@red-hat-developer-hub/e2e-test-utils 2.1.13 → 2.1.15

package/dist/secrets/config.js

@@ -0,0 +1,156 @@
+const COLLECTIONS = [
+    {
+        id: "rhdh-qe",
+        bitwardenCollection: "Rhdh Qe Ci Secrets",
+    },
+    {
+        id: "rhdh-test-instance",
+        bitwardenCollection: "Rhdh Test Instance Ci Secrets",
+    },
+    {
+        id: "rhdh-plugin-export-overlays",
+        bitwardenCollection: "Rhdh Plugin Export Overlays Ci Secrets",
+    },
+];
+const DENIED_COLLECTION = "rhdh-aws-credentials";
+const WORKSPACE_TOKEN = "${workspace}";
+const WORKSPACE_NAME = /^[a-z0-9][a-z0-9-]*$/;
+export function getCollectionMapping(collection) {
+    if (collection === DENIED_COLLECTION) {
+        throw new Error(`Collection ${DENIED_COLLECTION} is GSM-only and cannot be read from Bitwarden`);
+    }
+    if (!isReadableCollectionId(collection)) {
+        throw new Error(`Unknown Bitwarden collection: ${collection}`);
+    }
+    return COLLECTIONS.find((mapping) => mapping.id === collection);
+}
+export function parseProfile(value) {
+    if (!isRecord(value) || value.schemaVersion !== 1) {
+        throw new Error("Invalid secret profile: schemaVersion must be 1");
+    }
+    if (typeof value.collection !== "string") {
+        throw new Error("Invalid secret profile: collection is required");
+    }
+    const collection = getCollectionMapping(value.collection).id;
+    if (!Array.isArray(value.selectors) || value.selectors.length === 0) {
+        throw new Error("Invalid secret profile: selectors must not be empty");
+    }
+    const selectors = value.selectors.map((selector, index) => parseSelector(selector, index));
+    const selectorKeys = selectors.map((selector) => selector.prefix);
+    if (new Set(selectorKeys).size !== selectorKeys.length) {
+        throw new Error("Invalid secret profile: duplicate selector");
+    }
+    return { schemaVersion: 1, collection, selectors };
+}
+export function expandProfile(profile, workspaces = []) {
+    const hasWorkspaceToken = profile.selectors.some((selector) => selector.prefix.includes(WORKSPACE_TOKEN));
+    if (!hasWorkspaceToken && workspaces.length > 0) {
+        throw new Error("Secret profile does not accept workspace arguments");
+    }
+    if (hasWorkspaceToken && workspaces.length === 0) {
+        throw new Error("Secret profile requires at least one workspace argument");
+    }
+    for (const workspace of workspaces) {
+        if (!WORKSPACE_NAME.test(workspace)) {
+            throw new Error(`Invalid workspace name: ${workspace}`);
+        }
+    }
+    if (new Set(workspaces).size !== workspaces.length) {
+        throw new Error("Duplicate workspace argument");
+    }
+    const selectors = [];
+    for (const selector of profile.selectors) {
+        const values = selector.prefix.includes(WORKSPACE_TOKEN)
+            ? workspaces
+            : [undefined];
+        for (const workspace of values) {
+            selectors.push({
+                ...selector,
+                prefix: expandToken(selector.prefix, workspace),
+                destination: {
+                    ...selector.destination,
+                    stripPrefix: expandToken(selector.destination.stripPrefix, workspace),
+                },
+                optional: selector.optional === true,
+            });
+        }
+    }
+    return {
+        schemaVersion: 1,
+        collection: profile.collection,
+        selectors,
+    };
+}
+function parseSelector(value, index) {
+    if (!isRecord(value)) {
+        throw new Error(`Invalid secret selector at index ${index}`);
+    }
+    if (typeof value.prefix !== "string" || value.prefix.length === 0) {
+        throw new Error(`Invalid secret selector at index ${index}: prefix is required`);
+    }
+    validateTokenCount(value.prefix, `selector ${index} prefix`);
+    if (!value.prefix.endsWith("/")) {
+        throw new Error(`Invalid secret selector at index ${index}: prefix must end with /`);
+    }
+    if (!isRecord(value.destination) ||
+        value.destination.kind !== "environment") {
+        throw new Error(`Invalid secret selector at index ${index}: destination must be an environment`);
+    }
+    const destination = value.destination;
+    if (typeof destination.stripPrefix !== "string" ||
+        destination.stripPrefix.length === 0) {
+        throw new Error(`Invalid secret selector at index ${index}: stripPrefix is required`);
+    }
+    validateTokenCount(destination.stripPrefix, `selector ${index} stripPrefix`);
+    if (!destination.stripPrefix.endsWith("/")) {
+        throw new Error(`Invalid secret selector at index ${index}: stripPrefix must end with /`);
+    }
+    if (!value.prefix.startsWith(destination.stripPrefix)) {
+        throw new Error(`Invalid secret selector at index ${index}: stripPrefix must be a prefix of prefix`);
+    }
+    if (typeof destination.requirePrefix !== "undefined" &&
+        (typeof destination.requirePrefix !== "string" ||
+            destination.requirePrefix.length === 0)) {
+        throw new Error(`Invalid secret selector at index ${index}: requirePrefix must be non-empty`);
+    }
+    if (destination.keyTransform !== "identity" &&
+        destination.keyTransform !== "legacy-env") {
+        throw new Error(`Invalid secret selector at index ${index}: unsupported keyTransform`);
+    }
+    if (typeof value.optional !== "undefined" &&
+        typeof value.optional !== "boolean") {
+        throw new Error(`Invalid secret selector at index ${index}: optional must be boolean`);
+    }
+    return {
+        prefix: value.prefix,
+        optional: value.optional === true,
+        destination: {
+            kind: "environment",
+            stripPrefix: destination.stripPrefix,
+            ...(typeof destination.requirePrefix === "string"
+                ? { requirePrefix: destination.requirePrefix }
+                : {}),
+            keyTransform: destination.keyTransform,
+        },
+    };
+}
+function expandToken(value, workspace) {
+    if (!value.includes(WORKSPACE_TOKEN))
+        return value;
+    if (workspace === undefined) {
+        throw new Error(`Missing workspace for selector: ${value}`);
+    }
+    return value.replace(WORKSPACE_TOKEN, workspace);
+}
+function validateTokenCount(value, label) {
+    const count = value.split(WORKSPACE_TOKEN).length - 1;
+    if (count > 1) {
+        throw new Error(`${label} may contain ${WORKSPACE_TOKEN} at most once`);
+    }
+}
+function isReadableCollectionId(value) {
+    return COLLECTIONS.some((mapping) => mapping.id === value);
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/secrets/environment.d.ts

@@ -0,0 +1,10 @@
+import type { ExpandedSecretSelector } from "./config.js";
+export interface EnvironmentSecret {
+    id: string;
+    name: string;
+    value: string;
+    selector: ExpandedSecretSelector;
+}
+export declare function removeProviderEnvironmentVariables(environment: NodeJS.ProcessEnv): void;
+export declare function materializeEnvironment(secrets: readonly EnvironmentSecret[], selectors: readonly ExpandedSecretSelector[], parent?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=environment.d.ts.map

package/dist/secrets/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../src/secrets/environment.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAE1D,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,sBAAsB,CAAC;CAClC;AAUD,wBAAgB,kCAAkC,CAChD,WAAW,EAAE,MAAM,CAAC,UAAU,GAC7B,IAAI,CAMN;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,SAAS,iBAAiB,EAAE,EACrC,SAAS,EAAE,SAAS,sBAAsB,EAAE,EAC5C,MAAM,GAAE,MAAM,CAAC,UAAwB,GACtC,MAAM,CAAC,UAAU,CAwCnB"}

package/dist/secrets/environment.js

@@ -0,0 +1,53 @@
+const ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const PROVIDER_ENVIRONMENT_KEYS = new Set([
+    "VAULT",
+    "VAULT_TOKEN",
+    "VAULT_ADDR",
+    "VAULT_BASE_PATH",
+]);
+export function removeProviderEnvironmentVariables(environment) {
+    for (const key of Object.keys(environment)) {
+        if (key.startsWith("BW_") || PROVIDER_ENVIRONMENT_KEYS.has(key)) {
+            delete environment[key];
+        }
+    }
+}
+export function materializeEnvironment(secrets, selectors, parent = process.env) {
+    const child = { ...parent };
+    removeProviderEnvironmentVariables(child);
+    const mapped = new Map();
+    for (const secret of secrets) {
+        const selector = selectors.find((candidate) => sameSelector(candidate, secret.selector));
+        if (!selector) {
+            throw new Error(`Secret ${secret.name} does not match selector`);
+        }
+        if (!secret.name.startsWith(selector.prefix)) {
+            throw new Error(`Secret ${secret.name} does not match selector ${selector.prefix}`);
+        }
+        const relativeName = secret.name.slice(selector.destination.stripPrefix.length);
+        if (selector.destination.requirePrefix !== undefined) {
+            if (!relativeName.startsWith(selector.destination.requirePrefix))
+                continue;
+        }
+        const key = transformEnvironmentName(relativeName, selector.destination.keyTransform);
+        if (!ENVIRONMENT_NAME.test(key)) {
+            throw new Error(`Invalid environment variable name: ${key}`);
+        }
+        if (mapped.has(key)) {
+            throw new Error(`Environment variable collision: ${key}`);
+        }
+        mapped.set(key, secret.value);
+    }
+    for (const [key, value] of mapped)
+        child[key] = value;
+    return child;
+}
+function transformEnvironmentName(value, transform) {
+    return transform === "legacy-env" ? value.replace(/[.\-/]/g, "_") : value;
+}
+function sameSelector(left, right) {
+    return (left.prefix === right.prefix &&
+        left.destination.stripPrefix === right.destination.stripPrefix &&
+        left.destination.requirePrefix === right.destination.requirePrefix &&
+        left.destination.keyTransform === right.destination.keyTransform);
+}

package/dist/secrets/exec.d.ts

@@ -0,0 +1,18 @@
+import { type BitwardenSecret } from "./bitwarden.js";
+import { type ExpandedSecretSelector, type SecretProfile } from "./config.js";
+export interface SecretReader {
+    read(collection: SecretProfile["collection"], selectors: readonly ExpandedSecretSelector[]): Promise<BitwardenSecret[]>;
+}
+export type ChildRunner = (command: string, args: readonly string[], env: NodeJS.ProcessEnv) => Promise<number>;
+export interface ExecuteCommandOptions {
+    profile: SecretProfile;
+    workspaces: readonly string[];
+    command: string;
+    args: readonly string[];
+    env?: NodeJS.ProcessEnv;
+    client?: SecretReader;
+    childRunner?: ChildRunner;
+}
+export declare function executeCommand(options: ExecuteCommandOptions): Promise<number>;
+export declare const runChild: ChildRunner;
+//# sourceMappingURL=exec.d.ts.map

package/dist/secrets/exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/secrets/exec.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAEL,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EACnB,MAAM,aAAa,CAAC;AAGrB,MAAM,WAAW,YAAY;IAC3B,IAAI,CACF,UAAU,EAAE,aAAa,CAAC,YAAY,CAAC,EACvC,SAAS,EAAE,SAAS,sBAAsB,EAAE,GAC3C,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;CAC/B;AAED,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,MAAM,CAAC,CAAC;AAErB,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,aAAa,CAAC;IACvB,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACxB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,eAAO,MAAM,QAAQ,EAAE,WAqCnB,CAAC"}

package/dist/secrets/exec.js

@@ -0,0 +1,50 @@
+import { spawn } from "node:child_process";
+import { BitwardenClient } from "./bitwarden.js";
+import { expandProfile, } from "./config.js";
+import { materializeEnvironment } from "./environment.js";
+export async function executeCommand(options) {
+    const expanded = expandProfile(options.profile, options.workspaces);
+    const client = options.client ?? new BitwardenClient({ env: options.env ?? process.env });
+    const secrets = await client.read(options.profile.collection, expanded.selectors);
+    const childEnvironment = materializeEnvironment(secrets, expanded.selectors, options.env ?? process.env);
+    const childRunner = options.childRunner ?? runChild;
+    return childRunner(options.command, options.args, childEnvironment);
+}
+export const runChild = (command, args, env) => new Promise((resolve, reject) => {
+    const child = spawn(command, args, { env, stdio: "inherit" });
+    let settled = false;
+    const signals = ["SIGINT", "SIGTERM", "SIGHUP"];
+    const signalExitCodes = new Map([
+        ["SIGINT", 130],
+        ["SIGTERM", 143],
+        ["SIGHUP", 129],
+    ]);
+    const forwarders = new Map();
+    for (const signal of signals) {
+        const forwardSignal = () => child.kill(signal);
+        forwarders.set(signal, forwardSignal);
+        process.on(signal, forwardSignal);
+    }
+    const cleanup = () => {
+        for (const [signal, forwardSignal] of forwarders) {
+            process.removeListener(signal, forwardSignal);
+        }
+    };
+    child.once("error", () => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        reject(new Error(`Unable to start command: ${command}`));
+    });
+    child.once("close", (code, signal) => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        const signalExitCode = signal
+            ? signalExitCodes.get(signal)
+            : undefined;
+        resolve(code ?? signalExitCode ?? 1);
+    });
+});

package/dist/secrets/index.d.ts

@@ -0,0 +1,5 @@
+export { expandProfile, getCollectionMapping, parseProfile, type CollectionMapping, type EnvironmentDestination, type ExpandedSecretProfile, type ExpandedSecretSelector, type ReadableCollectionId, type SecretProfile, type SecretSelector, } from "./config.js";
+export { BitwardenClient, type BitwardenClientOptions, type BitwardenAttachment, type BitwardenSecret, } from "./bitwarden.js";
+export { executeCommand, runChild, type ChildRunner, type ExecuteCommandOptions, type SecretReader, } from "./exec.js";
+export { materializeEnvironment, removeProviderEnvironmentVariables, type EnvironmentSecret, } from "./environment.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,oBAAoB,EACpB,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,eAAe,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,cAAc,EACd,QAAQ,EACR,KAAK,WAAW,EAChB,KAAK,qBAAqB,EAC1B,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,sBAAsB,EACtB,kCAAkC,EAClC,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC"}

package/dist/secrets/index.js

@@ -0,0 +1,4 @@
+export { expandProfile, getCollectionMapping, parseProfile, } from "./config.js";
+export { BitwardenClient, } from "./bitwarden.js";
+export { executeCommand, runChild, } from "./exec.js";
+export { materializeEnvironment, removeProviderEnvironmentVariables, } from "./environment.js";

package/dist/secrets/tests/bitwarden.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bitwarden.integration.test.d.ts.map

package/dist/secrets/tests/bitwarden.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden.integration.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/bitwarden.integration.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/bitwarden.integration.test.js

@@ -0,0 +1,50 @@
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test fixture models CLI environment keys */
+import assert from "node:assert/strict";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { BitwardenClient } from "../bitwarden.js";
+const selector = {
+    prefix: "global/",
+    optional: false,
+    destination: {
+        kind: "environment",
+        stripPrefix: "global/",
+        requirePrefix: "VAULT_",
+        keyTransform: "legacy-env",
+    },
+};
+test("reads secure notes and attachments through a fake bw executable", async () => {
+    const directory = await mkdtemp(path.join(os.tmpdir(), "bitwarden-cli-test-"));
+    const command = path.join(directory, "bw");
+    await writeFile(command, `#!/usr/bin/env node
+const args = process.argv.slice(2);
+if (args[0] === "--version") process.stdout.write("2026.5.0\\n");
+else if (args[0] === "status") process.stdout.write(JSON.stringify({ status: "unlocked" }));
+else if (args[0] === "sync") {}
+else if (args[0] === "list" && args[1] === "collections") process.stdout.write(JSON.stringify([{ id: "collection-id", name: "Rhdh Qe Ci Secrets", organizationId: "organization-id" }]));
+else if (args[0] === "list" && args[1] === "items") process.stdout.write(JSON.stringify([{ id: "note-item-id" }, { id: "attachment-item-id" }]));
+else if (args[0] === "get" && args[1] === "item" && args[2] === "note-item-id") process.stdout.write(JSON.stringify({ id: "note-item-id", name: "global/VAULT_TOKEN", notes: "synthetic-note-value", type: 2, collectionIds: ["collection-id"], organizationId: "organization-id" }));
+else if (args[0] === "get" && args[1] === "item" && args[2] === "attachment-item-id") process.stdout.write(JSON.stringify({ id: "attachment-item-id", name: "global/VAULT_CERT_PEM", notes: null, type: 2, collectionIds: ["collection-id"], organizationId: "organization-id", attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }] }));
+else if (args[0] === "get" && args[1] === "attachment" && args[2] === "VAULT_CERT_PEM" && args[3] === "--itemid" && args[4] === "attachment-item-id" && args[5] === "--raw") process.stdout.write("synthetic-attachment-value");
+else process.exitCode = 1;
+`);
+    await chmod(command, 0o755);
+    try {
+        const secrets = await new BitwardenClient({
+            command,
+            env: { BW_SESSION: "synthetic-session" },
+        }).read("rhdh-qe", [selector]);
+        assert.deepEqual(secrets.map(({ name, value }) => ({ name, value })), [
+            { name: "global/VAULT_TOKEN", value: "synthetic-note-value" },
+            {
+                name: "global/VAULT_CERT_PEM",
+                value: "synthetic-attachment-value",
+            },
+        ]);
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+});

package/dist/secrets/tests/bitwarden.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=bitwarden.test.d.ts.map

package/dist/secrets/tests/bitwarden.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bitwarden.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/bitwarden.test.ts"],"names":[],"mappings":""}