@underpostnet/cyberia 3.3.0 → 3.3.76

package/test/unit/execution-profiles.test.js

@@ -0,0 +1,219 @@
+'use strict';
+
+import { expect } from 'chai';
+import {
+  activeExecutionProfile,
+  CAPABILITIES,
+  classifyCommand,
+  cli,
+  EXECUTION_PROFILE_ENV_KEY,
+  EXECUTION_PROFILES,
+  executionDecisionFactory,
+  executionProfileFactory,
+  profileFromOptionsFactory,
+  withExecutionProfile,
+} from '../../src/server/build/execution.js';
+
+describe('command capability classification', () => {
+  it('separates cluster reads from cluster writes', () => {
+    expect(classifyCommand('kubectl get pods')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl describe svc x -n default')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl apply -f manifest.yaml')).to.equal('cluster:write');
+    expect(classifyCommand('kubectl delete secret underpost-config -n default')).to.equal('cluster:write');
+    expect(classifyCommand('kubectl exec pod -- sh -c ls')).to.equal('cluster:write');
+  });
+
+  it('finds the verb past kubectl flags that consume their next token', () => {
+    expect(classifyCommand('kubectl -n default get pods')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl --namespace default --context x get svc')).to.equal('cluster:read');
+    expect(classifyCommand('kubectl -n default apply -f x.yaml')).to.equal('cluster:write');
+  });
+
+  it('treats an unrecognised kubectl verb as a write rather than assuming it is harmless', () => {
+    expect(classifyCommand('kubectl some-future-verb thing')).to.equal('cluster:write');
+  });
+
+  it('classifies through sudo rather than stopping at it', () => {
+    expect(classifyCommand('sudo kubectl apply -f x.yaml')).to.equal('cluster:write');
+    expect(classifyCommand('sudo kubectl get pods')).to.equal('cluster:read');
+    expect(classifyCommand('sudo -u dd kubectl get pods')).to.equal('cluster:read');
+  });
+
+  it('treats an escalated unknown command as a host mutation', () => {
+    expect(classifyCommand('sudo some-vendor-tool --install')).to.equal('host:write');
+    expect(classifyCommand('some-vendor-tool --install')).to.equal('fs');
+  });
+
+  it('takes the most privileged segment of a compound command', () => {
+    expect(classifyCommand('kubectl create secret generic x --dry-run=client -o yaml | kubectl apply -f -')).to.equal(
+      'cluster:write',
+    );
+    expect(classifyCommand('cd /home/dd && git add . && kubectl apply -f x.yaml')).to.equal('cluster:write');
+    expect(classifyCommand('cd /home/dd/cyberia-instances && git status')).to.equal('git');
+  });
+
+  it('reads a heredoc as data, not as a pipeline', () => {
+    const cmd = ["kubectl apply -f - -n default <<'EOF'", 'apiVersion: v1', 'kind: Secret', 'EOF'].join('\n');
+    expect(classifyCommand(cmd)).to.equal('cluster:write');
+  });
+
+  it('classifies host, network and git work distinctly', () => {
+    expect(classifyCommand('sudo dnf install -y cockpit')).to.equal('host:write');
+    expect(classifyCommand('sudo systemctl enable --now cockpit.socket')).to.equal('host:write');
+    expect(classifyCommand('curl https://example.com')).to.equal('net');
+    expect(classifyCommand('git add .')).to.equal('git');
+  });
+
+  it('lets nested engine invocations through so a profile can reach its own stages', () => {
+    expect(classifyCommand('node bin deploy --build-manifest dd development')).to.equal('fs');
+    expect(classifyCommand('cd /x && underpost pull . underpostnet/cyberia-instances')).to.equal('fs');
+  });
+
+  it('never returns a capability outside the declared set', () => {
+    const commands = [
+      '',
+      '   ',
+      'echo hi',
+      'NODE_ENV=production node bin client',
+      'sudo',
+      'kubectl',
+      'helm list -n default',
+      'helm upgrade --install x ./chart',
+    ];
+    for (const cmd of commands) expect(CAPABILITIES).to.include(classifyCommand(cmd));
+  });
+});
+
+describe('execution profiles', () => {
+  it('permits everything under LIVE_CLUSTER', () => {
+    for (const capability of CAPABILITIES) expect(EXECUTION_PROFILES.LIVE_CLUSTER.permits).to.include(capability);
+  });
+
+  it('permits build outputs but no environment mutation under HERMETIC_BUILD', () => {
+    const { permits } = EXECUTION_PROFILES.HERMETIC_BUILD;
+    expect(permits).to.have.members(['fs', 'git']);
+    for (const denied of ['cluster:read', 'cluster:write', 'host:write', 'net']) expect(permits).to.not.include(denied);
+  });
+
+  it('permits nothing under OFFLINE_DRY_RUN', () => {
+    expect(EXECUTION_PROFILES.OFFLINE_DRY_RUN.permits).to.deep.equal([]);
+  });
+
+  it('falls back to the default profile rather than throwing on an unknown name', () => {
+    expect(executionProfileFactory('nope').name).to.equal('LIVE_CLUSTER');
+    expect(executionProfileFactory('').name).to.equal('LIVE_CLUSTER');
+    expect(executionProfileFactory(undefined).name).to.equal('LIVE_CLUSTER');
+  });
+
+  it('accepts a profile name in either kebab or snake form', () => {
+    expect(executionProfileFactory('hermetic-build').name).to.equal('HERMETIC_BUILD');
+    expect(executionProfileFactory('hermetic_build').name).to.equal('HERMETIC_BUILD');
+  });
+});
+
+describe('execution decisions', () => {
+  it('denies cluster work under HERMETIC_BUILD and permits build output', () => {
+    const denied = executionDecisionFactory('kubectl delete secret x -n default', { profile: 'HERMETIC_BUILD' });
+    expect(denied.permitted).to.equal(false);
+    expect(denied.capability).to.equal('cluster:write');
+    expect(denied.neutral).to.equal(true);
+    expect(executionDecisionFactory('git add .', { profile: 'HERMETIC_BUILD' }).permitted).to.equal(true);
+  });
+
+  it('permits the same command under LIVE_CLUSTER', () => {
+    expect(
+      executionDecisionFactory('kubectl delete secret x -n default', { profile: 'LIVE_CLUSTER' }).permitted,
+    ).to.equal(true);
+  });
+
+  it('denies even local work under OFFLINE_DRY_RUN', () => {
+    expect(executionDecisionFactory('echo hi', { profile: 'OFFLINE_DRY_RUN' }).permitted).to.equal(false);
+  });
+});
+
+describe('profile propagation', () => {
+  const originalProfile = process.env[EXECUTION_PROFILE_ENV_KEY];
+
+  afterEach(() => {
+    if (originalProfile === undefined) delete process.env[EXECUTION_PROFILE_ENV_KEY];
+    else process.env[EXECUTION_PROFILE_ENV_KEY] = originalProfile;
+  });
+
+  it('exports the profile to the environment so child processes inherit it', () => {
+    withExecutionProfile('HERMETIC_BUILD', () => {
+      expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal('HERMETIC_BUILD');
+      expect(activeExecutionProfile().name).to.equal('HERMETIC_BUILD');
+    });
+    expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal(originalProfile);
+  });
+
+  it('restores the previous profile when the body throws', () => {
+    expect(() =>
+      withExecutionProfile('OFFLINE_DRY_RUN', () => {
+        throw new Error('stage failed');
+      }),
+    ).to.throw('stage failed');
+    expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal(originalProfile);
+  });
+
+  it('restores the previous profile after an async body settles', async () => {
+    await withExecutionProfile('HERMETIC_BUILD', async () => {
+      expect(activeExecutionProfile().name).to.equal('HERMETIC_BUILD');
+    });
+    expect(process.env[EXECUTION_PROFILE_ENV_KEY]).to.equal(originalProfile);
+  });
+
+  it('nests without leaking the inner profile outward', () => {
+    withExecutionProfile('HERMETIC_BUILD', () => {
+      withExecutionProfile('OFFLINE_DRY_RUN', () => {
+        expect(activeExecutionProfile().name).to.equal('OFFLINE_DRY_RUN');
+      });
+      expect(activeExecutionProfile().name).to.equal('HERMETIC_BUILD');
+    });
+  });
+
+  it('defaults to LIVE_CLUSTER when the environment says nothing', () => {
+    delete process.env[EXECUTION_PROFILE_ENV_KEY];
+    expect(activeExecutionProfile().name).to.equal('LIVE_CLUSTER');
+  });
+});
+
+describe('legacy bypass flag aliases', () => {
+  it('prefers an explicit --profile over every alias', () => {
+    expect(profileFromOptionsFactory({ profile: 'OFFLINE_DRY_RUN', disableUpdateUnderpostConfig: true })).to.equal(
+      'OFFLINE_DRY_RUN',
+    );
+  });
+
+  it('aliases the legacy flag only in the mode where it means the same thing', () => {
+    expect(profileFromOptionsFactory({ disableUpdateUnderpostConfig: true, buildManifest: true })).to.equal(
+      'HERMETIC_BUILD',
+    );
+    // A live deploy carrying the same flag must stay live: it is a step toggle there, and
+    // silently eliding every cluster write would turn the deploy into a no-op.
+    expect(profileFromOptionsFactory({ disableUpdateUnderpostConfig: true })).to.equal('');
+  });
+
+  it('selects nothing when no flag and no profile is given', () => {
+    expect(profileFromOptionsFactory({})).to.equal('');
+    expect(profileFromOptionsFactory()).to.equal('');
+  });
+});
+
+describe('CLI resolution', () => {
+  it('resolves underpost to a runnable command', () => {
+    const resolved = cli();
+    expect(resolved === 'underpost' || /^node \/.+\/bin\/index\.js$/.test(resolved)).to.equal(true);
+  });
+
+  it('re-enters this checkout under local, never a global install', () => {
+    // A globally installed underpost is a different package: resolving to it for a stage
+    // that operates on this working tree runs the wrong code against the right cwd.
+    expect(cli('underpost', { local: true })).to.match(/^node \/.+\/bin\/index\.js$/);
+    expect(cli('underpost', { local: true })).to.not.equal('underpost');
+  });
+
+  it('passes through any other binary name unchanged', () => {
+    expect(cli('kubectl')).to.equal('kubectl');
+  });
+});

package/test/unit/file-reference-registry.test.js

@@ -0,0 +1,141 @@
+'use strict';
+
+/**
+ * @module file-reference-registry.test
+ * @description Covers `src/api/file/file.ref.js`: the mapping of a model to the fields that hold
+ * a File `_id`, and the two deletions built on it. Every writer that removes a document reads
+ * this registry to take the blobs it owned with it, so what is asserted here is what keeps the
+ * File collection free of unreachable documents.
+ *
+ * Uses 'chai' for assertions.
+ */
+
+import { expect } from 'chai';
+import {
+  deleteOwnedFiles,
+  deleteUnreferencedFiles,
+  documentFileIds,
+  fileRefApis,
+  fileRefFields,
+} from '../../src/api/file/file.ref.js';
+
+/** Minimal collection: the helpers only run `find(filter, projection).lean()` and `deleteMany`. */
+const collection = (docs) => ({
+  docs,
+  find(filter) {
+    const clauses = filter.$or ?? [filter];
+    const matched = docs.filter((doc) =>
+      clauses.some((clause) =>
+        Object.entries(clause).every(([field, condition]) => {
+          const value = doc[field];
+          if (value === undefined || value === null) return false;
+          return condition.$in.map(String).includes(String(value));
+        }),
+      ),
+    );
+    return { lean: async () => matched };
+  },
+  async deleteMany({ _id: { $in } }) {
+    const removing = new Set($in.map(String));
+    const before = docs.length;
+    this.docs = docs = docs.filter((doc) => !removing.has(String(doc._id)));
+    return { deletedCount: before - docs.length };
+  },
+});
+
+describe('the File reference registry', () => {
+  it('answers the fields of a registered api and nothing for an unregistered one', () => {
+    expect(fileRefFields('atlas-sprite-sheet')).to.deep.equal(['fileId', 'minifyFileId', 'idlePreviewFileId']);
+    expect(fileRefFields('cyberia-map')).to.deep.equal(['thumbnail', 'preview']);
+    expect(fileRefFields('object-layer')).to.deep.equal([]);
+    expect(fileRefApis()).to.include('cyberia-audio');
+  });
+
+  it('reads ids out of documents by field, skipping the ones that hold none', () => {
+    const docs = [{ fileId: 'a', minifyFileId: 'b' }, { fileId: 'a' }, { minifyFileId: null }];
+    expect(documentFileIds(docs, ['fileId', 'minifyFileId'])).to.deep.equal(['a', 'b']);
+  });
+});
+
+describe('deleting the files a collection owned', () => {
+  it('removes the ids no surviving document holds', async () => {
+    const files = collection([{ _id: 'atlas-1' }, { _id: 'minify-1' }, { _id: 'unrelated' }]);
+    const atlases = collection([]);
+
+    const removed = await deleteOwnedFiles({
+      File: files,
+      Owner: atlases,
+      fields: ['fileId', 'minifyFileId'],
+      ids: ['atlas-1', 'minify-1'],
+    });
+
+    expect(removed).to.equal(2);
+    expect(files.docs.map((doc) => doc._id)).to.deep.equal(['unrelated']);
+  });
+
+  it('keeps an id a survivor still points at', async () => {
+    // Renders are content addressed, so a duplicate document of the same item resolves to the
+    // same File id. Dropping the duplicate must not blind the document that remains.
+    const files = collection([{ _id: 'shared' }, { _id: 'gone' }]);
+    const atlases = collection([{ _id: 'survivor', fileId: 'shared', minifyFileId: null }]);
+
+    const removed = await deleteOwnedFiles({
+      File: files,
+      Owner: atlases,
+      fields: ['fileId', 'minifyFileId'],
+      ids: ['shared', 'gone'],
+    });
+
+    expect(removed).to.equal(1);
+    expect(files.docs.map((doc) => doc._id)).to.deep.equal(['shared']);
+  });
+
+  it('deletes nothing when handed no candidates', async () => {
+    const files = collection([{ _id: 'kept' }]);
+    expect(await deleteOwnedFiles({ File: files, Owner: collection([]), fields: ['fileId'], ids: [] })).to.equal(0);
+    expect(files.docs).to.have.lengthOf(1);
+  });
+});
+
+describe('sweeping files no registered model references', () => {
+  const loadedModels = (overrides = {}) => {
+    const models = Object.fromEntries(fileRefApis().map((api) => [api, collection([])]));
+    return { ...models, ...overrides };
+  };
+
+  it('refuses to delete while a registered api has no model to read', async () => {
+    // An unreadable collection cannot be shown to hold no reference, and a sweep that assumed
+    // otherwise would delete a live blob belonging to another domain.
+    const files = collection([{ _id: 'candidate' }]);
+    const models = loadedModels();
+    delete models.document;
+
+    const result = await deleteUnreferencedFiles({
+      File: files,
+      ids: ['candidate'],
+      getModel: (api) => {
+        if (!models[api]) throw new Error(`Model not loaded: ${api}`);
+        return models[api];
+      },
+    });
+
+    expect(result.skipped).to.equal('document');
+    expect(result.removed).to.equal(0);
+    expect(files.docs).to.have.lengthOf(1);
+  });
+
+  it('deletes only the candidates every model agrees it never references', async () => {
+    const files = collection([{ _id: 'orphan' }, { _id: 'held' }]);
+    const models = loadedModels({ 'cyberia-map': collection([{ _id: 'map', thumbnail: 'held', preview: null }]) });
+
+    const result = await deleteUnreferencedFiles({
+      File: files,
+      ids: ['orphan', 'held'],
+      getModel: (api) => models[api],
+    });
+
+    expect(result.skipped).to.equal('');
+    expect(result.removed).to.equal(1);
+    expect(files.docs.map((doc) => doc._id)).to.deep.equal(['held']);
+  });
+});

package/test/unit/fleet-sync-source.test.js

@@ -0,0 +1,149 @@
+'use strict';
+
+import { expect } from 'chai';
+import Underpost from '../../src/index.js';
+import { hostAddressesFactory } from '../../src/cli/wireguard.js';
+
+const syncPrivateConfMock = vi.hoisted(() => vi.fn());
+vi.mock('../../src/server/runtime/conf.js', async (importOriginal) => ({
+  ...(await importOriginal()),
+  syncPrivateConf: syncPrivateConfMock,
+}));
+
+describe('a fleet command cannot fall back to local execution', () => {
+  it('refuses when a remote target resolved no SSH identity', async () => {
+    let thrown;
+    try {
+      await Underpost.event.runCommand('echo should-not-run', { requireRemote: true, host: '10.0.0.9' });
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown, 'runCommand should have thrown').to.be.an('error');
+    expect(thrown.message).to.include('refusing to run locally');
+  });
+
+  it('still runs locally for remediation, which has no such requirement', async () => {
+    const result = await Underpost.event.runCommand('echo local-remediation-ok', { silent: true });
+    expect(result.ok).to.equal(true);
+    expect(`${result.output}`).to.include('local-remediation-ok');
+  });
+
+  it('runs locally from where it is, when the deploy path is not on this machine', async () => {
+    // A CI container checks the engine out under /__w/<repo>, so entering the deploy path is
+    // impossible there; that chdir failing reported a perfectly runnable command as a failed
+    // remediation.
+    const output = await Underpost.ssh.sshRemoteRunner('echo local-remediation-ok', {
+      cd: '/underpost/absent-deploy-path',
+      remote: false,
+      silent: true,
+    });
+    expect(`${output}`).to.include('local-remediation-ok');
+  });
+});
+
+describe('wireguard sync never switches the checkout it runs from', () => {
+  const originalTargets = Underpost.wireguard.syncTargets;
+  const originalRunCommand = Underpost.event.runCommand;
+  const originalGetDefaultBranch = Underpost.repo.getDefaultBranch;
+
+  afterEach(() => {
+    Underpost.wireguard.syncTargets = originalTargets;
+    Underpost.event.runCommand = originalRunCommand;
+    Underpost.repo.getDefaultBranch = originalGetDefaultBranch;
+    syncPrivateConfMock.mockReset();
+  });
+
+  const stub = (targets) => {
+    const dispatched = [];
+    Underpost.wireguard.syncTargets = () => targets;
+    Underpost.event.runCommand = async (command, options) => {
+      dispatched.push({ host: options.host, requireRemote: options.requireRemote });
+      return { ok: true, output: '' };
+    };
+    return dispatched;
+  };
+
+  // Dispatch fixtures use RFC 5737 documentation addresses on purpose: the guard skips any node
+  // registered at an address this machine holds, so a fixture that names a real fleet address —
+  // the control plane's LAN address, or its 10.0.0.x tunnel address — stops being a remote node
+  // on the very hosts the suite runs on.
+  const remote = { nodeName: 'vultr', user: 'root', host: '203.0.113.10', via: 'root@203.0.113.10:22' };
+
+  it('skips a node registered at an address this machine holds', async () => {
+    // The peer list is keyed by managementHost because it is unique; a hostname is not, and
+    // the control plane and this workstation are both `localhost.localdomain`.
+    const [ownAddress] = [...hostAddressesFactory()];
+    expect(ownAddress, 'this host must have a routable address to exercise the guard').to.be.a('string');
+    const self = { nodeName: 'control', user: 'admin', host: ownAddress, via: 'ssh' };
+    const dispatched = stub([self, remote]);
+
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+
+    expect(dispatched.map(({ host }) => host)).to.deep.equal(['203.0.113.10']);
+  });
+
+  it('skips a target that resolved to local execution', async () => {
+    const local = { nodeName: 'control', user: '', host: '', via: 'local' };
+    const dispatched = stub([local, remote]);
+
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+
+    expect(dispatched).to.have.lengthOf(1);
+    expect(dispatched[0].host).to.equal('203.0.113.10');
+  });
+
+  it('marks every dispatch remote-only', async () => {
+    const dispatched = stub([remote]);
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+    expect(dispatched.every(({ requireRemote }) => requireRemote === true)).to.equal(true);
+  });
+
+  it('fails instead of reporting success when every node is this machine', async () => {
+    stub([{ nodeName: 'control', user: '', host: '', via: 'local' }]);
+    let thrown;
+    try {
+      await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown, 'an all-local selection must not look like a successful sync').to.be.an('error');
+    expect(thrown.message).to.include('sync source');
+  });
+
+  it('still syncs a remote node that merely shares this machine hostname', async () => {
+    // The reported case: the control plane and this workstation are both
+    // `localhost.localdomain`, so the remote one must still be reached, not skipped.
+    const sameName = { nodeName: 'localhost.localdomain', user: 'admin', host: '198.51.100.85', via: 'ssh' };
+    const dispatched = stub([sameName]);
+    await Underpost.wireguard.sync({ cmd: 'echo fleet' });
+    expect(dispatched.map(({ host }) => host)).to.deep.equal(['198.51.100.85']);
+  });
+
+  it('publishes an associated deploy private repo before updating remote nodes', async () => {
+    const order = [];
+    Underpost.repo.getDefaultBranch = () => 'main';
+    Underpost.wireguard.syncTargets = () => [remote];
+    syncPrivateConfMock.mockImplementation((deployId) => order.push(`publish:${deployId}`));
+    Underpost.event.runCommand = async () => {
+      order.push('update');
+      return { ok: true, output: '' };
+    };
+
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine-test-cyberia' });
+
+    expect(order).to.deep.equal(['publish:dd-cyberia', 'update']);
+  });
+
+  it('does not publish a deploy private repo for the base engine, a custom command, or a dry run', async () => {
+    const published = [];
+    Underpost.repo.getDefaultBranch = () => 'main';
+    syncPrivateConfMock.mockImplementation((deployId) => published.push(deployId));
+    stub([remote]);
+
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine' });
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine-cyberia', cmd: 'echo fleet' });
+    await Underpost.wireguard.sync({ repoEngine: 'fixture-org/engine-cyberia', dryRun: true });
+
+    expect(published).to.deep.equal([]);
+  });
+});