@serfab/cadre-host 0.10.0 → 0.11.0

package/src/push/__tests__/push.test.ts

@@ -1,90 +1,90 @@
-import { describe, it, expect } from 'vitest';
-
-import type { SecretsStore } from '../../nat/secrets/index.js';
-import type { PushSettings } from '../../installer/config.js';
-import {
-  resolvePushCredentials,
-  setFcmSecret,
-  setApnsSecret,
-  clearPushSecret,
-  pushAccount,
-  pushStatus,
-} from '../index.js';
-
-/** In-memory SecretsStore for tests. */
-function fakeStore(): SecretsStore {
-  const map = new Map<string, string>();
-  return {
-    async set(account, value) { map.set(account, value); },
-    async get(account) { return map.get(account) ?? null; },
-    async delete(account) { return map.delete(account); },
-    async list() { return [...map.keys()]; },
-  };
-}
-
-const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-PEM' };
-const APNS = { keyId: 'KID', teamId: 'TEAM', privateKey: 'P8-PEM' };
-
-describe('resolvePushCredentials', () => {
-  it('returns undefined when no platform is configured (opt-in default)', async () => {
-    const store = fakeStore();
-    expect(await resolvePushCredentials(store, undefined)).toBeUndefined();
-  });
-
-  it('resolves an FCM-only bundle from the secret store', async () => {
-    const store = fakeStore();
-    await setFcmSecret(store, FCM);
-    const push = await resolvePushCredentials(store, undefined);
-    expect(push).toEqual({ fcm: FCM });
-  });
-
-  it('merges the APNs secret with non-secret bundleId/production from settings', async () => {
-    const store = fakeStore();
-    await setApnsSecret(store, APNS);
-    const settings: PushSettings = { apns: { bundleId: 'com.example.app', production: true }, cooldownMs: 1000, debounceMs: 50 };
-    const push = await resolvePushCredentials(store, settings);
-    expect(push).toEqual({
-      apns: { keyId: 'KID', teamId: 'TEAM', bundleId: 'com.example.app', privateKey: 'P8-PEM', production: true },
-      cooldownMs: 1000,
-      debounceMs: 50,
-    });
-  });
-
-  it('combines both platforms when both secrets are present', async () => {
-    const store = fakeStore();
-    await setFcmSecret(store, FCM);
-    await setApnsSecret(store, APNS);
-    const push = await resolvePushCredentials(store, { apns: { bundleId: 'com.example.app' } });
-    expect(push?.fcm).toEqual(FCM);
-    expect(push?.apns?.bundleId).toBe('com.example.app');
-  });
-
-  it('throws on a partial APNs config (secret present but bundleId unset)', async () => {
-    const store = fakeStore();
-    await setApnsSecret(store, APNS);
-    // No settings.apns.bundleId → bundleId resolves to '' → validation rejects.
-    await expect(resolvePushCredentials(store, undefined)).rejects.toThrow(/push\.apns\.bundleId/);
-  });
-
-  it('keeps the FCM private key out of the secret-store account name', async () => {
-    const store = fakeStore();
-    await setFcmSecret(store, FCM);
-    const accounts = await store.list();
-    expect(accounts).toContain(pushAccount('fcm'));
-    expect(accounts.join()).not.toContain('FCM-PEM');
-  });
-});
-
-describe('clearPushSecret / pushStatus', () => {
-  it('reports configured platforms and clears them', async () => {
-    const store = fakeStore();
-    await setFcmSecret(store, FCM);
-    await setApnsSecret(store, APNS);
-    expect(await pushStatus(store)).toEqual({ fcm: true, apns: true });
-
-    expect(await clearPushSecret(store, 'fcm')).toBe(true);
-    expect(await pushStatus(store)).toEqual({ fcm: false, apns: true });
-
-    expect(await clearPushSecret(store, 'fcm')).toBe(false);
-  });
-});
+import { describe, it, expect } from 'vitest';
+
+import type { SecretsStore } from '../../nat/secrets/index.js';
+import type { PushSettings } from '../../installer/config.js';
+import {
+  resolvePushCredentials,
+  setFcmSecret,
+  setApnsSecret,
+  clearPushSecret,
+  pushAccount,
+  pushStatus,
+} from '../index.js';
+
+/** In-memory SecretsStore for tests. */
+function fakeStore(): SecretsStore {
+  const map = new Map<string, string>();
+  return {
+    async set(account, value) { map.set(account, value); },
+    async get(account) { return map.get(account) ?? null; },
+    async delete(account) { return map.delete(account); },
+    async list() { return [...map.keys()]; },
+  };
+}
+
+const FCM = { projectId: 'proj', clientEmail: 'svc@proj.iam', privateKey: 'FCM-PEM' };
+const APNS = { keyId: 'KID', teamId: 'TEAM', privateKey: 'P8-PEM' };
+
+describe('resolvePushCredentials', () => {
+  it('returns undefined when no platform is configured (opt-in default)', async () => {
+    const store = fakeStore();
+    expect(await resolvePushCredentials(store, undefined)).toBeUndefined();
+  });
+
+  it('resolves an FCM-only bundle from the secret store', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    const push = await resolvePushCredentials(store, undefined);
+    expect(push).toEqual({ fcm: FCM });
+  });
+
+  it('merges the APNs secret with non-secret bundleId/production from settings', async () => {
+    const store = fakeStore();
+    await setApnsSecret(store, APNS);
+    const settings: PushSettings = { apns: { bundleId: 'com.example.app', production: true }, cooldownMs: 1000, debounceMs: 50 };
+    const push = await resolvePushCredentials(store, settings);
+    expect(push).toEqual({
+      apns: { keyId: 'KID', teamId: 'TEAM', bundleId: 'com.example.app', privateKey: 'P8-PEM', production: true },
+      cooldownMs: 1000,
+      debounceMs: 50,
+    });
+  });
+
+  it('combines both platforms when both secrets are present', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    await setApnsSecret(store, APNS);
+    const push = await resolvePushCredentials(store, { apns: { bundleId: 'com.example.app' } });
+    expect(push?.fcm).toEqual(FCM);
+    expect(push?.apns?.bundleId).toBe('com.example.app');
+  });
+
+  it('throws on a partial APNs config (secret present but bundleId unset)', async () => {
+    const store = fakeStore();
+    await setApnsSecret(store, APNS);
+    // No settings.apns.bundleId → bundleId resolves to '' → validation rejects.
+    await expect(resolvePushCredentials(store, undefined)).rejects.toThrow(/push\.apns\.bundleId/);
+  });
+
+  it('keeps the FCM private key out of the secret-store account name', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    const accounts = await store.list();
+    expect(accounts).toContain(pushAccount('fcm'));
+    expect(accounts.join()).not.toContain('FCM-PEM');
+  });
+});
+
+describe('clearPushSecret / pushStatus', () => {
+  it('reports configured platforms and clears them', async () => {
+    const store = fakeStore();
+    await setFcmSecret(store, FCM);
+    await setApnsSecret(store, APNS);
+    expect(await pushStatus(store)).toEqual({ fcm: true, apns: true });
+
+    expect(await clearPushSecret(store, 'fcm')).toBe(true);
+    expect(await pushStatus(store)).toEqual({ fcm: false, apns: true });
+
+    expect(await clearPushSecret(store, 'fcm')).toBe(false);
+  });
+});

package/src/push/index.ts

@@ -1,146 +1,146 @@
-/**
- * Push (FCM/APNs) credential storage + resolution for cadre-host.
- *
- * The platform-push secrets a self-hosted deployment provisions live in the host
- * secret store (keytar with file-store fallback — the same store DDNS tokens use);
- * the non-secret app-config bits (APNs bundle id / sandbox toggle, cooldown /
- * debounce) live in `host.config.json` (`PushSettings`). At node-spawn time the
- * orchestrator's `pushResolver` calls {@link resolvePushCredentials}, which reads
- * BOTH and merges them into the `PushCredentials` block written into the spawned
- * node's `cadre.json`.
- *
- * Secret hygiene: the FCM service-account fields and the APNs `.p8` key are stored
- * ONLY in the secret store, never in `host.config.json` and never in `state.json`.
- * They are re-read on every spawn so a restart picks up rotated keys, and the
- * resolver redacts on any log line. A partial credential set (a present platform
- * missing required fields) is rejected — fail fast, not at first push.
- */
-
-import debug from 'debug';
-
-import type { PushCredentials, FcmCredentials, ApnsCredentials } from '@serfab/cadre-core';
-import { validatePushCredentials } from '@serfab/cadre-core';
-
-import type { SecretsStore } from '../nat/secrets/index.js';
-import type { PushSettings } from '../installer/config.js';
-
-const log = debug('cadre:host:push');
-
-/** Push platform whose secret bundle lives in the secret store. */
-export type PushSecretPlatform = 'fcm' | 'apns';
-
-/** Build the secret-store account key for a platform's credential bundle. */
-export function pushAccount(platform: PushSecretPlatform): string {
-  return `push:${platform}`;
-}
-
-/** FCM secret bundle persisted in the secret store (the whole set is sensitive). */
-export interface FcmSecret {
-  projectId: string;
-  clientEmail: string;
-  /** Service-account RSA private key, PEM. */
-  privateKey: string;
-}
-
-/**
- * APNs secret bundle persisted in the secret store. `bundleId` / `production` are
- * NOT here — they are non-secret app-config in {@link PushSettings}.
- */
-export interface ApnsSecret {
-  keyId: string;
-  teamId: string;
-  /** `.p8` ES256 private key, PEM. */
-  privateKey: string;
-}
-
-/** Store (or replace) the FCM service-account secret bundle. */
-export async function setFcmSecret(secrets: SecretsStore, secret: FcmSecret): Promise<void> {
-  await secrets.set(pushAccount('fcm'), JSON.stringify(secret));
-}
-
-/** Store (or replace) the APNs auth-key secret bundle. */
-export async function setApnsSecret(secrets: SecretsStore, secret: ApnsSecret): Promise<void> {
-  await secrets.set(pushAccount('apns'), JSON.stringify(secret));
-}
-
-/** Remove a platform's secret bundle. Returns true if one was present. */
-export async function clearPushSecret(secrets: SecretsStore, platform: PushSecretPlatform): Promise<boolean> {
-  return secrets.delete(pushAccount(platform));
-}
-
-/** Read a platform's stored secret bundle, or null when unset. */
-async function readSecret<T>(secrets: SecretsStore, platform: PushSecretPlatform): Promise<T | null> {
-  const raw = await secrets.get(pushAccount(platform));
-  if (raw === null) return null;
-  try {
-    return JSON.parse(raw) as T;
-  } catch (err) {
-    throw new Error(`Stored ${platform} push secret is not valid JSON: ${(err as Error).message}`, { cause: err });
-  }
-}
-
-/**
- * Resolve the full {@link PushCredentials} block to inject into a spawned node,
- * merging the secret-store bundles with the non-secret {@link PushSettings}.
- *
- * Returns `undefined` when NO platform is configured (push is opt-in — the node
- * then constructs no fan-out). Throws when a configured platform is incomplete
- * (e.g. APNs secret present but `bundleId` unset), so a misconfig surfaces at the
- * spawn boundary rather than silently at first push.
- */
-export async function resolvePushCredentials(
-  secrets: SecretsStore,
-  settings: PushSettings | undefined,
-): Promise<PushCredentials | undefined> {
-  const fcmSecret = await readSecret<FcmSecret>(secrets, 'fcm');
-  const apnsSecret = await readSecret<ApnsSecret>(secrets, 'apns');
-
-  if (!fcmSecret && !apnsSecret) return undefined;
-
-  const push: PushCredentials = {};
-  if (fcmSecret) {
-    const fcm: FcmCredentials = {
-      projectId: fcmSecret.projectId,
-      clientEmail: fcmSecret.clientEmail,
-      privateKey: fcmSecret.privateKey,
-    };
-    push.fcm = fcm;
-  }
-  if (apnsSecret) {
-    const apns: ApnsCredentials = {
-      keyId: apnsSecret.keyId,
-      teamId: apnsSecret.teamId,
-      bundleId: settings?.apns?.bundleId ?? '',
-      privateKey: apnsSecret.privateKey,
-      ...(settings?.apns?.production !== undefined ? { production: settings.apns.production } : {}),
-    };
-    push.apns = apns;
-  }
-  if (settings?.cooldownMs !== undefined) push.cooldownMs = settings.cooldownMs;
-  if (settings?.debounceMs !== undefined) push.debounceMs = settings.debounceMs;
-
-  const errors = validatePushCredentials(push);
-  if (errors.length > 0) {
-    throw new Error(`Invalid push credentials: ${errors.join('; ')}`);
-  }
-  log('resolved push credentials (fcm=%s apns=%s)', !!push.fcm, !!push.apns);
-  return push;
-}
-
-/**
- * A description of which push platforms are configured, for the `push status` CLI
- * and any UI — derived without exposing any secret material.
- */
-export interface PushStatus {
-  fcm: boolean;
-  apns: boolean;
-}
-
-/** Report which platforms have a stored secret bundle (no secret material). */
-export async function pushStatus(secrets: SecretsStore): Promise<PushStatus> {
-  const accounts = await secrets.list();
-  return {
-    fcm: accounts.includes(pushAccount('fcm')),
-    apns: accounts.includes(pushAccount('apns')),
-  };
-}
+/**
+ * Push (FCM/APNs) credential storage + resolution for cadre-host.
+ *
+ * The platform-push secrets a self-hosted deployment provisions live in the host
+ * secret store (keytar with file-store fallback — the same store DDNS tokens use);
+ * the non-secret app-config bits (APNs bundle id / sandbox toggle, cooldown /
+ * debounce) live in `host.config.json` (`PushSettings`). At node-spawn time the
+ * orchestrator's `pushResolver` calls {@link resolvePushCredentials}, which reads
+ * BOTH and merges them into the `PushCredentials` block written into the spawned
+ * node's `cadre.json`.
+ *
+ * Secret hygiene: the FCM service-account fields and the APNs `.p8` key are stored
+ * ONLY in the secret store, never in `host.config.json` and never in `state.json`.
+ * They are re-read on every spawn so a restart picks up rotated keys, and the
+ * resolver redacts on any log line. A partial credential set (a present platform
+ * missing required fields) is rejected — fail fast, not at first push.
+ */
+
+import debug from 'debug';
+
+import type { PushCredentials, FcmCredentials, ApnsCredentials } from '@serfab/cadre-core';
+import { validatePushCredentials } from '@serfab/cadre-core';
+
+import type { SecretsStore } from '../nat/secrets/index.js';
+import type { PushSettings } from '../installer/config.js';
+
+const log = debug('cadre:host:push');
+
+/** Push platform whose secret bundle lives in the secret store. */
+export type PushSecretPlatform = 'fcm' | 'apns';
+
+/** Build the secret-store account key for a platform's credential bundle. */
+export function pushAccount(platform: PushSecretPlatform): string {
+  return `push:${platform}`;
+}
+
+/** FCM secret bundle persisted in the secret store (the whole set is sensitive). */
+export interface FcmSecret {
+  projectId: string;
+  clientEmail: string;
+  /** Service-account RSA private key, PEM. */
+  privateKey: string;
+}
+
+/**
+ * APNs secret bundle persisted in the secret store. `bundleId` / `production` are
+ * NOT here — they are non-secret app-config in {@link PushSettings}.
+ */
+export interface ApnsSecret {
+  keyId: string;
+  teamId: string;
+  /** `.p8` ES256 private key, PEM. */
+  privateKey: string;
+}
+
+/** Store (or replace) the FCM service-account secret bundle. */
+export async function setFcmSecret(secrets: SecretsStore, secret: FcmSecret): Promise<void> {
+  await secrets.set(pushAccount('fcm'), JSON.stringify(secret));
+}
+
+/** Store (or replace) the APNs auth-key secret bundle. */
+export async function setApnsSecret(secrets: SecretsStore, secret: ApnsSecret): Promise<void> {
+  await secrets.set(pushAccount('apns'), JSON.stringify(secret));
+}
+
+/** Remove a platform's secret bundle. Returns true if one was present. */
+export async function clearPushSecret(secrets: SecretsStore, platform: PushSecretPlatform): Promise<boolean> {
+  return secrets.delete(pushAccount(platform));
+}
+
+/** Read a platform's stored secret bundle, or null when unset. */
+async function readSecret<T>(secrets: SecretsStore, platform: PushSecretPlatform): Promise<T | null> {
+  const raw = await secrets.get(pushAccount(platform));
+  if (raw === null) return null;
+  try {
+    return JSON.parse(raw) as T;
+  } catch (err) {
+    throw new Error(`Stored ${platform} push secret is not valid JSON: ${(err as Error).message}`, { cause: err });
+  }
+}
+
+/**
+ * Resolve the full {@link PushCredentials} block to inject into a spawned node,
+ * merging the secret-store bundles with the non-secret {@link PushSettings}.
+ *
+ * Returns `undefined` when NO platform is configured (push is opt-in — the node
+ * then constructs no fan-out). Throws when a configured platform is incomplete
+ * (e.g. APNs secret present but `bundleId` unset), so a misconfig surfaces at the
+ * spawn boundary rather than silently at first push.
+ */
+export async function resolvePushCredentials(
+  secrets: SecretsStore,
+  settings: PushSettings | undefined,
+): Promise<PushCredentials | undefined> {
+  const fcmSecret = await readSecret<FcmSecret>(secrets, 'fcm');
+  const apnsSecret = await readSecret<ApnsSecret>(secrets, 'apns');
+
+  if (!fcmSecret && !apnsSecret) return undefined;
+
+  const push: PushCredentials = {};
+  if (fcmSecret) {
+    const fcm: FcmCredentials = {
+      projectId: fcmSecret.projectId,
+      clientEmail: fcmSecret.clientEmail,
+      privateKey: fcmSecret.privateKey,
+    };
+    push.fcm = fcm;
+  }
+  if (apnsSecret) {
+    const apns: ApnsCredentials = {
+      keyId: apnsSecret.keyId,
+      teamId: apnsSecret.teamId,
+      bundleId: settings?.apns?.bundleId ?? '',
+      privateKey: apnsSecret.privateKey,
+      ...(settings?.apns?.production !== undefined ? { production: settings.apns.production } : {}),
+    };
+    push.apns = apns;
+  }
+  if (settings?.cooldownMs !== undefined) push.cooldownMs = settings.cooldownMs;
+  if (settings?.debounceMs !== undefined) push.debounceMs = settings.debounceMs;
+
+  const errors = validatePushCredentials(push);
+  if (errors.length > 0) {
+    throw new Error(`Invalid push credentials: ${errors.join('; ')}`);
+  }
+  log('resolved push credentials (fcm=%s apns=%s)', !!push.fcm, !!push.apns);
+  return push;
+}
+
+/**
+ * A description of which push platforms are configured, for the `push status` CLI
+ * and any UI — derived without exposing any secret material.
+ */
+export interface PushStatus {
+  fcm: boolean;
+  apns: boolean;
+}
+
+/** Report which platforms have a stored secret bundle (no secret material). */
+export async function pushStatus(secrets: SecretsStore): Promise<PushStatus> {
+  const accounts = await secrets.list();
+  return {
+    fcm: accounts.includes(pushAccount('fcm')),
+    apns: accounts.includes(pushAccount('apns')),
+  };
+}

package/src/server/__tests__/bus.test.ts

@@ -1,38 +1,38 @@
-import { describe, it, expect } from 'vitest';
-
-import { EventBus } from '../events/bus.js';
-import type { LocalUiEvent } from '../events/types.js';
-
-describe('EventBus', () => {
-  it('delivers events to subscribers in order', () => {
-    const bus = new EventBus();
-    const received: LocalUiEvent[] = [];
-    bus.subscribe((e) => received.push(e));
-    bus.publish({ type: 'trust-circle-changed', kind: 'invited' });
-    bus.publish({ type: 'trust-circle-changed', kind: 'revoked' });
-    expect(received).toEqual([
-      { type: 'trust-circle-changed', kind: 'invited' },
-      { type: 'trust-circle-changed', kind: 'revoked' },
-    ]);
-  });
-
-  it('unsubscribe stops further deliveries', () => {
-    const bus = new EventBus();
-    const received: LocalUiEvent[] = [];
-    const unsub = bus.subscribe((e) => received.push(e));
-    bus.publish({ type: 'trust-circle-changed', kind: 'invited' });
-    unsub();
-    bus.publish({ type: 'trust-circle-changed', kind: 'redeemed' });
-    expect(received).toHaveLength(1);
-    expect(bus.listenerCount()).toBe(0);
-  });
-
-  it('one listener throwing does not block others', () => {
-    const bus = new EventBus();
-    const received: LocalUiEvent[] = [];
-    bus.subscribe(() => { throw new Error('bad listener'); });
-    bus.subscribe((e) => received.push(e));
-    bus.publish({ type: 'trust-circle-changed', kind: 'invited' });
-    expect(received).toHaveLength(1);
-  });
-});
+import { describe, it, expect } from 'vitest';
+
+import { EventBus } from '../events/bus.js';
+import type { LocalUiEvent } from '../events/types.js';
+
+describe('EventBus', () => {
+  it('delivers events to subscribers in order', () => {
+    const bus = new EventBus();
+    const received: LocalUiEvent[] = [];
+    bus.subscribe((e) => received.push(e));
+    bus.publish({ type: 'trust-circle-changed', kind: 'invited' });
+    bus.publish({ type: 'trust-circle-changed', kind: 'revoked' });
+    expect(received).toEqual([
+      { type: 'trust-circle-changed', kind: 'invited' },
+      { type: 'trust-circle-changed', kind: 'revoked' },
+    ]);
+  });
+
+  it('unsubscribe stops further deliveries', () => {
+    const bus = new EventBus();
+    const received: LocalUiEvent[] = [];
+    const unsub = bus.subscribe((e) => received.push(e));
+    bus.publish({ type: 'trust-circle-changed', kind: 'invited' });
+    unsub();
+    bus.publish({ type: 'trust-circle-changed', kind: 'redeemed' });
+    expect(received).toHaveLength(1);
+    expect(bus.listenerCount()).toBe(0);
+  });
+
+  it('one listener throwing does not block others', () => {
+    const bus = new EventBus();
+    const received: LocalUiEvent[] = [];
+    bus.subscribe(() => { throw new Error('bad listener'); });
+    bus.subscribe((e) => received.push(e));
+    bus.publish({ type: 'trust-circle-changed', kind: 'invited' });
+    expect(received).toHaveLength(1);
+  });
+});