@serverkgg/bridge 0.0.21 → 0.1.1

package/src/runtime/bridgeFiles.test.ts

@@ -564,6 +564,68 @@ describe("extract", () => {
 		expect(await read("config/beta.json")).toBe("beta");
 	});
 
+	test("keeps dotfiles in a tree when asked and never writes .git or .serverk", async () => {
+		const path = await archive([
+			{
+				name: "bot/.env.example",
+				content: "DISCORD_TOKEN=",
+			},
+			{
+				name: "bot/src/.config/settings.json",
+				content: "{}",
+			},
+			{
+				name: "bot/index.js",
+				content: "run()",
+			},
+			{
+				name: "bot/.git/config",
+				content: "[core]",
+			},
+			{
+				name: "bot/.serverk/deploy-requested",
+				content: "{}",
+			},
+		]);
+
+		const written = await files.extract(path, "", {
+			tree: true,
+			dotfiles: true,
+			select: "bot/",
+		});
+
+		expect(written).toEqual([
+			".env.example",
+			"src/.config/settings.json",
+			"index.js",
+		]);
+
+		expect(await read(".env.example")).toBe("DISCORD_TOKEN=");
+		expect(await files.exists(".git/config")).toBe(false);
+		expect(await files.exists(".serverk/deploy-requested")).toBe(false);
+	});
+
+	test("still skips dotfiles in a tree unless asked", async () => {
+		const path = await archive([
+			{
+				name: ".env.example",
+				content: "DISCORD_TOKEN=",
+			},
+			{
+				name: "index.js",
+				content: "run()",
+			},
+		]);
+
+		const written = await files.extract(path, "", {
+			tree: true,
+		});
+
+		expect(written).toEqual([
+			"index.js",
+		]);
+	});
+
 	test("takes a single named entry when the select carries no trailing slash", async () => {
 		const path = await archive([
 			{

package/src/runtime/bridgeFiles.ts

@@ -152,6 +152,15 @@ const compileSelect = (select: string): ArchiveSelect => {
 	return select.endsWith("/") ? prefixSelect(select) : entrySelect(select);
 };
 
+const ALWAYS_SKIPPED_SEGMENTS: ReadonlySet<string> = new Set([
+	".git",
+	".serverk",
+]);
+
+const hiddenEntry = (segments: string[], dotfiles: boolean) => {
+	return segments.some((segment) => ALWAYS_SKIPPED_SEGMENTS.has(segment) || (!dotfiles && segment.startsWith(".")));
+};
+
 const compileSelects = (select: string | undefined, selects: string[] | undefined) => {
 	const compiled: ArchiveSelect[] = [];
 
@@ -603,6 +612,7 @@ export const createBridgeFiles = (options: BridgeFilesOptions): BridgeFiles => {
 			}
 
 			const tree = extractOptions.tree === true;
+			const dotfiles = extractOptions.dotfiles === true;
 			const allowed = extractOptions.extensions?.map((extension) => extension.toLowerCase());
 			const selects = compileSelects(extractOptions.select, extractOptions.selects);
 			const excluded = compileGlobs(extractOptions.exclude ?? []);
@@ -638,7 +648,7 @@ export const createBridgeFiles = (options: BridgeFilesOptions): BridgeFiles => {
 							selected.split("/").at(-1) ?? "",
 						];
 				const name = segments.at(-1) ?? "";
-				if (!name || segments.some((segment) => segment.startsWith("."))) {
+				if (!name || hiddenEntry(segments, dotfiles)) {
 					continue;
 				}
 				if (allowed !== undefined && !allowed.includes(name.split(".").at(-1)?.toLowerCase() ?? "")) {
@@ -677,7 +687,7 @@ export const createBridgeFiles = (options: BridgeFilesOptions): BridgeFiles => {
 				const name = segments.at(-1) ?? "";
 				const extension = name.split(".").at(-1)?.toLowerCase() ?? "";
 
-				if (name.length === 0 || segments.some((segment) => segment.startsWith("."))) {
+				if (name.length === 0 || hiddenEntry(segments, dotfiles)) {
 					continue;
 				}
 

package/src/runtime/bridgeLiveConfig.ts

@@ -14,9 +14,13 @@ export const BRIDGE_CONFIG_REFRESH_MS = 2000;
  */
 export interface BridgeLiveConfig {
 	variable: (key: string) => string | null;
+	variables: () => Readonly<Record<string, string>>;
 	secret: (key: string) => string | null;
+	secrets: () => Readonly<Record<string, string>>;
 	memoryMb: () => number;
 	cpuPercent: () => number;
+	publicAddress: () => string | null;
+	reload: () => void;
 }
 
 export const createBridgeLiveConfig = (
@@ -50,14 +54,28 @@ export const createBridgeLiveConfig = (
 		variable(key) {
 			return refresh().variables[key] ?? null;
 		},
+		variables() {
+			return refresh().variables;
+		},
 		secret(key) {
 			return refresh().secrets[key] ?? null;
 		},
+		secrets() {
+			return refresh().secrets;
+		},
 		memoryMb() {
 			return refresh().memoryMb;
 		},
 		cpuPercent() {
 			return refresh().cpuPercent;
 		},
+		publicAddress() {
+			return refresh().publicAddress ?? null;
+		},
+		reload() {
+			checkedAt = null;
+
+			refresh();
+		},
 	};
 };

package/src/runtime/bridgeRedaction.test.ts

@@ -0,0 +1,410 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { BridgeKind } from "../core";
+import type { BridgeDriver } from "../modules";
+import { BridgeControl, BridgeFormTarget, BridgeLayout, type BridgeTab } from "../panel";
+import type { BridgeConfig } from "../protocol";
+import { createBridgeLiveConfig } from "./bridgeLiveConfig";
+import type { BridgeLeveledLogger } from "./bridgeLog";
+import { createBridgeRedaction, REDACTED, redactLocalized, redactLogger, secretFieldKeys } from "./bridgeRedaction";
+
+const text = (value: string) => ({
+	ar: value,
+	en: value,
+});
+
+const TOKEN = "123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw";
+
+const driverWith = (tabs: BridgeTab[]): BridgeDriver => ({
+	install: {
+		kind: BridgeKind.Install,
+		run: async () => undefined,
+	},
+	lifecycle: {
+		kind: BridgeKind.Lifecycle,
+		command: async () => [
+			"run",
+		],
+	},
+	panel: {
+		tabs,
+	},
+});
+
+const secretsTab: BridgeTab = {
+	id: "bot",
+	title: text("Bot"),
+	sections: [
+		{
+			layout: BridgeLayout.Form,
+			id: "token",
+			target: BridgeFormTarget.Variables,
+			fields: [
+				{
+					key: "BOT_PLATFORM",
+					control: BridgeControl.Select,
+					label: text("Platform"),
+				},
+				{
+					key: "BOT_TOKEN",
+					control: BridgeControl.Secret,
+					label: text("Token"),
+				},
+			],
+		},
+		{
+			layout: BridgeLayout.Form,
+			id: "source",
+			target: BridgeFormTarget.Variables,
+			fields: [
+				{
+					key: "GIT_TOKEN",
+					control: BridgeControl.Secret,
+					label: text("Git token"),
+				},
+				{
+					key: "BOT_TOKEN",
+					control: BridgeControl.Secret,
+					label: text("Token again"),
+				},
+			],
+		},
+	],
+};
+
+const sourceOf = (initial: Record<string, string>, secrets: Record<string, string> = {}) => {
+	let variables: Readonly<Record<string, string>> = initial;
+	let current: Readonly<Record<string, string>> = secrets;
+
+	return {
+		source: {
+			variables: () => variables,
+			secrets: () => current,
+		},
+		save(next: Record<string, string>) {
+			variables = next;
+		},
+		seal(next: Record<string, string>) {
+			current = next;
+		},
+	};
+};
+
+describe("secretFieldKeys", () => {
+	test("collects every secret form field once and nothing else", () => {
+		expect(
+			secretFieldKeys(
+				driverWith([
+					secretsTab,
+				]),
+			),
+		).toEqual([
+			"BOT_TOKEN",
+			"GIT_TOKEN",
+		]);
+	});
+
+	test("finds nothing in a driver with no secret fields", () => {
+		expect(secretFieldKeys(driverWith([]))).toEqual([]);
+	});
+});
+
+describe("createBridgeRedaction", () => {
+	test("is built for every driver and leaves text alone until a secret exists", () => {
+		const { source, seal } = sourceOf({});
+		const redact = createBridgeRedaction([], source);
+
+		expect(redact(`token ${TOKEN}`)).toBe(`token ${TOKEN}`);
+
+		seal({
+			DISCORD_TOKEN: TOKEN,
+		});
+
+		expect(redact(`token ${TOKEN}`)).toBe(`token ${REDACTED}`);
+	});
+
+	test("blanks the platform secrets the manifest declares, with the same length floor", () => {
+		const redact = createBridgeRedaction(
+			[],
+			sourceOf(
+				{},
+				{
+					CURSEFORGE_API_KEY: "cf-api-key-0123456789",
+					SHORT_KEY: "short",
+				},
+			).source,
+		);
+
+		expect(redact("key cf-api-key-0123456789 and short")).toBe(`key ${REDACTED} and short`);
+	});
+
+	test("blanks secret fields and platform secrets together", () => {
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			sourceOf(
+				{
+					BOT_TOKEN: TOKEN,
+				},
+				{
+					CURSEFORGE_API_KEY: "cf-api-key-0123456789",
+				},
+			).source,
+		);
+
+		expect(redact(`${TOKEN} cf-api-key-0123456789`)).toBe(`${REDACTED} ${REDACTED}`);
+	});
+
+	test("replaces every occurrence of a secret value", () => {
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			sourceOf({
+				BOT_TOKEN: TOKEN,
+			}).source,
+		);
+
+		expect(redact(`InvalidToken: ${TOKEN} was rejected (${TOKEN})`)).toBe(
+			`InvalidToken: ${REDACTED} was rejected (${REDACTED})`,
+		);
+	});
+
+	test("blanks every line of a multi-line secret the process prints one line at a time", () => {
+		const key = [
+			"-----BEGIN PRIVATE KEY-----",
+			"MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7",
+			"  q1w2e3r4t5y6u7i8o9p0  ",
+			"short",
+			"-----END PRIVATE KEY-----",
+		].join("\r\n");
+		const redact = createBridgeRedaction(
+			[],
+			sourceOf(
+				{},
+				{
+					GOOGLE_PRIVATE_KEY: key,
+				},
+			).source,
+		);
+
+		expect(redact("MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7")).toBe(REDACTED);
+		expect(redact("line: q1w2e3r4t5y6u7i8o9p0")).toBe(`line: ${REDACTED}`);
+		expect(redact("-----BEGIN PRIVATE KEY-----")).toBe(REDACTED);
+		expect(redact("short stays")).toBe("short stays");
+		expect(redact(`whole ${key}`)).toBe(`whole ${REDACTED}`);
+	});
+
+	test("leaves a value under eight characters alone", () => {
+		const redact = createBridgeRedaction(
+			[
+				"RCON_PASSWORD",
+			],
+			sourceOf({
+				RCON_PASSWORD: "hunter2",
+			}).source,
+		);
+
+		expect(redact("the password is hunter2")).toBe("the password is hunter2");
+	});
+
+	test("escapes values that look like patterns and prefers the longest overlapping value", () => {
+		const redact = createBridgeRedaction(
+			[
+				"SHORT",
+				"LONG",
+			],
+			sourceOf({
+				SHORT: "a.b+c*d?",
+				LONG: "a.b+c*d?-and-more",
+			}).source,
+		);
+
+		expect(redact("x a.b+c*d?-and-more y a.b+c*d? z aXb+c*d?")).toBe(`x ${REDACTED} y ${REDACTED} z aXb+c*d?`);
+	});
+
+	test("follows a value saved after it was built and forgets the old one", () => {
+		const { source, save } = sourceOf({
+			BOT_TOKEN: "old-token-value",
+		});
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			source,
+		);
+
+		expect(redact("old-token-value")).toBe(REDACTED);
+
+		save({
+			BOT_TOKEN: "new-token-value",
+		});
+
+		expect(redact("old-token-value new-token-value")).toBe(`old-token-value ${REDACTED}`);
+	});
+});
+
+describe("redacting what the bridge reports", () => {
+	const redact = (value: string) => value.split(TOKEN).join(REDACTED);
+
+	test("covers both languages of a customer-facing message", () => {
+		expect(redactLocalized(text(`bad ${TOKEN}`), redact)).toEqual(text(`bad ${REDACTED}`));
+	});
+
+	test("covers the message and every string field of a log line", () => {
+		const lines: unknown[] = [];
+		const record = (level: string) => (message: string, fields?: Record<string, unknown>) => {
+			lines.push({
+				level,
+				message,
+				fields,
+			});
+		};
+		const logger: BridgeLeveledLogger = Object.assign(record("info"), {
+			warn: record("warn"),
+			error: record("error"),
+		});
+		const redacted = redactLogger(logger, redact);
+
+		redacted(`saw ${TOKEN}`);
+		redacted.warn("driver failed", {
+			error: `InvalidToken: ${TOKEN}`,
+			code: 401,
+			nested: {
+				list: [
+					TOKEN,
+				],
+			},
+			driver: true,
+		});
+		redacted.error("plain");
+
+		expect(lines).toEqual([
+			{
+				level: "info",
+				message: `saw ${REDACTED}`,
+				fields: undefined,
+			},
+			{
+				level: "warn",
+				message: "driver failed",
+				fields: {
+					error: `InvalidToken: ${REDACTED}`,
+					code: 401,
+					nested: {
+						list: [
+							REDACTED,
+						],
+					},
+					driver: true,
+				},
+			},
+			{
+				level: "error",
+				message: "plain",
+				fields: undefined,
+			},
+		]);
+	});
+});
+
+describe("redaction over the live config", () => {
+	let directory = "";
+	let path = "";
+
+	const configWith = (variables: Record<string, string>): BridgeConfig => ({
+		code: "wsvv8fakxm",
+		token: "token",
+		cwd: "/data",
+		run: "/run/bridge",
+		ports: {},
+		memoryMb: 1024,
+		cpuPercent: 100,
+		gameUid: 1000,
+		gameGid: 1000,
+		variables,
+		secrets: {},
+	});
+
+	const write = async (config: BridgeConfig) => {
+		await writeFile(path, `${JSON.stringify(config)}\n`);
+	};
+
+	beforeEach(async () => {
+		directory = await mkdtemp(join(tmpdir(), "bridge-redaction-"));
+		path = join(directory, "config.json");
+	});
+
+	afterEach(async () => {
+		await rm(directory, {
+			force: true,
+			recursive: true,
+		});
+	});
+
+	test("reads the platform secrets from the config the agent wrote", async () => {
+		const boot = {
+			...configWith({}),
+			secrets: {
+				CURSEFORGE_API_KEY: "cf-api-key-0123456789",
+			},
+		};
+
+		await write(boot);
+
+		const redact = createBridgeRedaction([], createBridgeLiveConfig(path, boot, 60_000));
+
+		expect(redact("cf-api-key-0123456789")).toBe(REDACTED);
+	});
+
+	test("starts as the identity with no secret anywhere and blanks a secret written after boot", async () => {
+		const boot = configWith({});
+
+		await write(boot);
+
+		const live = createBridgeLiveConfig(path, boot, 60_000);
+		const redact = createBridgeRedaction([], live);
+
+		expect(redact(`key ${TOKEN}`)).toBe(`key ${TOKEN}`);
+
+		await write({
+			...configWith({}),
+			secrets: {
+				MY_API_KEY: TOKEN,
+			},
+		});
+
+		live.reload();
+
+		expect(redact(`key ${TOKEN}`)).toBe(`key ${REDACTED}`);
+	});
+
+	test("picks up a token the agent writes into the config after boot", async () => {
+		const boot = configWith({});
+
+		await write(boot);
+
+		const live = createBridgeLiveConfig(path, boot, 60_000);
+		const redact = createBridgeRedaction(
+			[
+				"BOT_TOKEN",
+			],
+			live,
+		);
+
+		expect(redact(TOKEN)).toBe(TOKEN);
+
+		await write(
+			configWith({
+				BOT_TOKEN: TOKEN,
+			}),
+		);
+
+		live.reload();
+
+		expect(redact(TOKEN)).toBe(REDACTED);
+	});
+});