@underpostnet/cyberia 3.3.0 → 3.3.76

package/test/{cluster-instances.test.js → integration/infra/3-cluster/cluster-instances.test.js}

@@ -15,9 +15,9 @@ import {
   loadConfInstances,
   loadProjectInstanceEnvBuilder,
   normalizeInstanceTopology,
-} from '../src/server/conf.js';
-import { statusPageAssetPathFactory } from '../src/server/underpost-gateway.js';
-import UnderpostDockerCompose from '../src/cli/docker-compose.js';
+} from '../../../../src/server/runtime/conf.js';
+import { statusPageAssetPathFactory } from '../../../../src/server/network/underpost-gateway.js';
+import UnderpostDockerCompose from '../../../../src/cli/docker-compose.js';
 
 // `clusterInstancesFactory` reads `./engine-private/conf/<deployId>/conf.instances.json`
 // relative to the process cwd, mirroring every other conf loader. engine-private
@@ -61,7 +61,7 @@ const FIXTURES = {
 describe('cluster custom instances', () => {
   const created = [];
 
-  before(() => {
+  beforeAll(() => {
     for (const [deployId, entries] of Object.entries(FIXTURES)) {
       const dir = CONF_DIR(deployId);
       if (fs.existsSync(dir)) throw new Error(`Refusing to write fixtures into an existing deploy: ${dir}`);
@@ -75,7 +75,7 @@ describe('cluster custom instances', () => {
     fs.outputFileSync(`${customComposeDir}/project-router.conf`, 'project-owned\n');
   });
 
-  after(() => {
+  afterAll(() => {
     for (const dir of created) fs.removeSync(dir);
   });
 
@@ -158,12 +158,8 @@ describe('cluster custom instances', () => {
       const hostsPath = `${customComposeDir}/hosts`;
       fs.writeFileSync(hostsPath, '127.0.0.1 localhost\n', 'utf8');
       const options = { path: hostsPath, append: true, blockId: 'fixture-docker-compose' };
-      expect(etcHostFactory(['fixture-client', 'fixture-server', 'fixture-engine'], options).changed).to.equal(
-        true,
-      );
-      expect(etcHostFactory(['fixture-client', 'fixture-server', 'fixture-engine'], options).changed).to.equal(
-        false,
-      );
+      expect(etcHostFactory(['fixture-client', 'fixture-server', 'fixture-engine'], options).changed).to.equal(true);
+      expect(etcHostFactory(['fixture-client', 'fixture-server', 'fixture-engine'], options).changed).to.equal(false);
       const hosts = fs.readFileSync(hostsPath, 'utf8');
       expect(hosts.match(/underpost hosts fixture-docker-compose:begin/g)).to.have.length(1);
       expect(hosts).to.include('127.0.0.1 localhost');
@@ -184,7 +180,7 @@ describe('cluster custom instances', () => {
   it('resolves several instances across several deploys', () => {
     const { byDeployId, unmatched } = clusterInstancesFactory(
       ['dd-fixture-a', 'dd-fixture-b'],
-      'mmo-server+mmo-client+worker',
+      'mmo-server,mmo-client,worker',
     );
     expect(byDeployId['dd-fixture-a'].ids).to.deep.equal(['mmo-server', 'mmo-client']);
     expect(byDeployId['dd-fixture-a'].hosts).to.deep.equal(['server.fixture.test', 'client.fixture.test']);
@@ -207,13 +203,13 @@ describe('cluster custom instances', () => {
   });
 
   it('reports an id no deploy declares instead of silently skipping it', () => {
-    const { byDeployId, unmatched } = clusterInstancesFactory(['dd-fixture-a'], 'mmo-server+nope');
+    const { byDeployId, unmatched } = clusterInstancesFactory(['dd-fixture-a'], 'mmo-server,nope');
     expect(byDeployId['dd-fixture-a'].ids).to.deep.equal(['mmo-server']);
     expect(unmatched).to.deep.equal(['nope']);
   });
 
   it('is a no-op when no instance list is given', () => {
-    for (const list of ['', undefined, '+'])
+    for (const list of ['', undefined, ','])
       expect(clusterInstancesFactory(['dd-fixture-a'], list)).to.deep.equal({
         byDeployId: { 'dd-fixture-a': { ids: [], hosts: [] } },
         unmatched: [],
@@ -311,7 +307,7 @@ describe('cluster custom instances', () => {
   });
 
   describe('cluster gateway bootstrap order', () => {
-    const source = fs.readFileSync(new URL('../src/cli/run.js', import.meta.url), 'utf8');
+    const source = fs.readFileSync(new URL('../../../../src/cli/run.js', import.meta.url), 'utf8');
     const clusterRunner = source.slice(source.indexOf('cluster: async'), source.indexOf("'gateway-status': async"));
 
     it('tests the ingress-only fallback before applying any workload Deployment', () => {

package/test/{deploy-node-placement.test.js → integration/infra/3-cluster/deploy-node-placement.test.js}

@@ -2,7 +2,7 @@
 
 import { expect } from 'chai';
 import fs from 'fs-extra';
-import Underpost from '../src/index.js';
+import Underpost from '../../../../src/index.js';
 
 const deploymentManifest = (nodeName = '') =>
   Underpost.deploy.deploymentYamlPartsFactory({
@@ -29,7 +29,7 @@ describe('deployment node placement', () => {
   });
 
   it('does not restart a controller after node-move patches its pod template', () => {
-    const source = fs.readFileSync(new URL('../src/cli/run.js', import.meta.url), 'utf8');
+    const source = fs.readFileSync(new URL('../../../../src/cli/run.js', import.meta.url), 'utf8');
     const start = source.indexOf("    'node-move':");
     const end = source.indexOf('\n    /**', start);
     const runner = source.slice(start, end);
@@ -38,7 +38,7 @@ describe('deployment node placement', () => {
   });
 
   it('forwards --node-name into live and generated custom-instance manifests', () => {
-    const source = fs.readFileSync(new URL('../src/cli/run.js', import.meta.url), 'utf8');
+    const source = fs.readFileSync(new URL('../../../../src/cli/run.js', import.meta.url), 'utf8');
     const placements = source.match(/nodeName: options\.nodeName\s*\? Underpost\.deploy\.resolveDeployNode/g) || [];
     expect(placements).to.have.length(2);
   });

package/test/integration/infra/3-cluster/docker-compose-stack.test.js

@@ -0,0 +1,313 @@
+'use strict';
+
+import { expect } from 'chai';
+import fs from 'fs-extra';
+import UnderpostDockerCompose from '../../../../src/cli/docker-compose.js';
+import { shellHarness } from '../../../support/shell-harness.js';
+
+// Everything below writes generated artifacts under the engine tree and drives
+// the docker CLI. Both are replaced: an in-memory file table for the artifacts,
+// and the shell harness for the compose invocations.
+const composeFixture = (files = {}) => {
+  const table = new Map(Object.entries(files));
+  const written = new Map();
+  const removed = [];
+  const keys = () => [...table.keys(), ...written.keys()];
+
+  vi.spyOn(fs, 'existsSync').mockImplementation((filePath) => {
+    const key = `${filePath}`;
+    if (removed.includes(key)) return false;
+    return table.has(key) || written.has(key) || keys().some((entry) => entry.startsWith(`${key}/`));
+  });
+  vi.spyOn(fs, 'readFileSync').mockImplementation(
+    (filePath) => table.get(`${filePath}`) ?? written.get(`${filePath}`) ?? '',
+  );
+  vi.spyOn(fs, 'writeFileSync').mockImplementation((filePath, value) => written.set(`${filePath}`, `${value}`));
+  vi.spyOn(fs, 'mkdirpSync').mockImplementation(() => undefined);
+  vi.spyOn(fs, 'copySync').mockImplementation((src, dest) =>
+    written.set(`${dest}`, written.get(`${src}`) ?? table.get(`${src}`) ?? ''),
+  );
+  vi.spyOn(fs, 'removeSync').mockImplementation((filePath) => {
+    written.delete(`${filePath}`);
+    removed.push(`${filePath}`);
+  });
+  return { written, removed };
+};
+
+const relative = (path) => `${path}`.replace(`${process.cwd()}/`, '');
+
+describe('docker compose stack', () => {
+  let harness;
+
+  beforeEach(() => {
+    harness = shellHarness();
+  });
+
+  afterEach(() => {
+    harness.restore();
+    vi.restoreAllMocks();
+  });
+
+  describe('generated artifacts', () => {
+    it('renders the nginx routes, mongo entrypoint, monitoring config and env example', () => {
+      const { written } = composeFixture();
+      UnderpostDockerCompose.generate({});
+      const paths = [...written.keys()].map(relative);
+      expect(paths).to.include('docker/nginx/default.conf');
+      expect(paths).to.include('docker/mongodb/entrypoint.sh');
+      expect(paths).to.include('docker/prometheus/prometheus.yml');
+      expect(paths).to.include('docker/grafana/provisioning/datasources/datasource.yml');
+      expect(paths).to.include('docker/compose.env.example');
+      expect(paths).to.include('docker/compose.app.yml');
+    });
+
+    it('seeds the working env-file from the example only when it is absent', () => {
+      const { written } = composeFixture();
+      UnderpostDockerCompose.generate({});
+      const envPath = [...written.keys()].find((path) => relative(path) === 'docker/compose.env');
+      expect(written.get(envPath)).to.equal(written.get(`${envPath}.example`));
+
+      vi.restoreAllMocks();
+      const existing = composeFixture({ [envPath]: 'DB_PASSWORD=real\n' });
+      UnderpostDockerCompose.generate({});
+      expect(existing.written.has(envPath)).to.equal(false);
+    });
+
+    it('bakes the deploy id and environment into the app command override', () => {
+      const { written } = composeFixture();
+      UnderpostDockerCompose.generate({ deployId: 'dd-core', env: 'production' });
+      const override = written.get([...written.keys()].find((path) => relative(path) === 'docker/compose.app.yml'));
+      expect(override).to.include('dd-core');
+      expect(override).to.include('production');
+    });
+
+    it('self-bootstraps a fresh engine for the default deploy', () => {
+      expect(UnderpostDockerCompose.appCommand().join(' ')).to.include('underpost new engine');
+      expect(UnderpostDockerCompose.appCommand('dd-core', 'production').join(' ')).to.include(
+        'underpost start --build --run dd-core production',
+      );
+    });
+
+    it('honours every generated path override', () => {
+      const { written } = composeFixture();
+      UnderpostDockerCompose.generate({
+        nginxConf: 'custom/nginx.conf',
+        envFile: 'custom/env',
+        appOverride: 'custom/app.yml',
+      });
+      const paths = [...written.keys()].map(relative);
+      expect(paths).to.include('custom/nginx.conf');
+      expect(paths).to.include('custom/env');
+      expect(paths).to.include('custom/app.yml');
+    });
+
+    it('scrapes the app service in the rendered prometheus config', () => {
+      expect(UnderpostDockerCompose.prometheusContent()).to.include('app:4001');
+      expect(UnderpostDockerCompose.grafanaDatasourceContent()).to.include('http://prometheus:9090');
+      expect(UnderpostDockerCompose.envExampleContent()).to.include('=');
+      expect(UnderpostDockerCompose.mongoEntrypointContent()).to.include('BOOTSTRAP_USER_CREATED');
+    });
+
+    // A named workflow is fully owned by its canonical directory: the generic
+    // CLI never writes application-specific content into it.
+    it('uses a custom workflow canonical files as-is', () => {
+      const base = 'engine-private/conf/dd-core/docker-compose/custom';
+      const { written } = composeFixture({
+        [UnderpostDockerCompose.resolve(`${base}/docker-compose.yml`)]: 'services: {}\n',
+        [UnderpostDockerCompose.resolve(`${base}/compose.env`)]: 'FIXTURE=true\n',
+      });
+      UnderpostDockerCompose.generate({ deployId: 'dd-core', dockerComposeId: 'custom' });
+      expect(written.size).to.equal(0);
+    });
+
+    it('names the canonical files a custom workflow is missing', () => {
+      composeFixture();
+      expect(() => UnderpostDockerCompose.generate({ deployId: 'dd-core', dockerComposeId: 'custom' })).to.throw(
+        'missing',
+      );
+    });
+  });
+
+  describe('host installation', () => {
+    it('skips a platform the installer does not target', () => {
+      const previous = Object.getOwnPropertyDescriptor(process, 'platform');
+      Object.defineProperty(process, 'platform', { value: 'darwin', configurable: true });
+      try {
+        UnderpostDockerCompose.install({});
+        expect(harness.calls.length).to.equal(0);
+      } finally {
+        Object.defineProperty(process, 'platform', previous);
+      }
+    });
+
+    it('installs nothing when compose already works', () => {
+      composeFixture({ '/etc/redhat-release': 'Rocky Linux release 9\n' });
+      harness.route({ match: 'docker compose version', code: 0, stdout: 'v2.29.0\n' });
+      UnderpostDockerCompose.install({});
+      expect(harness.ran('dnf -y install docker-ce')).to.equal(false);
+    });
+
+    it('installs the engine and the compose plugin from the official repository', () => {
+      composeFixture({ '/etc/redhat-release': 'Rocky Linux release 9\n' });
+      harness.route({ match: 'docker compose version', code: 1, stdout: '' });
+      UnderpostDockerCompose.install({ user: 'operator' });
+      expect(harness.ran('download.docker.com/linux/rhel/docker-ce.repo')).to.equal(true);
+      expect(harness.ran('dnf -y install docker-ce docker-ce-cli containerd.io')).to.equal(true);
+      expect(harness.ran('systemctl enable --now docker')).to.equal(true);
+      expect(harness.ran('usermod -aG docker operator')).to.equal(true);
+    });
+
+    it('reinstalls under --force and warns on a host that is not RHEL-compatible', () => {
+      composeFixture();
+      harness.route({ match: 'docker compose version', code: 0, stdout: 'v2.29.0\n' });
+      UnderpostDockerCompose.install({ force: true, user: 'root' });
+      expect(harness.ran('dnf -y install docker-ce')).to.equal(true);
+      // root is already privileged; adding it to the group buys nothing.
+      expect(harness.ran('usermod -aG docker')).to.equal(false);
+    });
+  });
+
+  describe('reset', () => {
+    it('tears down containers, volumes and images, then prunes the generated artifacts', () => {
+      const { removed } = composeFixture({
+        [UnderpostDockerCompose.resolve('docker/nginx/default.conf')]: 'server {}\n',
+        [UnderpostDockerCompose.resolve('docker/compose.env')]: 'DB_PASSWORD=real\n',
+      });
+      UnderpostDockerCompose.reset({});
+      expect(harness.ran('down --remove-orphans --volumes --rmi local')).to.equal(true);
+      expect(removed.map(relative)).to.include('docker/nginx/default.conf');
+      // The working env-file holds credentials, so it survives a plain reset.
+      expect(removed.map(relative)).not.to.include('docker/compose.env');
+    });
+
+    it('drops the working env-file too under --force', () => {
+      const { removed } = composeFixture({ [UnderpostDockerCompose.resolve('docker/compose.env')]: 'DB=1\n' });
+      UnderpostDockerCompose.reset({ force: true });
+      expect(removed.map(relative)).to.include('docker/compose.env');
+    });
+
+    it('never prunes the files a custom workflow owns', () => {
+      const base = 'engine-private/conf/dd-core/docker-compose/custom';
+      const { removed } = composeFixture({
+        [UnderpostDockerCompose.resolve(`${base}/docker-compose.yml`)]: 'services: {}\n',
+        [UnderpostDockerCompose.resolve(`${base}/compose.env`)]: 'FIXTURE=true\n',
+      });
+      UnderpostDockerCompose.reset({ deployId: 'dd-core', dockerComposeId: 'custom' });
+      expect(harness.ran('down --remove-orphans')).to.equal(true);
+      expect(removed).to.deep.equal([]);
+    });
+  });
+
+  describe('CLI dispatch', () => {
+    const run = async (target, options) => {
+      composeFixture();
+      await UnderpostDockerCompose.API.callback(target, options);
+    };
+
+    it('brings the stack up when no action flag is given', async () => {
+      await run('', {});
+      expect(harness.ran('up -d')).to.equal(true);
+    });
+
+    it('rebuilds the images when asked to', async () => {
+      await run('', { up: true, build: true });
+      expect(harness.ran('up -d --build')).to.equal(true);
+    });
+
+    // baseCmd conditionally includes the app override, so it has to exist before
+    // the invocation is composed — notably after a reset prunes it.
+    it('regenerates the config before composing the invocation', async () => {
+      const { written } = composeFixture();
+      let generatedBeforeUp = false;
+      harness.route({
+        match: (command) => {
+          if (command.includes('up -d')) generatedBeforeUp = written.size > 0;
+          return false;
+        },
+      });
+      await UnderpostDockerCompose.API.callback('', { up: true });
+      expect(generatedBeforeUp).to.equal(true);
+    });
+
+    it('stops at the install when nothing else was requested', async () => {
+      composeFixture({ '/etc/redhat-release': 'Rocky\n' });
+      harness.route({ match: 'docker compose version', code: 0, stdout: 'v2\n' });
+      await UnderpostDockerCompose.API.callback('', { install: true });
+      expect(harness.ran('up -d')).to.equal(false);
+    });
+
+    it('continues past the install when a lifecycle flag follows it', async () => {
+      composeFixture({ '/etc/redhat-release': 'Rocky\n' });
+      harness.route({ match: 'docker compose version', code: 0, stdout: 'v2\n' });
+      await UnderpostDockerCompose.API.callback('', { install: true, up: true });
+      expect(harness.ran('up -d')).to.equal(true);
+    });
+
+    it('stops at the reset when nothing else was requested', async () => {
+      await run('', { reset: true });
+      expect(harness.ran('up -d')).to.equal(false);
+    });
+
+    it('recreates the stack when a reset is followed by an up', async () => {
+      await run('', { reset: true, up: true });
+      expect(harness.ran('up -d')).to.equal(true);
+    });
+
+    it('routes every remaining lifecycle flag to its compose subcommand', async () => {
+      for (const [options, expected] of [
+        [{ down: true }, 'down --remove-orphans'],
+        [{ down: true, volumes: true }, 'down --remove-orphans --volumes'],
+        [{ restart: true }, 'restart'],
+        [{ build: true }, 'build --no-cache'],
+        [{ pull: true }, 'pull'],
+        [{ logs: true }, 'logs -f --tail=200'],
+        [{ status: true }, 'ps --format'],
+        [{ exec: 'config' }, 'config'],
+      ]) {
+        harness.restore();
+        harness = shellHarness();
+        await run('', options);
+        expect(harness.ran(expected), JSON.stringify(options)).to.equal(true);
+      }
+    });
+
+    it('targets a single service where one is named', async () => {
+      await run('app', { logs: true });
+      expect(harness.ran('logs -f --tail=200 app')).to.equal(true);
+      harness.restore();
+      harness = shellHarness();
+      await run('mongodb', { restart: true });
+      expect(harness.ran('restart mongodb')).to.equal(true);
+    });
+
+    it('opens bash in the app service and sh in every other', async () => {
+      await run('', { shell: true });
+      expect(harness.ran('exec app /bin/bash')).to.equal(true);
+      harness.restore();
+      harness = shellHarness();
+      await run('mongodb', { shell: true });
+      expect(harness.ran('exec mongodb /bin/sh')).to.equal(true);
+    });
+
+    it('writes the config and runs nothing for a bare generate', async () => {
+      await run('', { generate: true });
+      expect(harness.calls.length).to.equal(0);
+    });
+
+    it('fails the process rather than half-applying a broken invocation', async () => {
+      const previousExit = process.exit;
+      let exitCode;
+      process.exit = (code) => {
+        exitCode = code;
+      };
+      try {
+        composeFixture();
+        harness.route({ match: 'up -d', throws: new Error('docker daemon unreachable') });
+        await UnderpostDockerCompose.API.callback('', { up: true });
+        expect(exitCode).to.equal(1);
+      } finally {
+        process.exit = previousExit;
+      }
+    });
+  });
+});

package/test/integration/infra/3-cluster/mongo-express-deploy.test.js

@@ -0,0 +1,156 @@
+'use strict';
+
+import { expect } from 'chai';
+import fs from 'fs-extra';
+// Named import: js-yaml's ESM build exports no default.
+import { load } from 'js-yaml';
+import {
+  MONGO_EXPRESS_BASE_URL,
+  MONGO_EXPRESS_IMAGE,
+  MONGO_EXPRESS_NAME,
+  MONGO_EXPRESS_NODE_PORT,
+  MONGO_EXPRESS_PORT,
+  MONGO_EXPRESS_SECRET_NAME,
+  MONGO_EXPRESS_SERVICE_NAME,
+  mongoAuthEnabledFactory,
+  mongoExpressManifestPathFactory,
+  mongoExpressNodePortManifestFactory,
+  parseMongodArgs,
+} from '../../../../src/db/mongo/MongoExpress.js';
+
+const MONGODB_AUTH_ARGS = load(fs.readFileSync('./manifests/mongodb/statefulset.yaml', 'utf8')).spec.template.spec
+  .containers[0].args;
+const MONGODB_4_4_ARGS = load(fs.readFileSync('./manifests/mongodb-4.4/statefulset.yaml', 'utf8')).spec.template.spec
+  .containers[0].args;
+
+const readYaml = (path) => load(fs.readFileSync(path, 'utf8'));
+const manifestDir = (authEnabled) => mongoExpressManifestPathFactory({ authEnabled });
+const container = (deployment) => deployment.spec.template.spec.containers[0];
+const envEntry = (deployment, name) => container(deployment).env.find((entry) => entry.name === name);
+
+describe('mongo-express auth mode selection', () => {
+  it('reads authentication from the deployed statefulset, not from the invocation flags', () => {
+    // The set that is running decides, whichever flag this invocation carries.
+    expect(mongoAuthEnabledFactory({ args: MONGODB_AUTH_ARGS, options: { mongodb4: true } })).to.equal(true);
+    expect(mongoAuthEnabledFactory({ args: MONGODB_4_4_ARGS, options: { mongodb: true } })).to.equal(false);
+  });
+
+  it('falls back to the flags only when no statefulset is deployed', () => {
+    expect(mongoAuthEnabledFactory({ args: null, options: { mongodb4: true } })).to.equal(false);
+    expect(mongoAuthEnabledFactory({ args: null, options: { mongodb: true } })).to.equal(true);
+    expect(mongoAuthEnabledFactory({})).to.equal(true);
+  });
+
+  it('separates an undeployed statefulset from one that declares no arguments', () => {
+    expect(parseMongodArgs('')).to.equal(null);
+    expect(parseMongodArgs('   ')).to.equal(null);
+    expect(parseMongodArgs('mongodb|--replSet|rs0|--auth|')).to.deep.equal(['--replSet', 'rs0', '--auth']);
+    // An empty vector is a deployed server running on its defaults: no --auth, so no credentials,
+    // and the flags of this invocation do not get to overrule it.
+    expect(mongoAuthEnabledFactory({ args: parseMongodArgs('mongodb|'), options: { mongodb: true } })).to.equal(false);
+    expect(mongoAuthEnabledFactory({ args: parseMongodArgs(''), options: { mongodb: true } })).to.equal(true);
+  });
+
+  it('routes each auth mode to a kustomization that exists', () => {
+    for (const authEnabled of [true, false]) {
+      const path = manifestDir(authEnabled);
+      expect(fs.existsSync(`${path}/kustomization.yaml`), path).to.equal(true);
+    }
+    expect(manifestDir(true)).to.not.equal(manifestDir(false));
+    expect(mongoExpressManifestPathFactory({ underpostRoot: '/npm/underpost', authEnabled: true })).to.equal(
+      '/npm/underpost/manifests/deployment/mongo-express',
+    );
+  });
+});
+
+describe('mongo-express manifests', () => {
+  const base = manifestDir(true);
+  const deployment = readYaml(`${base}/deployment.yaml`);
+  const service = readYaml(`${base}/service.yaml`);
+  const kustomization = readYaml(`${base}/kustomization.yaml`);
+
+  it('projects both credential pairs from the statefulset secret', () => {
+    // The client owns no credential of its own: the same secret the StatefulSet consumes gates
+    // the mongod connection and the UI session.
+    for (const name of [
+      'ME_CONFIG_MONGODB_ADMINUSERNAME',
+      'ME_CONFIG_MONGODB_ADMINPASSWORD',
+      'ME_CONFIG_BASICAUTH_USERNAME',
+      'ME_CONFIG_BASICAUTH_PASSWORD',
+    ]) {
+      const entry = envEntry(deployment, name);
+      expect(entry, name).to.be.an('object');
+      expect(entry.value, name).to.equal(undefined);
+      expect(entry.valueFrom.secretKeyRef.name, name).to.equal(MONGO_EXPRESS_SECRET_NAME);
+      expect(entry.valueFrom.secretKeyRef.key, name).to.be.oneOf(['username', 'password']);
+    }
+  });
+
+  it('targets the in-cluster statefulset identity, which is identical under kind, kubeadm and k3s', () => {
+    expect(envEntry(deployment, 'ME_CONFIG_MONGODB_SERVER').value).to.equal('mongodb-0.mongodb-service');
+    expect(envEntry(deployment, 'ME_CONFIG_MONGODB_PORT').value).to.equal('27017');
+    expect(envEntry(deployment, 'ME_CONFIG_MONGODB_ENABLE_ADMIN').value).to.equal('true');
+    // The deploy surface reports the URL operators open; the manifest decides what it is.
+    expect(envEntry(deployment, 'ME_CONFIG_SITE_BASEURL').value).to.equal(MONGO_EXPRESS_BASE_URL);
+  });
+
+  it('pins the image the pull path preloads', () => {
+    expect(container(deployment).image).to.equal(MONGO_EXPRESS_IMAGE);
+    expect(MONGO_EXPRESS_IMAGE).to.match(/:.+$/);
+  });
+
+  it('keeps the service names and ports the deploy surface reports', () => {
+    expect(deployment.metadata.name).to.equal(MONGO_EXPRESS_NAME);
+    expect(service.metadata.name).to.equal(MONGO_EXPRESS_SERVICE_NAME);
+    expect(service.spec.type).to.equal('ClusterIP');
+    expect(service.spec.ports[0].port).to.equal(MONGO_EXPRESS_PORT);
+    expect(container(deployment).ports[0].containerPort).to.equal(MONGO_EXPRESS_PORT);
+  });
+
+  it('leaves node exposure out of the kustomization', () => {
+    // An admin UI reaches the node network only through `--node-port`.
+    const nodePortManifest = mongoExpressNodePortManifestFactory({});
+    expect(kustomization.resources).to.deep.equal(['deployment.yaml', 'service.yaml']);
+    const nodePortService = readYaml(nodePortManifest);
+    expect(nodePortService.spec.type).to.equal('NodePort');
+    expect(nodePortService.spec.ports[0].nodePort).to.equal(MONGO_EXPRESS_NODE_PORT);
+    expect(nodePortService.spec.selector).to.deep.equal(deployment.spec.selector.matchLabels);
+  });
+
+  it('drops only the credentials a no-auth mongod would reject', () => {
+    const overlay = manifestDir(false);
+    const overlayKustomization = readYaml(`${overlay}/kustomization.yaml`);
+    expect(overlayKustomization.resources).to.deep.equal(['../mongo-express']);
+    const patchPath = `${overlay}/${overlayKustomization.patches[0].path}`;
+    const deleted = readYaml(patchPath)
+      .spec.template.spec.containers[0].env.filter((entry) => entry.$patch === 'delete')
+      .map((entry) => entry.name);
+    expect(deleted).to.deep.equal([
+      'ME_CONFIG_MONGODB_ADMINUSERNAME',
+      'ME_CONFIG_MONGODB_ADMINPASSWORD',
+      'ME_CONFIG_MONGODB_AUTH_DATABASE',
+    ]);
+    // The UI session stays gated: dropping the server credentials must not publish the client.
+    expect(deleted).to.not.include('ME_CONFIG_BASICAUTH_USERNAME');
+    expect(deleted).to.not.include('ME_CONFIG_BASICAUTH_PASSWORD');
+  });
+});
+
+describe('mongo-express cluster wiring', () => {
+  const clusterSource = fs.readFileSync('./src/cli/cluster.js', 'utf8');
+
+  it('registers the flag on the cluster command', () => {
+    expect(fs.readFileSync('./src/cli/index.js', 'utf8')).to.include("'--mongo-express'");
+  });
+
+  it('deploys the client after the statefulset branches', () => {
+    expect(clusterSource).to.include('if (options.mongoExpress)');
+    expect(clusterSource.indexOf('options.mongoExpress')).to.be.greaterThan(clusterSource.indexOf('options.mongodb4'));
+  });
+
+  it('keeps one deploy path shared with the service runner', () => {
+    const runSource = fs.readFileSync('./src/cli/run.js', 'utf8');
+    expect(runSource).to.include('MongoExpress.deploy(');
+    expect(runSource).to.not.include('manifests/deployment/mongo-express/deployment.yaml');
+  });
+});

package/test/integration/infra/4-ingress/api-cross-origin.test.js

@@ -0,0 +1,79 @@
+'use strict';
+
+import { expect } from 'chai';
+import {
+  buildCrudController,
+  serviceHandler,
+  setCrossOriginHeaders,
+} from '../../../../src/server/network/middlewares.js';
+
+// Minimal Express doubles: the middleware only sets headers and sends one JSON envelope.
+const requestFrom = (origin) => ({ query: {}, params: {}, path: '/', headers: origin ? { origin } : {} });
+const responseSpy = () => {
+  const headers = {};
+  const response = {
+    headers,
+    body: undefined,
+    statusCode: 0,
+    set: (key, value) => (headers[key] = value),
+    setHeader: (key, value) => (headers[key] = value),
+    status(code) {
+      this.statusCode = code;
+      return this;
+    },
+    json(body) {
+      this.body = body;
+      return this;
+    },
+  };
+  return response;
+};
+
+const crudService = {
+  get: async () => ({ data: [], total: 0 }),
+  post: async () => ({}),
+  put: async () => ({}),
+  delete: async () => ({}),
+};
+
+describe('public API cross-origin policy', () => {
+  it('answers a browser read with the origin it came from', async () => {
+    // The browser client is served from its own origin: a read without this header arrives with
+    // status 200 and is then discarded by the same-origin policy, which looks like a broken
+    // feature rather than a failed request.
+    const response = responseSpy();
+    await buildCrudController(crudService).get(requestFrom('http://localhost:8082'), response, {});
+    expect(response.headers['Access-Control-Allow-Origin']).to.equal('http://localhost:8082');
+    expect(response.headers['Cross-Origin-Resource-Policy']).to.equal('cross-origin');
+    expect(response.statusCode).to.equal(200);
+    expect(response.body.status).to.equal('success');
+  });
+
+  it('falls back to any origin when the request declares none', async () => {
+    const response = responseSpy();
+    await buildCrudController(crudService).get(requestFrom(), response, {});
+    expect(response.headers['Access-Control-Allow-Origin']).to.equal('*');
+  });
+
+  it('keeps writes same-origin: only reads are public', async () => {
+    const response = responseSpy();
+    await buildCrudController(crudService).post(requestFrom('http://localhost:8082'), response, {});
+    expect(response.headers).to.not.have.property('Access-Control-Allow-Origin');
+  });
+
+  it('carries the same policy on a hand-written read handler', async () => {
+    // `setCrossOriginHeaders` is the one place the policy lives, so a custom route opts in with it
+    // rather than restating the headers.
+    const response = responseSpy();
+    await serviceHandler(async () => ({ ok: true }), { crossOrigin: true })(
+      requestFrom('https://www.cyberiaonline.com'),
+      response,
+      {},
+    );
+    expect(response.headers['Access-Control-Allow-Origin']).to.equal('https://www.cyberiaonline.com');
+
+    const direct = responseSpy();
+    setCrossOriginHeaders(requestFrom('https://www.cyberiaonline.com'), direct);
+    expect(direct.headers).to.deep.equal(response.headers);
+  });
+});