@underpostnet/cyberia 3.3.0 → 3.3.73

package/test/{deploy-monitor.test.js → integration/infra/5-observability/deploy-monitor.test.js}

@@ -3,7 +3,7 @@
  * @description End-to-end test of the two-phase deployment readiness contract
  * between the in-pod runtime (`start.js` / `runtime-status.js`) and the CD-runner
  * monitor (`Underpost.monitor.monitorReadyRunner`), exercised as real OS
- * processes coordinating through the shared underpost env file and a real HTTP
+ * processes coordinating through the shared host configuration store and a real HTTP
  * internal status endpoint.
  *
  * Contract under test:
@@ -36,12 +36,12 @@ import fs from 'fs-extra';
 import os from 'node:os';
 import path from 'node:path';
 import { fileURLToPath, pathToFileURL } from 'node:url';
-import Underpost from '../src/index.js';
-import { shellExec } from '../src/server/process.js';
-import { startInternalStatusServer, stopInternalStatusServer } from '../src/server/runtime-status.js';
+import Underpost from '../../../../src/index.js';
+import { shellExec } from '../../../../src/server/runtime/process.js';
+import { startInternalStatusServer, stopInternalStatusServer } from '../../../../src/server/runtime/runtime-status.js';
 
 const node = process.execPath;
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../..');
 
 const DEPLOY_ID = 'dd-test';
 const ENV = 'production';
@@ -54,24 +54,22 @@ const BUILD_STATUS = `${DEPLOY_ID}-${ENV}-build-deployment`;
 const INTERNAL_PORT = 39517; // internal status endpoint (real server bound here)
 const CLOSED_PORT = 39518; // no server — used to force a transport failure
 
-describe('Deploy monitor — two-phase state machine (e2e, real HTTP transport)', function () {
-  this.timeout(60000);
-
+describe('Deploy monitor — two-phase state machine (e2e, real HTTP transport)', { timeout: 60000 }, () => {
   let prevPrefix;
   let tmpPrefix;
   let fakeBinDir;
-  let envFile;
+  let stateFile;
   let monitorScriptPath;
 
-  before(() => {
+  beforeAll(() => {
     prevPrefix = process.env.npm_config_prefix;
     tmpPrefix = fs.mkdtempSync(path.join(os.tmpdir(), 'underpost-e2e-'));
     process.env.npm_config_prefix = tmpPrefix;
 
-    Underpost.env.set('container-status', 'init');
-    Underpost.env.set('start-container-status', '');
+    Underpost.state.set('container-status', 'init');
+    Underpost.state.set('start-container-status', '');
     const npmRoot = shellExec('npm root -g', { stdout: true, silent: true, disableLog: true }).trim();
-    envFile = path.join(npmRoot, 'underpost', '.env');
+    stateFile = path.join(npmRoot, 'underpost', '.state');
 
     process.env.UNDERPOST_INTERNAL_PORT = String(INTERNAL_PORT);
     startInternalStatusServer(INTERNAL_PORT);
@@ -107,7 +105,7 @@ if [[ "$verb" == "port-forward" ]]; then
   exit 0
 fi
 if [[ "$verb" == "exec" ]]; then
-  grep -E '^container-status=' "$UNDERPOST_ENV_FILE" 2>/dev/null | tail -n1 | sed -E 's/^container-status=//'
+  grep -E '^container-status=' "$UNDERPOST_STATE_FILE" 2>/dev/null | tail -n1 | sed -E 's/^container-status=//'
   exit 0
 fi
 exit 0
@@ -135,7 +133,7 @@ try {
     );
   });
 
-  after(async () => {
+  afterAll(async () => {
     await stopInternalStatusServer();
     delete process.env.UNDERPOST_INTERNAL_PORT;
     if (prevPrefix === undefined) delete process.env.npm_config_prefix;
@@ -145,17 +143,17 @@ try {
 
   beforeEach(() => {
     // Deploy in flight: app not yet reporting running.
-    Underpost.env.set('container-status', INIT_STATUS);
+    Underpost.state.set('container-status', INIT_STATUS);
     // start-container-status is unset (empty) — the readinessProbe
     // sees 503 until the start pipeline completes and stamps this key.
-    Underpost.env.set('start-container-status', '');
+    Underpost.state.set('start-container-status', '');
   });
 
   const spawnMonitor = (overrides = {}) =>
     new Promise((resolve) => {
       const envVars = {
         PATH: `${fakeBinDir}:${process.env.PATH}`,
-        UNDERPOST_ENV_FILE: envFile,
+        UNDERPOST_STATE_FILE: stateFile,
         POD_NAME,
         npm_config_prefix: tmpPrefix,
         UNDERPOST_INTERNAL_PORT: String(INTERNAL_PORT),
@@ -178,7 +176,7 @@ try {
     });
 
   it('success (default exec transport): both phases satisfied → monitor exits 0', async () => {
-    Underpost.env.set('container-status', RUNNING_STATUS);
+    Underpost.state.set('container-status', RUNNING_STATUS);
     // start-container-status not needed for monitor (reads container-status);
     // this test exercises the default exec transport path.
     const code = await spawnMonitor({ FAKE_POD_READY: 'True' });
@@ -186,21 +184,21 @@ try {
   });
 
   it('success (opt-in http transport): both phases satisfied → monitor exits 0', async () => {
-    Underpost.env.set('container-status', RUNNING_STATUS);
-    Underpost.env.set('start-container-status', RUNNING_STATUS);
+    Underpost.state.set('container-status', RUNNING_STATUS);
+    Underpost.state.set('start-container-status', RUNNING_STATUS);
     const code = await spawnMonitor({ FAKE_POD_READY: 'True', MON_TRANSPORT: 'http' });
     expect(code).to.equal(0);
   });
 
   it('runtime failure: container-status=error → monitor exits 1', async () => {
     const monitorExit = spawnMonitor({ FAKE_POD_READY: 'True' });
-    Underpost.env.set('container-status', 'error');
+    Underpost.state.set('container-status', 'error');
     expect(await monitorExit).to.equal(1);
   });
 
   it('readiness mismatch: runtime running but pod not Ready → never succeeds (exits 1)', async () => {
     // Phase 2 satisfied, Phase 1 not: success requires BOTH, so it must time out.
-    Underpost.env.set('container-status', RUNNING_STATUS);
+    Underpost.state.set('container-status', RUNNING_STATUS);
     // start-container-status is NOT set — the readinessProbe would fail,
     // but the monitor only checks container-status via exec/http transport.
     const code = await spawnMonitor({ FAKE_POD_READY: 'False', UNDERPOST_MONITOR_MAX_ITERATIONS: '4' });
@@ -208,7 +206,7 @@ try {
   });
 
   it('transport failure (http): endpoint unreachable is never success (exits 1)', async () => {
-    Underpost.env.set('container-status', RUNNING_STATUS);
+    Underpost.state.set('container-status', RUNNING_STATUS);
     const code = await spawnMonitor({
       MON_TRANSPORT: 'http',
       UNDERPOST_INTERNAL_PORT: String(CLOSED_PORT),
@@ -219,7 +217,7 @@ try {
   });
 
   it('timeout: runtime stuck initializing → monitor exits 1', async () => {
-    Underpost.env.set('container-status', INIT_STATUS);
+    Underpost.state.set('container-status', INIT_STATUS);
     // start-container-status remains unset — readinessProbe returns 503
     // (correct, since the runtime is still initializing).
     const code = await spawnMonitor({ FAKE_POD_READY: 'True', UNDERPOST_MONITOR_MAX_ITERATIONS: '4' });
@@ -229,15 +227,15 @@ try {
   it('regression: advanced pod whose runtime status falls back → monitor exits 1', async () => {
     // Pod advances past build, then its reported status regresses (pod restart);
     // the monitor must treat this as a failure rather than wait it out.
-    Underpost.env.set('container-status', INIT_STATUS);
+    Underpost.state.set('container-status', INIT_STATUS);
     const monitorExit = spawnMonitor({ FAKE_POD_READY: 'False', UNDERPOST_MONITOR_MAX_ITERATIONS: '120' });
     await new Promise((r) => setTimeout(r, 1500));
-    Underpost.env.set('container-status', BUILD_STATUS);
+    Underpost.state.set('container-status', BUILD_STATUS);
     expect(await monitorExit).to.equal(1);
   });
 
   it('readinessProbe: start-container-status set → returns 200 (probe passes)', async () => {
-    Underpost.env.set('start-container-status', RUNNING_STATUS);
+    Underpost.state.set('start-container-status', RUNNING_STATUS);
     const res = await fetch(`http://127.0.0.1:${INTERNAL_PORT}/_internal/ready`);
     expect(res.status).to.equal(200);
     const body = await res.json();
@@ -246,7 +244,7 @@ try {
 
   it('readinessProbe: start-container-status unset → returns 503 (probe fails)', async () => {
     // Unset from beforeEach re-stamp; clear it.
-    Underpost.env.set('start-container-status', '');
+    Underpost.state.set('start-container-status', '');
     const res = await fetch(`http://127.0.0.1:${INTERNAL_PORT}/_internal/ready`);
     expect(res.status).to.equal(503);
   });
@@ -254,14 +252,14 @@ try {
   // Custom instances (cyberia-*) gate on K8s Ready and read status via exec;
   // their runtime never stamps `running-deployment` (stays `initializing`).
   it('instance (kubernetes gate + exec): K8s Ready with initializing status → exits 0', async () => {
-    Underpost.env.set('container-status', INIT_STATUS);
+    Underpost.state.set('container-status', INIT_STATUS);
     const code = await spawnMonitor({ FAKE_POD_READY: 'True', MON_READY_GATE: 'kubernetes', MON_TRANSPORT: 'exec' });
     expect(code).to.equal(0);
   });
 
   it('instance (kubernetes gate + exec): container-status=error → exits 1', async () => {
     const monitorExit = spawnMonitor({ FAKE_POD_READY: 'True', MON_READY_GATE: 'kubernetes', MON_TRANSPORT: 'exec' });
-    Underpost.env.set('container-status', 'error');
+    Underpost.state.set('container-status', 'error');
     expect(await monitorExit).to.equal(1);
   });
 });

package/test/integration/infra/5-observability/event-notification.test.js

@@ -0,0 +1,197 @@
+'use strict';
+
+import { expect } from 'chai';
+import { MailerProviderClass } from '../../../../src/mailer/MailerProvider.js';
+import { mailerInterceptorFactory } from '../../../../src/mailer/MailerInterceptor.js';
+import {
+  EVENT_CONF_PATH,
+  assertNotificationRoutes,
+  eventNotificationRoutes,
+} from '../../../../src/server/ops/event-notification.js';
+
+const CONF = {
+  'notification-providers': {
+    'default-cluster-mailer-provider': {
+      type: 'mailer',
+      mailer: {
+        sender: { email: 'env:CLUSTER_MAILER_ADMIN_SENDER_EMAIL', name: 'env:CLUSTER_MAILER_ADMIN_SENDER_NAME' },
+        transport: {
+          host: 'env:CLUSTER_MAILER_SMTP_HOST',
+          port: 'env:CLUSTER_MAILER_SMTP_PORT',
+          secure: 'env:CLUSTER_SMTP_SECURE',
+          auth: { user: 'env:CLUSTER_MAILER_SMTP_AUTH_USER', pass: 'env:CLUSTER_MAILER_SMTP_AUTH_PASS' },
+        },
+      },
+    },
+  },
+  events: {
+    'wireguard-server-down': {
+      notifications: [
+        {
+          'notification-provider-id': 'default-cluster-mailer-provider',
+          payload: { subscribers: [{ email: 'ops@example.com', name: 'Ops' }] },
+        },
+      ],
+    },
+  },
+};
+
+const loadedProviderFactory = async () => {
+  const provider = new MailerProviderClass();
+  await provider.load({
+    id: 'test',
+    sender: { email: 'sender@example.com', name: 'Sender' },
+    transport: { host: 'smtp.example.com', port: 587, secure: false, auth: { user: '', pass: '' } },
+    templates: {},
+  });
+  return provider;
+};
+
+describe('event notification contract', () => {
+  it('resolves a declared route without reading any credential', () => {
+    const [route] = eventNotificationRoutes('wireguard-server-down', CONF);
+    expect(route.error).to.equal(undefined);
+    expect(route.providerId).to.equal('default-cluster-mailer-provider');
+    expect(route.type).to.equal('mailer');
+    expect(route.target).to.equal('smtp (env)');
+    expect(route.recipients).to.deep.equal([
+      { email: 'ops@example.com', name: 'Ops', address: 'Ops <ops@example.com>' },
+    ]);
+  });
+
+  it('reports an event that declares no notification', () => {
+    const [route] = eventNotificationRoutes('wireguard-spoke-down', CONF);
+    expect(route.error).to.include(EVENT_CONF_PATH);
+    expect(route.error).to.include('wireguard-spoke-down');
+  });
+
+  it('reports a route naming an undeclared provider', () => {
+    const conf = {
+      ...CONF,
+      events: { 'x-down': { notifications: [{ 'notification-provider-id': 'ghost', payload: {} }] } },
+    };
+    expect(eventNotificationRoutes('x-down', conf)[0].error).to.include("'ghost' is not declared");
+  });
+
+  it('reports a provider type nothing can deliver', () => {
+    const conf = {
+      'notification-providers': { pager: { type: 'pager' } },
+      events: {
+        'x-down': {
+          notifications: [{ 'notification-provider-id': 'pager', payload: { subscribers: [{ email: 'a@b.com' }] } }],
+        },
+      },
+    };
+    expect(eventNotificationRoutes('x-down', conf)[0].error).to.include(
+      "unsupported notification provider type 'pager'",
+    );
+  });
+
+  it('reports a route with no subscriber to deliver to', () => {
+    const conf = {
+      ...CONF,
+      events: {
+        'x-down': {
+          notifications: [
+            {
+              'notification-provider-id': 'default-cluster-mailer-provider',
+              payload: { subscribers: [{ name: 'Ops' }] },
+            },
+          ],
+        },
+      },
+    };
+    expect(eventNotificationRoutes('x-down', conf)[0].error).to.include('no subscriber with an email');
+  });
+
+  it('refuses detection whose outcome would reach nobody', () => {
+    expect(() => assertNotificationRoutes(eventNotificationRoutes('wireguard-spoke-down', CONF))).to.throw(
+      'notification routes are unresolved',
+    );
+    expect(assertNotificationRoutes(eventNotificationRoutes('wireguard-server-down', CONF))).to.have.lengthOf(1);
+  });
+});
+
+describe('mailer send middleware', () => {
+  it('wraps a delivery in registration order and unregisters on dispose', async () => {
+    const provider = await loadedProviderFactory();
+    const order = [];
+    const dispose = provider.use(async (context, next) => {
+      order.push(`outer:${context.id}`);
+      return await next();
+    });
+    // Suppressing the transport keeps the assertion on ordering, not on SMTP.
+    provider.use(async () => {
+      order.push('inner');
+      return { messageId: 'stub' };
+    });
+
+    const info = await provider.send({ id: 'test', sendOptions: { to: 'a@b.com', subject: 'hi', text: 'hi' } });
+    expect(info).to.deep.equal({ messageId: 'stub' });
+    expect(order).to.deep.equal(['outer:test', 'inner']);
+
+    dispose();
+    order.length = 0;
+    await provider.send({ id: 'test', sendOptions: { to: 'a@b.com', subject: 'hi', text: 'hi' } });
+    expect(order).to.deep.equal(['inner']);
+  });
+
+  it('defaults the sender before any middleware observes the message', async () => {
+    const provider = await loadedProviderFactory();
+    let observed;
+    provider.use(async (context) => {
+      observed = context.sendOptions.from;
+      return { messageId: 'stub' };
+    });
+    await provider.send({ id: 'test', sendOptions: { to: 'a@b.com', subject: 'hi', text: 'hi' } });
+    expect(observed).to.equal('Sender <sender@example.com>');
+  });
+});
+
+describe('mailer interceptor', () => {
+  it('records what was sent and waits for a specific message', async () => {
+    const provider = await loadedProviderFactory();
+    const interceptor = mailerInterceptorFactory({ provider, suppress: true });
+
+    const pending = interceptor.waitFor((message) => message.sendOptions.subject.includes('wireguard-server-down'), {
+      timeoutMs: 2000,
+      intervalMs: 10,
+    });
+    await provider.send({
+      id: 'test',
+      sendOptions: { to: 'ops@example.com', subject: '[underpost] wireguard-server-down — hub — remediated', text: '' },
+    });
+
+    const message = await pending;
+    expect(message.accepted).to.equal(true);
+    expect(message.sendOptions.to).to.equal('ops@example.com');
+    expect(interceptor.messages).to.have.lengthOf(1);
+
+    interceptor.close();
+    provider.use(async () => ({ messageId: 'stub' }));
+    await provider.send({ id: 'test', sendOptions: { to: 'ops@example.com', subject: 'later', text: '' } });
+    expect(interceptor.messages).to.have.lengthOf(1);
+  });
+
+  it('resolves undefined when nothing matching is ever sent', async () => {
+    const provider = await loadedProviderFactory();
+    const interceptor = mailerInterceptorFactory({ provider, suppress: true });
+    const message = await interceptor.waitFor(() => false, { timeoutMs: 60, intervalMs: 10 });
+    interceptor.close();
+    expect(message).to.equal(undefined);
+  });
+});
+
+describe('mailer transport lifecycle', () => {
+  it('releases the instance so a one-shot process can exit', async () => {
+    const provider = await loadedProviderFactory();
+    expect(provider.instance.test).to.be.an('object');
+    expect(provider.close('test')).to.equal(true);
+    expect(provider.instance.test).to.equal(undefined);
+  });
+
+  it('is a no-op for an instance that was never loaded', async () => {
+    const provider = await loadedProviderFactory();
+    expect(provider.close('absent')).to.equal(false);
+  });
+});