@red-hat-developer-hub/e2e-test-utils 2.1.15 → 2.1.16

package/dist/secrets/tests/gsm-wrapper.test.js

@@ -0,0 +1,166 @@
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test assertions */
+import assert from "node:assert/strict";
+import { access, mkdir, mkdtemp, readFile, rm, writeFile, } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import test from "node:test";
+import { GsmWrapper } from "../gsm-wrapper.js";
+const script = '#!/bin/bash\nset -euo pipefail\nGCLOUD_CONFIG_PATH=x\nCONTAINER_ENGINE=podman\nIMAGE="${SECRET_MANAGER_IMAGE:-quay.io/openshift/ci-public:ci_secret-manager_latest}"\n';
+test("downloads and atomically caches the GSM wrapper", async () => {
+    const cacheDir = await mkdtemp(path.join(os.tmpdir(), "gsm-wrapper-test-"));
+    const calls = [];
+    try {
+        const wrapper = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => script,
+            env: {
+                BW_SESSION: "must-not-reach-gsm",
+                VAULT_TOKEN: "must-not-reach-gsm",
+            },
+            commandRunner: async (_command, args, options) => {
+                calls.push([...args]);
+                assert.equal(options?.env?.BW_SESSION, undefined);
+                assert.equal(options?.env?.VAULT_TOKEN, undefined);
+                return { status: 0, stdout: "", stderr: "" };
+            },
+        });
+        const metadata = await wrapper.run(["describe", "-o", "json"]);
+        assert.equal(metadata.usedCache, false);
+        assert.match(path.basename(calls[0][0]), /^secret-manager\.sh\.[a-f0-9]{64}$/);
+        assert.equal(await readFile(calls[0][0], "utf8"), script);
+    }
+    finally {
+        await rm(cacheDir, { recursive: true, force: true });
+    }
+});
+test("uses a validated cached wrapper when refresh fails", async () => {
+    const cacheDir = await mkdtemp(path.join(os.tmpdir(), "gsm-wrapper-test-"));
+    const warnings = [];
+    try {
+        const first = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => script,
+            commandRunner: async () => ({ status: 0, stdout: "", stderr: "" }),
+        });
+        await first.run(["list"]);
+        const second = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => {
+                throw new Error("offline");
+            },
+            commandRunner: async () => ({ status: 0, stdout: "", stderr: "" }),
+            warning: (message) => warnings.push(message),
+        });
+        const result = await second.run(["list"]);
+        assert.equal(result.usedCache, true);
+        assert.match(warnings[0] ?? "", /cached GSM wrapper/i);
+    }
+    finally {
+        await rm(cacheDir, { recursive: true, force: true });
+    }
+});
+test("rejects an untrusted downloaded wrapper", async () => {
+    const cacheDir = await mkdtemp(path.join(os.tmpdir(), "gsm-wrapper-test-"));
+    try {
+        const wrapper = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => "#!/bin/sh\necho untrusted\n",
+            commandRunner: async () => ({ status: 0, stdout: "", stderr: "" }),
+        });
+        await assert.rejects(() => wrapper.run(["list"]), /no validated cache/i);
+    }
+    finally {
+        await rm(cacheDir, { recursive: true, force: true });
+    }
+});
+test("rejects a wrapper that selects an image outside the trusted repository", async () => {
+    const cacheDir = await mkdtemp(path.join(os.tmpdir(), "gsm-wrapper-test-"));
+    try {
+        const wrapper = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => script.replace("quay.io/openshift/ci-public:ci_secret-manager_latest", "docker.io/example/secret-manager:latest"),
+            commandRunner: async () => ({ status: 0, stdout: "", stderr: "" }),
+        });
+        await assert.rejects(() => wrapper.run(["list"]), /trusted image/i);
+    }
+    finally {
+        await rm(cacheDir, { recursive: true, force: true });
+    }
+});
+test("rejects an image override outside the trusted repository", () => {
+    assert.throws(() => new GsmWrapper({
+        env: {
+            SECRET_MANAGER_IMAGE: "docker.io/example/secret-manager:latest",
+        },
+    }), /trusted image/i);
+});
+test("passes interactive GSM commands through the terminal", async () => {
+    const cacheDir = await mkdtemp(path.join(os.tmpdir(), "gsm-wrapper-test-"));
+    let received;
+    try {
+        const wrapper = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => script,
+            commandRunner: async (_command, _args, options) => {
+                received = options;
+                return { status: 0, stdout: "", stderr: "" };
+            },
+        });
+        await wrapper.run(["create"], undefined, {
+            stdio: "inherit",
+            tty: true,
+        });
+        assert.deepEqual({ stdio: received?.stdio, tty: received?.tty }, { stdio: "inherit", tty: true });
+    }
+    finally {
+        await rm(cacheDir, { recursive: true, force: true });
+    }
+});
+test("cleans the local GSM authentication directory without the wrapper", async () => {
+    const cacheDir = await mkdtemp(path.join(os.tmpdir(), "gsm-wrapper-test-"));
+    const authDir = path.join(cacheDir, "gcp-secret-manager", ".secret-manager-gcloud");
+    let fetched = false;
+    let executed = false;
+    try {
+        await mkdir(authDir, { recursive: true });
+        await writeFile(path.join(authDir, "credentials.db"), "synthetic");
+        const wrapper = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => {
+                fetched = true;
+                throw new Error("offline");
+            },
+            commandRunner: async () => {
+                executed = true;
+                throw new Error("wrapper must not execute");
+            },
+        });
+        await wrapper.clean();
+        await assert.rejects(() => access(authDir), /ENOENT/);
+        assert.equal(fetched, false);
+        assert.equal(executed, false);
+    }
+    finally {
+        await rm(cacheDir, { recursive: true, force: true });
+    }
+});
+test("shares one wrapper initialization across concurrent runs", async () => {
+    const cacheDir = await mkdtemp(path.join(os.tmpdir(), "gsm-wrapper-test-"));
+    let fetches = 0;
+    try {
+        const wrapper = new GsmWrapper({
+            cacheDir,
+            fetchScript: async () => {
+                fetches++;
+                await new Promise((resolve) => setTimeout(resolve, 10));
+                return script;
+            },
+            commandRunner: async () => ({ status: 0, stdout: "", stderr: "" }),
+        });
+        await Promise.all([wrapper.run(["list"]), wrapper.run(["list"])]);
+        assert.equal(fetches, 1);
+    }
+    finally {
+        await rm(cacheDir, { recursive: true, force: true });
+    }
+});

package/dist/secrets/tests/gsm.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gsm.test.d.ts.map

package/dist/secrets/tests/gsm.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gsm.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/gsm.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/gsm.test.js

@@ -0,0 +1,181 @@
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect, playwright/no-conditional-in-test -- node:test assertions */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { GsmClient } from "../gsm.js";
+function result(stdout = "", status = 0, timedOut = false, signal) {
+    return {
+        status,
+        stdout,
+        stderr: "synthetic",
+        timedOut,
+        ...(signal === undefined ? {} : { signal }),
+        usedCache: false,
+    };
+}
+test("describes GSM metadata without exposing provider output", async () => {
+    const calls = [];
+    const runner = {
+        run: async (args) => {
+            calls.push([...args]);
+            return result([
+                "Created:               synthetic",
+                "JIRA project:          (not set)",
+                "Rotation instructions: (not set)",
+                "Request information:   (not set)",
+            ].join("\n"));
+        },
+    };
+    const metadata = await new GsmClient({ runner }).describe("rhdh-qe", "rhdh/test");
+    assert.deepEqual(metadata, {
+        "create-time": "synthetic",
+        "jira-project": "(not set)",
+        "rotation-instructions": "(not set)",
+        "request-information": "(not set)",
+    });
+    assert.deepEqual(calls[0], ["describe", "-c", "rhdh-qe", "rhdh/test"]);
+});
+test("whitelists JSON metadata fields before returning them", async () => {
+    const runner = {
+        run: async () => result(JSON.stringify({
+            "create-time": "synthetic",
+            value: "must-not-leak",
+            payload: "must-not-leak",
+            unexpected: "ignored",
+        })),
+    };
+    assert.deepEqual(await new GsmClient({ runner }).describe("rhdh-qe", "rhdh/test"), { "create-time": "synthetic" });
+});
+test("updates GSM using the private snapshot and reports timeout as indeterminate", async () => {
+    const calls = [];
+    const runner = {
+        run: async (args, timeout) => {
+            calls.push({ args: [...args], timeout });
+            return result("", 0);
+        },
+    };
+    await new GsmClient({ runner }).update("rhdh-qe", "rhdh/test", "/private/snapshot", 123);
+    assert.deepEqual(calls[0], {
+        args: [
+            "update",
+            "-c",
+            "rhdh-qe",
+            "rhdh/test",
+            "--from-file",
+            "/private/snapshot",
+        ],
+        timeout: 123,
+    });
+    const timeoutRunner = {
+        run: async () => result("", null, true),
+    };
+    await assert.rejects(() => new GsmClient({ runner: timeoutRunner }).update("rhdh-qe", "rhdh/test", "/private/snapshot", 123), (error) => error instanceof Error &&
+        error.message.includes("indeterminate") &&
+        error.indeterminate === true);
+});
+test("reports a signal-terminated GSM create as indeterminate", async () => {
+    const runner = {
+        run: async () => result("", null, false, "SIGTERM"),
+    };
+    await assert.rejects(() => new GsmClient({ runner }).create("rhdh-qe", "rhdh/test", "/private/snapshot", 123), (error) => error instanceof Error &&
+        error.message.includes("indeterminate") &&
+        error.message.includes("SIGTERM") &&
+        error.indeterminate === true);
+});
+test("reports a signal-terminated GSM update as indeterminate", async () => {
+    const runner = {
+        run: async () => result("", null, false, "SIGINT"),
+    };
+    await assert.rejects(() => new GsmClient({ runner }).update("rhdh-qe", "rhdh/test", "/private/snapshot", 123), (error) => error instanceof Error &&
+        error.message.includes("indeterminate") &&
+        error.message.includes("SIGINT") &&
+        error.indeterminate === true);
+});
+test("reports a signal-terminated GSM delete as indeterminate", async () => {
+    const runner = {
+        run: async () => result("", null, false, "SIGTERM"),
+    };
+    await assert.rejects(() => new GsmClient({ runner }).delete("rhdh-qe", "rhdh/test", 123), (error) => error instanceof Error &&
+        error.message.includes("indeterminate") &&
+        error.indeterminate === true);
+});
+test("distinguishes a missing GSM secret from other describe failures", async () => {
+    const missing = {
+        run: async () => result("", 1, false),
+    };
+    const missingClient = new GsmClient({
+        runner: {
+            run: async () => ({
+                ...result("Secret 'rhdh/test' does not exist", 1),
+                stderr: "",
+            }),
+        },
+    });
+    assert.equal(await missingClient.exists("rhdh-qe", "rhdh/test"), false);
+    await assert.rejects(() => new GsmClient({ runner: missing }).exists("rhdh-qe", "rhdh/test"), /does not exist or is inaccessible/i);
+});
+test("does not classify missing application credentials as a missing secret", async () => {
+    const runner = {
+        run: async () => result("", 1, false),
+    };
+    const authenticationRunner = {
+        run: async () => ({
+            ...result("", 1),
+            stderr: "google.auth.exceptions.DefaultCredentialsError: default credentials were not found",
+        }),
+    };
+    await assert.rejects(() => new GsmClient({ runner }).exists("rhdh-qe", "rhdh/test"), /does not exist or is inaccessible/i);
+    await assert.rejects(() => new GsmClient({ runner: authenticationRunner }).exists("rhdh-qe", "rhdh/test"), /gsm-login/i);
+});
+test("gives login guidance when GSM list authentication fails", async () => {
+    const runner = {
+        run: async () => ({
+            ...result("", 1),
+            stderr: "DefaultCredentialsError: default credentials were not found",
+        }),
+    };
+    await assert.rejects(() => new GsmClient({ runner }).list("rhdh-qe"), /gsm-login/i);
+});
+test("rejects metadata timeouts that Node timers cannot represent", () => {
+    assert.throws(() => new GsmClient({ metadataTimeoutMs: 2_147_483_648 }), /maximum|positive integer/i);
+});
+test("lists GSM paths and creates with an interactive terminal", async () => {
+    const calls = [];
+    const runner = {
+        run: async (args, timeout, options) => {
+            calls.push({ args: [...args], timeout, options });
+            if (args[0] === "list")
+                return result('["rhdh/test", "rhdh/other"]');
+            return result();
+        },
+        ensureInteractive: async () => undefined,
+    };
+    const client = new GsmClient({ runner });
+    assert.deepEqual(await client.list("rhdh-qe"), ["rhdh/test", "rhdh/other"]);
+    await client.ensureInteractive();
+    await client.create("rhdh-qe", "rhdh/new", "/private/snapshot", 123);
+    await client.delete("rhdh-qe", "rhdh/new", 456);
+    assert.deepEqual(calls, [
+        {
+            args: ["list", "-c", "rhdh-qe", "-o", "json"],
+            timeout: 60_000,
+            options: undefined,
+        },
+        {
+            args: [
+                "create",
+                "-c",
+                "rhdh-qe",
+                "rhdh/new",
+                "--from-file",
+                "/private/snapshot",
+            ],
+            timeout: 123,
+            options: { stdio: "inherit", tty: true },
+        },
+        {
+            args: ["delete", "-c", "rhdh-qe", "rhdh/new"],
+            timeout: 456,
+            options: undefined,
+        },
+    ]);
+});

package/dist/secrets/tests/mutation.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=mutation.test.d.ts.map

package/dist/secrets/tests/mutation.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutation.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/mutation.test.ts"],"names":[],"mappings":""}