@red-hat-developer-hub/e2e-test-utils 2.1.15 → 2.1.17

package/dist/secrets/stream.js

@@ -0,0 +1,211 @@
+import { isValidEnvironmentName } from "./environment-name.js";
+export const SECRET_STREAM_ENVIRONMENT_VARIABLE = "RHDH_E2E_SECRET_FD";
+export const SECRET_STREAM_FD = 3;
+const HEADER = new TextEncoder().encode("RHDHSEC1");
+const FOOTER = new TextEncoder().encode("RHDHEND1");
+const HEADER_BYTES = HEADER.byteLength + 4;
+const FOOTER_BYTES = FOOTER.byteLength;
+const ENTRY_FRAME_BYTES = 8;
+const MAX_ENTRIES = 65535;
+const MAX_FIELD_BYTES = 8 * 1024 * 1024;
+const MAX_STREAM_BYTES = 64 * 1024 * 1024;
+const UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
+export async function writeSecretStream(stream, entries) {
+    const encodedEntries = validateEntries(entries);
+    const header = new Uint8Array(HEADER_BYTES);
+    header.set(HEADER);
+    writeUint32(header, HEADER.byteLength, encodedEntries.length);
+    await writeChunk(stream, header);
+    for (const entry of encodedEntries) {
+        const frame = new Uint8Array(ENTRY_FRAME_BYTES);
+        writeUint32(frame, 0, entry.nameBytes);
+        writeUint32(frame, 4, entry.valueBytes);
+        await writeChunk(stream, frame);
+        await writeChunk(stream, new TextEncoder().encode(entry.name));
+        await writeChunk(stream, new TextEncoder().encode(entry.value));
+    }
+    await writeChunk(stream, FOOTER);
+    await endStream(stream);
+}
+export function decodeSecretStream(input) {
+    if (input.byteLength > MAX_STREAM_BYTES) {
+        throw new Error("Secret stream exceeds the maximum size");
+    }
+    let offset = 0;
+    if (input.byteLength < HEADER_BYTES) {
+        throw new Error("Secret stream header is truncated");
+    }
+    if (!sameBytes(input.subarray(0, HEADER.byteLength), HEADER)) {
+        throw new Error("Invalid secret stream header");
+    }
+    offset += HEADER.byteLength;
+    const count = readUint32(input, offset);
+    offset += 4;
+    if (count > MAX_ENTRIES) {
+        throw new Error("Secret stream contains too many entries");
+    }
+    const entries = [];
+    const names = new Set();
+    for (let index = 0; index < count; index++) {
+        if (input.byteLength - offset < ENTRY_FRAME_BYTES) {
+            throw new Error("Secret stream entry frame is truncated");
+        }
+        const nameBytes = readUint32(input, offset);
+        const valueBytes = readUint32(input, offset + 4);
+        offset += ENTRY_FRAME_BYTES;
+        validateFieldSize(nameBytes);
+        validateFieldSize(valueBytes);
+        const payloadBytes = nameBytes + valueBytes;
+        if (input.byteLength - offset < payloadBytes) {
+            throw new Error("Secret stream entry payload is truncated");
+        }
+        const name = decodeUtf8(input.subarray(offset, offset + nameBytes));
+        offset += nameBytes;
+        const value = decodeUtf8(input.subarray(offset, offset + valueBytes));
+        offset += valueBytes;
+        validateEntry(name, value, names);
+        entries.push({ name, value });
+    }
+    if (input.byteLength - offset < FOOTER_BYTES) {
+        throw new Error("Secret stream footer is truncated");
+    }
+    if (!sameBytes(input.subarray(offset, offset + FOOTER_BYTES), FOOTER)) {
+        throw new Error("Invalid secret stream footer");
+    }
+    offset += FOOTER_BYTES;
+    if (offset !== input.byteLength) {
+        throw new Error("Secret stream contains trailing data");
+    }
+    return entries;
+}
+function validateEntries(entries) {
+    if (entries.length > MAX_ENTRIES) {
+        throw new Error("Secret stream contains too many entries");
+    }
+    const names = new Set();
+    const encodedEntries = [];
+    let totalBytes = HEADER_BYTES + FOOTER_BYTES;
+    for (const entry of entries) {
+        if (typeof entry !== "object" ||
+            entry === null ||
+            typeof entry.name !== "string" ||
+            typeof entry.value !== "string") {
+            throw new Error("Secret stream entry must contain a name and value");
+        }
+        validateEntry(entry.name, entry.value, names);
+        const nameBytes = new TextEncoder().encode(entry.name).byteLength;
+        const valueBytes = new TextEncoder().encode(entry.value).byteLength;
+        validateFieldSize(nameBytes);
+        validateFieldSize(valueBytes);
+        totalBytes += ENTRY_FRAME_BYTES + nameBytes + valueBytes;
+        if (totalBytes > MAX_STREAM_BYTES) {
+            throw new Error("Secret stream exceeds the maximum size");
+        }
+        encodedEntries.push({ ...entry, nameBytes, valueBytes });
+    }
+    return encodedEntries.sort((left, right) => left.name < right.name ? -1 : left.name > right.name ? 1 : 0);
+}
+function validateEntry(name, value, names) {
+    if (name.includes("\0") || value.includes("\0")) {
+        throw new Error("Secret stream entries cannot contain NUL bytes");
+    }
+    if (!isValidEnvironmentName(name)) {
+        throw new Error("Secret stream entry has an invalid environment name");
+    }
+    if (names.has(name)) {
+        throw new Error("Secret stream contains duplicate entry names");
+    }
+    names.add(name);
+}
+function validateFieldSize(byteLength) {
+    if (byteLength > MAX_FIELD_BYTES) {
+        throw new Error("Secret stream field exceeds the maximum size");
+    }
+}
+function decodeUtf8(input) {
+    try {
+        return UTF8_DECODER.decode(input);
+    }
+    catch {
+        throw new Error("Secret stream contains invalid UTF-8");
+    }
+}
+function writeUint32(target, offset, value) {
+    target[offset] = value >>> 24;
+    target[offset + 1] = value >>> 16;
+    target[offset + 2] = value >>> 8;
+    target[offset + 3] = value;
+}
+function readUint32(input, offset) {
+    return (input[offset] * 0x1000000 +
+        input[offset + 1] * 0x10000 +
+        input[offset + 2] * 0x100 +
+        input[offset + 3]);
+}
+function sameBytes(left, right) {
+    if (left.byteLength !== right.byteLength)
+        return false;
+    return left.every((byte, index) => byte === right[index]);
+}
+function writeChunk(stream, chunk) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => {
+            stream.removeListener("drain", onDrain);
+            stream.removeListener("error", onError);
+        };
+        const resolveOnce = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve();
+        };
+        const rejectOnce = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(new Error("Unable to write secret stream"));
+        };
+        const onDrain = () => resolveOnce();
+        const onError = () => rejectOnce();
+        stream.once("drain", onDrain);
+        stream.once("error", onError);
+        try {
+            if (stream.write(chunk))
+                resolveOnce();
+        }
+        catch {
+            rejectOnce();
+        }
+    });
+}
+function endStream(stream) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const cleanup = () => stream.removeListener("error", onError);
+        const resolveOnce = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            resolve();
+        };
+        const rejectOnce = () => {
+            if (settled)
+                return;
+            settled = true;
+            cleanup();
+            reject(new Error("Unable to close secret stream"));
+        };
+        const onError = () => rejectOnce();
+        stream.once("error", onError);
+        try {
+            stream.end(resolveOnce);
+        }
+        catch {
+            rejectOnce();
+        }
+    });
+}

package/dist/secrets/temporary-secret.d.ts

@@ -0,0 +1,13 @@
+export interface TemporarySecretFile {
+    path: string;
+    remove(): Promise<void>;
+}
+export interface TemporarySecretFileOptions {
+    rootDirectory?: string;
+    processId?: number;
+    processExists?: (processId: number) => boolean;
+    removeDirectory?: (directory: string) => Promise<void>;
+}
+export declare function defaultTemporarySecretRoot(): string;
+export declare function createTemporarySecretFile(value: string, fileName: string, options?: TemporarySecretFileOptions): Promise<TemporarySecretFile>;
+//# sourceMappingURL=temporary-secret.d.ts.map

package/dist/secrets/temporary-secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"temporary-secret.d.ts","sourceRoot":"","sources":["../../src/secrets/temporary-secret.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED,MAAM,WAAW,0BAA0B;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IAC/C,eAAe,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,wBAAgB,0BAA0B,IAAI,MAAM,CAEnD;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,mBAAmB,CAAC,CA2C9B"}

package/dist/secrets/temporary-secret.js

@@ -0,0 +1,87 @@
+import { chmod, lstat, mkdir, mkdtemp, readdir, rm, stat, writeFile, } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+const TEMPORARY_SECRET_DIRECTORY = "rhdh-e2e-secrets";
+export function defaultTemporarySecretRoot() {
+    return path.join(os.tmpdir(), TEMPORARY_SECRET_DIRECTORY);
+}
+export async function createTemporarySecretFile(value, fileName, options = {}) {
+    if (!fileName || path.basename(fileName) !== fileName) {
+        throw new Error(`Temporary secret filename is unsafe: ${fileName}`);
+    }
+    const rootDirectory = path.resolve(options.rootDirectory ?? defaultTemporarySecretRoot());
+    const processId = options.processId ?? process.pid;
+    const processExists = options.processExists ?? isProcessAlive;
+    const removeDirectory = options.removeDirectory ??
+        ((directory) => rm(directory, { recursive: true, force: true }));
+    await ensureSecureDirectory(rootDirectory);
+    await removeStaleDirectories(rootDirectory, processId, processExists);
+    const directory = await mkdtemp(path.join(rootDirectory, `${processId}-`));
+    try {
+        await chmod(directory, 0o700);
+        await writeFile(path.join(directory, fileName), value, {
+            encoding: "utf8",
+            mode: 0o600,
+        });
+        await chmod(path.join(directory, fileName), 0o600);
+    }
+    catch (error) {
+        try {
+            await removeDirectory(directory);
+        }
+        catch (cleanupError) {
+            throw new AggregateError([error], "Temporary secret creation and cleanup failed", { cause: cleanupError });
+        }
+        throw error;
+    }
+    const filePath = path.join(directory, fileName);
+    return {
+        path: filePath,
+        remove: () => removeDirectory(directory),
+    };
+}
+async function ensureSecureDirectory(directory) {
+    await mkdir(directory, { recursive: true, mode: 0o700 });
+    const details = await lstat(directory);
+    if (details.isSymbolicLink()) {
+        throw new Error(`Temporary secret directory must not be a symlink: ${directory}`);
+    }
+    if (!details.isDirectory()) {
+        throw new Error(`Temporary secret path is not a directory: ${directory}`);
+    }
+    const userId = process.getuid?.();
+    if (userId !== undefined && details.uid !== userId) {
+        throw new Error(`Temporary secret directory has the wrong owner: ${directory}`);
+    }
+    await chmod(directory, 0o700);
+    const secured = await stat(directory);
+    if ((secured.mode & 0o777) !== 0o700) {
+        throw new Error(`Temporary secret directory is not private: ${directory}`);
+    }
+}
+async function removeStaleDirectories(rootDirectory, currentProcessId, processExists) {
+    const entries = await readdir(rootDirectory, { withFileTypes: true });
+    await Promise.all(entries.map(async (entry) => {
+        if (!entry.isDirectory() || entry.isSymbolicLink())
+            return;
+        const match = /^(\d+)-/.exec(entry.name);
+        if (!match)
+            return;
+        const processId = Number(match[1]);
+        if (processId === currentProcessId || processExists(processId))
+            return;
+        await rm(path.join(rootDirectory, entry.name), {
+            recursive: true,
+            force: true,
+        });
+    }));
+}
+function isProcessAlive(processId) {
+    try {
+        process.kill(processId, 0);
+        return true;
+    }
+    catch (error) {
+        return error.code === "EPERM";
+    }
+}