@red-hat-developer-hub/e2e-test-utils 2.1.15 → 2.1.17

package/dist/secrets/tests/cli.integration.test.js

@@ -1,10 +1,46 @@
 /* eslint-disable @typescript-eslint/naming-convention, playwright/expect-expect -- node:test fixture models CLI environment keys */
 import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
 import { chmod, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
 import { spawnSync } from "node:child_process";
 import os from "node:os";
 import path from "node:path";
 import test from "node:test";
+import { pathToFileURL } from "node:url";
+const SECRET_METADATA = [
+    {
+        name: "VAULT_CERT_PEM",
+        byteLength: 64 * 1024,
+        sha256: createHash("sha256")
+            .update("x".repeat(64 * 1024))
+            .digest("hex"),
+    },
+    {
+        name: "VAULT_TOKEN",
+        byteLength: Buffer.byteLength("synthetic-note-value"),
+        sha256: createHash("sha256").update("synthetic-note-value").digest("hex"),
+    },
+];
+test("provides provider-free help for every CLI command", () => {
+    const topics = [
+        [["--help"], "rhdh-e2e-secrets exec"],
+        [["exec", "--help"], "--profile"],
+        [["create", "-h"], "--from-stdin"],
+        [["update", "--help"], "--from-file"],
+        [["delete", "-h"], "--force"],
+        [["describe", "--help"], "--output"],
+        [["list", "-h"], "--collection"],
+        [["gsm-login", "--help"], "Authenticate"],
+        [["gsm-clean", "-h"], "Remove"],
+    ];
+    for (const [args, expected] of topics) {
+        const result = spawnSync(process.execPath, [path.resolve("dist/secrets/cli.js"), ...args], { cwd: path.resolve("."), encoding: "utf8", env: process.env });
+        assert.equal(result.status, 0, `${args.join(" ")} failed: ${result.stderr}`);
+        assert.equal(result.stderr, "", `${args.join(" ")} wrote stderr`);
+        assert.match(result.stdout, /Usage:/);
+        assert.match(result.stdout, new RegExp(expected));
+    }
+});
 test("runs the package bin with a fake bw executable and redacted child auth", async () => {
     const directory = await mkdtemp(path.join(os.tmpdir(), "secrets-cli-test-"));
     const command = path.join(directory, "bw");
@@ -20,7 +56,7 @@ else if (args[0] === "list" && args[1] === "collections") process.stdout.write(J
 else if (args[0] === "list" && args[1] === "items") process.stdout.write(JSON.stringify([{ id: "note-item-id" }, { id: "attachment-item-id" }]));
 else if (args[0] === "get" && args[1] === "item" && args[2] === "note-item-id") process.stdout.write(JSON.stringify({ id: "note-item-id", name: "global/VAULT_TOKEN", notes: "synthetic-note-value", type: 2, collectionIds: ["collection-id"], organizationId: "organization-id" }));
 else if (args[0] === "get" && args[1] === "item" && args[2] === "attachment-item-id") process.stdout.write(JSON.stringify({ id: "attachment-item-id", name: "global/VAULT_CERT_PEM", notes: null, type: 2, collectionIds: ["collection-id"], organizationId: "organization-id", attachments: [{ id: "attachment-id", fileName: "VAULT_CERT_PEM" }] }));
-else if (args[0] === "get" && args[1] === "attachment" && args[2] === "VAULT_CERT_PEM" && args[3] === "--itemid" && args[4] === "attachment-item-id" && args[5] === "--raw") process.stdout.write("synthetic-attachment-value");
+else if (args[0] === "get" && args[1] === "attachment" && args[2] === "VAULT_CERT_PEM" && args[3] === "--itemid" && args[4] === "attachment-item-id" && args[5] === "--raw") process.stdout.write("x".repeat(64 * 1024));
 else process.exitCode = 1;
 `);
     await chmod(command, 0o755);
@@ -40,6 +76,7 @@ else process.exitCode = 1;
         ],
     }));
     try {
+        const expectedMetadata = JSON.stringify(SECRET_METADATA);
         const result = spawnSync(entrypoint, [
             "exec",
             "--profile",
@@ -47,7 +84,14 @@ else process.exitCode = 1;
             "--",
             process.execPath,
             "-e",
-            "if (process.env.VAULT_TOKEN === 'synthetic-note-value' && process.env.VAULT_CERT_PEM === 'synthetic-attachment-value' && process.env.BW_SESSION === undefined) process.stdout.write('child-ran'); else process.exit(1)",
+            [
+                "const { createHash } = require('node:crypto');",
+                `const expected = ${expectedMetadata};`,
+                "const digest = (value) => createHash('sha256').update(value).digest('hex');",
+                "const actual = ['VAULT_CERT_PEM', 'VAULT_TOKEN'].map((name) => ({ name, byteLength: Buffer.byteLength(process.env[name] ?? ''), sha256: typeof process.env[name] === 'string' ? digest(process.env[name]) : '' }));",
+                "if (JSON.stringify(actual) !== JSON.stringify(expected) || process.env.BW_SESSION !== undefined) process.exit(1);",
+                "process.stdout.write('child-ran');",
+            ].join(" "),
         ], {
             cwd: path.resolve("."),
             encoding: "utf8",
@@ -58,11 +102,95 @@ else process.exitCode = 1;
             },
         });
         assert.equal(result.status, 0, result.stderr);
-        assert.match(result.stdout, /child-ran/);
+        assert.equal(result.stdout, "child-ran");
+        assert.equal(result.stderr, "");
         assert.doesNotMatch(result.stdout, /synthetic-(note|attachment)-value/);
         assert.doesNotMatch(result.stderr, /synthetic-(note|attachment)-value/);
         assert.doesNotMatch(result.stdout, /synthetic-session/);
         assert.doesNotMatch(result.stderr, /synthetic-session/);
+        const streamModuleUrl = pathToFileURL(path.resolve("dist/secrets/stream.js")).href;
+        const streamed = spawnSync(entrypoint, [
+            "exec",
+            "--profile",
+            profile,
+            "--stream-secrets",
+            "--",
+            process.execPath,
+            "--input-type=module",
+            "-e",
+            [
+                "import fs from 'node:fs';",
+                "import { createHash } from 'node:crypto';",
+                `import { decodeSecretStream } from ${JSON.stringify(streamModuleUrl)};`,
+                `const expected = ${expectedMetadata};`,
+                "const entries = decodeSecretStream(fs.readFileSync(3));",
+                "const actual = entries.map(({ name, value }) => ({ name, byteLength: Buffer.byteLength(value), sha256: createHash('sha256').update(value).digest('hex') }));",
+                "if (JSON.stringify(actual) !== JSON.stringify(expected) || process.env.VAULT_TOKEN !== undefined || process.env.VAULT_CERT_PEM !== undefined || process.env.RHDH_E2E_SECRET_FD !== '3' || process.env.BW_SESSION !== undefined) process.exit(1);",
+                "process.stdout.write('child-ran-with-stream');",
+            ].join(" "),
+        ], {
+            cwd: path.resolve("."),
+            encoding: "utf8",
+            env: {
+                ...process.env,
+                PATH: `${directory}${path.delimiter}${process.env.PATH ?? ""}`,
+                BW_SESSION: "synthetic-session",
+            },
+        });
+        assert.equal(streamed.status, 0, streamed.stderr);
+        assert.equal(streamed.stdout, "child-ran-with-stream");
+        assert.equal(streamed.stderr, "");
+        assert.doesNotMatch(streamed.stdout, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(streamed.stderr, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(streamed.stdout, /synthetic-session/);
+        assert.doesNotMatch(streamed.stderr, /synthetic-session/);
+        const childEnvironment = {
+            ...process.env,
+            PATH: `${directory}${path.delimiter}${process.env.PATH ?? ""}`,
+            BW_SESSION: "synthetic-session",
+        };
+        const ignored = spawnSync(entrypoint, [
+            "exec",
+            "--profile",
+            profile,
+            "--stream-secrets",
+            "--",
+            process.execPath,
+            "-e",
+            "process.exit(0)",
+        ], {
+            cwd: path.resolve("."),
+            encoding: "utf8",
+            env: childEnvironment,
+            timeout: 2_000,
+        });
+        assert.equal(ignored.error, undefined);
+        assert.notEqual(ignored.status, null);
+        assert.doesNotMatch(ignored.stdout, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(ignored.stderr, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(ignored.stdout, /synthetic-session/);
+        assert.doesNotMatch(ignored.stderr, /synthetic-session/);
+        const earlyClosed = spawnSync(entrypoint, [
+            "exec",
+            "--profile",
+            profile,
+            "--stream-secrets",
+            "--",
+            process.execPath,
+            "-e",
+            "if (process.env.VAULT_CERT_PEM !== undefined || process.env.VAULT_TOKEN !== undefined || process.env.RHDH_E2E_SECRET_FD !== '3' || process.env.BW_SESSION !== undefined) process.exit(18); require('node:fs').closeSync(3); setTimeout(() => process.exit(17), 50)",
+        ], {
+            cwd: path.resolve("."),
+            encoding: "utf8",
+            env: childEnvironment,
+            timeout: 2_000,
+        });
+        assert.equal(earlyClosed.error, undefined);
+        assert.equal(earlyClosed.status, 17, earlyClosed.stderr);
+        assert.doesNotMatch(earlyClosed.stdout, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(earlyClosed.stderr, /synthetic-(note|attachment)-value/);
+        assert.doesNotMatch(earlyClosed.stdout, /synthetic-session/);
+        assert.doesNotMatch(earlyClosed.stderr, /synthetic-session/);
     }
     finally {
         await rm(directory, { recursive: true, force: true });

package/dist/secrets/tests/cli.test.js

@@ -1,7 +1,7 @@
 /* eslint-disable playwright/expect-expect -- this file uses node:test assertions */
 import assert from "node:assert/strict";
 import test from "node:test";
-import { parseCliArguments } from "../cli.js";
+import { formatMutationResult, getHelpText, parseCliArguments, } from "../cli.js";
 test("parses the exec profile, repeated workspaces, and command after --", () => {
     const parsed = parseCliArguments([
         "exec",
@@ -23,13 +23,288 @@ test("parses the exec profile, repeated workspaces, and command after --", () =>
         args: ["test", "--headed"],
     });
 });
-test("requires a profile and a command after --", () => {
-    assert.throws(() => parseCliArguments(["exec", "--", "playwright"]), /profile/i);
-    assert.throws(() => parseCliArguments(["exec", "--profile", "profile.json"]), /command.*--/i);
-    assert.throws(() => parseCliArguments(["exec", "--profile", "profile.json", "--", ""]), /command/i);
+test("parses secret streaming before the child command", () => {
+    assert.deepEqual(parseCliArguments([
+        "exec",
+        "--profile",
+        "profile.json",
+        "--stream-secrets",
+        "--",
+        "node",
+    ]), {
+        command: "exec",
+        profilePath: "profile.json",
+        workspaces: [],
+        executable: "node",
+        args: [],
+        streamSecrets: true,
+    });
 });
-test("rejects unknown commands and malformed options", () => {
+test("keeps --stream-secrets after -- as a child argument", () => {
+    assert.deepEqual(parseCliArguments([
+        "exec",
+        "--profile",
+        "profile.json",
+        "--",
+        "node",
+        "--stream-secrets",
+    ]), {
+        command: "exec",
+        profilePath: "profile.json",
+        workspaces: [],
+        executable: "node",
+        args: ["--stream-secrets"],
+    });
+});
+test("advertises secret streaming and removes secret-name exposure from help", () => {
+    assert.doesNotMatch(getHelpText("root"), /--expose-secret-names/);
+    assert.doesNotMatch(getHelpText("exec"), /--expose-secret-names/);
+    assert.match(getHelpText("root"), /--stream-secrets/);
+    assert.match(getHelpText("exec"), /--stream-secrets/);
+});
+test("rejects the removed secret-name exposure option", () => {
+    assert.throws(() => parseCliArguments([
+        "exec",
+        "--profile",
+        "profile.json",
+        "--expose-secret-names",
+        "--",
+        "node",
+    ]), /Unknown option: --expose-secret-names/);
+});
+test("formats provider actions with their actual collection names", () => {
+    const plan = {
+        command: "delete",
+        collection: "rhdh-qe",
+        bitwardenCollection: "Rhdh Qe Ci Secrets",
+        gsmCollection: "rhdh-qe",
+        bitwardenPath: "rhdh/TEST",
+        gsmPath: "rhdh/TEST",
+        bitwardenAction: "delete",
+        gsmAction: "delete",
+    };
+    assert.equal(formatMutationResult("applied", plan), [
+        "Applied: delete rhdh-qe/rhdh/TEST",
+        "Bitwarden: delete Rhdh Qe Ci Secrets/rhdh/TEST",
+        "GSM: delete rhdh-qe/rhdh/TEST",
+    ].join("\n"));
+});
+test("supports short exec profile and workspace options", () => {
+    assert.deepEqual(parseCliArguments([
+        "exec",
+        "-p",
+        "profile.json",
+        "-w",
+        "backstage",
+        "--",
+        "node",
+    ]), {
+        command: "exec",
+        profilePath: "profile.json",
+        workspaces: ["backstage"],
+        executable: "node",
+        args: [],
+    });
+});
+test("returns root and subcommand help before validating required arguments", () => {
+    assert.deepEqual(parseCliArguments(["--help"]), {
+        command: "help",
+        topic: "root",
+    });
+    assert.deepEqual(parseCliArguments(["create", "--help"]), {
+        command: "help",
+        topic: "create",
+    });
+    assert.deepEqual(parseCliArguments(["update", "-h"]), {
+        command: "help",
+        topic: "update",
+    });
+    assert.deepEqual(parseCliArguments(["delete", "--help"]), {
+        command: "help",
+        topic: "delete",
+    });
+    assert.deepEqual(parseCliArguments(["describe", "-h"]), {
+        command: "help",
+        topic: "describe",
+    });
+    assert.deepEqual(parseCliArguments(["list", "--help"]), {
+        command: "help",
+        topic: "list",
+    });
+    assert.deepEqual(parseCliArguments(["gsm-login", "-h"]), {
+        command: "help",
+        topic: "gsm-login",
+    });
+    assert.deepEqual(parseCliArguments(["gsm-clean", "--help"]), {
+        command: "help",
+        topic: "gsm-clean",
+    });
+});
+test("keeps --help after exec -- for the child command", () => {
+    assert.deepEqual(parseCliArguments([
+        "exec",
+        "--profile",
+        "profile.json",
+        "--",
+        "node",
+        "--help",
+    ]), {
+        command: "exec",
+        profilePath: "profile.json",
+        workspaces: [],
+        executable: "node",
+        args: ["--help"],
+    });
+});
+test("parses create with file input and applies by default", () => {
+    assert.deepEqual(parseCliArguments([
+        "create",
+        "-c",
+        "rhdh-qe",
+        "rhdh/test",
+        "-f",
+        "replacement.txt",
+    ]), {
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromFile: "replacement.txt",
+        fromStdin: false,
+        allowEmpty: false,
+        force: false,
+        dryRun: false,
+        gsmTimeoutMs: undefined,
+    });
+});
+test("parses update with stdin input and dry-run", () => {
+    assert.deepEqual(parseCliArguments([
+        "update",
+        "--collection=rhdh-qe",
+        "rhdh/test",
+        "--from-stdin",
+        "--allow-empty",
+        "--dry-run",
+        "--gsm-timeout-seconds",
+        "30",
+    ]), {
+        command: "update",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromFile: undefined,
+        fromStdin: true,
+        allowEmpty: true,
+        dryRun: true,
+        gsmTimeoutMs: 30_000,
+    });
+});
+test("supports the short stdin flag and case-insensitive output values", () => {
+    assert.deepEqual(parseCliArguments(["create", "-c", "rhdh-qe", "rhdh/test", "-i"]), {
+        command: "create",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        fromFile: undefined,
+        fromStdin: true,
+        allowEmpty: false,
+        force: false,
+        dryRun: false,
+        gsmTimeoutMs: undefined,
+    });
+    assert.equal(parseCliArguments([
+        "describe",
+        "-c",
+        "rhdh-qe",
+        "rhdh/test",
+        "-o",
+        "JSON",
+    ]).output, "json");
+});
+test("parses forced delete and does not require input", () => {
+    assert.deepEqual(parseCliArguments([
+        "delete",
+        "--collection",
+        "rhdh-qe",
+        "rhdh/test",
+        "--force",
+    ]), {
+        command: "delete",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        force: true,
+        dryRun: false,
+        gsmTimeoutMs: undefined,
+    });
+});
+test("parses GSM describe and list commands", () => {
+    assert.deepEqual(parseCliArguments(["describe", "-c", "rhdh-qe", "rhdh/test", "-o", "json"]), {
+        command: "describe",
+        collection: "rhdh-qe",
+        bitwardenPath: "rhdh/test",
+        output: "json",
+    });
+    assert.deepEqual(parseCliArguments(["list", "--collection", "rhdh-qe"]), {
+        command: "list",
+        collection: "rhdh-qe",
+        output: "text",
+    });
+});
+test("rejects GSM timeout values above the Node timer limit", () => {
+    assert.throws(() => parseCliArguments([
+        "create",
+        "-c",
+        "rhdh-qe",
+        "rhdh/test",
+        "-i",
+        "--gsm-timeout-seconds",
+        "2147484",
+    ]), /maximum|timeout/i);
+});
+test("requires exactly one input for create and update", () => {
+    assert.throws(() => parseCliArguments(["create", "-c", "rhdh-qe", "rhdh/test"]), /from-file.*from-stdin/i);
+    assert.throws(() => parseCliArguments([
+        "update",
+        "-c",
+        "rhdh-qe",
+        "rhdh/test",
+        "--from-file",
+        "one",
+        "--from-stdin",
+    ]), /exactly one/i);
+    assert.throws(() => parseCliArguments([
+        "delete",
+        "-c",
+        "rhdh-qe",
+        "rhdh/test",
+        "--from-stdin",
+    ]), /does not accept input/i);
+    assert.throws(() => parseCliArguments([
+        "create",
+        "-c",
+        "rhdh-qe",
+        "rhdh/test",
+        "--from-literal",
+        "secret-value",
+    ]), /unknown option/i);
+});
+test("restricts force to create and delete", () => {
+    assert.throws(() => parseCliArguments([
+        "update",
+        "-c",
+        "rhdh-qe",
+        "rhdh/test",
+        "--from-stdin",
+        "--force",
+    ]), /force.*update/i);
+});
+test("rejects the removed rotation and resume commands", () => {
     assert.throws(() => parseCliArguments(["rotate"]), /unsupported command/i);
+    assert.throws(() => parseCliArguments(["create", "--resume", "operation-id"]), /unknown option|collection/i);
+});
+test("parses GSM credential lifecycle commands", () => {
+    assert.deepEqual(parseCliArguments(["gsm-login"]), { command: "gsm-login" });
+    assert.deepEqual(parseCliArguments(["gsm-clean"]), { command: "gsm-clean" });
+});
+test("rejects unknown commands and malformed options", () => {
+    assert.throws(() => parseCliArguments(["unknown"]), /unsupported command/i);
     assert.throws(() => parseCliArguments(["exec", "--profile", "--", "playwright"]), /requires a value/i);
     assert.throws(() => parseCliArguments([
         "exec",

package/dist/secrets/tests/command.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=command.test.d.ts.map

package/dist/secrets/tests/command.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.test.d.ts","sourceRoot":"","sources":["../../../src/secrets/tests/command.test.ts"],"names":[],"mappings":""}

package/dist/secrets/tests/command.test.js

@@ -0,0 +1,39 @@
+/* eslint-disable playwright/expect-expect, playwright/no-conditional-in-test -- node:test assertions */
+import assert from "node:assert/strict";
+import test from "node:test";
+import { setTimeout as delay } from "node:timers/promises";
+import { runCommand, shouldDetachCommand } from "../command.js";
+test("keeps terminal-backed commands in the parent session", () => {
+    if (process.platform === "win32")
+        return;
+    assert.equal(shouldDetachCommand({}), true);
+    assert.equal(shouldDetachCommand({ tty: true }), false);
+});
+test("terminates timed-out commands and marks the result indeterminate", async () => {
+    const result = await runCommand(process.execPath, ["-e", "setTimeout(() => {}, 10_000)"], { timeoutMs: 25 });
+    assert.equal(result.timedOut, true);
+    assert.equal(result.status, null);
+});
+test("cancels forced termination after a timed-out child exits", async () => {
+    if (process.platform === "win32")
+        return;
+    const originalKill = process.kill;
+    const signals = [];
+    process.kill = ((pid, signal) => {
+        if (signal !== undefined)
+            signals.push(signal);
+        return originalKill(pid, signal);
+    });
+    try {
+        await runCommand(process.execPath, ["-e", "setTimeout(() => {}, 10_000)"], {
+            timeoutMs: 25,
+        });
+        const signalCountAfterExit = signals.length;
+        await delay(1_100);
+        assert.equal(signals.length, signalCountAfterExit);
+        assert.doesNotMatch(signals.slice(signalCountAfterExit).join(","), /SIGKILL/);
+    }
+    finally {
+        process.kill = originalKill;
+    }
+});

package/dist/secrets/tests/config.test.js

@@ -1,7 +1,7 @@
 /* eslint-disable playwright/expect-expect -- this file uses node:test assertions */
 import assert from "node:assert/strict";
 import test from "node:test";
-import { expandProfile, getCollectionMapping, parseProfile, } from "../config.js";
+import { bitwardenPathFromGsmPath, expandProfile, getCollectionMapping, gsmPathFromBitwardenPath, parseProfile, } from "../config.js";
 const overlayProfile = {
     schemaVersion: 1,
     collection: "rhdh-plugin-export-overlays",
@@ -31,8 +31,27 @@ test("maps each approved collection to its exact Bitwarden collection name", ()
     assert.deepEqual(getCollectionMapping("rhdh-qe"), {
         id: "rhdh-qe",
         bitwardenCollection: "Rhdh Qe Ci Secrets",
+        gsmCollection: "rhdh-qe",
     });
 });
+test("keeps legacy collection mappings constructible without a GSM name", () => {
+    const mapping = {
+        id: "rhdh-qe",
+        bitwardenCollection: "Rhdh Qe Ci Secrets",
+    };
+    assert.equal(mapping.gsmCollection, undefined);
+});
+test("maps dotted Bitwarden paths to the GSM punctuation encoding", () => {
+    assert.equal(gsmPathFromBitwardenPath("rhdh/azure-db-certificates.pem"), "rhdh/azure-db-certificates--dot--pem");
+});
+test("normalizes a GSM-encoded path for Bitwarden and preserves GSM encoding", () => {
+    const gsmPath = "rhdh/already--dot--encoded";
+    assert.equal(bitwardenPathFromGsmPath(gsmPath), "rhdh/already.encoded");
+    assert.equal(gsmPathFromBitwardenPath(gsmPath), gsmPath);
+});
+test("rejects overlong rotation path segments", () => {
+    assert.throws(() => gsmPathFromBitwardenPath(`rhdh/${"a".repeat(256)}`), /too long/i);
+});
 test("rejects the GSM-only AWS collection before Bitwarden access", () => {
     assert.throws(() => parseProfile({ ...overlayProfile, collection: "rhdh-aws-credentials" }), /rhdh-aws-credentials.*Bitwarden/i);
 });