@underpostnet/cyberia 3.2.90 → 3.3.73

package/test/unit/execution-profiles.test.js

@@ -0,0 +1,219 @@
+'use strict';
+
+import { expect } from 'chai';
+import {
+  activeExecutionProfile,
+  CAPABILITIES,
+  classifyCommand,
+  cli,
+  EXECUTION_PROFILE_ENV_KEY,
+  EXECUTION_PROFILES,
+  executionDecisionFactory,
+  executionProfileFactory,
+  profileFromOptionsFactory,
+  withExecutionProfile,
+} from '../../src/server/build/execution.js';
+
+describe('command capability classification', () => {
+  it('separates cluster reads from cluster writes', () => {
+    expect(classifyCommand('kubectl get pods')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl describe svc x -n default')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl apply -f manifest.yaml')).to.equal('cluster:write');
+    expect(classifyCommand('kubectl delete secret underpost-config -n default')).to.equal('cluster:write');
+    expect(classifyCommand('kubectl exec pod -- sh -c ls')).to.equal('cluster:write');
+  });
+
+  it('finds the verb past kubectl flags that consume their next token', () => {
+    expect(classifyCommand('kubectl -n default get pods')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl --namespace default --context x get svc')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl -n default apply -f x.yaml')).to.equal('cluster:write');
+  });
+
+  it('treats an unrecognised kubectl verb as a write rather than assuming it is harmless', () => {
+    expect(classifyCommand('kubectl some-future-verb thing')).to.equal('cluster:write');
+  });
+
+  it('classifies through sudo rather than stopping at it', () => {
+    expect(classifyCommand('sudo kubectl apply -f x.yaml')).to.equal('cluster:write');
+    expect(classifyCommand('sudo kubectl get pods')).to.equal('cluster:read');
+    expect(classifyCommand('sudo -u dd kubectl get pods')).to.equal('cluster:read');
+  });
+
+  it('treats an escalated unknown command as a host mutation', () => {
+    expect(classifyCommand('sudo some-vendor-tool --install')).to.equal('host:write');
+    expect(classifyCommand('some-vendor-tool --install')).to.equal('fs');
+  });
+
+  it('takes the most privileged segment of a compound command', () => {
+    expect(classifyCommand('kubectl create secret generic x --dry-run=client -o yaml | kubectl apply -f -')).to.equal(
+      'cluster:write',
+    );
+    expect(classifyCommand('cd /home/dd && git add . && kubectl apply -f x.yaml')).to.equal('cluster:write');
+    expect(classifyCommand('cd /home/dd/cyberia-instances && git status')).to.equal('git');
+  });
+
+  it('reads a heredoc as data, not as a pipeline', () => {
+    const cmd = ["kubectl apply -f - -n default <<'EOF'", 'apiVersion: v1', 'kind: Secret', 'EOF'].join('\n');
+    expect(classifyCommand(cmd)).to.equal('cluster:write');
+  });
+
+  it('classifies host, network and git work distinctly', () => {
+    expect(classifyCommand('sudo dnf install -y cockpit')).to.equal('host:write');
+    expect(classifyCommand('sudo systemctl enable --now cockpit.socket')).to.equal('host:write');
+    expect(classifyCommand('curl https://example.com')).to.equal('net');
+    expect(classifyCommand('git add .')).to.equal('git');
+  });
+
+  it('lets nested engine invocations through so a profile can reach its own stages', () => {
+    expect(classifyCommand('node bin deploy --build-manifest dd development')).to.equal('fs');
+    expect(classifyCommand('cd /x && underpost pull . underpostnet/cyberia-instances')).to.equal('fs');
+  });
+
+  it('never returns a capability outside the declared set', () => {
+    const commands = [
+      '',
+      '   ',
+      'echo hi',
+      'NODE_ENV=production node bin client',
+      'sudo',
+      'kubectl',
+      'helm list -n default',
+      'helm upgrade --install x ./chart',
+    ];
+    for (const cmd of commands) expect(CAPABILITIES).to.include(classifyCommand(cmd));
+  });
+});
+
+describe('execution profiles', () => {
+  it('permits everything under LIVE_CLUSTER', () => {
+    for (const capability of CAPABILITIES) expect(EXECUTION_PROFILES.LIVE_CLUSTER.permits).to.include(capability);
+  });
+
+  it('permits build outputs but no environment mutation under HERMETIC_BUILD', () => {
+    const { permits } = EXECUTION_PROFILES.HERMETIC_BUILD;
+    expect(permits).to.have.members(['fs', 'git']);
+    for (const denied of ['cluster:read', 'cluster:write', 'host:write', 'net']) expect(permits).to.not.include(denied);
+  });
+
+  it('permits nothing under OFFLINE_DRY_RUN', () => {
+    expect(EXECUTION_PROFILES.OFFLINE_DRY_RUN.permits).to.deep.equal([]);
+  });
+
+  it('falls back to the default profile rather than throwing on an unknown name', () => {
+    expect(executionProfileFactory('nope').name).to.equal('LIVE_CLUSTER');
+    expect(executionProfileFactory('').name).to.equal('LIVE_CLUSTER');
+    expect(executionProfileFactory(undefined).name).to.equal('LIVE_CLUSTER');
+  });
+
+  it('accepts a profile name in either kebab or snake form', () => {
+    expect(executionProfileFactory('hermetic-build').name).to.equal('HERMETIC_BUILD');
+    expect(executionProfileFactory('hermetic_build').name).to.equal('HERMETIC_BUILD');
+  });
+});
+
+describe('execution decisions', () => {
+  it('denies cluster work under HERMETIC_BUILD and permits build output', () => {
+    const denied = executionDecisionFactory('kubectl delete secret x -n default', { profile: 'HERMETIC_BUILD' });
+    expect(denied.permitted).to.equal(false);
+    expect(denied.capability).to.equal('cluster:write');
+    expect(denied.neutral).to.equal(true);
+    expect(executionDecisionFactory('git add .', { profile: 'HERMETIC_BUILD' }).permitted).to.equal(true);
+  });
+
+  it('permits the same command under LIVE_CLUSTER', () => {
+    expect(
+      executionDecisionFactory('kubectl delete secret x -n default', { profile: 'LIVE_CLUSTER' }).permitted,
+    ).to.equal(true);
+  });
+
+  it('denies even local work under OFFLINE_DRY_RUN', () => {
+    expect(executionDecisionFactory('echo hi', { profile: 'OFFLINE_DRY_RUN' }).permitted).to.equal(false);
+  });
+});
+
+describe('profile propagation', () => {
+  const originalProfile = process.env[EXECUTION_PROFILE_ENV_KEY];
+
+  afterEach(() => {
+    if (originalProfile === undefined) delete process.env[EXECUTION_PROFILE_ENV_KEY];
+    else process.env[EXECUTION_PROFILE_ENV_KEY] = originalProfile;
+  });
+
+  it('exports the profile to the environment so child processes inherit it', () => {
+    withExecutionProfile('HERMETIC_BUILD', () => {
+      expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal('HERMETIC_BUILD');
+      expect(activeExecutionProfile().name).to.equal('HERMETIC_BUILD');
+    });
+    expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal(originalProfile);
+  });
+
+  it('restores the previous profile when the body throws', () => {
+    expect(() =>
+      withExecutionProfile('OFFLINE_DRY_RUN', () => {
+        throw new Error('stage failed');
+      }),
+    ).to.throw('stage failed');
+    expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal(originalProfile);
+  });
+
+  it('restores the previous profile after an async body settles', async () => {
+    await withExecutionProfile('HERMETIC_BUILD', async () => {
+      expect(activeExecutionProfile().name).to.equal('HERMETIC_BUILD');
+    });
+    expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal(originalProfile);
+  });
+
+  it('nests without leaking the inner profile outward', () => {
+    withExecutionProfile('HERMETIC_BUILD', () => {
+      withExecutionProfile('OFFLINE_DRY_RUN', () => {
+        expect(activeExecutionProfile().name).to.equal('OFFLINE_DRY_RUN');
+      });
+      expect(activeExecutionProfile().name).to.equal('HERMETIC_BUILD');
+    });
+  });
+
+  it('defaults to LIVE_CLUSTER when the environment says nothing', () => {
+    delete process.env[EXECUTION_PROFILE_ENV_KEY];
+    expect(activeExecutionProfile().name).to.equal('LIVE_CLUSTER');
+  });
+});
+
+describe('legacy bypass flag aliases', () => {
+  it('prefers an explicit --profile over every alias', () => {
+    expect(profileFromOptionsFactory({ profile: 'OFFLINE_DRY_RUN', disableUpdateUnderpostConfig: true })).to.equal(
+      'OFFLINE_DRY_RUN',
+    );
+  });
+
+  it('aliases the legacy flag only in the mode where it means the same thing', () => {
+    expect(profileFromOptionsFactory({ disableUpdateUnderpostConfig: true, buildManifest: true })).to.equal(
+      'HERMETIC_BUILD',
+    );
+    // A live deploy carrying the same flag must stay live: it is a step toggle there, and
+    // silently eliding every cluster write would turn the deploy into a no-op.
+    expect(profileFromOptionsFactory({ disableUpdateUnderpostConfig: true })).to.equal('');
+  });
+
+  it('selects nothing when no flag and no profile is given', () => {
+    expect(profileFromOptionsFactory({})).to.equal('');
+    expect(profileFromOptionsFactory()).to.equal('');
+  });
+});
+
+describe('CLI resolution', () => {
+  it('resolves underpost to a runnable command', () => {
+    const resolved = cli();
+    expect(resolved === 'underpost' || /^node \/.+\/bin\/index\.js$/.test(resolved)).to.equal(true);
+  });
+
+  it('re-enters this checkout under local, never a global install', () => {
+    // A globally installed underpost is a different package: resolving to it for a stage
+    // that operates on this working tree runs the wrong code against the right cwd.
+    expect(cli('underpost', { local: true })).to.match(/^node \/.+\/bin\/index\.js$/);
+    expect(cli('underpost', { local: true })).to.not.equal('underpost');
+  });
+
+  it('passes through any other binary name unchanged', () => {
+    expect(cli('kubectl')).to.equal('kubectl');
+  });
+});

package/test/unit/fleet-sync-source.test.js

@@ -0,0 +1,149 @@
+'use strict';
+
+import { expect } from 'chai';
+import Underpost from '../../src/index.js';
+import { hostAddressesFactory } from '../../src/cli/wireguard.js';
+
+const syncPrivateConfMock = vi.hoisted(() => vi.fn());
+vi.mock('../../src/server/runtime/conf.js', async (importOriginal) => ({
+  ...(await importOriginal()),
+  syncPrivateConf: syncPrivateConfMock,
+}));
+
+describe('a fleet command cannot fall back to local execution', () => {
+  it('refuses when a remote target resolved no SSH identity', async () => {
+    let thrown;
+    try {
+      await Underpost.event.runCommand('echo should-not-run', { requireRemote: true, host: '10.0.0.9' });
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown, 'runCommand should have thrown').to.be.an('error');
+    expect(thrown.message).to.include('refusing to run locally');
+  });
+
+  it('still runs locally for remediation, which has no such requirement', async () => {
+    const result = await Underpost.event.runCommand('echo local-remediation-ok', { silent: true });
+    expect(result.ok).to.equal(true);
+    expect(`${result.output}`).to.include('local-remediation-ok');
+  });
+
+  it('runs locally from where it is, when the deploy path is not on this machine', async () => {
+    // A CI container checks the engine out under /__w/<repo>, so entering the deploy path is
+    // impossible there; that chdir failing reported a perfectly runnable command as a failed
+    // remediation.
+    const output = await Underpost.ssh.sshRemoteRunner('echo local-remediation-ok', {
+      cd: '/underpost/absent-deploy-path',
+      remote: false,
+      silent: true,
+    });
+    expect(`${output}`).to.include('local-remediation-ok');
+  });
+});
+
+describe('wireguard sync never switches the checkout it runs from', () => {
+  const originalTargets = Underpost.wireguard.syncTargets;
+  const originalRunCommand = Underpost.event.runCommand;
+  const originalGetDefaultBranch = Underpost.repo.getDefaultBranch;
+
+  afterEach(() => {
+    Underpost.wireguard.syncTargets = originalTargets;
+    Underpost.event.runCommand = originalRunCommand;
+    Underpost.repo.getDefaultBranch = originalGetDefaultBranch;
+    syncPrivateConfMock.mockReset();
+  });
+
+  const stub = (targets) => {
+    const dispatched = [];
+    Underpost.wireguard.syncTargets = () => targets;
+    Underpost.event.runCommand = async (command, options) => {
+      dispatched.push({ host: options.host, requireRemote: options.requireRemote });
+      return { ok: true, output: '' };
+    };
+    return dispatched;
+  };
+
+  // Dispatch fixtures use RFC 5737 documentation addresses on purpose: the guard skips any node
+  // registered at an address this machine holds, so a fixture that names a real fleet address —
+  // the control plane's LAN address, or its 10.0.0.x tunnel address — stops being a remote node
+  // on the very hosts the suite runs on.
+  const remote = { nodeName: 'vultr', user: 'root', host: '203.0.113.10', via: 'root@203.0.113.10:22' };
+
+  it('skips a node registered at an address this machine holds', async () => {
+    // The peer list is keyed by managementHost because it is unique; a hostname is not, and
+    // the control plane and this workstation are both `localhost.localdomain`.
+    const [ownAddress] = [...hostAddressesFactory()];
+    expect(ownAddress, 'this host must have a routable address to exercise the guard').to.be.a('string');
+    const self = { nodeName: 'control', user: 'admin', host: ownAddress, via: 'ssh' };
+    const dispatched = stub([self, remote]);
+
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+
+    expect(dispatched.map(({ host }) => host)).to.deep.equal(['203.0.113.10']);
+  });
+
+  it('skips a target that resolved to local execution', async () => {
+    const local = { nodeName: 'control', user: '', host: '', via: 'local' };
+    const dispatched = stub([local, remote]);
+
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+
+    expect(dispatched).to.have.lengthOf(1);
+    expect(dispatched[0].host).to.equal('203.0.113.10');
+  });
+
+  it('marks every dispatch remote-only', async () => {
+    const dispatched = stub([remote]);
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+    expect(dispatched.every(({ requireRemote }) => requireRemote === true)).to.equal(true);
+  });
+
+  it('fails instead of reporting success when every node is this machine', async () => {
+    stub([{ nodeName: 'control', user: '', host: '', via: 'local' }]);
+    let thrown;
+    try {
+      await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown, 'an all-local selection must not look like a successful sync').to.be.an('error');
+    expect(thrown.message).to.include('sync source');
+  });
+
+  it('still syncs a remote node that merely shares this machine hostname', async () => {
+    // The reported case: the control plane and this workstation are both
+    // `localhost.localdomain`, so the remote one must still be reached, not skipped.
+    const sameName = { nodeName: 'localhost.localdomain', user: 'admin', host: '198.51.100.85', via: 'ssh' };
+    const dispatched = stub([sameName]);
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+    expect(dispatched.map(({ host }) => host)).to.deep.equal(['198.51.100.85']);
+  });
+
+  it('publishes an associated deploy private repo before updating remote nodes', async () => {
+    const order = [];
+    Underpost.repo.getDefaultBranch = () => 'main';
+    Underpost.wireguard.syncTargets = () => [remote];
+    syncPrivateConfMock.mockImplementation((deployId) => order.push(`publish:${deployId}`));
+    Underpost.event.runCommand = async () => {
+      order.push('update');
+      return { ok: true, output: '' };
+    };
+
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine-test-cyberia' });
+
+    expect(order).to.deep.equal(['publish:dd-cyberia', 'update']);
+  });
+
+  it('does not publish a deploy private repo for the base engine, a custom command, or a dry run', async () => {
+    const published = [];
+    Underpost.repo.getDefaultBranch = () => 'main';
+    syncPrivateConfMock.mockImplementation((deployId) => published.push(deployId));
+    stub([remote]);
+
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine' });
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine-cyberia', cmd: 'echo fleet' });
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine-cyberia', dryRun: true });
+
+    expect(published).to.deep.equal([]);
+  });
+});

package/test/unit/logger-redaction.test.js

@@ -0,0 +1,112 @@
+'use strict';
+
+import { expect } from 'chai';
+import { PassThrough } from 'node:stream';
+import winston from 'winston';
+import { loggerFormatFactory, redactSensitiveText, serializeLogValue } from '../../src/server/ops/logger.js';
+
+const renderLog = (message, metadata) => {
+  const stream = new PassThrough();
+  let output = '';
+  stream.on('data', (chunk) => {
+    output += chunk;
+  });
+  const logger = winston.createLogger({
+    format: loggerFormatFactory('logger-redaction.test.js'),
+    transports: [new winston.transports.Stream({ stream })],
+  });
+  metadata === undefined ? logger.info(message) : logger.info(message, metadata);
+  logger.close();
+  return output;
+};
+
+describe('central logger redaction', () => {
+  it('filters common secret forms from free-form messages', () => {
+    const rawToken = `ghp_${'A'.repeat(30)}`;
+    const input = [
+      'node bin host set GITHUB_TOKEN positional-secret',
+      'GITHUB_TOKEN=environment-secret node bin db',
+      'DB_PASS=database-secret',
+      'curl --api-key flag-secret',
+      'Authorization: Bearer bearer-secret',
+      'https://user:url-secret@example.test/repo',
+      '?session_id=query-secret&ok=true',
+      `raw ${rawToken}`,
+      '-----BEGIN PRIVATE KEY-----\nprivate-key-secret\n-----END PRIVATE KEY-----',
+    ].join(' && ');
+    const output = redactSensitiveText(input);
+
+    for (const secret of [
+      'positional-secret',
+      'environment-secret',
+      'database-secret',
+      'flag-secret',
+      'bearer-secret',
+      'url-secret',
+      'query-secret',
+      'private-key-secret',
+      rawToken,
+    ])
+      expect(output).to.not.include(secret);
+    expect(output).to.include('GITHUB_TOKEN=[REDACTED]');
+    expect(output).to.include('https://***@example.test/repo');
+  });
+
+  it('filters nested sensitive fields without mutating the source metadata', () => {
+    const metadata = {
+      githubToken: 'nested-secret',
+      auth: { client_secret: 'client-secret', username: 'operator' },
+      command: 'node bin host set API_KEY command-secret',
+    };
+    metadata.self = metadata;
+    const output = serializeLogValue(metadata);
+
+    expect(output).to.not.include('nested-secret');
+    expect(output).to.not.include('client-secret');
+    expect(output).to.not.include('command-secret');
+    expect(output).to.include('operator');
+    expect(output).to.include('[Circular]');
+    expect(metadata.githubToken).to.equal('nested-secret');
+  });
+
+  it('applies the filter in the formatter used by every logger transport', () => {
+    const output = renderLog('ssh node :: node bin host set GITHUB_TOKEN message-secret', {
+      token_secret: 'metadata-secret',
+      repository: 'https://user:url-secret@example.test/repo',
+    });
+
+    for (const secret of ['message-secret', 'metadata-secret', 'url-secret']) expect(output).to.not.include(secret);
+    expect(output).to.include('[REDACTED]');
+  });
+
+  it('leaves ordinary operational context readable', () => {
+    expect(redactSensitiveText('ssh operator@example.test :: uptime')).to.equal('ssh operator@example.test :: uptime');
+  });
+
+  it('filters Git fetch credentials from plain and escaped URLs', () => {
+    const token = 'opaque-git-credential_123';
+    for (const command of [
+      `GIT_TERMINAL_PROMPT=0 git fetch --force "https://x-access-token:${token}@github.com/o/r" main`,
+      `GIT_TERMINAL_PROMPT=0 git fetch --force "https:\\/\\/x-access-token:${token}@github.com\\/o\\/r" main`,
+      `GIT_TERMINAL_PROMPT=0 git fetch --force "https\\://x-access-token\\:${token}\\@github.com\\/o\\/r" main`,
+      `git fetch x-access-token:${token}@github.com`,
+    ]) {
+      const output = redactSensitiveText(command);
+      expect(output).to.not.include(token);
+      expect(output).to.match(/\*\*\*|\[REDACTED\]/);
+    }
+  });
+
+  it('filters every database password form used by the db workflow', () => {
+    for (const command of [
+      'mariadb -u root -psecret database',
+      'mariadb -u root -p "secret" database',
+      'mariadb-dump --user=root --password=secret database',
+      'mongosh -u root -p "secret"',
+      'mongorestore --username root --password "secret"',
+      'MYSQL_PWD=secret mariadb database',
+      'mongodb://root:secret@mongo/database',
+    ])
+      expect(redactSensitiveText(command), command).to.not.include('secret');
+  });
+});