@red-hat-developer-hub/e2e-test-utils 2.1.14 → 2.1.16

package/dist/secrets/tests/mutation.test.js

@@ -0,0 +1,390 @@
+/* eslint-disable playwright/expect-expect -- node:test assertions */
+import assert from "node:assert/strict";
+import { mkdtemp, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { executeMutation, } from "../mutation.js";
+function item(value, storage = "note") {
+    return {
+        id: "item-id",
+        name: "rhdh/test",
+        value,
+        storage,
+        revisionDate: "revision-1",
+        raw: {},
+        attachments: storage === "attachment"
+            ? [{ id: "attachment-id", fileName: "test" }]
+            : [],
+        ...(storage === "attachment"
+            ? { attachment: { id: "attachment-id", fileName: "test" } }
+            : {}),
+    };
+}
+function gsm(overrides = {}) {
+    return {
+        exists: async () => false,
+        create: async () => undefined,
+        update: async () => undefined,
+        delete: async () => undefined,
+        ...overrides,
+    };
+}
+test("dry-run creates one value-free plan and performs no writes", async () => {
+    const calls = [];
+    const bitwarden = {
+        findItem: async () => {
+            calls.push("bitwarden-find");
+            return undefined;
+        },
+        createItem: async () => {
+            calls.push("bitwarden-create");
+            throw new Error("must not write");
+        },
+        updateItem: async () => {
+            calls.push("bitwarden-update");
+            throw new Error("must not write");
+        },
+        deleteItem: async () => {
+            calls.push("bitwarden-delete");
+            throw new Error("must not write");
+        },
+    };
+    const result = await executeMutation({
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromStdin: true,
+        stdin: ["new-value"],
+        dryRun: true,
+        bitwarden,
+        gsm: gsm(),
+    });
+    assert.deepEqual(result, {
+        state: "dry-run",
+        plan: {
+            command: "create",
+            collection: "rhdh-qe",
+            bitwardenCollection: "Rhdh Qe Ci Secrets",
+            gsmCollection: "rhdh-qe",
+            bitwardenPath: "rhdh/test",
+            gsmPath: "rhdh/test",
+            byteLength: 9,
+            storage: "note",
+            bitwardenAction: "create",
+            gsmAction: "create",
+        },
+    });
+    assert.deepEqual(calls, ["bitwarden-find"]);
+});
+test("decodes GSM dot encoding only for Bitwarden lookups", async () => {
+    const calls = [];
+    const result = await executeMutation({
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/rds-db-certificates--dot--pem",
+        fromStdin: true,
+        stdin: ["new-value"],
+        dryRun: true,
+        bitwarden: {
+            findItem: async (_collection, name) => {
+                calls.push(`bitwarden:${name}`);
+                return undefined;
+            },
+            createItem: async () => item("new-value"),
+            updateItem: async () => item("new-value"),
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm({
+            exists: async (_collection, name) => {
+                calls.push(`gsm:${name}`);
+                return false;
+            },
+        }),
+    });
+    assert.deepEqual(calls, [
+        "bitwarden:rhdh/rds-db-certificates.pem",
+        "gsm:rhdh/rds-db-certificates--dot--pem",
+    ]);
+    assert.equal(result.plan.bitwardenPath, "rhdh/rds-db-certificates.pem");
+    assert.equal(result.plan.gsmPath, "rhdh/rds-db-certificates--dot--pem");
+});
+test("forced create reconciles existing providers and converts Bitwarden storage", async () => {
+    const calls = [];
+    const bitwarden = {
+        findItem: async () => item("old-value", "note"),
+        createItem: async () => {
+            calls.push("bitwarden-create");
+            return item("new-value", "attachment");
+        },
+        updateItem: async (_item, value, storage) => {
+            calls.push(`bitwarden-update:${value}:${storage}`);
+            return item(value, storage);
+        },
+        deleteItem: async () => {
+            calls.push("bitwarden-delete");
+        },
+    };
+    const gsmClient = gsm({
+        exists: async () => true,
+        update: async () => {
+            calls.push("gsm-update");
+        },
+    });
+    const result = await executeMutation({
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromFile: "replacement.txt",
+        readFile: async () => Buffer.from("replacement-value"),
+        force: true,
+        bitwarden,
+        gsm: gsmClient,
+    });
+    assert.equal(result.state, "applied");
+    assert.deepEqual(result.plan, {
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenCollection: "Rhdh Qe Ci Secrets",
+        gsmCollection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        gsmPath: "rhdh/test",
+        byteLength: 17,
+        storage: "attachment",
+        existingStorage: "note",
+        bitwardenAction: "update",
+        gsmAction: "update",
+    });
+    assert.deepEqual(calls, [
+        "bitwarden-update:replacement-value:attachment",
+        "gsm-update",
+    ]);
+});
+test("checks the interactive terminal before writing Bitwarden for GSM create", async () => {
+    const calls = [];
+    await executeMutation({
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromStdin: true,
+        stdin: ["new-value"],
+        bitwarden: {
+            findItem: async () => undefined,
+            createItem: async () => {
+                calls.push("bitwarden-create");
+                return item("new-value");
+            },
+            updateItem: async () => item("new-value"),
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm({
+            ensureInteractive: async () => {
+                calls.push("gsm-ensure-interactive");
+            },
+            create: async () => {
+                calls.push("gsm-create");
+            },
+        }),
+    });
+    assert.deepEqual(calls, [
+        "gsm-ensure-interactive",
+        "bitwarden-create",
+        "gsm-create",
+    ]);
+});
+test("normal create rejects a one-sided existing target before writing", async () => {
+    const calls = [];
+    await assert.rejects(() => executeMutation({
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromStdin: true,
+        stdin: ["new-value"],
+        bitwarden: {
+            findItem: async () => item("old-value"),
+            createItem: async () => {
+                calls.push("bitwarden-create");
+                return item("new-value");
+            },
+            updateItem: async () => item("new-value"),
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm(),
+    }), /already exists.*force/i);
+    assert.deepEqual(calls, []);
+});
+test("update writes Bitwarden before GSM and reports a retry without a resume id", async () => {
+    const calls = [];
+    await assert.rejects(() => executeMutation({
+        command: "update",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromStdin: true,
+        stdin: ["new-value"],
+        bitwarden: {
+            findItem: async () => item("old-value"),
+            createItem: async () => item("new-value"),
+            updateItem: async (_item, value) => {
+                calls.push("bitwarden-update");
+                return item(value);
+            },
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm({
+            exists: async () => true,
+            update: async () => {
+                calls.push("gsm-update");
+                throw new Error("GSM unavailable");
+            },
+        }),
+    }), (error) => {
+        assert(error instanceof Error);
+        assert.match(error.message, /GSM unavailable/);
+        assert.match(error.message, /retry/i);
+        assert.doesNotMatch(error.message, /resume|operation id/i);
+        return true;
+    });
+    assert.deepEqual(calls, ["bitwarden-update", "gsm-update"]);
+});
+test("preserves force guidance after a forced partial delete fails", async () => {
+    await assert.rejects(() => executeMutation({
+        command: "delete",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        force: true,
+        bitwarden: {
+            findItem: async () => undefined,
+            createItem: async () => item("unused"),
+            updateItem: async () => item("unused"),
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm({
+            exists: async () => true,
+            delete: async () => {
+                throw new Error("GSM unavailable");
+            },
+        }),
+    }), (error) => {
+        assert(error instanceof Error);
+        assert.match(error.message, /retry the delete command with --force/i);
+        return true;
+    });
+});
+test("reports reconciliation guidance when Bitwarden may have changed", async () => {
+    await assert.rejects(() => executeMutation({
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromStdin: true,
+        stdin: ["new-value"],
+        force: true,
+        bitwarden: {
+            findItem: async () => undefined,
+            createItem: async () => {
+                throw new Error("Bitwarden response lost after create");
+            },
+            updateItem: async () => item("unused"),
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm(),
+    }), (error) => {
+        assert(error instanceof Error);
+        assert.match(error.message, /may have been updated|Bitwarden/i);
+        assert.match(error.message, /--force/);
+        return true;
+    });
+});
+test("rejects delete input options at the library boundary", async () => {
+    await assert.rejects(() => executeMutation({
+        command: "delete",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromFile: "secret.txt",
+        bitwarden: {
+            findItem: async () => undefined,
+            createItem: async () => item("unused"),
+            updateItem: async () => item("unused"),
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm(),
+    }), /delete does not accept input options/i);
+});
+test("uses one lock for equivalent GSM path spellings", async () => {
+    const lockDirectory = await mkdtemp(path.join(os.tmpdir(), "rhdh-e2e-mutation-lock-test-"));
+    let active = 0;
+    let maximumActive = 0;
+    const bitwarden = {
+        findItem: async () => undefined,
+        createItem: async () => {
+            active++;
+            maximumActive = Math.max(maximumActive, active);
+            await new Promise((resolve) => setTimeout(resolve, 25));
+            active--;
+            return item("new-value");
+        },
+        updateItem: async () => item("new-value"),
+        deleteItem: async () => undefined,
+    };
+    const options = {
+        command: "create",
+        collection: "rhdh-qe",
+        fromStdin: true,
+        stdin: ["new-value"],
+        force: true,
+        lockDirectory,
+        bitwarden,
+        gsm: gsm(),
+    };
+    try {
+        const results = await Promise.allSettled([
+            executeMutation({ ...options, bitwardenPath: "rhdh/test.pem" }),
+            executeMutation({ ...options, bitwardenPath: "rhdh/test--dot--pem" }),
+        ]);
+        assert.equal(maximumActive, 1);
+        assert.equal(results.filter((result) => result.status === "rejected").length, 1);
+    }
+    finally {
+        await rm(lockDirectory, { recursive: true, force: true });
+    }
+});
+test("forced delete removes existing targets and accepts an absent provider", async () => {
+    const calls = [];
+    const result = await executeMutation({
+        command: "delete",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        force: true,
+        bitwarden: {
+            findItem: async () => item("old-value"),
+            createItem: async () => item("unused"),
+            updateItem: async () => item("unused"),
+            deleteItem: async () => {
+                calls.push("bitwarden-delete");
+            },
+        },
+        gsm: gsm({
+            exists: async () => false,
+            delete: async () => {
+                calls.push("gsm-delete");
+            },
+        }),
+    });
+    assert.equal(result.state, "applied");
+    assert.equal(result.plan.bitwardenAction, "delete");
+    assert.equal(result.plan.gsmAction, "skip");
+    assert.deepEqual(calls, ["bitwarden-delete"]);
+});
+test("normal delete rejects an absent provider unless forced", async () => {
+    await assert.rejects(() => executeMutation({
+        command: "delete",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        bitwarden: {
+            findItem: async () => undefined,
+            createItem: async () => item("unused"),
+            updateItem: async () => item("unused"),
+            deleteItem: async () => undefined,
+        },
+        gsm: gsm({ exists: async () => true }),
+    }), /absent.*force/i);
+});

package/dist/secrets/tests/secret-input.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=secret-input.test.d.ts.map

package/dist/secrets/tests/secret-input.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-input.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/secret-input.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/secret-input.test.js

@@ -0,0 +1,71 @@
+/* eslint-disable playwright/expect-expect -- node:test assertions */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { Readable } from "node:stream";
+import { readSecretInput } from "../secret-input.js";
+test("reads a UTF-8 file and reports its byte size", async () => {
+    const result = await readSecretInput({
+        fromFile: "synthetic.txt",
+        readFile: async () => Buffer.from("line one\nline two\n", "utf8"),
+    });
+    assert.deepEqual(result, {
+        value: "line one\nline two\n",
+        byteLength: 18,
+        storage: "attachment",
+    });
+});
+test("reads stdin when selected and rejects a second input source", async () => {
+    const result = await readSecretInput({
+        fromStdin: true,
+        stdin: Readable.from([Buffer.from("synthetic")]),
+    });
+    assert.equal(result.value, "synthetic");
+    assert.equal(result.byteLength, 9);
+    assert.equal(result.storage, "note");
+    await assert.rejects(() => readSecretInput({
+        fromFile: "secret.txt",
+        fromStdin: true,
+        readFile: async () => Buffer.from("ignored"),
+    }), /exactly one/i);
+});
+test("rejects terminal stdin before waiting for input", async () => {
+    let iterated = false;
+    const terminalStdin = {
+        isTTY: true,
+        [Symbol.asyncIterator]() {
+            iterated = true;
+            return {
+                next: async () => ({ done: true, value: undefined }),
+            };
+        },
+    };
+    await assert.rejects(() => readSecretInput({ fromStdin: true, stdin: terminalStdin }), /piped.*stdin|stdin.*piped/i);
+    assert.equal(iterated, false);
+});
+test("rejects missing input and invalid UTF-8", async () => {
+    await assert.rejects(() => readSecretInput({ readFile: async () => Buffer.from("") }), /exactly one/i);
+    await assert.rejects(() => readSecretInput({
+        fromFile: "secret.txt",
+        readFile: async () => Buffer.from([0xc3, 0x28]),
+    }), /UTF-8/i);
+});
+test("requires explicit confirmation for an empty value", async () => {
+    await assert.rejects(() => readSecretInput({
+        fromFile: "empty.txt",
+        readFile: async () => Buffer.alloc(0),
+    }), /allow-empty/i);
+    const result = await readSecretInput({
+        fromFile: "empty.txt",
+        allowEmpty: true,
+        readFile: async () => Buffer.alloc(0),
+    });
+    assert.deepEqual(result, { value: "", byteLength: 0, storage: "attachment" });
+});
+test("preserves a UTF-8 BOM during validation", async () => {
+    const result = await readSecretInput({
+        fromFile: "bom.txt",
+        readFile: async () => Buffer.from([0xef, 0xbb, 0xbf, 0x76]),
+    });
+    assert.equal(result.value, "\ufeffv");
+    assert.equal(Buffer.byteLength(result.value, "utf8"), 4);
+});

package/dist/secrets/tests/stream.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=stream.test.d.ts.map

package/dist/secrets/tests/stream.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/stream.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/stream.test.js

@@ -0,0 +1,88 @@
+/* eslint-disable playwright/expect-expect -- node:test assertions */
+import assert from "node:assert/strict";
+import { Writable } from "node:stream";
+import test from "node:test";
+import { decodeSecretStream, writeSecretStream, } from "../stream.js";
+async function encode(entries) {
+    const chunks = [];
+    const stream = new Writable({
+        write(chunk, _encoding, callback) {
+            chunks.push(Buffer.from(chunk));
+            callback();
+        },
+    });
+    await writeSecretStream(stream, entries);
+    return Buffer.concat(chunks);
+}
+test("round-trips sorted multiline and empty values", async () => {
+    const entries = [
+        { name: "ZETA_VALUE", value: "last" },
+        { name: "EMPTY_VALUE", value: "" },
+        { name: "ALPHA_VALUE", value: "first line\nsecond line\n" },
+    ];
+    const encoded = await encode(entries);
+    assert.deepEqual(decodeSecretStream(encoded), [
+        { name: "ALPHA_VALUE", value: "first line\nsecond line\n" },
+        { name: "EMPTY_VALUE", value: "" },
+        { name: "ZETA_VALUE", value: "last" },
+    ]);
+});
+test("round-trips a value larger than an execve environment string", async () => {
+    const value = "x".repeat(160 * 1024);
+    const encoded = await encode([{ name: "LARGE_VALUE", value }]);
+    assert.deepEqual(decodeSecretStream(encoded), [
+        { name: "LARGE_VALUE", value },
+    ]);
+});
+test("rejects truncated and trailing data", async () => {
+    const encoded = await encode([{ name: "VALUE", value: "synthetic" }]);
+    assert.throws(() => decodeSecretStream(encoded.subarray(0, encoded.length - 1)), /truncated|incomplete/i);
+    assert.throws(() => decodeSecretStream(Buffer.concat([encoded, Buffer.from([0])])), /trailing|end of input/i);
+});
+test("rejects duplicate, invalid, NUL-containing, and oversized entries", async () => {
+    await assert.rejects(() => encode([
+        { name: "DUPLICATE", value: "first" },
+        { name: "DUPLICATE", value: "second" },
+    ]), /duplicate/i);
+    await assert.rejects(() => encode([{ name: "NOT-VALID", value: "synthetic" }]), /environment name|invalid name/i);
+    await assert.rejects(() => encode([{ name: "NUL\0NAME", value: "synthetic" }]), /nul/i);
+    await assert.rejects(() => encode([{ name: "NUL_VALUE", value: "nul\0value" }]), /nul/i);
+    await assert.rejects(() => encode([{ name: "OVERSIZED", value: "x".repeat(8 * 1024 * 1024 + 1) }]), /field|large|size/i);
+});
+test("rejects an invalid header, footer, count, and field length", async () => {
+    const encoded = await encode([{ name: "VALUE", value: "synthetic" }]);
+    const invalidHeader = Buffer.from(encoded);
+    invalidHeader[0] = invalidHeader[0] ^ 1;
+    assert.throws(() => decodeSecretStream(invalidHeader), /header/i);
+    const invalidFooter = Buffer.from(encoded);
+    invalidFooter[invalidFooter.length - 1] =
+        invalidFooter[invalidFooter.length - 1] ^ 1;
+    assert.throws(() => decodeSecretStream(invalidFooter), /footer/i);
+    const invalidCount = Buffer.from(encoded);
+    invalidCount.writeUInt32BE(65536, 8);
+    assert.throws(() => decodeSecretStream(invalidCount), /count|entries/i);
+    const invalidFieldLength = Buffer.from(encoded);
+    invalidFieldLength.writeUInt32BE(0xffffffff, 12);
+    assert.throws(() => decodeSecretStream(invalidFieldLength), /field|length|truncated/i);
+});
+test("rejects an oversized stream before writing any bytes", async () => {
+    const chunks = [];
+    let ended = false;
+    const stream = {
+        write(chunk) {
+            chunks.push(chunk);
+            return true;
+        },
+        end() {
+            ended = true;
+        },
+    };
+    const value = "x".repeat(8 * 1024 * 1024 - 1);
+    const entries = Array.from({ length: 8 }, (_, index) => ({
+        name: `VALUE_${index}`,
+        value,
+    }));
+    await assert.rejects(() => writeSecretStream(stream, entries), /stream|size/i);
+    assert.deepEqual(chunks, []);
+    assert.equal(ended, false);
+});

package/dist/secrets/tests/temporary-secret.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=temporary-secret.test.d.ts.map

package/dist/secrets/tests/temporary-secret.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temporary-secret.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/temporary-secret.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/temporary-secret.test.js

@@ -0,0 +1,76 @@
+/* eslint-disable playwright/expect-expect -- node:test assertions */
+import assert from "node:assert/strict";
+import { access, lstat, mkdir, mkdtemp, readFile, rm, stat, symlink, } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { createTemporarySecretFile } from "../temporary-secret.js";
+test("creates a private temporary secret file and removes it", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "temporary-secret-test-"));
+    try {
+        const secret = await createTemporarySecretFile("synthetic-secret", "value", {
+            rootDirectory: root,
+        });
+        const rootStats = await stat(root);
+        const directoryStats = await stat(path.dirname(secret.path));
+        const fileStats = await stat(secret.path);
+        assert.equal(rootStats.mode & 0o777, 0o700);
+        assert.equal(directoryStats.mode & 0o777, 0o700);
+        assert.equal(fileStats.mode & 0o777, 0o600);
+        assert.equal(await readFile(secret.path, "utf8"), "synthetic-secret");
+        await secret.remove();
+        await assert.rejects(() => access(secret.path), /ENOENT/);
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+test("removes abandoned directories for dead processes but preserves active ones", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "temporary-secret-test-"));
+    const deadDirectory = path.join(root, "424242-dead");
+    const activeDirectory = path.join(root, "424243-active");
+    try {
+        await mkdir(deadDirectory);
+        await mkdir(activeDirectory);
+        const secret = await createTemporarySecretFile("value", "value", {
+            rootDirectory: root,
+            processId: 424243,
+            processExists: (pid) => pid === 424243,
+        });
+        await assert.rejects(() => lstat(deadDirectory), /ENOENT/);
+        await access(activeDirectory);
+        await secret.remove();
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+test("rejects a symlink used as the temporary secret root", async () => {
+    const parent = await mkdtemp(path.join(os.tmpdir(), "temporary-secret-test-"));
+    const target = path.join(parent, "target");
+    const link = path.join(parent, "link");
+    try {
+        await mkdir(target);
+        await symlink(target, link);
+        await assert.rejects(() => createTemporarySecretFile("value", "value", {
+            rootDirectory: link,
+        }), /symlink/i);
+    }
+    finally {
+        await rm(parent, { recursive: true, force: true });
+    }
+});
+test("reports temporary cleanup failure when file creation fails", async () => {
+    const root = await mkdtemp(path.join(os.tmpdir(), "temporary-secret-test-"));
+    try {
+        await assert.rejects(() => createTemporarySecretFile("value", ".", {
+            rootDirectory: root,
+            removeDirectory: async () => {
+                throw new Error("cleanup failed");
+            },
+        }), /creation and cleanup failed/i);
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@red-hat-developer-hub/e2e-test-utils",
-  "version": "2.1.14",
+  "version": "2.1.16",
   "description": "Test utilities for RHDH E2E tests",
   "license": "Apache-2.0",
   "repository": {

package/dist/deployment/rhdh/config/new-frontend-system/secrets.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: rhdh-secrets
-type: Opaque
-stringData:
-  APP_CONFIG_app_packageName: app-next
-  ENABLE_STANDARD_MODULE_FEDERATION: "true"