@red-hat-developer-hub/e2e-test-utils 2.1.15 → 2.1.17

package/dist/secrets/tests/environment.test.js

@@ -1,7 +1,8 @@
 /* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test fixtures model process environment keys */
 import assert from "node:assert/strict";
 import test from "node:test";
-import { materializeEnvironment, } from "../environment.js";
+import { materializeEnvironmentWithSecrets, materializeEnvironment, materializeStreamEnvironment, } from "../environment.js";
+import { SECRET_STREAM_ENVIRONMENT_VARIABLE, SECRET_STREAM_FD, } from "../stream.js";
 const selector = {
     prefix: "global/",
     optional: false,
@@ -57,6 +58,109 @@ test("maps selected notes into a child environment without mutating the parent",
         VAULT: "legacy-provider-setting",
     });
 });
+test("returns sorted mapped secret entries", () => {
+    const identitySelector = {
+        ...selector,
+        destination: {
+            ...selector.destination,
+            requirePrefix: undefined,
+            keyTransform: "identity",
+        },
+    };
+    const result = materializeEnvironmentWithSecrets([
+        {
+            id: "zeta-id",
+            name: "global/ZETA",
+            value: "zeta-value",
+            selector: identitySelector,
+        },
+        {
+            id: "alpha-id",
+            name: "global/ALPHA",
+            value: "alpha-value",
+            selector: identitySelector,
+        },
+    ], [identitySelector], {});
+    assert.deepEqual(result.secrets, [
+        { name: "ALPHA", value: "alpha-value" },
+        { name: "ZETA", value: "zeta-value" },
+    ]);
+});
+test("does not retain an inherited stream marker outside stream mode", () => {
+    const secrets = [
+        {
+            id: "token-id",
+            name: "global/VAULT_TOKEN",
+            value: "synthetic-value",
+            selector,
+        },
+    ];
+    assert.deepEqual(materializeEnvironment(secrets, [selector], {
+        PATH: "/bin",
+        RHDH_E2E_SECRET_FD: "inherited-fd",
+    }), {
+        PATH: "/bin",
+        VAULT_TOKEN: "synthetic-value",
+    });
+});
+test("removes selected names from a stream child environment", () => {
+    const parent = {
+        PATH: "/bin",
+        VAULT_TOKEN: "inherited-value",
+        RHDH_E2E_SECRET_FD: "stale-fd",
+    };
+    const materialized = materializeEnvironmentWithSecrets([
+        {
+            id: "token-id",
+            name: "global/VAULT_TOKEN",
+            value: "stream-value",
+            selector,
+        },
+    ], [selector], parent);
+    const streamEnvironment = materializeStreamEnvironment(materialized);
+    assert.equal(streamEnvironment.VAULT_TOKEN, undefined);
+    assert.equal(streamEnvironment[SECRET_STREAM_ENVIRONMENT_VARIABLE], String(SECRET_STREAM_FD));
+    assert.equal(streamEnvironment.PATH, "/bin");
+    assert.equal(parent.VAULT_TOKEN, "inherited-value");
+    assert.equal(parent.RHDH_E2E_SECRET_FD, "stale-fd");
+});
+test("does not mutate the parent process environment", () => {
+    const parent = {
+        RHDH_E2E_SECRET_FD: "stale-fd",
+        VAULT_TOKEN: "old-value",
+    };
+    const materialized = materializeEnvironmentWithSecrets([
+        {
+            id: "token-id",
+            name: "global/VAULT_TOKEN",
+            value: "new-value",
+            selector,
+        },
+    ], [selector], parent);
+    materializeStreamEnvironment(materialized);
+    assert.deepEqual(parent, {
+        RHDH_E2E_SECRET_FD: "stale-fd",
+        VAULT_TOKEN: "old-value",
+    });
+});
+test("reserves RHDH_E2E_SECRET_FD", () => {
+    const identitySelector = {
+        ...selector,
+        destination: {
+            ...selector.destination,
+            requirePrefix: undefined,
+            keyTransform: "identity",
+        },
+    };
+    assert.throws(() => materializeEnvironmentWithSecrets([
+        {
+            id: "reserved-fd-id",
+            name: "global/RHDH_E2E_SECRET_FD",
+            value: "synthetic",
+            selector: identitySelector,
+        },
+    ], [identitySelector], {}), /reserved environment variable name.*RHDH_E2E_SECRET_FD/i);
+});
 test("filters item names that do not satisfy requirePrefix", () => {
     const secrets = [
         {
@@ -84,7 +188,45 @@ test("rejects transformed environment-name collisions", () => {
             selector,
         },
     ];
-    assert.throws(() => materializeEnvironment(secrets, [selector], {}), /environment variable collision.*VAULT_A_B/i);
+    assert.throws(() => materializeEnvironmentWithSecrets(secrets, [selector], {}), /environment variable collision.*VAULT_A_B/i);
+});
+test("rejects selected Bitwarden provider variables", () => {
+    const identitySelector = {
+        ...selector,
+        destination: {
+            ...selector.destination,
+            requirePrefix: undefined,
+            keyTransform: "identity",
+        },
+    };
+    assert.throws(() => materializeEnvironmentWithSecrets([
+        {
+            id: "provider-id",
+            name: "global/BW_SESSION",
+            value: "synthetic",
+            selector: identitySelector,
+        },
+    ], [identitySelector], {}), /Bitwarden provider environment variable.*BW_SESSION/i);
+});
+test("materializes prototype-named environment variables as own properties", () => {
+    const identitySelector = {
+        ...selector,
+        destination: {
+            ...selector.destination,
+            requirePrefix: undefined,
+            keyTransform: "identity",
+        },
+    };
+    const child = materializeEnvironment([
+        {
+            id: "prototype-id",
+            name: "global/__proto__",
+            value: "synthetic",
+            selector: identitySelector,
+        },
+    ], [identitySelector], {});
+    assert.equal(Object.hasOwn(child, "__proto__"), true);
+    assert.equal(child.__proto__, "synthetic");
 });
 test("rejects invalid identity environment names", () => {
     const identitySelector = {
@@ -95,7 +237,7 @@ test("rejects invalid identity environment names", () => {
             keyTransform: "identity",
         },
     };
-    assert.throws(() => materializeEnvironment([
+    assert.throws(() => materializeEnvironmentWithSecrets([
         {
             id: "invalid-id",
             name: "global/NOT-VALID",

package/dist/secrets/tests/exec.test.js

@@ -1,7 +1,16 @@
-/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test fixtures model process environment keys */
+/* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect, playwright/no-conditional-in-test -- node:test fixtures model process environment keys */
 import assert from "node:assert/strict";
+import { EventEmitter } from "node:events";
+import { existsSync } from "node:fs";
+import { execFileSync } from "node:child_process";
+import { mkdtemp, readFile, rm } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { Writable } from "node:stream";
 import test from "node:test";
-import { executeCommand, runChild } from "../exec.js";
+import { setTimeout as delay } from "node:timers/promises";
+import { pathToFileURL } from "node:url";
+import { createChildRunner, executeCommand, runChild, } from "../exec.js";
 const profile = {
     schemaVersion: 1,
     collection: "rhdh-plugin-export-overlays",
@@ -41,6 +50,7 @@ test("executes a command with only selected secrets in its child environment", a
         env: {
             PATH: "/usr/bin",
             BW_SESSION: "synthetic-session",
+            RHDH_E2E_SECRET_FD: "stale-fd",
             EXISTING_VALUE: "preserved",
         },
         client,
@@ -52,6 +62,411 @@ test("executes a command with only selected secrets in its child environment", a
     assert.equal(received?.env.VAULT_TOKEN, "synthetic-value");
     assert.equal(received?.env.EXISTING_VALUE, "preserved");
     assert.equal(received?.env.BW_SESSION, undefined);
+    assert.equal(received?.env.RHDH_E2E_SECRET_FD, undefined);
+});
+test("does not pass stream options to a non-stream injected runner", async () => {
+    let receivedArgumentCount = 0;
+    const childRunner = async (...args) => {
+        receivedArgumentCount = args.length;
+        return 0;
+    };
+    const exitCode = await executeCommand({
+        profile,
+        workspaces: [],
+        command: "playwright",
+        args: [],
+        env: { BW_SESSION: "synthetic-session" },
+        client: { read: async () => [secret] },
+        childRunner,
+    });
+    assert.equal(exitCode, 0);
+    assert.equal(receivedArgumentCount, 3);
+});
+test("streams selected secrets without placing values in the child environment", async () => {
+    let childEnvironment;
+    let runnerOptions;
+    const childRunner = async (_command, _args, env, options) => {
+        childEnvironment = env;
+        runnerOptions = options;
+        return 0;
+    };
+    const exitCode = await executeCommand({
+        profile,
+        workspaces: [],
+        command: "podman",
+        args: ["run"],
+        streamSecrets: true,
+        env: {
+            BW_SESSION: "synthetic-session",
+            BW_CLIENTID: "synthetic-client-id",
+            VAULT_TOKEN: "stale-value",
+            RHDH_E2E_SECRET_FD: "stale-fd",
+        },
+        client: { read: async () => [secret] },
+        childRunner,
+    });
+    assert.equal(exitCode, 0);
+    assert.equal(childEnvironment?.VAULT_TOKEN, undefined);
+    assert.equal(childEnvironment?.BW_SESSION, undefined);
+    assert.equal(childEnvironment?.BW_CLIENTID, undefined);
+    assert.equal(childEnvironment?.RHDH_E2E_SECRET_FD, "3");
+    assert.deepEqual(runnerOptions, {
+        secretStream: [{ name: "VAULT_TOKEN", value: "synthetic-value" }],
+    });
+});
+test("passes sorted mapped entries to the stream child runner", async () => {
+    const expandedSelector = secret.selector;
+    const secrets = [
+        {
+            id: "zeta-id",
+            name: "global/VAULT_ZETA",
+            value: "zeta-secret-value",
+            selector: expandedSelector,
+        },
+        {
+            id: "alpha-id",
+            name: "global/VAULT_ALPHA",
+            value: "alpha-secret-value",
+            selector: expandedSelector,
+        },
+    ];
+    let runnerOptions;
+    const exitCode = await executeCommand({
+        profile,
+        workspaces: [],
+        command: "playwright",
+        args: [],
+        streamSecrets: true,
+        env: { BW_SESSION: "synthetic-session" },
+        client: { read: async () => secrets },
+        childRunner: async (_command, _args, _env, options) => {
+            runnerOptions = options;
+            return 0;
+        },
+    });
+    assert.equal(exitCode, 0);
+    assert.deepEqual(runnerOptions?.secretStream, [
+        { name: "VAULT_ALPHA", value: "alpha-secret-value" },
+        { name: "VAULT_ZETA", value: "zeta-secret-value" },
+    ]);
+});
+test("writes the secret stream to child file descriptor three", async () => {
+    const childScript = [
+        "const fs = require('node:fs');",
+        "const stream = fs.readFileSync(3);",
+        "if (!stream.subarray(0, 8).equals(Buffer.from('RHDHSEC1')) || !stream.includes(Buffer.from('RHDHEND1')) || stream.length < 160000) process.exit(1);",
+    ].join(" ");
+    const exitCode = await runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, { secretStream: [{ name: "LARGE_VALUE", value: "x".repeat(160 * 1024) }] });
+    assert.equal(exitCode, 0);
+});
+test("decodes multiline, empty, and large values without exposing them to the child environment", async () => {
+    const streamModuleUrl = pathToFileURL(path.join(process.cwd(), "dist/secrets/stream.js")).href;
+    const childScript = [
+        "import fs from 'node:fs';",
+        `import { decodeSecretStream } from ${JSON.stringify(streamModuleUrl)};`,
+        "const entries = decodeSecretStream(fs.readFileSync(3));",
+        "const values = new Map(entries.map(({ name, value }) => [name, value]));",
+        "if (process.env.RHDH_E2E_SECRET_FD !== '3') process.exit(2);",
+        "if (values.get('VAULT_EMPTY_VALUE') !== '') process.exit(3);",
+        "if (values.get('VAULT_MULTILINE_VALUE')?.split('\\n').length !== 3) process.exit(4);",
+        "if (values.get('VAULT_LARGE_VALUE')?.length !== 160 * 1024) process.exit(5);",
+        "if (process.env.VAULT_EMPTY_VALUE !== undefined || process.env.VAULT_MULTILINE_VALUE !== undefined || process.env.VAULT_LARGE_VALUE !== undefined) process.exit(6);",
+        "if (process.env.BW_SESSION !== undefined || process.env.BW_CLIENTID !== undefined) process.exit(7);",
+        "try { fs.fstatSync(0); fs.fstatSync(3); } catch { process.exit(9); }",
+        "if (process.stdin.fd !== 0 || 0 === 3) process.exit(10);",
+    ].join(" ");
+    const selector = secret.selector;
+    const exitCode = await executeCommand({
+        profile,
+        workspaces: [],
+        command: process.execPath,
+        args: ["--input-type=module", "-e", childScript],
+        streamSecrets: true,
+        env: {
+            ...process.env,
+            VAULT_EMPTY_VALUE: "stale-value",
+            VAULT_MULTILINE_VALUE: "stale-value",
+            VAULT_LARGE_VALUE: "stale-value",
+            BW_SESSION: "synthetic-session",
+            BW_CLIENTID: "synthetic-client-id",
+        },
+        client: {
+            read: async () => [
+                {
+                    id: "empty-id",
+                    name: "global/VAULT_EMPTY_VALUE",
+                    value: "",
+                    selector,
+                },
+                {
+                    id: "multiline-id",
+                    name: "global/VAULT_MULTILINE_VALUE",
+                    value: "first line\nsecond line\n",
+                    selector,
+                },
+                {
+                    id: "large-id",
+                    name: "global/VAULT_LARGE_VALUE",
+                    value: "x".repeat(160 * 1024),
+                    selector,
+                },
+            ],
+        },
+    });
+    assert.equal(exitCode, 0);
+});
+test("preserves a stream child's exit code after it reads the stream", async () => {
+    const childScript = [
+        "const fs = require('node:fs');",
+        "fs.readFileSync(3);",
+        "process.exit(17);",
+    ].join(" ");
+    const exitCode = await runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, { secretStream: [{ name: "EXIT_VALUE", value: "synthetic-value" }] });
+    assert.equal(exitCode, 17);
+});
+test("maps a stream child's SIGTERM to status 143", async () => {
+    const childScript = [
+        "const fs = require('node:fs');",
+        "fs.readFileSync(3);",
+        "process.kill(process.pid, 'SIGTERM');",
+    ].join(" ");
+    const exitCode = await runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, { secretStream: [{ name: "SIGNAL_VALUE", value: "synthetic-value" }] });
+    assert.equal(exitCode, 143);
+});
+test("preserves the child result when it closes the stream before reading it", async () => {
+    const childScript = [
+        "const fs = require('node:fs');",
+        "fs.closeSync(3);",
+        "setTimeout(() => process.exit(17), 50);",
+    ].join(" ");
+    const exitCode = await runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, {
+        secretStream: [
+            { name: "EARLY_CLOSE_VALUE", value: "x".repeat(160 * 1024) },
+        ],
+    });
+    assert.equal(exitCode, 17);
+});
+test("settles a backpressured writer when the child closes FD 3 without an error", async () => {
+    const childScript = [
+        "const fs = require('node:fs');",
+        "fs.closeSync(3);",
+        "setTimeout(() => process.exit(17), 100);",
+    ].join(" ");
+    const exitCode = await runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, {
+        secretStream: [
+            { name: "BACKPRESSURED_VALUE", value: "x".repeat(160 * 1024) },
+        ],
+    });
+    assert.equal(exitCode, 17);
+});
+test("maps a forwarded SIGTERM while the stream writer is backpressured", async () => {
+    if (process.platform === "win32")
+        return;
+    const childScript = "setTimeout(() => {}, 10000);";
+    const result = runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, {
+        secretStream: [
+            { name: "SIGNAL_BACKPRESSURED_VALUE", value: "x".repeat(160 * 1024) },
+        ],
+    });
+    await delay(20);
+    process.kill(process.pid, "SIGTERM");
+    assert.equal(await result, 143);
+});
+test("does not wait for an unstarted writer after a pre-spawn SIGTERM", async () => {
+    if (process.platform === "win32")
+        return;
+    const originalOn = process.on;
+    process.on = ((event, listener) => {
+        const result = originalOn.call(process, event, listener);
+        if (event === "SIGTERM")
+            listener();
+        return result;
+    });
+    try {
+        const result = runChild(process.execPath, ["-e", "setTimeout(() => {}, 10000);"], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, {
+            secretStream: [
+                { name: "PRE_SPAWN_SIGNAL_VALUE", value: "x".repeat(160 * 1024) },
+            ],
+        });
+        assert.equal(await Promise.race([
+            result,
+            delay(500).then(() => {
+                throw new Error("pre-spawn signal left runChild pending");
+            }),
+        ]), 143);
+    }
+    finally {
+        process.on = originalOn;
+    }
+});
+test("waits for child termination before rejecting a fatal stream writer error", async () => {
+    if (process.platform === "win32")
+        return;
+    const directory = await mkdtemp(path.join(os.tmpdir(), "rhdh-e2e-exec-stream-error-test-"));
+    const marker = path.join(directory, "state");
+    const ready = path.join(directory, "ready");
+    let valueReads = 0;
+    const entry = {
+        name: "FATAL_STREAM_VALUE",
+        get value() {
+            valueReads++;
+            if (valueReads > 4) {
+                for (let attempt = 0; attempt < 100 && !existsSync(ready); attempt++) {
+                    execFileSync("/bin/sh", ["-c", "sleep 0.01"], { stdio: "ignore" });
+                }
+                throw Object.assign(new Error("synthetic writer failure"), {
+                    code: "EIO",
+                });
+            }
+            return "synthetic-value";
+        },
+    };
+    const childScript = [
+        "const fs = require('node:fs');",
+        `process.on('SIGTERM', () => { fs.writeFileSync(${JSON.stringify(marker)}, 'signal'); setTimeout(() => { fs.writeFileSync(${JSON.stringify(marker)}, 'closed'); process.exit(0); }, 100); });`,
+        `fs.writeFileSync(${JSON.stringify(ready)}, 'ready');`,
+        "setTimeout(() => {}, 10000);",
+    ].join(" ");
+    try {
+        await assert.rejects(() => runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, { secretStream: [entry] }), /Unable to write secret stream/);
+        let state;
+        for (let attempt = 0; attempt < 50; attempt++) {
+            try {
+                state = await readFile(marker, "utf8");
+                break;
+            }
+            catch {
+                await delay(10);
+            }
+        }
+        assert.equal(state, "closed");
+    }
+    finally {
+        await delay(150);
+        await rm(directory, { recursive: true, force: true });
+    }
+});
+test("kills an unresponsive child after a fatal stream writer error", async () => {
+    if (process.platform === "win32")
+        return;
+    const directory = await mkdtemp(path.join(os.tmpdir(), "rhdh-e2e-exec-unresponsive-test-"));
+    const ready = path.join(directory, "ready");
+    let childReady = false;
+    let valueReads = 0;
+    const entry = {
+        name: "UNRESPONSIVE_STREAM_VALUE",
+        get value() {
+            valueReads++;
+            if (valueReads > 4) {
+                for (let attempt = 0; attempt < 100 && !existsSync(ready); attempt++) {
+                    execFileSync("/bin/sh", ["-c", "sleep 0.01"], { stdio: "ignore" });
+                }
+                childReady = existsSync(ready);
+                throw new Error("synthetic writer failure");
+            }
+            return "synthetic-value";
+        },
+    };
+    const childScript = [
+        "const fs = require('node:fs');",
+        "process.on('SIGTERM', () => {});",
+        `fs.writeFileSync(${JSON.stringify(ready)}, 'ready');`,
+        "setTimeout(() => {}, 10000);",
+    ].join(" ");
+    try {
+        const startedAt = Date.now();
+        await assert.rejects(() => runChild(process.execPath, ["-e", childScript], { ...process.env, RHDH_E2E_SECRET_FD: "3" }, { secretStream: [entry] }), /Unable to write secret stream/);
+        assert.equal(childReady, true);
+        assert.ok(Date.now() - startedAt < 2_000);
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
+});
+test("does not write or leak values when the stream command cannot start", async () => {
+    await assert.rejects(() => runChild("command-that-does-not-exist", [], { ...process.env }, { secretStream: [{ name: "MISSING_COMMAND_VALUE", value: "secret" }] }), (error) => {
+        assert(error instanceof Error);
+        assert.equal(error.message, "Unable to start command: command-that-does-not-exist");
+        assert.equal(error.message.includes("secret"), false);
+        return true;
+    });
+});
+test("suggests stream mode when the child environment exceeds OS limits", async () => {
+    const oversizedEnvironmentSpawn = (() => {
+        throw Object.assign(new Error("spawn E2BIG"), { code: "E2BIG" });
+    });
+    await assert.rejects(() => createChildRunner(oversizedEnvironmentSpawn)(process.execPath, [], {
+        LARGE_VALUE: "synthetic-value",
+    }), (error) => {
+        assert(error instanceof Error);
+        assert.equal(error.message, `Unable to start command: ${process.execPath}; child environment exceeds OS limits; retry with --stream-secrets`);
+        return true;
+    });
+});
+test("preserves the child result when the secret pipe resets", async () => {
+    let child;
+    const resetPipe = new Writable({
+        write(_chunk, _encoding, callback) {
+            callback(Object.assign(new Error("read ECONNRESET"), { code: "ECONNRESET" }));
+            setTimeout(() => child.emit("close", 17, null), 10);
+        },
+    });
+    const resetPipeSpawn = (() => {
+        child = new EventEmitter();
+        Object.defineProperty(child, "stdio", {
+            value: [null, null, null, resetPipe],
+        });
+        child.kill = (() => true);
+        queueMicrotask(() => child.emit("spawn"));
+        return child;
+    });
+    const exitCode = await createChildRunner(resetPipeSpawn)(process.execPath, [], { RHDH_E2E_SECRET_FD: "3" }, {
+        secretStream: [{ name: "RESET_VALUE", value: "x".repeat(160 * 1024) }],
+    });
+    assert.equal(exitCode, 17);
+});
+test("rejects an unavailable secret stream pipe without environment fallback", async () => {
+    let spawnOptions;
+    const unavailablePipeSpawn = ((_command, _args, options) => {
+        spawnOptions = options;
+        const child = new EventEmitter();
+        Object.defineProperty(child, "stdio", {
+            value: [null, null, null, null],
+        });
+        child.kill = (() => {
+            queueMicrotask(() => child.emit("close", null, "SIGTERM"));
+            return true;
+        });
+        queueMicrotask(() => child.emit("spawn"));
+        return child;
+    });
+    await assert.rejects(() => executeCommand({
+        profile,
+        workspaces: [],
+        command: "unavailable-pipe-command",
+        args: [],
+        streamSecrets: true,
+        env: {
+            BW_SESSION: "synthetic-session",
+            VAULT_TOKEN: "stale-value",
+        },
+        client: { read: async () => [secret] },
+        childRunner: createChildRunner(unavailablePipeSpawn),
+    }), (error) => {
+        assert(error instanceof Error);
+        assert.equal(error.message, "Unable to write secret stream for command: unavailable-pipe-command");
+        assert.doesNotMatch(error.message, /synthetic|session|token/i);
+        return true;
+    });
+    assert.deepEqual(spawnOptions?.stdio, [
+        "inherit",
+        "inherit",
+        "inherit",
+        "pipe",
+    ]);
+    assert.equal(spawnOptions?.env?.VAULT_TOKEN, undefined);
+    assert.equal(spawnOptions?.env?.BW_SESSION, undefined);
+    assert.equal(spawnOptions?.env?.RHDH_E2E_SECRET_FD, "3");
 });
 test("validates all selected mappings before starting the child", async () => {
     let childStarted = false;
@@ -85,3 +500,55 @@ test("returns the shell-compatible status for a signal-terminated child", async
     const exitCode = await runChild(process.execPath, ["-e", "process.kill(process.pid, 'SIGTERM')"], { ...process.env });
     assert.equal(exitCode, 143);
 });
+test("forwards termination to descendants in the child process group", async () => {
+    if (process.platform === "win32")
+        return;
+    const directory = await mkdtemp(path.join(os.tmpdir(), "rhdh-e2e-exec-test-"));
+    const marker = path.join(directory, "terminated");
+    const ready = path.join(directory, "ready");
+    const pidFile = path.join(directory, "pid");
+    let descendantPid;
+    try {
+        const descendantScript = [
+            "const fs = require('node:fs');",
+            `process.on('SIGTERM', () => { fs.writeFileSync(${JSON.stringify(marker)}, 'terminated'); process.exit(0); });`,
+            `fs.writeFileSync(${JSON.stringify(ready)}, 'ready');`,
+            "setTimeout(() => {}, 10000);",
+        ].join(" ");
+        const parentScript = [
+            "const fs = require('node:fs');",
+            "const { spawn } = require('node:child_process');",
+            `const child = spawn(process.execPath, ['-e', ${JSON.stringify(descendantScript)}], { stdio: 'ignore' });`,
+            `fs.writeFileSync(${JSON.stringify(pidFile)}, String(child.pid));`,
+            "setTimeout(() => {}, 10000);",
+        ].join(" ");
+        const result = runChild(process.execPath, ["-e", parentScript], {
+            ...process.env,
+        });
+        for (let attempt = 0; attempt < 50; attempt++) {
+            try {
+                await readFile(ready, "utf8");
+                descendantPid = Number(await readFile(pidFile, "utf8"));
+                break;
+            }
+            catch {
+                await delay(10);
+            }
+        }
+        assert.equal(typeof descendantPid, "number");
+        process.kill(process.pid, "SIGTERM");
+        assert.equal(await result, 143);
+        assert.equal(await readFile(marker, "utf8"), "terminated");
+    }
+    finally {
+        if (descendantPid !== undefined) {
+            try {
+                process.kill(descendantPid, "SIGTERM");
+            }
+            catch {
+                // The descendant may already have exited with the process group.
+            }
+        }
+        await rm(directory, { recursive: true, force: true });
+    }
+});

package/dist/secrets/tests/gsm-wrapper.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=gsm-wrapper.test.d.ts.map

package/dist/secrets/tests/gsm-wrapper.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gsm-wrapper.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/gsm-wrapper.test.ts"],"names":[],"mappings":""}