@rubytech/create-maxy-code 0.1.109 → 0.1.111

package/payload/platform/plugins/cloudflare/scripts/__tests__/tunnel-ingress.test.ts

@@ -1,241 +0,0 @@
-// acceptance grid for tunnel-ingress.ts pure layer.
-//
-// Runs under `node --test --experimental-strip-types` (no compile step). No
-// filesystem reads except via temp files written by the test itself; no
-// network; no shell-outs. Mirrors apt-resolve / samba-provision style.
-
-import test from "node:test";
-import assert from "node:assert/strict";
-import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
-import { join } from "node:path";
-import { tmpdir } from "node:os";
-import {
-  renderConfigYml,
-  renderTunnelState,
-  readPersistedHostnames,
-  probeSambaStanza,
-  renderAccessPolicyActionRequired,
-  type IngressSpec,
-  type TunnelState,
-} from "../tunnel-ingress.ts";
-
-// ---------------------------------------------------------------------------
-// renderConfigYml
-// ---------------------------------------------------------------------------
-
-test("renderConfigYml: HTTPS-only matches expected shape byte-for-byte", () => {
-  const spec: IngressSpec = {
-    tunnelId: "abc-123",
-    credentialsPath: "/home/admin/.maxy/cloudflared/abc-123.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot", "public.maxy.bot"],
-  };
-  assert.equal(
-    renderConfigYml(spec),
-    [
-      "tunnel: abc-123",
-      "credentials-file: /home/admin/.maxy/cloudflared/abc-123.json",
-      "ingress:",
-      "  - hostname: admin.maxy.bot",
-      "    service: http://localhost:19200",
-      "  - hostname: public.maxy.bot",
-      "    service: http://localhost:19200",
-      "  - service: http_status:404",
-      "",
-    ].join("\n"),
-  );
-});
-
-test("renderConfigYml: SSH+SMB appear AFTER http hostnames and BEFORE catch-all", () => {
-  const spec: IngressSpec = {
-    tunnelId: "t-id",
-    credentialsPath: "/creds.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot"],
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: "smb.maxy.bot",
-  };
-  const out = renderConfigYml(spec);
-  const idxHttp = out.indexOf("admin.maxy.bot");
-  const idxSsh = out.indexOf("ssh.maxy.bot");
-  const idxSmb = out.indexOf("smb.maxy.bot");
-  const idx404 = out.indexOf("http_status:404");
-  assert.ok(idxHttp < idxSsh, "HTTP before SSH");
-  assert.ok(idxSsh < idxSmb, "SSH before SMB");
-  assert.ok(idxSmb < idx404, "SMB before catch-all 404");
-  assert.match(out, /\s+service: ssh:\/\/localhost:22$/m);
-  assert.match(out, /\s+service: tcp:\/\/localhost:445$/m);
-});
-
-test("renderConfigYml: SSH only — no SMB block when smbHostname is null", () => {
-  const spec: IngressSpec = {
-    tunnelId: "t-id",
-    credentialsPath: "/creds.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot"],
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: null,
-  };
-  const out = renderConfigYml(spec);
-  assert.ok(out.includes("ssh.maxy.bot"));
-  assert.ok(!out.includes("tcp://localhost:445"));
-});
-
-test("renderConfigYml: empty string hostnames are treated as absent", () => {
-  const spec: IngressSpec = {
-    tunnelId: "t-id",
-    credentialsPath: "/creds.json",
-    httpPort: 19200,
-    httpHostnames: ["admin.maxy.bot"],
-    sshHostname: "",
-    smbHostname: "",
-  };
-  const out = renderConfigYml(spec);
-  assert.ok(!out.includes("ssh://localhost:22"));
-  assert.ok(!out.includes("tcp://localhost:445"));
-});
-
-// ---------------------------------------------------------------------------
-// renderTunnelState
-// ---------------------------------------------------------------------------
-
-test("renderTunnelState: base fields preserved when ssh/smb absent", () => {
-  const state: TunnelState = {
-    tunnelId: "abc",
-    tunnelName: "maxy",
-    domain: "admin.maxy.bot",
-    configPath: "/home/admin/.maxy/cloudflared/config.yml",
-    credentialsPath: "/home/admin/.maxy/cloudflared/abc.json",
-  };
-  const parsed = JSON.parse(renderTunnelState(state));
-  assert.deepEqual(parsed, {
-    tunnelId: "abc",
-    tunnelName: "maxy",
-    domain: "admin.maxy.bot",
-    configPath: "/home/admin/.maxy/cloudflared/config.yml",
-    credentialsPath: "/home/admin/.maxy/cloudflared/abc.json",
-  });
-});
-
-test("renderTunnelState: ssh/smb hostnames persist when present", () => {
-  const state: TunnelState = {
-    tunnelId: "abc",
-    tunnelName: "maxy",
-    domain: "admin.maxy.bot",
-    configPath: "/cfg.yml",
-    credentialsPath: "/creds.json",
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: "smb.maxy.bot",
-  };
-  const parsed = JSON.parse(renderTunnelState(state));
-  assert.equal(parsed.sshHostname, "ssh.maxy.bot");
-  assert.equal(parsed.smbHostname, "smb.maxy.bot");
-});
-
-// ---------------------------------------------------------------------------
-// readPersistedHostnames
-// ---------------------------------------------------------------------------
-
-test("readPersistedHostnames: returns nulls when file missing", () => {
-  const got = readPersistedHostnames("/nope/does/not/exist.json");
-  assert.deepEqual(got, { sshHostname: null, smbHostname: null });
-});
-
-test("readPersistedHostnames: round-trips ssh/smb hostnames from disk", () => {
-  const dir = mkdtempSync(join(tmpdir(), "tunnel-state-"));
-  const path = join(dir, "tunnel.state");
-  try {
-    writeFileSync(
-      path,
-      JSON.stringify({
-        tunnelId: "abc",
-        tunnelName: "maxy",
-        domain: "admin.maxy.bot",
-        configPath: "/cfg.yml",
-        credentialsPath: "/creds.json",
-        sshHostname: "ssh.maxy.bot",
-        smbHostname: "smb.maxy.bot",
-      }),
-    );
-    const got = readPersistedHostnames(path);
-    assert.deepEqual(got, { sshHostname: "ssh.maxy.bot", smbHostname: "smb.maxy.bot" });
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("readPersistedHostnames: malformed JSON returns nulls (no throw)", () => {
-  const dir = mkdtempSync(join(tmpdir(), "tunnel-state-bad-"));
-  const path = join(dir, "tunnel.state");
-  try {
-    writeFileSync(path, "not json");
-    assert.deepEqual(readPersistedHostnames(path), { sshHostname: null, smbHostname: null });
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// probeSambaStanza
-// ---------------------------------------------------------------------------
-
-test("probeSambaStanza: true when [<brand>] header present", () => {
-  const dir = mkdtempSync(join(tmpdir(), "smb-probe-"));
-  const path = join(dir, "smb.conf");
-  try {
-    writeFileSync(path, "[global]\nworkgroup = WORKGROUP\n\n[maxy]\n   path = /home/admin\n");
-    assert.equal(probeSambaStanza("maxy", path), true);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("probeSambaStanza: false when only peer brand present (isolation)", () => {
-  const dir = mkdtempSync(join(tmpdir(), "smb-probe-peer-"));
-  const path = join(dir, "smb.conf");
-  try {
-    writeFileSync(path, "[global]\n\n[realagent]\n   path = /home/admin\n");
-    assert.equal(probeSambaStanza("maxy", path), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-test("probeSambaStanza: false when smb.conf missing", () => {
-  assert.equal(probeSambaStanza("maxy", "/nope/smb.conf"), false);
-});
-
-test("probeSambaStanza: brand names with regex meta characters are escaped", () => {
-  const dir = mkdtempSync(join(tmpdir(), "smb-probe-regex-"));
-  const path = join(dir, "smb.conf");
-  try {
-    writeFileSync(path, "[some.brand]\n   path = /x\n");
-    assert.equal(probeSambaStanza("some.brand", path), true);
-    assert.equal(probeSambaStanza("someXbrand", path), false);
-  } finally {
-    rmSync(dir, { recursive: true, force: true });
-  }
-});
-
-// ---------------------------------------------------------------------------
-// renderAccessPolicyActionRequired
-// ---------------------------------------------------------------------------
-
-test("renderAccessPolicyActionRequired: empty string when neither hostname set", () => {
-  assert.equal(
-    renderAccessPolicyActionRequired({ operatorEmail: "x@y.com" }),
-    "",
-  );
-});
-
-test("renderAccessPolicyActionRequired: lists each hostname with operator email", () => {
-  const out = renderAccessPolicyActionRequired({
-    sshHostname: "ssh.maxy.bot",
-    smbHostname: "smb.maxy.bot",
-    operatorEmail: "joel@example.com",
-  });
-  assert.match(out, /SSH: ssh\.maxy\.bot/);
-  assert.match(out, /SMB: smb\.maxy\.bot/);
-  assert.match(out, /Emails: joel@example\.com/);
-  assert.match(out, /Zero Trust → Access → Applications/);
-});

package/payload/platform/plugins/cloudflare/scripts/list-cf-domains.sh

@@ -1,98 +0,0 @@
-#!/usr/bin/env bash
-# Deterministic scrape of the operator's Cloudflare dashboard to discover
-# the domains on the logged-in account. Output on stdout is a JSON `string[]`,
-# sorted and deduped. Every failure exits non-zero with a `reason=<enum>`
-# token on stderr tagged `[list-cf-domains]`.
-#
-# Usage:
-#   list-cf-domains.sh <brand>
-#
-# brand arg is REQUIRED — the prior silent default (string
-# fallback to "maxy" when $1 was empty) made every non-Maxy brand's CF
-# setup form fail on first use because the wrapper's child node helper
-# read the Maxy CDP port from a hardcoded fallback. Missing arg now exits
-# 1 with `phase=error reason=brand-arg-missing`.
-#
-# The wrapper also resolves and exports MAXY_PLATFORM_ROOT from its own
-# script location so the .ts helper can read `<root>/config/brand.json` for
-# the brand's `cdpPort` (the source of truth). Direct-SSH invocation
-# works because the script lives at `<install>/platform/plugins/cloudflare/
-# scripts/`, making platform root three dirs up from the resolved script.
-#
-# Runtime: Node 22's `--experimental-strip-types` runs the .ts helper
-# directly, so no tsx / playwright / ws dependency exists.
-
-set -euo pipefail
-
-# Resolve symlinks before dirname — ~/list-cf-domains.sh is installed as a
-# symlink into $HOME, so the raw BASH_SOURCE[0] points at $HOME, not the
-# scripts directory.
-SCRIPT_DIR="$(dirname "$(readlink -f "${BASH_SOURCE[0]}")")"
-
-# Phase-line helper. Stream-log plumbing retired in Task 287 — every
-# observation goes straight to stdout for the PTY to render.
-phase_line() {
-  local scope=$1
-  shift
-  printf '[%s] %s\n' "${scope}" "$*"
-}
-
-if [ "$#" -lt 1 ] || [ -z "${1:-}" ]; then
-  phase_line list-cf-domains phase=error reason=brand-arg-missing
-  exit 1
-fi
-
-BRAND="${1}"
-CONFIG_DIR=".${BRAND}"
-mkdir -p "${HOME}/${CONFIG_DIR}/logs"
-
-# MAXY_PLATFORM_ROOT may be set by the calling environment. Direct-from-Bash
-# invocation has no such env so derive it from the resolved script location:
-# scripts/ → cloudflare/ → plugins/ → platform → install root (three dirs up).
-if [ -z "${MAXY_PLATFORM_ROOT:-}" ]; then
-  MAXY_PLATFORM_ROOT="$(cd "${SCRIPT_DIR}/../../.." && pwd)"
-fi
-
-phase_line list-cf-domains phase=script-start brand="${BRAND}" config_dir="${CONFIG_DIR}"
-
-TS_ENTRY="${SCRIPT_DIR}/list-cf-domains.ts"
-
-if [ ! -f "${TS_ENTRY}" ]; then
-  phase_line list-cf-domains phase=error reason=entry-missing path="${TS_ENTRY}"
-  exit 1
-fi
-
-# 30s hard ceiling. The node helper has its own per-phase budgets totalling
-# ~27s; the wrapper's extra 3s absorbs process startup and CF network jitter.
-# Use `timeout --preserve-status` so the exit code of a timeout is distinct
-# (124) from a helper-reported failure (1).
-HARD_TIMEOUT_SECS=30
-
-# Env passed through:
-#  - CONFIG_DIR    — consumed by the node helper when writing selector-drift
-#                    dumps to ~/.${BRAND}/logs/list-cf-domains-<ts>.html.
-#  - BRAND         — names the brand for log lines naming the brand on
-#                    config-class failures (helper does not derive it from
-#                    CONFIG_DIR to keep the two concerns independent).
-#  - MAXY_PLATFORM_ROOT — install root the helper reads `config/brand.json`
-#                    from for `cdpPort`. Resolved above so direct-SSH
-#                    invocation matches the systemd-spawned path.
-#
-# `node --experimental-strip-types` (stable in Node 22.22) runs the .ts file
-# natively: type annotations are stripped, no enums / decorators are used, so
-# no TS type-transform is needed. `--no-warnings` suppresses the experimental
-# banner which would otherwise leak into stderr and confuse the route parser.
-set +e
-CONFIG_DIR="${CONFIG_DIR}" BRAND="${BRAND}" MAXY_PLATFORM_ROOT="${MAXY_PLATFORM_ROOT}" \
-  timeout --preserve-status --signal=TERM "${HARD_TIMEOUT_SECS}" \
-  node --experimental-strip-types --no-warnings "${TS_ENTRY}"
-EXIT_CODE=$?
-set -e
-
-if [ "${EXIT_CODE}" -eq 124 ]; then
-  phase_line list-cf-domains phase=script-exit code=124 reason=wrapper-timeout budget_secs="${HARD_TIMEOUT_SECS}"
-  exit 1
-fi
-
-phase_line list-cf-domains phase=script-exit code="${EXIT_CODE}"
-exit "${EXIT_CODE}"