expect(result).toBe("needs-setup");
+    expect(userCount(db)).toBe(0);
+  });
+
+  test("seeds an admin from PARACHUTE_INITIAL_ADMIN_* on fresh state", async () => {
+    const db = openHubDb(dbPath);
+    const log = mock<(line: string) => void>(() => {});
+    const result = await seedInitialAdminIfNeeded(
+      db,
+      {
+        PARACHUTE_INITIAL_ADMIN_USERNAME: "ops",
+        PARACHUTE_INITIAL_ADMIN_PASSWORD: "correct horse battery staple",
+      },
+      log,
+    );
+    expect(result).toBe("seeded");
+    expect(userCount(db)).toBe(1);
+    // The log line carries the username so operators can grep container
+    // logs to verify the seed fired.
+    expect(log).toHaveBeenCalledTimes(1);
+    expect(log.mock.calls[0]?.[0] ?? "").toContain("seeded initial admin");
+    expect(log.mock.calls[0]?.[0] ?? "").toContain("ops");
+  });
+
+  test("returns 'exists' when an admin already exists, even with env vars set", async () => {
+    // Seed once.
+    const db = openHubDb(dbPath);
+    await seedInitialAdminIfNeeded(
+      db,
+      {
+        PARACHUTE_INITIAL_ADMIN_USERNAME: "ops",
+        PARACHUTE_INITIAL_ADMIN_PASSWORD: "first-pw",
+      },
+      () => {},
+    );
+
+    // Same env on a second boot must NOT clobber the existing admin —
+    // the seed is first-boot only. (Container restart with the env still
+    // set from the Render dashboard is the canonical second-boot.)
+    const result = await seedInitialAdminIfNeeded(
+      db,
+      {
+        PARACHUTE_INITIAL_ADMIN_USERNAME: "ops",
+        PARACHUTE_INITIAL_ADMIN_PASSWORD: "different-pw",
+      },
+      () => {},
+    );
+    expect(result).toBe("exists");
+    expect(userCount(db)).toBe(1);
+  });
+
+  test("treats whitespace-only username as missing (needs-setup)", async () => {
+    const db = openHubDb(dbPath);
+    const result = await seedInitialAdminIfNeeded(
+      db,
+      {
+        PARACHUTE_INITIAL_ADMIN_USERNAME: "   ",
+        PARACHUTE_INITIAL_ADMIN_PASSWORD: "pw",
+      },
+      () => {},
+    );
+    expect(result).toBe("needs-setup");
+    expect(userCount(db)).toBe(0);
+  });
+
+  test("requires both username and password — half-set env is needs-setup", async () => {
+    const db = openHubDb(dbPath);
+    const result = await seedInitialAdminIfNeeded(
+      db,
+      { PARACHUTE_INITIAL_ADMIN_USERNAME: "ops" },
+      () => {},
+    );
+    expect(result).toBe("needs-setup");
+    expect(userCount(db)).toBe(0);
+  });
+});

package/src/__tests__/sessions.test.ts

@@ -81,7 +81,7 @@ describe("deleteSession", () => {
 });
 
 describe("buildSessionCookie", () => {
-  test("emits the expected attributes", () => {
+  test("emits the expected attributes (default secure)", () => {
     const v = buildSessionCookie("abc", 86400);
     expect(v).toContain(`${SESSION_COOKIE_NAME}=abc`);
     expect(v).toContain("HttpOnly");
@@ -91,16 +91,39 @@ describe("buildSessionCookie", () => {
     expect(v).not.toContain("Path=/oauth");
     expect(v).toContain("Max-Age=86400");
   });
+
+  // Bug 1 (rc.5 → rc.6) regression: session cookies minted over plain
+  // HTTP must NOT carry Secure or browsers drop them, leaving the
+  // operator un-signed-in on the very next request.
+  test("omits Secure when secure: false (HTTP localhost)", () => {
+    const v = buildSessionCookie("abc", 86400, { secure: false });
+    expect(v).toContain(`${SESSION_COOKIE_NAME}=abc`);
+    expect(v).toContain("HttpOnly");
+    expect(v).not.toContain("Secure");
+    expect(v).toContain("SameSite=Lax");
+  });
+
+  test("keeps Secure when secure: true (explicit)", () => {
+    const v = buildSessionCookie("abc", 86400, { secure: true });
+    expect(v).toContain("Secure");
+  });
 });
 
 describe("buildSessionClearCookie", () => {
-  test("emits Max-Age=0", () => {
+  test("emits Max-Age=0 (default secure)", () => {
     const v = buildSessionClearCookie();
     expect(v).toContain(`${SESSION_COOKIE_NAME}=`);
     expect(v).toContain("Max-Age=0");
+    expect(v).toContain("Secure");
     expect(v).toContain("Path=/");
     expect(v).not.toContain("Path=/oauth");
   });
+
+  test("omits Secure when secure: false (HTTP localhost)", () => {
+    const v = buildSessionClearCookie({ secure: false });
+    expect(v).not.toContain("Secure");
+    expect(v).toContain("Max-Age=0");
+  });
 });
 
 describe("parseSessionCookie", () => {

package/src/__tests__/setup-gate.test.ts

@@ -0,0 +1,222 @@
+/**
+ * Pre-admin setup gate (hub#258). When the hub boots with no admin row
+ * (the fresh container case), admin-onboarding-coupled surfaces 503
+ * with `{error: "setup_required", setup_url: "/admin/setup"}` so
+ * callers can branch on the shape rather than scrape an HTML page.
+ *
+ * Gated routes (require an admin to be useful): `/login`, `/logout`,
+ * `/admin/*` (except `/admin/setup`), `/api/*`.
+ *
+ * Routes that pass through (platform health, public discovery, OAuth
+ * third-party flows, content proxies, the setup page itself):
+ *
+ *   /health, /, /hub.html, /.well-known/*, /admin/setup,
+ *   /oauth/*, /vault/*, /<service>/*
+ *
+ * Once an admin row exists, the gate is a no-op — the rest of dispatch
+ * runs as normal. The `/admin/setup` route 301s to /login at that
+ * point so a stale bookmark still lands somewhere.
+ */
+
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { hubDbPath, openHubDb } from "../hub-db.ts";
+import { hubFetch } from "../hub-server.ts";
+import { writeManifest } from "../services-manifest.ts";
+import { createUser } from "../users.ts";
+
+interface Harness {
+  dir: string;
+  cleanup: () => void;
+}
+
+function makeHarness(): Harness {
+  const dir = mkdtempSync(join(tmpdir(), "setup-gate-"));
+  // Minimal hub.html so the `/` route resolves without a 404.
+  writeFileSync(join(dir, "hub.html"), "<html>discovery</html>");
+  writeManifest({ services: [] }, join(dir, "services.json"));
+  return {
+    dir,
+    cleanup: () => rmSync(dir, { recursive: true, force: true }),
+  };
+}
+
+function req(path: string, init: RequestInit = {}): Request {
+  return new Request(`http://127.0.0.1:1939${path}`, init);
+}
+
+describe("setup gate (no admin yet)", () => {
+  let h: Harness;
+  beforeEach(() => {
+    h = makeHarness();
+  });
+  afterEach(() => h.cleanup());
+
+  test("503s gated admin/api routes with setup_required body", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      // `/api/me` is a representative gated route — admin SPA bootstrap
+      // can't function without an operator identity behind it.
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/api/me"));
+      expect(res.status).toBe(503);
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.error).toBe("setup_required");
+      expect(body.setup_url).toBe("/admin/setup");
+      expect(typeof body.error_description).toBe("string");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("503s /login when no admin exists", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/login"));
+      expect(res.status).toBe(503);
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.error).toBe("setup_required");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("/oauth/register passes through the gate (third-party DCR doesn't need admin)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        issuer: "https://hub.example",
+      })(
+        req("/oauth/register", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ redirect_uris: ["https://app.example/cb"] }),
+        }),
+      );
+      // Either 201 (registered) or 4xx (validation rejection) — the
+      // point is NOT 503-setup_required. OAuth surfaces operate
+      // independently of the admin-onboarding state.
+      expect(res.status).not.toBe(503);
+    } finally {
+      db.close();
+    }
+  });
+
+  test("/health passes through the gate", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/health"));
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as Record<string, unknown>;
+      expect(body.status).toBe("ok");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("/.well-known/jwks.json passes through the gate", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/.well-known/jwks.json"));
+      // Empty keys array is the no-rotation-yet shape, but the route is
+      // reachable — not gated to 503.
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { keys: unknown[] };
+      expect(Array.isArray(body.keys)).toBe(true);
+    } finally {
+      db.close();
+    }
+  });
+
+  // Bug 2 (rc.5 → rc.6) regression: on a fresh hub, GET `/` should
+  // funnel straight to the wizard rather than render the static
+  // portal — the operator otherwise has to manually navigate to
+  // `/admin/setup`. The portal pre-setup carries no usable signal
+  // (no installed services to discover, no admin to sign in as).
+  test("/ 302s to /admin/setup when no admin exists (fresh-hub funnel)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin/setup");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("/hub.html 302s to /admin/setup when no admin exists", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/hub.html"));
+      expect(res.status).toBe(302);
+      expect(res.headers.get("location")).toBe("/admin/setup");
+    } finally {
+      db.close();
+    }
+  });
+
+  test("/admin/setup renders the wizard (account step) when no admin exists", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      const res = await hubFetch(h.dir, { getDb: () => db })(req("/admin/setup"));
+      expect(res.status).toBe(200);
+      expect(res.headers.get("content-type")).toContain("text/html");
+      const html = await res.text();
+      // Spot-check the wizard is rendering its account-step form (hub#259
+      // replaced the env-var-only placeholder with a real wizard, but the
+      // env-var path is still surfaced as the "alt-path" disclosure).
+      expect(html).toContain('action="/admin/setup/account"');
+      expect(html).toContain("PARACHUTE_INITIAL_ADMIN_USERNAME");
+      expect(html).toContain("PARACHUTE_INITIAL_ADMIN_PASSWORD");
+    } finally {
+      db.close();
+    }
+  });
+});
+
+describe("setup gate (admin exists)", () => {
+  let h: Harness;
+  beforeEach(() => {
+    h = makeHarness();
+  });
+  afterEach(() => h.cleanup());
+
+  test("no-ops once an admin row exists — operator routes resume normal dispatch", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      await createUser(db, "owner", "pw");
+      // /oauth/token rejects GET with 405 in normal dispatch (it's a
+      // POST-only endpoint). If the gate were still firing this would
+      // come back 503; the 405 confirms regular dispatch resumed.
+      const res = await hubFetch(h.dir, { getDb: () => db })(
+        req("/oauth/token", { method: "GET" }),
+      );
+      expect(res.status).toBe(405);
+    } finally {
+      db.close();
+    }
+  });
+
+  test("/admin/setup resumes at the vault step when admin exists but vault doesn't (hub#259)", async () => {
+    const db = openHubDb(hubDbPath(h.dir));
+    try {
+      await createUser(db, "owner", "pw");
+      const res = await hubFetch(h.dir, {
+        getDb: () => db,
+        manifestPath: join(h.dir, "services.json"),
+      })(req("/admin/setup"));
+      // With admin in place but no vault entry in services.json, the
+      // wizard's GET resumes at step 3 — the vault-name form — rather
+      // than 301-ing to /login. The 301-to-/login fires only once BOTH
+      // admin and vault are in place; that case is exercised in the
+      // setup-wizard suite where the manifest is seeded.
+      expect(res.status).toBe(200);
+      const html = await res.text();
+      expect(html).toContain('action="/admin/setup/vault"');
+    } finally {
+      db.close();
+    }
+  });
+});