@red-hat-developer-hub/e2e-test-utils 2.1.13 → 2.1.14

package/dist/secrets/tests/environment.test.js

@@ -0,0 +1,119 @@
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test fixtures model process environment keys */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { materializeEnvironment, } from "../environment.js";
+const selector = {
+    prefix: "global/",
+    optional: false,
+    destination: {
+        kind: "environment",
+        stripPrefix: "global/",
+        requirePrefix: "VAULT_",
+        keyTransform: "legacy-env",
+    },
+};
+test("maps selected notes into a child environment without mutating the parent", () => {
+    const parent = {
+        PATH: "/usr/bin",
+        VAULT_GITHUB_TOKEN: "old-value",
+        BW_SESSION: "session-value",
+        BW_CLIENTID: "client-id",
+        BW_CLIENTSECRET: "client-secret",
+        BW_PASSWORD: "password",
+        VAULT_TOKEN: "legacy-provider-token",
+        VAULT_ADDR: "legacy-provider-address",
+        VAULT_BASE_PATH: "legacy-provider-path",
+        VAULT: "legacy-provider-setting",
+    };
+    const secrets = [
+        {
+            id: "token-id",
+            name: "global/VAULT_GITHUB_TOKEN",
+            value: "line one\nline two\n",
+            selector,
+        },
+    ];
+    const child = materializeEnvironment(secrets, [selector], parent);
+    assert.equal(child.VAULT_GITHUB_TOKEN, "line one\nline two\n");
+    assert.equal(child.PATH, "/usr/bin");
+    assert.equal(child.BW_SESSION, undefined);
+    assert.equal(child.BW_CLIENTID, undefined);
+    assert.equal(child.BW_CLIENTSECRET, undefined);
+    assert.equal(child.BW_PASSWORD, undefined);
+    assert.equal(child.VAULT_TOKEN, undefined);
+    assert.equal(child.VAULT_ADDR, undefined);
+    assert.equal(child.VAULT_BASE_PATH, undefined);
+    assert.equal(child.VAULT, undefined);
+    assert.deepEqual(parent, {
+        PATH: "/usr/bin",
+        VAULT_GITHUB_TOKEN: "old-value",
+        BW_SESSION: "session-value",
+        BW_CLIENTID: "client-id",
+        BW_CLIENTSECRET: "client-secret",
+        BW_PASSWORD: "password",
+        VAULT_TOKEN: "legacy-provider-token",
+        VAULT_ADDR: "legacy-provider-address",
+        VAULT_BASE_PATH: "legacy-provider-path",
+        VAULT: "legacy-provider-setting",
+    });
+});
+test("filters item names that do not satisfy requirePrefix", () => {
+    const secrets = [
+        {
+            id: "ignored-id",
+            name: "global/OTHER_SETTING",
+            value: "ignored",
+            selector,
+        },
+    ];
+    const child = materializeEnvironment(secrets, [selector], {});
+    assert.deepEqual(child, {});
+});
+test("rejects transformed environment-name collisions", () => {
+    const secrets = [
+        {
+            id: "first-id",
+            name: "global/VAULT_A-B",
+            value: "first",
+            selector,
+        },
+        {
+            id: "second-id",
+            name: "global/VAULT_A.B",
+            value: "second",
+            selector,
+        },
+    ];
+    assert.throws(() => materializeEnvironment(secrets, [selector], {}), /environment variable collision.*VAULT_A_B/i);
+});
+test("rejects invalid identity environment names", () => {
+    const identitySelector = {
+        ...selector,
+        destination: {
+            ...selector.destination,
+            requirePrefix: undefined,
+            keyTransform: "identity",
+        },
+    };
+    assert.throws(() => materializeEnvironment([
+        {
+            id: "invalid-id",
+            name: "global/NOT-VALID",
+            value: "synthetic",
+            selector: identitySelector,
+        },
+    ], [identitySelector], {}), /invalid environment variable name/i);
+});
+test("rejects secrets that are not covered by their selector", () => {
+    const wrongSelector = {
+        ...selector,
+        prefix: "workspaces/backstage/",
+    };
+    const secret = {
+        id: "wrong-id",
+        name: "global/VAULT_TOKEN",
+        value: "synthetic",
+        selector: wrongSelector,
+    };
+    assert.throws(() => materializeEnvironment([secret], [selector], {}), /does not match selector/i);
+});

package/dist/secrets/tests/exec.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=exec.test.d.ts.map

package/dist/secrets/tests/exec.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/exec.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/exec.test.js

@@ -0,0 +1,87 @@
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test fixtures model process environment keys */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { executeCommand, runChild } from "../exec.js";
+const profile = {
+    schemaVersion: 1,
+    collection: "rhdh-plugin-export-overlays",
+    selectors: [
+        {
+            prefix: "global/",
+            destination: {
+                kind: "environment",
+                stripPrefix: "global/",
+                requirePrefix: "VAULT_",
+                keyTransform: "legacy-env",
+            },
+        },
+    ],
+};
+const secret = {
+    id: "secret-id",
+    name: "global/VAULT_TOKEN",
+    value: "synthetic-value",
+    selector: {
+        ...profile.selectors[0],
+        optional: false,
+    },
+};
+test("executes a command with only selected secrets in its child environment", async () => {
+    let received;
+    const childRunner = async (command, args, env) => {
+        received = { command, args, env };
+        return 0;
+    };
+    const client = { read: async () => [secret] };
+    const exitCode = await executeCommand({
+        profile,
+        workspaces: [],
+        command: "playwright",
+        args: ["test", "--project", "github"],
+        env: {
+            PATH: "/usr/bin",
+            BW_SESSION: "synthetic-session",
+            EXISTING_VALUE: "preserved",
+        },
+        client,
+        childRunner,
+    });
+    assert.equal(exitCode, 0);
+    assert.deepEqual(received?.args, ["test", "--project", "github"]);
+    assert.equal(received?.command, "playwright");
+    assert.equal(received?.env.VAULT_TOKEN, "synthetic-value");
+    assert.equal(received?.env.EXISTING_VALUE, "preserved");
+    assert.equal(received?.env.BW_SESSION, undefined);
+});
+test("validates all selected mappings before starting the child", async () => {
+    let childStarted = false;
+    const childRunner = async () => {
+        childStarted = true;
+        return 0;
+    };
+    const client = {
+        read: async () => {
+            throw new Error("required prefix has no matching item");
+        },
+    };
+    await assert.rejects(() => executeCommand({
+        profile,
+        workspaces: [],
+        command: "playwright",
+        args: [],
+        env: { BW_SESSION: "synthetic-session" },
+        client,
+        childRunner,
+    }), /required prefix/i);
+    assert.equal(childStarted, false);
+});
+test("propagates the real child exit code", async () => {
+    const exitCode = await runChild(process.execPath, ["-e", "process.exit(17)"], {
+        ...process.env,
+    });
+    assert.equal(exitCode, 17);
+});
+test("returns the shell-compatible status for a signal-terminated child", async () => {
+    const exitCode = await runChild(process.execPath, ["-e", "process.kill(process.pid, 'SIGTERM')"], { ...process.env });
+    assert.equal(exitCode, 143);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@red-hat-developer-hub/e2e-test-utils",
-  "version": "2.1.13",
+  "version": "2.1.14",
   "description": "Test utilities for RHDH E2E tests",
   "license": "Apache-2.0",
   "repository": {
@@ -56,8 +56,15 @@
     "./openldap": {
       "types": "./dist/deployment/openldap/index.d.ts",
       "default": "./dist/deployment/openldap/index.js"
+    },
+    "./secrets": {
+      "types": "./dist/secrets/index.d.ts",
+      "default": "./dist/secrets/index.js"
     }
   },
+  "bin": {
+    "rhdh-e2e-secrets": "./dist/secrets/cli.js"
+  },
   "publishConfig": {
     "access": "public"
   },
@@ -66,7 +73,7 @@
     "tsconfig.base.json"
   ],
   "scripts": {
-    "build": "yarn clean && tsc -p tsconfig.build.json && cp -r src/deployment/rhdh/config dist/deployment/rhdh/ && cp -r src/deployment/keycloak/config dist/deployment/keycloak/ && cp -r src/deployment/openldap/config dist/deployment/openldap/ && cp src/deployment/orchestrator/install-orchestrator.sh dist/deployment/orchestrator/",
+    "build": "yarn clean && tsc -p tsconfig.build.json && cp -r src/deployment/rhdh/config dist/deployment/rhdh/ && cp -r src/deployment/keycloak/config dist/deployment/keycloak/ && cp -r src/deployment/openldap/config dist/deployment/openldap/ && cp src/deployment/orchestrator/install-orchestrator.sh dist/deployment/orchestrator/ && chmod +x dist/secrets/cli.js",
     "prepare": "husky",
     "check": "yarn typecheck && yarn lint:check && yarn prettier:check",
     "clean": "rm -rf dist",

package/dist/utils/vault.d.ts

@@ -1,16 +0,0 @@
-/**
- * Loads secrets from HashiCorp Vault into process.env.
- * Only runs when `VAULT=1` or `VAULT=true` is set. Handles OIDC login automatically.
- *
- * Fetches secrets from:
- * - Global path: `<basePath>/global`
- * - Per-workspace paths: `<basePath>/workspaces/<name>`
- *
- * Configure via env vars:
- * - `VAULT_ADDR` — Vault server URL (default: https://vault.ci.openshift.org)
- * - `VAULT_BASE_PATH` — Base path in Vault (default: selfservice/rhdh-plugin-export-overlays)
- *
- * Security: Only key names are logged, never secret values.
- */
-export declare function loadLocalVaultSecrets(): Promise<void>;
-//# sourceMappingURL=vault.d.ts.map

package/dist/utils/vault.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/utils/vault.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;;;GAaG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,IAAI,CAAC,CAiE3D"}

package/dist/utils/vault.js

@@ -1,94 +0,0 @@
-import { $ } from "./bash.js";
-const VAULT_ADDR_DEFAULT = "https://vault.ci.openshift.org";
-const VAULT_BASE_PATH_DEFAULT = "selfservice/rhdh-plugin-export-overlays";
-/**
- * Loads secrets from HashiCorp Vault into process.env.
- * Only runs when `VAULT=1` or `VAULT=true` is set. Handles OIDC login automatically.
- *
- * Fetches secrets from:
- * - Global path: `<basePath>/global`
- * - Per-workspace paths: `<basePath>/workspaces/<name>`
- *
- * Configure via env vars:
- * - `VAULT_ADDR` — Vault server URL (default: https://vault.ci.openshift.org)
- * - `VAULT_BASE_PATH` — Base path in Vault (default: selfservice/rhdh-plugin-export-overlays)
- *
- * Security: Only key names are logged, never secret values.
- */
-export async function loadLocalVaultSecrets() {
-    if (process.env.VAULT !== "1" && process.env.VAULT !== "true")
-        return;
-    const vaultAddr = process.env.VAULT_ADDR || VAULT_ADDR_DEFAULT;
-    const basePath = process.env.VAULT_BASE_PATH || VAULT_BASE_PATH_DEFAULT;
-    process.env.VAULT_ADDR = vaultAddr;
-    // Check vault CLI is installed
-    const whichResult = await vaultCmd `command -v vault`;
-    if (whichResult.exitCode !== 0) {
-        throw new Error("vault CLI not found. Install from https://developer.hashicorp.com/vault/downloads");
-    }
-    // Check if already logged in
-    const tokenCheck = await vaultCmd `vault token lookup`;
-    if (tokenCheck.exitCode !== 0) {
-        console.log("Vault: not logged in, starting OIDC login...");
-        // vault login needs inherited stdio for browser-based OIDC flow
-        await $ `vault login -no-print -method=oidc`;
-        const retryCheck = await vaultCmd `vault token lookup`;
-        if (retryCheck.exitCode !== 0) {
-            throw new Error("Vault login failed. Run manually:\n  export VAULT_ADDR='" +
-                vaultAddr +
-                "'\n  vault login -method=oidc");
-        }
-    }
-    // Check access by fetching global secrets first
-    const globalResult = await vaultCmd `vault kv get -format=json -mount=kv ${basePath}/global`;
-    if (globalResult.stderr.includes("permission denied")) {
-        console.log("Vault: permission denied. Request access in Slack: #rhdh-e2e-tests");
-        return;
-    }
-    console.log("Loading secrets from vault...");
-    // Load global secrets
-    loadSecretsFromResult(globalResult, "global");
-    // List and fetch per-workspace secrets
-    const listResult = await vaultCmd `vault kv list -format=json -mount=kv ${basePath}/workspaces`;
-    if (listResult.exitCode === 0) {
-        const workspaces = JSON.parse(listResult.stdout);
-        await Promise.all(workspaces.map((ws) => {
-            const name = ws.replace(/\/$/, "");
-            return exportSecretsFromPath(`${basePath}/workspaces/${name}`, name);
-        }));
-    }
-    else {
-        console.log("  No workspace-specific secrets found");
-    }
-    console.log("Vault secrets loaded successfully.");
-}
-/** Runs a shell command with piped stdio and nothrow, for capturing vault CLI output. */
-const vaultCmd = $({
-    stdio: ["pipe", "pipe", "pipe"],
-    nothrow: true,
-});
-async function exportSecretsFromPath(vaultPath, label) {
-    const result = await vaultCmd `vault kv get -format=json -mount=kv ${vaultPath}`;
-    loadSecretsFromResult(result, label);
-}
-function loadSecretsFromResult(result, label) {
-    if (result.exitCode !== 0) {
-        console.log(`  No secrets at: ${label}`);
-        return;
-    }
-    const json = JSON.parse(result.stdout);
-    const secrets = json?.data?.data;
-    if (!secrets) {
-        console.log(`  No secrets at: ${label}`);
-        return;
-    }
-    console.log(`  From: ${label}`);
-    for (const [key, value] of Object.entries(secrets)) {
-        if (key.startsWith("secretsync/"))
-            continue;
-        if (!key.startsWith("VAULT_"))
-            continue;
-        const safeKey = key.replace(/[.\-/]/g, "_");
-        process.env[safeKey] = value;
-    }
-}