@red-hat-developer-hub/e2e-test-utils 2.1.11 → 2.1.14

package/dist/playwright/helpers/github-session.test.js

@@ -0,0 +1,199 @@
+import { describe, it } from "node:test";
+import assert from "node:assert";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { ensureGithubSession, githubSessionFile, readStoredCookies, withGithubSessionLock, writeStorageStateAtomically, } from "./common.js";
+const tmp = () => fs.mkdtempSync(path.join(os.tmpdir(), "gh-session-test-"));
+describe("github session file naming", () => {
+    it("gives two users different files, and is stable for one user", () => {
+        assert.notStrictEqual(githubSessionFile("user-a"), githubSessionFile("user-b"));
+        assert.strictEqual(githubSessionFile("rhdh-qe"), githubSessionFile("rhdh-qe"));
+    });
+    it("is deliberately not keyed by project", () => {
+        // Scoping per project was the obvious fix and is the wrong one: logintoGithub
+        // derives its 2FA code from one shared TOTP secret, so lanes logging in within the
+        // same 30-second window submit the identical code and GitHub rejects the second.
+        // Sharing the session is the point; withGithubSessionLock is what makes it safe.
+        const file = githubSessionFile("rhdh-qe");
+        assert.doesNotMatch(path.basename(file), /app-next|project/);
+    });
+    it("is absolute, so it does not follow a later chdir", () => {
+        assert.ok(path.isAbsolute(githubSessionFile("rhdh-qe")));
+    });
+    it("keeps a separator in the user id inside one file name", () => {
+        // Otherwise it becomes a directory that does not exist and the write fails.
+        assert.strictEqual(path.dirname(githubSessionFile("org/user")), process.cwd());
+    });
+    it("does not throw when the GitHub user id is unset", () => {
+        // loginAsGithubUser defaults to `process.env.VAULT_GH_USER_ID as string`, and the
+        // cast hides the undefined. Building the path must not be where that surfaces —
+        // a TypeError here points nowhere near the missing variable.
+        assert.doesNotThrow(() => githubSessionFile(undefined));
+    });
+});
+describe("the session lock", () => {
+    it("holds off a second caller until the first is done", async () => {
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        const order = [];
+        let held = () => { };
+        const acquired = new Promise((resolve) => {
+            held = resolve;
+        });
+        // The second caller must not start until the first demonstrably holds the lock —
+        // racing them from the same tick would test the scheduler, not the lock.
+        const first = withGithubSessionLock(file, async () => {
+            order.push("first-in");
+            held();
+            await new Promise((resolve) => setTimeout(resolve, 50));
+            order.push("first-out");
+        });
+        await acquired;
+        const second = withGithubSessionLock(file, async () => {
+            order.push("second-in");
+        });
+        await Promise.all([first, second]);
+        assert.deepStrictEqual(order, ["first-in", "first-out", "second-in"]);
+    });
+    it("releases the lock when the body throws", async () => {
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        await assert.rejects(withGithubSessionLock(file, async () => {
+            throw new Error("boom");
+        }));
+        // A lock held after a failed login would hang every other lane for `stale`.
+        await withGithubSessionLock(file, async () => { });
+    });
+});
+describe("writing a stored session", () => {
+    /** Enough of a Page for the write path; a real one needs a browser. */
+    const fakePage = (write) => ({
+        context: () => ({
+            storageState: async ({ path: target }) => write(target),
+        }),
+    });
+    it("leaves only the final file behind", async () => {
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        await writeStorageStateAtomically(fakePage((target) => fs.writeFileSync(target, '{"cookies":[]}')), file);
+        assert.deepStrictEqual(fs.readdirSync(dir), ["s.json"]);
+    });
+    it("removes the temp file when the write fails", async () => {
+        // Otherwise a failed run litters the workspace's e2e-tests directory, where
+        // nothing gitignores authState*.
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        await assert.rejects(writeStorageStateAtomically(fakePage((target) => {
+            fs.writeFileSync(target, "partial");
+            throw new Error("browser went away");
+        }), file));
+        assert.deepStrictEqual(fs.readdirSync(dir), []);
+    });
+});
+describe("reading a stored session", () => {
+    it("returns the cookies of a well-formed file", () => {
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        fs.writeFileSync(file, JSON.stringify({ cookies: [{ name: "a" }] }));
+        assert.deepStrictEqual(readStoredCookies(file), [{ name: "a" }]);
+    });
+    it("returns undefined rather than throwing on a truncated file", () => {
+        // What a concurrent reader saw while storageState() was mid-write. It used to
+        // come out of JSON.parse as a test failure that looked like a plugin bug.
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        fs.writeFileSync(file, '{"cookies":[{"name"');
+        assert.strictEqual(readStoredCookies(file), undefined);
+    });
+    it("returns undefined for a file that does not exist", () => {
+        assert.strictEqual(readStoredCookies(path.join(tmp(), "absent.json")), undefined);
+    });
+    it("treats an empty cookie list as no session", () => {
+        // Reusing it would send the user through a login the caller thinks it skipped.
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        fs.writeFileSync(file, JSON.stringify({ cookies: [] }));
+        assert.strictEqual(readStoredCookies(file), undefined);
+    });
+    it("treats a file with no cookies key as no session", () => {
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        fs.writeFileSync(file, JSON.stringify({ origins: [] }));
+        assert.strictEqual(readStoredCookies(file), undefined);
+    });
+});
+describe("ensuring the shared session", () => {
+    const writeSession = (file) => fs.writeFileSync(file, JSON.stringify({ cookies: [{ name: "a" }] }));
+    it("reuses an existing session without taking the lock", async () => {
+        // The point of the split: reuse is cookies plus a Sign In against a different
+        // namespace host. Holding the lock across it made every lane queue behind one
+        // sign-in it did not need. Proven by holding the lock elsewhere — if reuse
+        // still waited on it, this would block until the holder released.
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        writeSession(file);
+        let release = () => { };
+        const holding = new Promise((resolve) => {
+            release = resolve;
+        });
+        let held = () => { };
+        const acquired = new Promise((resolve) => {
+            held = resolve;
+        });
+        const holder = withGithubSessionLock(file, async () => {
+            held();
+            await holding;
+        });
+        // Wait until the lock is demonstrably held. Starting from the same tick races
+        // the scheduler instead of the lock, and the result then depends on how loaded
+        // the run is — it passed alone and passed under the full suite for different
+        // reasons, neither of them the one under test.
+        await acquired;
+        try {
+            // Bounded rather than a plain await: if reuse ever waits on the lock again
+            // this deadlocks, and a hung CI job is harder to read than a failed
+            // assertion. proper-lockfile retries for 60s, far past this deadline.
+            const outcome = await Promise.race([
+                ensureGithubSession(file, async () => {
+                    throw new Error("must not create when a session already exists");
+                }),
+                new Promise((_, reject) => {
+                    setTimeout(() => reject(new Error("reuse waited on the session lock")), 2_000).unref();
+                }),
+            ]);
+            assert.strictEqual(outcome, "reused");
+        }
+        finally {
+            release();
+            await holder;
+        }
+    });
+    it("creates once when two callers find no session at the same time", async () => {
+        // Both pass the outer check, so the re-read inside the lock is the only thing
+        // stopping the second from logging in again and submitting the same TOTP code.
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        let creates = 0;
+        const create = async () => {
+            creates += 1;
+            await new Promise((resolve) => setTimeout(resolve, 20));
+            writeSession(file);
+        };
+        const outcomes = await Promise.all([
+            ensureGithubSession(file, create),
+            ensureGithubSession(file, create),
+        ]);
+        assert.strictEqual(creates, 1);
+        assert.deepStrictEqual(outcomes.filter((o) => o === "created").length, 1);
+        assert.deepStrictEqual(outcomes.filter((o) => o === "reused").length, 1);
+    });
+    it("reports creation so the caller does not replay the reuse path", async () => {
+        // Creating leaves the page signed in. A "created" that read as "reused" would
+        // click Sign In a second time against a live session.
+        const dir = tmp();
+        const file = path.join(dir, "s.json");
+        const outcome = await ensureGithubSession(file, async () => writeSession(file));
+        assert.strictEqual(outcome, "created");
+    });
+});

package/dist/playwright/tests/global-setup.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=global-setup.test.d.ts.map

package/dist/playwright/tests/global-setup.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-setup.test.d.ts","sourceRoot":"","sources":["../../../src/playwright/tests/global-setup.test.ts"],"names":[],"mappings":""}

package/dist/playwright/tests/global-setup.test.js

@@ -0,0 +1,68 @@
+/* eslint-disable playwright/expect-expect, playwright/no-conditional-in-test -- this is a node:test regression suite */
+import assert from "node:assert/strict";
+import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { loadDotenvFromProjects } from "../global-setup.js";
+test("workspace .env values override inherited values", async (context) => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "global-setup-test-"));
+    const e2eRoot = path.join(root, "e2e-tests");
+    const testDir = path.join(e2eRoot, "tests");
+    await mkdir(testDir, { recursive: true });
+    await writeFile(path.join(e2eRoot, ".env"), "VAULT_GITHUB_TOKEN=dotenv-value\nBW_SESSION=dotenv-session\nVAULT_TOKEN=dotenv-token\nLOCAL_ONLY=dotenv-only\n");
+    const previousToken = process.env.VAULT_GITHUB_TOKEN;
+    const previousSession = process.env.BW_SESSION;
+    const previousProviderToken = process.env.VAULT_TOKEN;
+    const previousLocal = process.env.LOCAL_ONLY;
+    const previousCi = process.env.CI;
+    try {
+        await context.test("local .env values override inherited values", () => {
+            delete process.env.CI;
+            process.env.VAULT_GITHUB_TOKEN = "bitwarden-value";
+            process.env.BW_SESSION = "parent-session";
+            process.env.VAULT_TOKEN = "parent-token";
+            delete process.env.LOCAL_ONLY;
+            loadDotenvFromProjects({ projects: [{ testDir }] });
+            assert.equal(process.env.VAULT_GITHUB_TOKEN, "dotenv-value");
+            assert.equal(process.env.BW_SESSION, "dotenv-session");
+            assert.equal(process.env.VAULT_TOKEN, "dotenv-token");
+            assert.equal(process.env.LOCAL_ONLY, "dotenv-only");
+        });
+        await context.test("workspace .env values override CI values", () => {
+            process.env.CI = "true";
+            process.env.VAULT_GITHUB_TOKEN = "ci-value";
+            process.env.BW_SESSION = "ci-session";
+            process.env.VAULT_TOKEN = "ci-token";
+            delete process.env.LOCAL_ONLY;
+            loadDotenvFromProjects({ projects: [{ testDir }] });
+            assert.equal(process.env.VAULT_GITHUB_TOKEN, "dotenv-value");
+            assert.equal(process.env.BW_SESSION, "dotenv-session");
+            assert.equal(process.env.VAULT_TOKEN, "dotenv-token");
+            assert.equal(process.env.LOCAL_ONLY, "dotenv-only");
+        });
+    }
+    finally {
+        if (previousToken === undefined)
+            delete process.env.VAULT_GITHUB_TOKEN;
+        else
+            process.env.VAULT_GITHUB_TOKEN = previousToken;
+        if (previousSession === undefined)
+            delete process.env.BW_SESSION;
+        else
+            process.env.BW_SESSION = previousSession;
+        if (previousProviderToken === undefined)
+            delete process.env.VAULT_TOKEN;
+        else
+            process.env.VAULT_TOKEN = previousProviderToken;
+        if (previousLocal === undefined)
+            delete process.env.LOCAL_ONLY;
+        else
+            process.env.LOCAL_ONLY = previousLocal;
+        if (previousCi === undefined)
+            delete process.env.CI;
+        else
+            process.env.CI = previousCi;
+        await rm(root, { recursive: true, force: true });
+    }
+});

package/dist/secrets/bitwarden.d.ts

@@ -0,0 +1,34 @@
+import { type CommandResult } from "./command.js";
+import { type ExpandedSecretSelector, type ReadableCollectionId } from "./config.js";
+export interface BitwardenCommandRunner {
+    (command: string, args: readonly string[], options?: {
+        env?: NodeJS.ProcessEnv;
+        input?: string;
+    }): Promise<CommandResult>;
+}
+export interface BitwardenSecret {
+    id: string;
+    name: string;
+    value: string;
+    selector: ExpandedSecretSelector;
+}
+export interface BitwardenAttachment {
+    id: string;
+    fileName: string;
+}
+export interface BitwardenClientOptions {
+    command?: string;
+    env?: NodeJS.ProcessEnv;
+    runner?: BitwardenCommandRunner;
+}
+export declare class BitwardenClient {
+    private readonly command;
+    private readonly env;
+    private readonly runner;
+    constructor(options?: BitwardenClientOptions);
+    read(collectionId: ReadableCollectionId, selectors: readonly ExpandedSecretSelector[]): Promise<BitwardenSecret[]>;
+    private resolveCollection;
+    private readSelector;
+    private runOrThrow;
+}
+//# sourceMappingURL=bitwarden.d.ts.map

package/dist/secrets/bitwarden.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden.d.ts","sourceRoot":"","sources":["../../src/secrets/bitwarden.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EAC1B,MAAM,aAAa,CAAC;AAErB,MAAM,WAAW,sBAAsB;IACrC,CACE,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE;QACR,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GACA,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;CAClB;AAQD,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,sBAAsB,CAAC;CACjC;AAED,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;gBAEpC,OAAO,GAAE,sBAA2B;IAM1C,IAAI,CACR,YAAY,EAAE,oBAAoB,EAClC,SAAS,EAAE,SAAS,sBAAsB,EAAE,GAC3C,OAAO,CAAC,eAAe,EAAE,CAAC;YA4Cf,iBAAiB;YA0CjB,YAAY;YA0HZ,UAAU;CAazB"}

package/dist/secrets/bitwarden.js

@@ -0,0 +1,193 @@
+import { runCommand } from "./command.js";
+import { getCollectionMapping, } from "./config.js";
+export class BitwardenClient {
+    command;
+    env;
+    runner;
+    constructor(options = {}) {
+        this.command = options.command ?? "bw";
+        this.env = { ...process.env, ...options.env };
+        this.runner = options.runner ?? runCommand;
+    }
+    async read(collectionId, selectors) {
+        const mapping = getCollectionMapping(collectionId);
+        if (!this.env.BW_SESSION?.trim()) {
+            throw new Error("BW_SESSION is required and must contain an unlocked Bitwarden session");
+        }
+        await this.runOrThrow(["--version"], "Bitwarden CLI is unavailable");
+        const status = await this.runOrThrow(["status"], "Bitwarden session status could not be checked");
+        const statusJson = parseJson(status, "Bitwarden status");
+        if (!isRecord(statusJson) || statusJson.status !== "unlocked") {
+            throw new Error("BW_SESSION is missing or Bitwarden is not unlocked");
+        }
+        await this.runOrThrow(["sync"], "Bitwarden sync failed");
+        const collection = await this.resolveCollection(mapping.bitwardenCollection);
+        const result = [];
+        const names = new Set();
+        for (const selector of selectors) {
+            const items = await this.readSelector(collection, selector);
+            if (items.length === 0 && !selector.optional) {
+                throw new Error(`Required prefix has no matching item: ${selector.prefix}`);
+            }
+            for (const item of items) {
+                if (names.has(item.name)) {
+                    throw new Error(`Duplicate Bitwarden item name: ${item.name}`);
+                }
+                names.add(item.name);
+                result.push(item);
+            }
+        }
+        return result;
+    }
+    async resolveCollection(collectionName) {
+        const result = await this.runOrThrow(["list", "collections"], "Bitwarden collection listing failed");
+        const values = parseJson(result, "Bitwarden collection list");
+        if (!Array.isArray(values)) {
+            throw new Error("Bitwarden returned an invalid collection list");
+        }
+        const matches = values.filter((value) => isRecord(value) && value.name === collectionName);
+        if (matches.length === 0) {
+            throw new Error(`Bitwarden collection not found: ${collectionName}`);
+        }
+        if (matches.length > 1) {
+            throw new Error(`Bitwarden collection name is ambiguous: ${collectionName}`);
+        }
+        const match = matches[0];
+        if (typeof match.id !== "string" ||
+            typeof match.name !== "string" ||
+            typeof match.organizationId !== "string") {
+            throw new Error(`Bitwarden collection has invalid metadata: ${collectionName}`);
+        }
+        return {
+            id: match.id,
+            name: match.name,
+            organizationId: match.organizationId,
+        };
+    }
+    async readSelector(collection, selector) {
+        const result = await this.runOrThrow([
+            "list",
+            "items",
+            "--collectionid",
+            collection.id,
+            "--search",
+            selector.prefix,
+        ], `Bitwarden item listing failed for ${selector.prefix}`);
+        const values = parseJson(result, `Bitwarden item list for ${selector.prefix}`);
+        if (!Array.isArray(values)) {
+            throw new Error(`Bitwarden returned an invalid item list for ${selector.prefix}`);
+        }
+        const ids = values.flatMap((value) => {
+            if (!isRecord(value) ||
+                typeof value.id !== "string" ||
+                value.id.length === 0) {
+                throw new Error(`Bitwarden returned an item without an id for ${selector.prefix}`);
+            }
+            if (typeof value.name === "string" &&
+                !value.name.startsWith(selector.prefix)) {
+                return [];
+            }
+            return [value.id];
+        });
+        if (new Set(ids).size !== ids.length) {
+            throw new Error(`Duplicate Bitwarden item id for ${selector.prefix}`);
+        }
+        const items = [];
+        for (const id of ids) {
+            const itemResult = await this.runOrThrow(["get", "item", id], `Bitwarden item read failed for ${selector.prefix}`);
+            const value = parseJson(itemResult, `Bitwarden item ${id}`);
+            if (!isRecord(value)) {
+                throw new Error(`Bitwarden returned an invalid item for ${selector.prefix}`);
+            }
+            if (typeof value.name !== "string" ||
+                !value.name.startsWith(selector.prefix)) {
+                continue;
+            }
+            if (value.id !== id ||
+                value.type !== 2 ||
+                !Array.isArray(value.collectionIds) ||
+                value.collectionIds.length !== 1 ||
+                value.collectionIds[0] !== collection.id ||
+                value.organizationId !== collection.organizationId) {
+                throw new Error(`Bitwarden item ${typeof value.name === "string" ? value.name : id} is not a secure note in the selected collection`);
+            }
+            const attachment = parseAttachment(value.attachments, selector.prefix);
+            if (attachment === undefined) {
+                if (typeof value.notes !== "string") {
+                    throw new Error(`Bitwarden item ${value.name} is not a secure note in the selected collection`);
+                }
+                items.push({
+                    id,
+                    name: value.name,
+                    value: value.notes,
+                    selector,
+                });
+                continue;
+            }
+            if (value.notes !== null &&
+                (typeof value.notes !== "string" || value.notes.length > 0)) {
+                throw new Error(`Bitwarden item notes must be null or empty when an attachment is present for ${selector.prefix}`);
+            }
+            if (attachment.fileName !== attachmentFileName(value.name)) {
+                throw new Error(`Bitwarden attachment filename does not match the item basename for ${selector.prefix}`);
+            }
+            const attachmentResult = await this.runOrThrow(["get", "attachment", attachment.fileName, "--itemid", id, "--raw"], `Bitwarden attachment read failed for ${selector.prefix}`);
+            items.push({
+                id,
+                name: value.name,
+                value: attachmentResult.stdout,
+                selector,
+            });
+        }
+        return items;
+    }
+    async runOrThrow(args, message) {
+        let result;
+        try {
+            result = await this.runner(this.command, args, { env: this.env });
+        }
+        catch {
+            throw new Error(message);
+        }
+        if (result.status !== 0)
+            throw new Error(message);
+        return result;
+    }
+}
+function parseJson(result, label) {
+    try {
+        return JSON.parse(result.stdout);
+    }
+    catch {
+        throw new Error(`${label} returned invalid JSON`);
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseAttachment(value, prefix) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (!Array.isArray(value)) {
+        throw new Error(`Bitwarden item has invalid attachment metadata for ${prefix}`);
+    }
+    if (value.length === 0)
+        return undefined;
+    if (value.length !== 1) {
+        throw new Error(`Bitwarden item must have exactly one attachment for ${prefix}`);
+    }
+    const attachment = value[0];
+    if (!isRecord(attachment) ||
+        typeof attachment.id !== "string" ||
+        attachment.id.length === 0 ||
+        typeof attachment.fileName !== "string" ||
+        attachment.fileName.length === 0) {
+        throw new Error(`Bitwarden item has invalid attachment metadata for ${prefix}`);
+    }
+    return { id: attachment.id, fileName: attachment.fileName };
+}
+function attachmentFileName(name) {
+    const basename = name.split("/").at(-1) ?? name;
+    const sanitized = basename.replace(/[^A-Za-z0-9._-]/g, "_");
+    return sanitized || "secret";
+}

package/dist/secrets/cli.d.ts

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+export interface ExecCliArguments {
+    command: "exec";
+    profilePath: string;
+    workspaces: string[];
+    executable: string;
+    args: string[];
+}
+export declare function parseCliArguments(argv: readonly string[]): ExecCliArguments;
+export declare function main(argv?: readonly string[]): Promise<number>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/secrets/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../src/secrets/cli.ts"],"names":[],"mappings":";AASA,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;CAChB;AAUD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,gBAAgB,CAkD3E;AAED,wBAAsB,IAAI,CACxB,IAAI,GAAE,SAAS,MAAM,EAA0B,GAC9C,OAAO,CAAC,MAAM,CAAC,CAwBjB"}

package/dist/secrets/cli.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import { realpathSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
+import { executeCommand } from "./exec.js";
+import { parseProfile } from "./config.js";
+const HELP = `Usage:
+  rhdh-e2e-secrets exec --profile <profile.json> [--workspace <name> ...] -- <command> [args...]
+
+Requirements:
+  BW_SESSION must contain an already unlocked Bitwarden CLI session.
+  The bw CLI must be installed and available on PATH.
+`;
+export function parseCliArguments(argv) {
+    if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+        throw new Error(HELP);
+    }
+    if (argv[0] !== "exec") {
+        throw new Error(`Unsupported command: ${argv[0]}`);
+    }
+    const delimiter = argv.indexOf("--");
+    if (delimiter === -1) {
+        throw new Error("A command after -- is required");
+    }
+    const options = argv.slice(1, delimiter);
+    const command = argv[delimiter + 1];
+    const args = argv.slice(delimiter + 2);
+    let profilePath;
+    const workspaces = [];
+    for (let index = 0; index < options.length; index++) {
+        const option = options[index];
+        if (option === "--profile" || option === "--workspace") {
+            const value = options[++index];
+            if (!value)
+                throw new Error(`${option} requires a value`);
+            if (option === "--profile")
+                profilePath = value;
+            else
+                workspaces.push(value);
+            continue;
+        }
+        if (option.startsWith("--profile=")) {
+            profilePath = option.slice("--profile=".length);
+            if (!profilePath)
+                throw new Error("--profile requires a value");
+            continue;
+        }
+        if (option.startsWith("--workspace=")) {
+            const workspace = option.slice("--workspace=".length);
+            if (!workspace)
+                throw new Error("--workspace requires a value");
+            workspaces.push(workspace);
+            continue;
+        }
+        throw new Error(`Unknown option: ${option}`);
+    }
+    if (!profilePath)
+        throw new Error("--profile is required");
+    if (!command)
+        throw new Error("A non-empty command after -- is required");
+    return {
+        command: "exec",
+        profilePath,
+        workspaces,
+        executable: command,
+        args,
+    };
+}
+export async function main(argv = process.argv.slice(2)) {
+    if (argv.length === 0 || argv[0] === "--help" || argv[0] === "-h") {
+        console.log(HELP);
+        return 0;
+    }
+    try {
+        const parsed = parseCliArguments(argv);
+        const profileValue = JSON.parse(await readFile(resolve(parsed.profilePath), "utf8"));
+        const profile = parseProfile(profileValue);
+        return await executeCommand({
+            profile,
+            workspaces: parsed.workspaces,
+            command: parsed.executable,
+            args: parsed.args,
+        });
+    }
+    catch (error) {
+        console.error(error instanceof Error ? error.message : "Secret execution failed");
+        return 1;
+    }
+}
+if (process.argv[1] &&
+    realpathSync(process.argv[1]) === realpathSync(fileURLToPath(import.meta.url))) {
+    void main().then((exitCode) => {
+        process.exitCode = exitCode;
+    }, () => {
+        process.exitCode = 1;
+    });
+}

package/dist/secrets/command.d.ts

@@ -0,0 +1,15 @@
+export interface CommandResult {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+    error?: Error;
+}
+export interface CommandOptions {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    input?: string;
+    stdio?: "pipe" | "inherit";
+}
+export type CommandRunner = (command: string, args: readonly string[], options?: CommandOptions) => Promise<CommandResult>;
+export declare const runCommand: CommandRunner;
+//# sourceMappingURL=command.d.ts.map

package/dist/secrets/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../src/secrets/command.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,KAAK,CAAC;CACf;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5B;AAED,MAAM,MAAM,aAAa,GAAG,CAC1B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,CAAC,EAAE,cAAc,KACrB,OAAO,CAAC,aAAa,CAAC,CAAC;AAE5B,eAAO,MAAM,UAAU,EAAE,aA6BrB,CAAC"}

package/dist/secrets/command.js

@@ -0,0 +1,30 @@
+import { spawn } from "node:child_process";
+export const runCommand = (command, args, options = {}) => new Promise((resolve) => {
+    const child = spawn(command, args, {
+        cwd: options.cwd,
+        env: options.env,
+        stdio: options.stdio === "inherit" ? "inherit" : "pipe",
+    });
+    let stdout = "";
+    let stderr = "";
+    if (options.stdio !== "inherit") {
+        child.stdout?.setEncoding("utf8");
+        child.stderr?.setEncoding("utf8");
+        child.stdout?.on("data", (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderr += chunk;
+        });
+        if (options.input !== undefined)
+            child.stdin?.end(options.input);
+        else
+            child.stdin?.end();
+    }
+    child.once("error", (error) => {
+        resolve({ status: null, stdout, stderr, error });
+    });
+    child.once("close", (status) => {
+        resolve({ status, stdout, stderr });
+    });
+});