@underpostnet/cyberia 3.3.0 → 3.3.73

package/test/unit/test-tiers.test.js

@@ -0,0 +1,193 @@
+'use strict';
+
+import { expect } from 'chai';
+import fs from 'node:fs';
+import {
+  TEST_TIERS,
+  UNDERPOST_TESTING,
+  coverageIncludeFactory,
+  coverageThresholdFactory,
+  resolveTestSelection,
+  testProjectsFactory,
+  testSuiteNames,
+} from '../../src/server/build/testing.js';
+
+// The table declares every tier the platform ships. A product build slices the
+// tree, so whether a tier's directory is present here is a catalog question,
+// asserted in catalog.test.js — these are about the table itself.
+describe('test tiers', () => {
+  it('names every tier uniquely', () => {
+    const names = TEST_TIERS.map(({ name }) => name);
+    expect(new Set(names).size).to.equal(names.length);
+  });
+
+  it('never leaves a tier on group order 0', () => {
+    // Vitest routes a single-worker project on the default 0 into a bucket it
+    // appends after every ordered group, which would run that tier last.
+    for (const { name, groupOrder } of TEST_TIERS) expect(groupOrder, name).to.be.greaterThan(0);
+  });
+
+  it('declares tiers in the order they run', () => {
+    const orders = TEST_TIERS.map(({ groupOrder }) => groupOrder);
+    expect(orders).to.deep.equal([...orders].sort((a, b) => a - b));
+  });
+
+  it('keeps delegated tiers in the last group', () => {
+    // They run after the Vitest pass, so an earlier group order would describe
+    // an execution order that does not happen.
+    const lastGroup = Math.max(...TEST_TIERS.map(({ groupOrder }) => groupOrder));
+    for (const { name, groupOrder, delegate } of TEST_TIERS) if (delegate) expect(groupOrder, name).to.equal(lastGroup);
+  });
+
+  it('exposes only non-delegated tiers as Vitest projects', () => {
+    const projects = testProjectsFactory().map(({ test }) => test.name);
+    expect(projects).to.deep.equal(TEST_TIERS.filter(({ delegate }) => !delegate).map(({ name }) => name));
+  });
+});
+
+describe('test tier selection', () => {
+  it('runs every tier when nothing is selected', () => {
+    for (const selector of ['', 'all']) {
+      const { projects, runVitest, delegated } = resolveTestSelection(selector);
+      // No explicit project list: Vitest runs them all, and a product build
+      // that strips one must not fail on a name it no longer ships.
+      expect(projects, selector).to.be.empty;
+      expect(runVitest, selector).to.equal(true);
+      expect(
+        delegated.map(({ name }) => name),
+        selector,
+      ).to.deep.equal(TEST_TIERS.filter(({ delegate }) => delegate).map(({ name }) => name));
+    }
+  });
+
+  it('expands a suite into its tiers', () => {
+    expect(resolveTestSelection('infra').projects).to.deep.equal(
+      TEST_TIERS.filter(({ name }) => name.startsWith('infra:')).map(({ name }) => name),
+    );
+  });
+
+  it('skips the Vitest pass when only delegated tiers are selected', () => {
+    const { runVitest, delegated } = resolveTestSelection('contracts');
+    expect(runVitest).to.equal(false);
+    expect(delegated.map(({ name }) => name)).to.deep.equal(['contracts']);
+  });
+
+  it('rejects an unknown selector instead of reporting an empty green run', () => {
+    expect(() => resolveTestSelection('not-a-suite')).to.throw(/unknown suite/);
+  });
+
+  it('offers every suite prefix as a selector', () => {
+    for (const suite of testSuiteNames()) expect(() => resolveTestSelection(suite), suite).to.not.throw();
+  });
+});
+
+describe('delegated tier commands', () => {
+  const delegated = TEST_TIERS.filter(({ delegate }) => delegate);
+
+  it('ships at least one delegated tier to assert against', () => {
+    expect(delegated).to.not.be.empty;
+  });
+
+  it('writes results only when a destination is given', () => {
+    for (const { name, delegate } of delegated) {
+      expect(delegate({}), name).to.not.include('--test-reporter-destination=/');
+      expect(delegate({ resultsPath: '/results/TEST-x.xml' }), name).to.include('/results/TEST-x.xml');
+    }
+  });
+
+  it('passes a name filter through to its runner', () => {
+    for (const { name, delegate } of delegated) expect(delegate({ grep: 'Burning' }), name).to.include('Burning');
+  });
+
+  // Under an outer `npm`, npx resolves the root project as the local prefix and
+  // pulls its own copy of a nested tool from the registry, which Hardhat then
+  // refuses to run as a non-local installation.
+  it('runs nested tooling from the nested install rather than through npx', () => {
+    for (const { name, delegate } of delegated) {
+      expect(delegate({}), name).to.not.match(/\bnpx\b/);
+      expect(delegate({}), name).to.include('./node_modules/.bin/');
+    }
+  });
+
+  // A directory left behind by an interrupted install passes a `-d` probe while
+  // holding none of the binaries the tier runs.
+  it('probes the installed binary before skipping the install', () => {
+    for (const { name, delegate } of delegated)
+      expect(delegate({}), name).to.match(/\[ -x node_modules\/\.bin\/[\w.-]+ \] \|\| npm ci/);
+  });
+});
+
+describe('coverage threshold', () => {
+  it('reports without gating until a run opts in', () => {
+    // A tier selection measures a slice of the tree, so the whole-suite number is
+    // not the bar it should be held to.
+    expect(coverageThresholdFactory({})).to.equal(null);
+    expect(coverageThresholdFactory({ COVERAGE_ENFORCE: '0' })).to.equal(null);
+  });
+
+  it('gates an opted-in run on the shipped threshold', () => {
+    for (const COVERAGE_ENFORCE of ['1', 'true'])
+      expect(coverageThresholdFactory({ COVERAGE_ENFORCE }), COVERAGE_ENFORCE).to.equal(
+        UNDERPOST_TESTING.coverageThreshold,
+      );
+  });
+
+  it('lets a repository ratchet its own bar', () => {
+    expect(coverageThresholdFactory({ COVERAGE_MIN: '25' })).to.equal(25);
+    // An unset repository variable arrives as an empty string, not as absent.
+    expect(coverageThresholdFactory({ COVERAGE_ENFORCE: '1', COVERAGE_MIN: '' })).to.equal(
+      UNDERPOST_TESTING.coverageThreshold,
+    );
+  });
+
+  it('refuses a bar that is not a percentage', () => {
+    for (const COVERAGE_MIN of ['eighty', '-1', '101'])
+      expect(() => coverageThresholdFactory({ COVERAGE_MIN }), COVERAGE_MIN).to.throw('COVERAGE_MIN');
+  });
+});
+
+describe('coverage scope', () => {
+  const vitestTiers = TEST_TIERS.filter(({ delegate }) => !delegate);
+
+  it('makes every Vitest tier accountable for the sources it drives', () => {
+    for (const { name, sources } of vitestTiers) expect(sources, name).to.not.be.empty;
+  });
+
+  it('leaves a delegated tier out of the Vitest report', () => {
+    // Its runner measures its own coverage, and this table only feeds Vitest.
+    for (const { name, sources, delegate } of TEST_TIERS) if (delegate) expect(sources, name).to.equal(undefined);
+  });
+
+  it('points every glob at something this tree ships', () => {
+    // A source that moved leaves the tier silently measuring nothing, which
+    // reads as coverage rather than as the missing measurement it is. A product
+    // build slices the tree, so only tiers it kept are asserted.
+    for (const { name, directory, sources } of vitestTiers) {
+      if (!fs.existsSync(directory)) continue;
+      for (const glob of sources) expect(fs.globSync(glob), `${name}: ${glob}`).to.not.be.empty;
+    }
+  });
+
+  it('measures every tier when the run selects none', () => {
+    const everySource = new Set(vitestTiers.flatMap(({ sources }) => sources));
+    expect(coverageIncludeFactory([])).to.have.members([...everySource]);
+  });
+
+  it('measures only the selected tiers', () => {
+    const unit = TEST_TIERS.find(({ name }) => name === 'unit').sources;
+    for (const argv of [['--project', 'unit'], ['--project=unit']])
+      expect(coverageIncludeFactory(['npx', 'vitest', 'run', ...argv, '--coverage']), argv.join(' ')).to.deep.equal(
+        unit,
+      );
+  });
+
+  it('counts a source two tiers drive once', () => {
+    const include = coverageIncludeFactory(['--project', 'infra:3-cluster', '--project', 'infra:4-ingress']);
+    expect(new Set(include).size).to.equal(include.length);
+    expect(include).to.include('src/server/runtime/conf.js');
+  });
+
+  it('rejects a selection that matches no tier', () => {
+    expect(() => coverageIncludeFactory(['--project', 'not-a-tier'])).to.throw(/unknown suite/);
+  });
+});

package/vitest.config.js

@@ -0,0 +1,58 @@
+import { defineConfig } from 'vitest/config';
+import {
+  UNDERPOST_TESTING,
+  coverageIncludeFactory,
+  coverageThresholdFactory,
+  testProjectsFactory,
+} from './src/server/build/testing.js';
+
+const allureResultsDirectory = process.env[UNDERPOST_TESTING.allureResultsEnvKey];
+const coverageThreshold = coverageThresholdFactory(process.env);
+const coverageInclude = coverageIncludeFactory(process.argv);
+
+// Spread into every tier: a Vitest project inherits nothing from the root
+// `test` block, and only `coverage` and `reporters` are read from it.
+const projectDefaults = {
+  // Mocha's `describe`/`it` and the hooks stay global, so the suites read the
+  // same either side of the migration and carry no runner import.
+  globals: true,
+  environment: 'node',
+  // A tier is only meaningful if its failures are attributable to it, and a
+  // suite that reads `dd.routes` or binds a fixed port cannot share a worker
+  // with another doing the same.
+  fileParallelism: false,
+  ...(allureResultsDirectory ? { setupFiles: ['allure-vitest/setup'] } : {}),
+};
+
+export default defineConfig({
+  test: {
+    reporters: [
+      'default',
+      ...(allureResultsDirectory ? [['allure-vitest/reporter', { resultsDir: allureResultsDirectory }]] : []),
+    ],
+    coverage: {
+      provider: 'v8',
+      reportsDirectory: UNDERPOST_TESTING.coverageDirectory,
+      // `lcov` is what Coveralls ingests, `json` is what a merged multi-job
+      // report is assembled from, `text` is what a local run reads.
+      reporter: ['text', 'lcov', 'json'],
+      // Written even when the run fails: the coverage workflows upload the report
+      // from a job the threshold step is meant to fail, and without it the badge
+      // freezes at the last passing build instead of moving with the tree.
+      reportOnFailure: true,
+      // The tiers in the selection decide what is measured, so a partial run
+      // reports the slice it drives and the whole run reports the whole of it —
+      // rather than every module the CLI barrel drags into a worker on import.
+      include: coverageInclude,
+      // Only the suites themselves: an `include` whitelist already keeps
+      // dependencies, bundles and generated assets out, and a directory pattern
+      // here is not anchored to the root — `test/**` also excluded the API
+      // surfaces named `test`, so the tier covering them reported nothing.
+      exclude: ['**/*.{test,spec}.js'],
+      // Absent unless the run opted in, so a single-tier run reports its slice
+      // instead of failing against a number it never measured.
+      ...(coverageThreshold === null ? {} : { thresholds: { lines: coverageThreshold } }),
+    },
+    projects: testProjectsFactory(projectDefaults),
+  },
+});

package/.nycrc

@@ -1,9 +0,0 @@
-{
-  "exclude": [],
-  "include": ["test"],
-  "output": "reports",
-  "reporter": ["html", "text", "lcov", "text-lcov", "cobertura"],
-  "sourceMap": true,
-  "instrument": true,
-  "all": true
-}

package/deploy/lib/logging.sh

@@ -1,96 +0,0 @@
-# Shared logging helpers for deploy/<deploy-id>/*.sh. Sourced, never executed directly.
-#
-# Deploy script contract:
-# - one run_quiet call per remote command, with its own label
-# - the body lives in main(), invoked on the last line: the first remote command
-#   pulls this repository, rewriting the running script while bash reads it
-#
-# run_quiet hides normal output, prints only `patterns` matches plus the next
-# `lines_after` lines, and returns the command's exit status so `set -e` stops
-# the deployment. On failure it keeps two temp files and prints their paths in
-# red instead of their contents: the command's own stderr (native error message
-# and stack trace) and the full unfiltered log up to the error.
-
-RUN_QUIET_RED=$'\033[0;31m'
-RUN_QUIET_RESET=$'\033[0m'
-
-RUN_QUIET_NODE_NAME=$(hostname 2>/dev/null | tr '[:upper:]' '[:lower:]')
-RUN_QUIET_NODE_TAG=${RUN_QUIET_NODE_NAME:+ [$RUN_QUIET_NODE_NAME]}
-
-run_quiet() {
-    local label="$1"
-    local patterns="$2"
-    local lines_after="$3"
-    shift 3
-    
-    local debug_log
-    local error_log
-    local fifo_dir
-    local filter_pid
-    local stderr_pid
-    local status=0
-    
-    echo "$(date -Is) $RUN_QUIET_NODE_TAG ▶ $label"
-    
-    debug_log=$(mktemp --suffix=.debug.log)
-    error_log=$(mktemp --suffix=.error.log)
-    fifo_dir=$(mktemp -d)
-    mkfifo "$fifo_dir/merged" "$fifo_dir/stderr"
-    
-    # The filter reads the live stream rather than the finished log: a deployment
-    # monitor prints its matches for minutes before exiting, so a pass over the
-    # completed file would show nothing until then. fflush defeats awk's block
-    # buffering, which otherwise withholds matches whenever stdout is a pipe.
-    # awk writes the debug log itself rather than piping through tee, so the
-    # reader stays a single process that a kill can always release.
-    awk \
-    -v pattern="$patterns" \
-    -v lines_after="$lines_after" \
-    -v debug_log="$debug_log" '
-        {
-            print > debug_log
-        }
-        $0 ~ pattern {
-            remaining = lines_after + 1
-        }
-        remaining > 0 {
-            print
-            fflush()
-            remaining--
-        }
-    ' <"$fifo_dir/merged" &
-    filter_pid=$!
-    
-    # stderr is duplicated: on its own for the native error and stack trace, and
-    # into the merged stream so both the debug log and the filter see it in
-    # chronological order with stdout.
-    tee -a "$error_log" <"$fifo_dir/stderr" >"$fifo_dir/merged" &
-    stderr_pid=$!
-    
-    "$@" >"$fifo_dir/merged" 2>"$fifo_dir/stderr" || status=$?
-    
-    # Drain both readers before the paths are printed, or the trace can still be
-    # in flight. Bounded: a command that leaks a child holding a stream open must
-    # not hang the deployment, and by then everything read has been written.
-    run_quiet_drain "$stderr_pid"
-    run_quiet_drain "$filter_pid"
-    rm -rf "$fifo_dir"
-    
-    if [ "$status" -ne 0 ]; then
-        printf '%s✖ %s failed (exit %s)\n  error trace: %s\n  debug log:   %s%s\n' \
-        "$RUN_QUIET_RED" "$label" "$status" "$error_log" "$debug_log" "$RUN_QUIET_RESET" >&2
-        return "$status"
-    fi
-    
-    rm -f "$debug_log" "$error_log"
-    
-    return "$status"
-}
-
-run_quiet_drain() {
-    local pid="$1"
-    
-    timeout 10 tail --pid="$pid" -f /dev/null 2>/dev/null || true
-    kill "$pid" 2>/dev/null || true
-    wait "$pid" 2>/dev/null || true
-}

package/manifests/cronjobs/dd-cron/dd-cron-dns.yaml

@@ -1,48 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: dd-cron-dns
-  namespace: default
-  labels:
-    app: dd-cron-dns
-    managed-by: underpost
-spec:
-  schedule: "* * * * *"
-  concurrencyPolicy: Forbid
-  startingDeadlineSeconds: 200
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 1
-  suspend: false
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: dd-cron-dns
-            managed-by: underpost
-        spec:
-          containers:
-            - name: dd-cron-dns
-              image: underpost/underpost-engine:v3.3.0
-              command:
-                - /bin/sh
-                - -c
-                - >
-                  cd /home/dd/engine &&
-                  node bin env dd-cron production &&
-                  node bin cron dd-cron dns --git --kubeadm 
-              volumeMounts:
-                - mountPath: /home/dd/engine
-                  name: underpost-cron-container-volume
-                - mountPath: /usr/lib/node_modules/underpost
-                  name: underpost-share-env
-          volumes:
-            - hostPath:
-                path: /home/dd/engine
-                type: Directory
-              name: underpost-cron-container-volume
-            - hostPath:
-                path: /root/.nvm/versions/node/v24.15.0/lib/node_modules/underpost
-                type: DirectoryOrCreate
-              name: underpost-share-env
-          restartPolicy: OnFailure

package/manifests/mongodb/pv-pvc.yaml

@@ -1,59 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mongodb-pv-0
-  labels:
-    app: mongodb
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: mongodb-storage-class
-  claimRef:
-    namespace: default
-    name: mongodb-storage-mongodb-0
-  hostPath:
-    path: /data/mongodb/v0
-    type: DirectoryOrCreate
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mongodb-pv-1
-  labels:
-    app: mongodb
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: mongodb-storage-class
-  claimRef:
-    namespace: default
-    name: mongodb-storage-mongodb-1
-  hostPath:
-    path: /data/mongodb/v1
-    type: DirectoryOrCreate
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mongodb-pv-2
-  labels:
-    app: mongodb
-spec:
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: mongodb-storage-class
-  claimRef:
-    namespace: default
-    name: mongodb-storage-mongodb-2
-  hostPath:
-    path: /data/mongodb/v2
-    type: DirectoryOrCreate

package/scripts/coverall-test-cyberia.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -u -o pipefail
-
-EXCLUDES=(
-    --exclude="test/cluster-instances.test.js"
-    --exclude="test/deploy-monitor.test.js"
-    --exclude="test/deploy-node-placement.test.js"
-    --exclude="test/instance-traffic-plan.test.js"
-    --exclude="test/sops-secret-store.test.js"
-    --exclude="test/underpost-gateway.test.js"
-    --exclude="test/underpost-ingress.test.js"
-    --exclude="test/wireguard-edge.test.js"
-)
-
-TESTS=(
-    test/cyberia-instance-conf-defaults.test.js
-    test/cyberia-load.test.js
-    test/object-layer-item-id.test.js
-    test/api.test.js
-    test/crypto.test.js
-    test/shape-generator.test.js
-)
-
-c8 "${EXCLUDES[@]}" mocha "${TESTS[@]}"

package/scripts/coverall-test.sh

@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-set -u -o pipefail
-
-EXCLUDES=(
-    --exclude="test/cyberia-instance-conf-defaults.test.js"
-    --exclude="test/cyberia-load.test.js"
-    --exclude="test/object-layer-item-id.test.js"
-    --exclude="test/api.test.js"
-    --exclude="test/crypto.test.js"
-    --exclude="test/shape-generator.test.js"
-)
-
-TESTS=(
-    test/cluster-instances.test.js
-    test/deploy-monitor.test.js
-    test/deploy-node-placement.test.js
-    test/instance-traffic-plan.test.js
-    test/sops-secret-store.test.js
-    test/underpost-gateway.test.js
-    test/underpost-ingress.test.js
-    test/wireguard-edge.test.js
-)
-
-c8 "${EXCLUDES[@]}" mocha "${TESTS[@]}"

package/scripts/link-local-underpost-cli.sh

@@ -1,6 +0,0 @@
-
-#!/usr/bin/env bash
-set -euo pipefail
-
-cd /home/dd && underpost clone underpostnet/pwa-microservices-template
-cd /home/dd/pwa-microservices-template && npm install && npm link

package/src/api/user/user.build.js

@@ -1,16 +0,0 @@
-import fs from 'fs-extra';
-import { faBase64Png, getBufferPngText } from '../../server/client-icons.js';
-
-process.exit(0);
-
-fs.writeFileSync(
-  './tmp/api-user-invalid-token.png',
-  await getBufferPngText({ text: 'Invalid token', textColor: '#ff0000' }),
-  'utf8',
-);
-fs.writeFileSync(
-  './tmp/api-user-recover.png',
-  Buffer.from(faBase64Png('rotate-left', 50, 50, '#ffffff'), 'base64'),
-  'utf8',
-);
-fs.writeFileSync('./tmp/api-user-check.png', Buffer.from(faBase64Png('check', 50, 50), 'base64'), 'utf8');