@serfab/cadre-host 1.13.0 → 1.14.0

package/src/__tests__/orchestrator-claim-secret.test.ts

@@ -0,0 +1,112 @@
+/**
+ * HostProcessOrchestrator claim-secret test — the one piece of a hosted node's
+ * spawn that is secret.
+ *
+ * A node started waiting to be claimed takes its secret from `CADRE_CLAIM_SECRET`
+ * (`cadre-cli start`). The orchestrator must hand it to the child through the
+ * environment and nowhere else: not as an argument (the process list shows
+ * those) and not in `state.json` (which outlives the child and is readable by
+ * anything on the machine). A fake CLI records its environment and arguments to a
+ * file so both are observable without a real cadre node.
+ */
+
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+import { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+import { removeAllNodes } from './orchestrator-teardown.js';
+
+// Writes CADRE_CLAIM_SECRET (as seen in the child env) and the argv next to the
+// startup token, then behaves like a minimal long-lived node.
+const FAKE_CLI = `
+import fs from 'node:fs';
+import path from 'node:path';
+const args = process.argv.slice(2);
+const get = (flag) => { const i = args.indexOf(flag); return i >= 0 ? args[i + 1] : undefined; };
+const tokenPath = get('--startup-token-file');
+const token = process.env.CADRE_STARTUP_TOKEN ?? '';
+if (tokenPath) {
+  const dir = path.dirname(tokenPath);
+  const record = { secret: process.env.CADRE_CLAIM_SECRET ?? null, args };
+  const seenPath = path.join(dir, 'spawn-seen.json');
+  try { fs.writeFileSync(seenPath + '.tmp', JSON.stringify(record), 'utf8'); fs.renameSync(seenPath + '.tmp', seenPath); } catch (e) { console.error(e); }
+  if (token) { try { fs.writeFileSync(tokenPath, token, 'utf8'); } catch (e) { console.error(e); } }
+}
+process.on('SIGTERM', () => process.exit(0));
+setInterval(() => {}, 1 << 30);
+`;
+
+const SECRET = 'claim-secret-' + 'x'.repeat(30);
+
+let tmpRoot: string;
+let scriptPath: string;
+const orchestrators: HostProcessOrchestrator[] = [];
+
+beforeEach(() => {
+  tmpRoot = mkdtempSync(join(tmpdir(), 'cadre-host-claim-'));
+  scriptPath = join(tmpRoot, 'fake-cli.mjs');
+  writeFileSync(scriptPath, FAKE_CLI, 'utf8');
+});
+
+afterEach(async () => {
+  try {
+    await removeAllNodes(orchestrators);
+  } finally {
+    await sleep(50);
+    try { rmSync(tmpRoot, { recursive: true, force: true }); } catch { /* ignore */ }
+  }
+});
+
+function makeOrchestrator(rootDir: string): HostProcessOrchestrator {
+  mkdirSync(rootDir, { recursive: true });
+  const orch = new HostProcessOrchestrator({
+    rootDir,
+    portRange: { start: 18500, end: 18999 },
+    stopTimeoutMs: 1500,
+    spawn: { entrypoint: scriptPath },
+  });
+  orchestrators.push(orch);
+  return orch;
+}
+
+async function waitForFile(path: string, timeoutMs = 5000): Promise<string> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    if (existsSync(path)) return readFileSync(path, 'utf8');
+    await sleep(50);
+  }
+  throw new Error(`file never appeared: ${path}`);
+}
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((res) => setTimeout(res, ms));
+}
+
+describe('HostProcessOrchestrator claim secret', () => {
+  it('reaches the child as CADRE_CLAIM_SECRET only: not an argument, not state.json', async () => {
+    const rootDir = join(tmpRoot, 'a');
+    const orch = makeOrchestrator(rootDir);
+    await orch.init();
+
+    await orch.createContainer({
+      containerId: 'hn_claim',
+      partyId: 'unclaimed',
+      bootstrapNodes: [],
+      profile: 'storage',
+      claimSecret: SECRET,
+    });
+
+    const seen = JSON.parse(await waitForFile(join(rootDir, 'hn_claim', 'spawn-seen.json'))) as { secret: string | null; args: string[] };
+    expect(seen.secret).toBe(SECRET);
+    expect(seen.args.join(' ')).not.toContain(SECRET);
+    expect(readFileSync(join(rootDir, 'state.json'), 'utf8')).not.toContain(SECRET);
+
+    // No secret, no variable: `cadre-cli start` treats a set-but-empty value as unset,
+    // but the child must not even see the name.
+    await orch.createContainer({ containerId: 'hn_plain', partyId: 'p', bootstrapNodes: [], profile: 'storage' });
+    const plain = JSON.parse(await waitForFile(join(rootDir, 'hn_plain', 'spawn-seen.json'))) as { secret: string | null };
+    expect(plain.secret).toBeNull();
+  });
+});

package/src/__tests__/orchestrator-handle-contract.ts

@@ -1,134 +1,134 @@
-/**
- * The handle rules `HostProcessOrchestrator` and its test stand-in
- * `FakeOrchestrator` (`donation/__tests__/fake-orchestrator.ts`) must both obey,
- * written once and run against each: `orchestrator.test.ts` registers them over
- * the real class, `fake-orchestrator.test.ts` over the fake. A rule one of them
- * stops obeying fails in that file's run.
- *
- * Not a `.test.ts` file, so vitest does not collect it on its own.
- *
- * Only what both classes can satisfy belongs here — no ports, no files on disk,
- * none of the fake's recording arrays. Those stay in the two calling files.
- */
-
-import { describe, expect, it } from 'vitest';
-
-import type { OrchestratorCreateRequest, OrchestratorCreateResult } from '@serfab/cadre-provider';
-
-import type { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
-
-/** What the contract needs from either orchestrator. */
-export type ContractOrchestrator = Pick<
-  HostProcessOrchestrator,
-  'createContainer' | 'stopContainer' | 'removeContainer' | 'resolveDockerId'
->;
-
-export interface HandleContractHarness<O extends ContractOrchestrator> {
-  /** A fresh orchestrator. Teardown is the calling file's own afterEach. */
-  make(): O;
-  request(containerId: string): OrchestratorCreateRequest;
-  /** Resolve once the spawn named by `dockerId` reads as running. */
-  started(orch: O, dockerId: string): Promise<void>;
-  /**
-   * Make `createContainer` for `containerId` throw from here on. Only called
-   * after that container has been spawned once and stopped, and no case creates
-   * again afterwards.
-   */
-  failNextCreate(orch: O, containerId: string): void;
-}
-
-const CONTAINER = 'grn_contract_a';
-const OTHER_CONTAINER = 'grn_contract_b';
-
-export function describeHandleContract<O extends ContractOrchestrator>(
-  label: string,
-  harness: HandleContractHarness<O>,
-): void {
-  async function spawn(orch: O, containerId: string): Promise<OrchestratorCreateResult> {
-    const result = await orch.createContainer(harness.request(containerId));
-    await harness.started(orch, result.dockerId);
-    return result;
-  }
-
-  // Stops first: a container whose previous child is still running is refused.
-  async function respawn(orch: O, containerId: string, previousDockerId: string): Promise<OrchestratorCreateResult> {
-    await orch.stopContainer(previousDockerId);
-    return spawn(orch, containerId);
-  }
-
-  describe(`${label} handle contract`, () => {
-    it('rejects a dockerId it never issued', async () => {
-      const orch = harness.make();
-
-      await expectNotFound(orch.stopContainer('never-issued'), 'never-issued');
-      await expectNotFound(orch.removeContainer('never-issued'), 'never-issued');
-    });
-
-    it('rejects a dockerId once its container has been removed', async () => {
-      const orch = harness.make();
-      const { dockerId } = await spawn(orch, CONTAINER);
-      await orch.stopContainer(dockerId);
-
-      await orch.removeContainer(dockerId);
-
-      await expectNotFound(orch.stopContainer(dockerId), dockerId);
-      await expectNotFound(orch.removeContainer(dockerId), dockerId);
-    });
-
-    it('replaces the first spawn\'s dockerId when the container re-spawns', async () => {
-      const orch = harness.make();
-      const first = await spawn(orch, CONTAINER);
-
-      const second = await respawn(orch, CONTAINER, first.dockerId);
-
-      await expectNotFound(orch.stopContainer(first.dockerId), first.dockerId);
-      expect(orch.resolveDockerId(CONTAINER)).toBe(second.dockerId);
-      await expect(orch.stopContainer(second.dockerId)).resolves.toBeUndefined();
-    });
-
-    // Launching over a live child hands its ports to a second child that then
-    // dies on them, while the caller records the new dockerId and seed token.
-    it('refuses to re-spawn a container whose previous child is still running', async () => {
-      const orch = harness.make();
-      const first = await spawn(orch, CONTAINER);
-
-      await expect(orch.createContainer(harness.request(CONTAINER)))
-        .rejects.toHaveProperty('message', `container ${CONTAINER} is still running`);
-
-      expect(orch.resolveDockerId(CONTAINER)).toBe(first.dockerId);
-      await expect(orch.stopContainer(first.dockerId)).resolves.toBeUndefined();
-    });
-
-    // The drop on re-spawn filters on containerId; an orchestrator that cleared
-    // every handle would still pass the same-container case above.
-    it('leaves another container\'s dockerId alone when one container re-spawns', async () => {
-      const orch = harness.make();
-      const other = await spawn(orch, OTHER_CONTAINER);
-      const first = await spawn(orch, CONTAINER);
-
-      await respawn(orch, CONTAINER, first.dockerId);
-
-      expect(orch.resolveDockerId(OTHER_CONTAINER)).toBe(other.dockerId);
-      await expect(orch.stopContainer(other.dockerId)).resolves.toBeUndefined();
-    });
-
-    // What lets a caller still clean up the node it knows about after a re-spawn
-    // that did not happen.
-    it('keeps the first spawn\'s dockerId when the re-spawn fails', async () => {
-      const orch = harness.make();
-      const first = await spawn(orch, CONTAINER);
-      await orch.stopContainer(first.dockerId);
-
-      harness.failNextCreate(orch, CONTAINER);
-      await expect(orch.createContainer(harness.request(CONTAINER))).rejects.toThrow();
-
-      expect(orch.resolveDockerId(CONTAINER)).toBe(first.dockerId);
-      await expect(orch.removeContainer(first.dockerId)).resolves.toBeUndefined();
-    });
-  });
-}
-
-/** The whole message, not a substring, so the two classes cannot come to word it differently. */
-async function expectNotFound(call: Promise<void>, dockerId: string): Promise<void> {
-  await expect(call).rejects.toHaveProperty('message', `Container not found: ${dockerId}`);
-}
+/**
+ * The handle rules `HostProcessOrchestrator` and its test stand-in
+ * `FakeOrchestrator` (`hosted/__tests__/fake-orchestrator.ts`) must both obey,
+ * written once and run against each: `orchestrator.test.ts` registers them over
+ * the real class, `fake-orchestrator.test.ts` over the fake. A rule one of them
+ * stops obeying fails in that file's run.
+ *
+ * Not a `.test.ts` file, so vitest does not collect it on its own.
+ *
+ * Only what both classes can satisfy belongs here — no ports, no files on disk,
+ * none of the fake's recording arrays. Those stay in the two calling files.
+ */
+
+import { describe, expect, it } from 'vitest';
+
+import type { OrchestratorCreateRequest, OrchestratorCreateResult } from '@serfab/cadre-provider';
+
+import type { HostProcessOrchestrator } from '../orchestrator/host-process-orchestrator.js';
+
+/** What the contract needs from either orchestrator. */
+export type ContractOrchestrator = Pick<
+  HostProcessOrchestrator,
+  'createContainer' | 'stopContainer' | 'removeContainer' | 'resolveDockerId'
+>;
+
+export interface HandleContractHarness<O extends ContractOrchestrator> {
+  /** A fresh orchestrator. Teardown is the calling file's own afterEach. */
+  make(): O;
+  request(containerId: string): OrchestratorCreateRequest;
+  /** Resolve once the spawn named by `dockerId` reads as running. */
+  started(orch: O, dockerId: string): Promise<void>;
+  /**
+   * Make `createContainer` for `containerId` throw from here on. Only called
+   * after that container has been spawned once and stopped, and no case creates
+   * again afterwards.
+   */
+  failNextCreate(orch: O, containerId: string): void;
+}
+
+const CONTAINER = 'hn_contract_a';
+const OTHER_CONTAINER = 'hn_contract_b';
+
+export function describeHandleContract<O extends ContractOrchestrator>(
+  label: string,
+  harness: HandleContractHarness<O>,
+): void {
+  async function spawn(orch: O, containerId: string): Promise<OrchestratorCreateResult> {
+    const result = await orch.createContainer(harness.request(containerId));
+    await harness.started(orch, result.dockerId);
+    return result;
+  }
+
+  // Stops first: a container whose previous child is still running is refused.
+  async function respawn(orch: O, containerId: string, previousDockerId: string): Promise<OrchestratorCreateResult> {
+    await orch.stopContainer(previousDockerId);
+    return spawn(orch, containerId);
+  }
+
+  describe(`${label} handle contract`, () => {
+    it('rejects a dockerId it never issued', async () => {
+      const orch = harness.make();
+
+      await expectNotFound(orch.stopContainer('never-issued'), 'never-issued');
+      await expectNotFound(orch.removeContainer('never-issued'), 'never-issued');
+    });
+
+    it('rejects a dockerId once its container has been removed', async () => {
+      const orch = harness.make();
+      const { dockerId } = await spawn(orch, CONTAINER);
+      await orch.stopContainer(dockerId);
+
+      await orch.removeContainer(dockerId);
+
+      await expectNotFound(orch.stopContainer(dockerId), dockerId);
+      await expectNotFound(orch.removeContainer(dockerId), dockerId);
+    });
+
+    it('replaces the first spawn\'s dockerId when the container re-spawns', async () => {
+      const orch = harness.make();
+      const first = await spawn(orch, CONTAINER);
+
+      const second = await respawn(orch, CONTAINER, first.dockerId);
+
+      await expectNotFound(orch.stopContainer(first.dockerId), first.dockerId);
+      expect(orch.resolveDockerId(CONTAINER)).toBe(second.dockerId);
+      await expect(orch.stopContainer(second.dockerId)).resolves.toBeUndefined();
+    });
+
+    // Launching over a live child hands its ports to a second child that then
+    // dies on them, while the caller records the new dockerId and seed token.
+    it('refuses to re-spawn a container whose previous child is still running', async () => {
+      const orch = harness.make();
+      const first = await spawn(orch, CONTAINER);
+
+      await expect(orch.createContainer(harness.request(CONTAINER)))
+        .rejects.toHaveProperty('message', `container ${CONTAINER} is still running`);
+
+      expect(orch.resolveDockerId(CONTAINER)).toBe(first.dockerId);
+      await expect(orch.stopContainer(first.dockerId)).resolves.toBeUndefined();
+    });
+
+    // The drop on re-spawn filters on containerId; an orchestrator that cleared
+    // every handle would still pass the same-container case above.
+    it('leaves another container\'s dockerId alone when one container re-spawns', async () => {
+      const orch = harness.make();
+      const other = await spawn(orch, OTHER_CONTAINER);
+      const first = await spawn(orch, CONTAINER);
+
+      await respawn(orch, CONTAINER, first.dockerId);
+
+      expect(orch.resolveDockerId(OTHER_CONTAINER)).toBe(other.dockerId);
+      await expect(orch.stopContainer(other.dockerId)).resolves.toBeUndefined();
+    });
+
+    // What lets a caller still clean up the node it knows about after a re-spawn
+    // that did not happen.
+    it('keeps the first spawn\'s dockerId when the re-spawn fails', async () => {
+      const orch = harness.make();
+      const first = await spawn(orch, CONTAINER);
+      await orch.stopContainer(first.dockerId);
+
+      harness.failNextCreate(orch, CONTAINER);
+      await expect(orch.createContainer(harness.request(CONTAINER))).rejects.toThrow();
+
+      expect(orch.resolveDockerId(CONTAINER)).toBe(first.dockerId);
+      await expect(orch.removeContainer(first.dockerId)).resolves.toBeUndefined();
+    });
+  });
+}
+
+/** The whole message, not a substring, so the two classes cannot come to word it differently. */
+async function expectNotFound(call: Promise<void>, dockerId: string): Promise<void> {
+  await expect(call).rejects.toHaveProperty('message', `Container not found: ${dockerId}`);
+}