@tdk-landscape/tdk-cli-core 1.3.45 → 1.3.48

package/tests/tilt-engine/test_docker_generator_bugs.py

@@ -0,0 +1,493 @@
+"""
+Tests for Docker and Compose generators to catch parameter mismatch bugs.
+
+These tests verify that:
+1. Docker generator functions are called with correct parameter names (not positional)
+2. Generated compose files use correct YAML anchors (*backend-port vs *frontend-port)
+3. Frontend services get correct port anchors (not backend anchors)
+4. Backend services get correct port anchors (not frontend anchors)
+"""
+
+import json
+import pytest
+import re
+from pathlib import Path
+from typing import Callable
+
+pytestmark = [pytest.mark.fast, pytest.mark.generator]
+
+
+class TestDockerGeneratorSignatures:
+    """Test that Docker generator functions have correct signatures."""
+    
+    def test_generate_frontend_dockerfile_signature(self):
+        """Verify frontend generator has expected parameter names."""
+        # This test documents the correct parameter names
+        # If someone changes the signature, this test will fail
+        import inspect
+        
+        # Simulate loading the function (we can't import .star files directly)
+        # Instead we verify the source code has the expected signature
+        dockerfile_star = Path(__file__).parent.parent.parent / "engine" / "topologies" / "platform" / "docker" / "dockerfile" / "dockerfile.star"
+        
+        if dockerfile_star.exists():
+            content = dockerfile_star.read_text()
+            
+            # Check function definition exists with expected params
+            assert "def generate_frontend_dockerfile(" in content
+            assert "res_path" in content
+            assert "resource_name" in content
+            assert "port=" in content
+            assert "target_path=" in content
+            assert "use_nginx=" in content
+            
+            # Verify it uses keyword args when calling L4_generate_orchestrator
+            assert "res_path=res_path" in content
+            assert "res_type='frontend'" in content
+            assert "port=port" in content
+    
+    def test_generate_app_dockerfile_signature(self):
+        """Verify backend generator has expected parameter names."""
+        dockerfile_star = Path(__file__).parent.parent.parent / "engine" / "topologies" / "platform" / "docker" / "dockerfile" / "dockerfile.star"
+        
+        if dockerfile_star.exists():
+            content = dockerfile_star.read_text()
+            
+            # Check function definition exists
+            assert "def generate_app_dockerfile(" in content
+            assert "res_path" in content
+            assert "resource_name" in content
+            assert "port=" in content
+            
+            # Verify it uses keyword args when calling L4_generate_orchestrator
+            assert "res_path=res_path" in content
+            assert "res_type='backend'" in content
+            assert "port=port" in content
+    
+    def test_l4_generate_orchestrator_signature(self):
+        """Verify L4_generate_orchestrator has expected parameter order."""
+        golden_generator = Path(__file__).parent.parent.parent / "engine" / "topologies" / "platform" / "docker" / "generators" / "golden_docker_generator_v2.star"
+        
+        if golden_generator.exists():
+            content = golden_generator.read_text()
+            
+            # Check function signature - this is where bugs happen!
+            # use_nginx is 4th param, port is 5th param
+            # If someone passes use_nginx positionally as 3rd arg after res_path, res_type, resource_name
+            # it becomes use_nginx instead of port!
+            match = re.search(
+                r'def L4_generate_orchestrator\([^)]+\)',
+                content
+            )
+            if match:
+                sig = match.group(0)
+                # Verify parameter order that caused the bug
+                params = ['res_path', 'res_type', 'resource_name', 'use_nginx', 'port']
+                for param in params:
+                    assert param in sig, f"Missing param: {param}"
+
+
+class TestComposePortAnchors:
+    """Test that compose files use correct YAML anchors for ports."""
+    
+    @pytest.fixture
+    def sample_backend_entry(self) -> str:
+        """Return a sample backend service entry as would be generated."""
+        return '''
+  identity-management-backend:
+    image: identity_identity-management-backend:dev
+    restart: unless-stopped
+    build:
+      context: ../../../../.
+      dockerfile: services/product/identity/identity-management-backend/.autogenerated/Dockerfile.app.autogenerated
+    env_file:
+      - ../../../../services/product/identity/identity-management-backend/.autogenerated/.env.backend.autogenerated
+    environment:
+      - RESOURCE_NAME=identity
+      - PORT=4004
+      - INSTANCE_ID=0
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.identity-management-backend.rule=Host(`identity.backend.{project}.local`)"
+      - "traefik.http.routers.identity-management-backend.entrypoints=web"
+      - "traefik.http.routers.identity-management-backend.service=identity-management-backend"
+      - "traefik.http.services.identity-management-backend.loadbalancer.server.port=4004"
+      - "traefik.http.services.identity-management-backend.loadbalancer.healthcheck.path=/api/v1/health"
+    networks:
+      - {project}_traefik-public
+      - {project}_backend
+    healthcheck:
+      test: ["CMD", "curl", "-f", "--max-time", "5", "http://localhost:4004/api/v1/health"]
+    deploy:
+      resources:
+        limits:
+          memory: 512M
+'''
+    
+    @pytest.fixture
+    def sample_frontend_entry(self) -> str:
+        """Return a sample frontend service entry as would be generated."""
+        return '''
+  identity-management-frontend:
+    image: identity_identity-management-frontend:dev
+    build:
+      context: ../../../../.
+      dockerfile: services/product/identity/identity-management-frontend/.autogenerated/Dockerfile.app.autogenerated
+    env_file:
+      - ../../../../services/product/identity/identity-management-frontend/.autogenerated/.env.frontend.autogenerated
+    environment:
+      - VITE_APP_ENV=development
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.identity-management-frontend.rule=Host(`identity-management-frontend.localhost`)"
+      - "traefik.http.routers.identity-management-frontend.entrypoints=web,websecure"
+      - "traefik.http.services.identity-management-frontend.loadbalancer.server.port=4000"
+      - "traefik.docker.network={project}_traefik-public"
+    networks:
+      - {project}_traefik-public
+    healthcheck:
+      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://127.0.0.1:4000"]
+    <<: *frontend-memory-limit
+'''
+    
+    def test_backend_entry_is_detected_as_backend(self, sample_backend_entry: str):
+        """Verify backend detection logic identifies backends correctly."""
+        # This mirrors the _is_backend_entry function logic
+        entry = sample_backend_entry
+        
+        # Backend should NOT be SDK
+        assert not ("-sdk:" in entry or entry.strip().startswith("identity-sdk:"))
+        
+        # Backend should NOT have frontend-memory-limit
+        assert "<<: *frontend-memory-limit" not in entry
+        
+        # Backend SHOULD have healthcheck with curl
+        assert "healthcheck:" in entry
+        assert "curl" in entry
+        
+        # Backend port should be 4004
+        port_match = re.search(r'loadbalancer\.server\.port=(\d+)', entry)
+        if port_match:
+            assert port_match.group(1) == "4004", "Backend should use port 4004"
+    
+    def test_frontend_entry_is_not_detected_as_backend(self, sample_frontend_entry: str):
+        """Verify backend detection correctly excludes frontends."""
+        entry = sample_frontend_entry
+        
+        # Frontend HAS frontend-memory-limit
+        assert "<<: *frontend-memory-limit" in entry
+        
+        # Frontend uses wget not curl in healthcheck
+        assert "wget" in entry
+        
+        # Frontend port should NOT be backend port
+        port_match = re.search(r'loadbalancer\.server\.port=(\d+)', entry)
+        if port_match:
+            port = port_match.group(1)
+            # Frontend port is typically 3000-3999 range
+            assert port != "4004", "Frontend should not use backend port 4004"
+    
+    def test_backend_gets_backend_port_anchor(self, sample_backend_entry: str):
+        """Verify backend entries get *backend-port anchor."""
+        entry = sample_backend_entry
+        
+        # After processing, backend with port 4004 should get *backend-port
+        # This tests the _replace_ports_with_anchors logic
+        is_backend = "healthcheck:" in entry and "curl" in entry and "<<: *frontend-memory-limit" not in entry
+        has_frontend = "<<: *frontend-memory-limit" in entry
+        
+        port = 4004
+        if port != 3000 and is_backend:
+            # Should use backend-port anchor
+            expected = "loadbalancer.server.port=*backend-port"
+            # Simulate the replacement
+            processed = entry.replace(f"loadbalancer.server.port={port}", expected)
+            assert expected in processed
+    
+    def test_frontend_gets_frontend_port_anchor(self, sample_frontend_entry: str):
+        """Verify frontend entries get *frontend-port anchor."""
+        entry = sample_frontend_entry
+        
+        # Frontend with non-3000 port and has_frontend=True should get *frontend-port
+        is_frontend = "<<: *frontend-memory-limit" in entry
+        
+        port_match = re.search(r'loadbalancer\.server\.port=(\d+)', entry)
+        if port_match:
+            port = int(port_match.group(1))
+            if port != 3000 and is_frontend:
+                expected = "loadbalancer.server.port=*frontend-port"
+                processed = entry.replace(f"loadbalancer.server.port={port}", expected)
+                assert expected in processed
+
+
+class TestDockerfileGeneration:
+    """Test Dockerfile generation for correct EXPOSE statements."""
+    
+    def test_frontend_dockerfile_exposes_port_not_path(self):
+        """Verify frontend Dockerfile EXPOSEs a port number, not a path."""
+        # The bug was: EXPOSE /usr/share/nginx/html (path instead of port)
+        # This happens when target_path is passed as port parameter positionally
+        
+        # Simulate the function signature issue
+        def generate_frontend_dockerfile_bad(res_path, resource_name, port=3000, target_path='/app/dist', use_nginx=False):
+            """Buggy version with positional args."""
+            # If called as Docker.frontend(path, name, use_nginx) 
+            # then use_nginx (bool) becomes port!
+            if use_nginx:
+                return f"EXPOSE {target_path}\n"  # BUG: uses path as port
+            return f"EXPOSE {port}\n"
+        
+        def generate_frontend_dockerfile_fixed(res_path, resource_name, port=3000, target_path='/app/dist', use_nginx=False):
+            """Fixed version with keyword args."""
+            if use_nginx:
+                return "EXPOSE 80\n"  # Nginx uses port 80
+            return f"EXPOSE {port}\n"
+        
+        # Test the buggy call pattern
+        bad_result = generate_frontend_dockerfile_bad(
+            "services/test", "test-svc", True  # True (use_nginx) becomes port!
+        )
+        # In the bug, port=True (which is 1) and use_nginx uses default False
+        # Actually the bug was: port gets /usr/share/nginx/html as string!
+        
+        # Test the fixed call pattern
+        fixed_result = generate_frontend_dockerfile_fixed(
+            res_path="services/test",
+            resource_name="test-svc",
+            use_nginx=True
+        )
+        assert "EXPOSE 80" in fixed_result
+        
+        fixed_result_port = generate_frontend_dockerfile_fixed(
+            res_path="services/test",
+            resource_name="test-svc",
+            port=4000,
+            use_nginx=False
+        )
+        assert "EXPOSE 4000" in fixed_result_port
+        assert "usr/share" not in fixed_result_port  # Should not have path!
+    
+    def test_expose_line_must_be_numeric_port(self):
+        """Verify EXPOSE lines in generated Dockerfiles contain numeric ports only."""
+        # Regex to match valid EXPOSE lines
+        valid_expose_pattern = re.compile(r'^EXPOSE\s+\d+$', re.MULTILINE)
+        
+        # Invalid patterns that should NOT appear
+        invalid_patterns = [
+            r'EXPOSE\s+/usr/share',  # Path instead of port
+            r'EXPOSE\s+\*',  # Anchor reference (should be resolved)
+            r'EXPOSE\s+\w+',  # Word instead of number
+        ]
+        
+        sample_dockerfile_good = """
+FROM oven/bun:1.3.11-alpine
+WORKDIR /app
+COPY . .
+EXPOSE 4004
+CMD ["bun", "run", "start"]
+"""
+        
+        sample_dockerfile_bad = """
+FROM oven/bun:1.3.11-alpine
+WORKDIR /app
+COPY . .
+EXPOSE /usr/share/nginx/html
+CMD ["bun", "run", "start"]
+"""
+        
+        # Good Dockerfile should have valid EXPOSE
+        assert valid_expose_pattern.search(sample_dockerfile_good)
+        
+        # Bad Dockerfile should NOT have valid EXPOSE
+        assert not valid_expose_pattern.search(sample_dockerfile_bad)
+        
+        # Bad Dockerfile should match invalid patterns
+        for pattern in invalid_patterns:
+            assert re.search(pattern, sample_dockerfile_bad, re.MULTILINE)
+
+
+class TestComposeFileValidation:
+    """Test generated compose files for structural correctness."""
+    
+    @pytest.fixture
+    def compose_file_pattern(self) -> dict:
+        """Return patterns that must/must not appear in compose files."""
+        return {
+            "required": [
+                r'x-backend-port: &backend-port\s+\d+',
+                r'x-frontend-port: &frontend-port\s+\d+',
+            ],
+            "forbidden": [
+                # Port anchors should be resolved, not literal in services
+                r'loadbalancer\.server\.port=\*frontend-port[^\s]*',  # In wrong place
+                r'loadbalancer\.server\.port=\*backend-port[^\s]*',   # In wrong place
+            ],
+            "resource_valid": [
+                r'loadbalancer\.server\.port=\*(?:frontend|backend|sdk)-port',
+            ]
+        }
+    
+    def test_compose_has_required_anchors(self, compose_file_pattern: dict):
+        """Verify compose file defines required YAML anchors."""
+        # This would test actual generated compose files
+        # For now, just verify the patterns are valid regex
+        for pattern in compose_file_pattern["required"]:
+            assert re.compile(pattern)
+    
+    def test_backend_resource_uses_backend_anchor(self):
+        """Backend service port anchor must be *backend-port not *frontend-port."""
+        # The bug: backend with port 4004 got *frontend-port because has_frontend=True
+        
+        resource_entry = '''
+  identity-management-backend:
+    labels:
+      - "traefik.http.services.identity-management-backend.loadbalancer.server.port=*backend-port"
+'''
+        # Should have backend-port
+        assert "*backend-port" in resource_entry
+        assert "*frontend-port" not in resource_entry
+    
+    def test_frontend_resource_uses_frontend_anchor(self):
+        """Frontend service port anchor must be *frontend-port not *backend-port."""
+        resource_entry = '''
+  identity-management-frontend:
+    <<: *frontend-memory-limit
+    labels:
+      - "traefik.http.services.identity-management-frontend.loadbalancer.server.port=*frontend-port"
+'''
+        # Should have frontend-port
+        assert "*frontend-port" in resource_entry
+        assert "*backend-port" not in resource_entry
+
+
+class TestGeneratorCallerPatterns:
+    """Test that generator callers use correct argument patterns."""
+    
+    def test_caller_uses_keyword_args_not_positional(self):
+        """Verify all Docker generator callers use keyword arguments."""
+        # This test inspects the source code to ensure keyword args are used
+        
+        orchestrator_dir = Path(__file__).parent.parent.parent / "engine" / "topologies" / "tilt" / "resources" / "orchestrator"
+        
+        if orchestrator_dir.exists():
+            for star_file in orchestrator_dir.glob("*.star"):
+                content = star_file.read_text()
+                
+                # Find all Docker.frontend calls
+                frontend_calls = re.findall(r'Docker\.frontend\([^)]+\)', content)
+                for call in frontend_calls:
+                    # Must use keyword args, not positional
+                    assert "=" in call, f"Docker.frontend call must use keyword args: {call}"
+                
+                # Find all Docker.backend calls
+                backend_calls = re.findall(r'Docker\.backend\([^)]+\)', content)
+                for call in backend_calls:
+                    # Must use keyword args, not positional
+                    assert "=" in call, f"Docker.backend call must use keyword args: {call}"
+    
+    def test_no_bare_boolean_positional_args(self):
+        """Test that bare boolean values aren't passed positionally."""
+        # The bug: Docker.frontend(path, name, True) - True became port!
+        
+        orchestrator_dir = Path(__file__).parent.parent.parent / "engine" / "topologies" / "tilt" / "resources" / "orchestrator"
+        
+        if orchestrator_dir.exists():
+            for star_file in orchestrator_dir.glob("*.star"):
+                content = star_file.read_text()
+                lines = content.split('\n')
+                
+                for i, line in enumerate(lines, 1):
+                    # Look for patterns like: Docker.frontend(path, name, True)
+                    # or Docker.backend(path, name, cmd, True)
+                    suspicious = re.search(
+                        r'Docker\.(frontend|backend|migrator)\([^)]+,\s*(True|False|\d+)\s*\)',
+                        line
+                    )
+                    if suspicious:
+                        # If there's no = before the boolean/number, it's positional
+                        call = suspicious.group(0)
+                        # Count commas before the boolean/number
+                        before_bool = call[:call.rfind(suspicious.group(2))]
+                        if '=' not in before_bool.split('(')[-1]:
+                            pytest.fail(
+                                f"Positional boolean/number in Docker call at {star_file}:{i}: {line.strip()}"
+                            )
+
+
+class TestL2BunDirectoryGuarantee:
+    """Test that l2_deps_manifest always creates /app/node_modules/.bun.
+
+    Regression test for: Bun's isolated linker only creates /app/node_modules/.bun
+    when hoisted packages are present. Without TDK_LICENSE_KEY the Verdaccio
+    private registry is skipped, the public-npm install may not produce that
+    directory, and the subsequent L3 `COPY --link --from=l2_deps_manifest
+    /app/node_modules/.bun` fails with 'not found'.
+    """
+
+    def test_l2_layer_contains_mkdir_bun(self):
+        """l2_dependency_layers.star must guarantee /app/node_modules/.bun exists."""
+        l2_star = (
+            Path(__file__).parent.parent.parent
+            / "engine"
+            / "topologies"
+            / "platform"
+            / "docker"
+            / "layers"
+            / "l2_dependency_layers.star"
+        )
+        assert l2_star.exists(), "l2_dependency_layers.star not found"
+        content = l2_star.read_text()
+        assert "mkdir -p /app/node_modules/.bun" in content, (
+            "l2_dependency_layers.star must emit `RUN mkdir -p /app/node_modules/.bun` "
+            "so L3's COPY --link never fails when Bun skips creating the directory "
+            "(e.g. when TDK_LICENSE_KEY is unset and only public npm packages are installed)."
+        )
+
+    def test_mkdir_comes_after_install_deps(self):
+        """The mkdir must appear AFTER install-deps.sh runs, not before."""
+        l2_star = (
+            Path(__file__).parent.parent.parent
+            / "engine"
+            / "topologies"
+            / "platform"
+            / "docker"
+            / "layers"
+            / "l2_dependency_layers.star"
+        )
+        if not l2_star.exists():
+            pytest.skip("l2_dependency_layers.star not found")
+        content = l2_star.read_text()
+        install_pos = content.find("install-deps.sh")
+        mkdir_pos = content.find("mkdir -p /app/node_modules/.bun")
+        assert install_pos != -1, "install-deps.sh reference not found"
+        assert mkdir_pos != -1, "mkdir -p /app/node_modules/.bun not found"
+        assert mkdir_pos > install_pos, (
+            "mkdir -p /app/node_modules/.bun must appear AFTER install-deps.sh"
+        )
+
+    def test_l3_backend_copies_bun_dir_from_l2(self):
+        """l3_builder_layers.star must copy /app/node_modules/.bun from l2_deps_manifest."""
+        l3_star = (
+            Path(__file__).parent.parent.parent
+            / "engine"
+            / "topologies"
+            / "platform"
+            / "docker"
+            / "layers"
+            / "l3_builder_layers.star"
+        )
+        if not l3_star.exists():
+            pytest.skip("l3_builder_layers.star not found")
+        content = l3_star.read_text()
+        # Both backend and frontend builders copy the .bun dir
+        assert content.count("node_modules/.bun") >= 2, (
+            "Expected at least 2 COPY references to node_modules/.bun in l3_builder_layers.star "
+            "(one for backend builder, one for frontend builder)"
+        )
+        assert "l2_deps_manifest" in content, (
+            "L3 must reference l2_deps_manifest as the source for .bun COPY"
+        )
+
+
+if __name__ == "__main__":
+    pytest.main([__file__, "-v"])

package/tests/tilt-engine/test_docker_prune.py

@@ -0,0 +1,119 @@
+"""
+Tests for safe Docker prune script.
+Tests the volume protection mechanisms.
+"""
+
+import pytest
+import re
+
+
+@pytest.mark.safety
+class TestDockerPrune:
+    """Tests for Docker prune safety."""
+    
+    def test_standard_prune_excludes_verdaccio(self, protected_volumes):
+        """
+        Scenario: Standard prune excludes verdaccio
+        WHEN the script `./scripts/safe-docker-prune.sh standard` runs
+        AND there is a volume named `verdaccio-storage`
+        THEN the volume SHALL NOT be deleted
+        AND it SHALL appear in the "protected volumes" list
+        """
+        volume_name = "verdaccio-storage"
+        
+        is_protected = self._is_volume_protected(volume_name, protected_volumes)
+        
+        assert is_protected, "verdaccio-storage should be protected"
+    
+    def test_full_prune_excludes_infisical(self, protected_volumes):
+        """
+        Scenario: Full prune excludes infisical
+        WHEN the script `./scripts/safe-docker-prune.sh full` runs
+        AND there is a volume named `infisical-db-data`
+        THEN the volume SHALL NOT be deleted
+        AND the script SHALL log "Protected: infisical-db-data"
+        """
+        volume_name = "infisical-db-data"
+        
+        is_protected = self._is_volume_protected(volume_name, protected_volumes)
+        
+        assert is_protected, "infisical-db-data should be protected"
+    
+    def test_pattern_matching_protection(self, protected_volumes):
+        """
+        Scenario: Pattern matching protection
+        WHEN a volume matches patterns `*verdaccio*` or `*infisical*`
+        THEN it SHALL be protected regardless of exact name
+        AND examples like `verdaccio-conf`, `verdaccio-plugins` SHALL be protected
+        """
+        # Test actual protected volumes
+        for volume in protected_volumes:
+            is_protected = self._is_volume_protected(volume, protected_volumes)
+            assert is_protected, f"{volume} should be protected"
+        
+        # Test pattern matching with additional volumes
+        additional_volumes = [
+            "verdaccio-logs",
+            "verdaccio-backup",
+            "infisical-backup",
+        ]
+        
+        for volume in additional_volumes:
+            is_protected = self._is_volume_protected(volume, protected_volumes)
+            assert is_protected, f"{volume} should be protected by pattern matching"
+    
+    def test_listing_protected_volumes(self, protected_volumes):
+        """
+        Scenario: Listing protected volumes
+        WHEN running `docker-protected-volumes` alias
+        THEN it SHALL list all protected volume patterns
+        AND it SHALL show currently matching volumes
+        """
+        # Verify all expected patterns are present
+        expected_volumes = [
+            "verdaccio-storage",
+            "verdaccio-conf",
+            "verdaccio-plugins",
+            "infisical-db-data",
+            "infisical-redis-data"
+        ]
+        
+        for volume in expected_volumes:
+            assert volume in protected_volumes, f"Volume {volume} should be protected"
+        
+        # Verify pattern-based protection works
+        pattern_matches = [v for v in protected_volumes if "verdaccio" in v or "infisical" in v]
+        assert len(pattern_matches) >= 5, "Should have multiple protected volumes"
+    
+    def test_dangerous_command_warning(self):
+        """
+        Scenario: Dangerous command warning
+        WHEN a user runs `docker system prune -a -f --volumes` directly
+        THEN the system SHALL warn (if alias is configured): "DANGER: Will delete protected volumes!"
+        AND it SHALL suggest using the safe script instead
+        """
+        dangerous_command = "docker system prune -a -f --volumes"
+        
+        # Check if command is dangerous
+        is_dangerous = "--volumes" in dangerous_command and "prune" in dangerous_command
+        
+        assert is_dangerous, "Command with --volumes flag should be flagged as dangerous"
+    
+    def _is_volume_protected(self, volume_name: str, protected_patterns: list) -> bool:
+        """Check if volume name matches any protected pattern."""
+        volume_lower = volume_name.lower()
+        
+        # Direct match
+        if volume_name in protected_patterns:
+            return True
+        
+        # Pattern matching: check if any protected pattern appears in the volume name
+        # This handles cases like "verdaccio-logs" matching "verdaccio-storage" pattern
+        for pattern in protected_patterns:
+            pattern_lower = pattern.lower()
+            # Extract the base name (e.g., "verdaccio" from "verdaccio-storage")
+            base_name = pattern_lower.split("-")[0]
+            if base_name in volume_lower:
+                return True
+        
+        return False