@underpostnet/cyberia 3.3.73 → 3.3.77

package/test/integration/infra/2-network/wireguard-edge.test.js

@@ -1413,9 +1413,9 @@ describe('engine sync', () => {
     const commands = UnderpostWireguard.API.syncCommands().map((step) => step.command);
     expect(commands.join('\n')).to.not.match(/<[a-z-]+>/);
     expect(commands.some((command) => command.includes('package.sh'))).to.equal(false);
-    expect(commands).to.include('underpost cmt --switch-repo someone/engine --target-branch master');
+    expect(commands).to.include('node bin cmt --switch-repo someone/engine --target-branch master');
     expect(commands).to.include(
-      'underpost cmt ./engine-private --switch-repo someone/engine-private --target-branch main',
+      'node bin cmt ./engine-private --switch-repo someone/engine-private --target-branch main',
     );
   });
 
@@ -1424,9 +1424,9 @@ describe('engine sync', () => {
     const commands = UnderpostWireguard.API.syncCommands({
       repoEngine: 'https://github.com/underpostnet/engine.git',
     }).map((step) => step.command);
-    expect(commands).to.include('underpost cmt --switch-repo underpostnet/engine --target-branch master');
+    expect(commands).to.include('node bin cmt --switch-repo underpostnet/engine --target-branch master');
     expect(commands).to.include(
-      'underpost cmt ./engine-private --switch-repo underpostnet/engine-private --target-branch main',
+      'node bin cmt ./engine-private --switch-repo underpostnet/engine-private --target-branch main',
     );
   });
 
@@ -1436,9 +1436,9 @@ describe('engine sync', () => {
       repoEngine: 'https://github.com/underpostnet/engine.git',
       repoEnginePrivate: 'https://github.com/underposnet/engine-core-private.git',
     }).map((step) => step.command);
-    expect(commands).to.include('underpost cmt --switch-repo underpostnet/engine --target-branch master');
+    expect(commands).to.include('node bin cmt --switch-repo underpostnet/engine --target-branch master');
     expect(commands).to.include(
-      'underpost cmt ./engine-private --switch-repo underposnet/engine-core-private --target-branch main',
+      'node bin cmt ./engine-private --switch-repo underposnet/engine-core-private --target-branch main',
     );
   });
 
@@ -1447,7 +1447,7 @@ describe('engine sync', () => {
     const commands = UnderpostWireguard.API.syncCommands({ cmd: 'uptime, hostname -I' }).map((step) => step.command);
     expect(commands).to.deep.equal(['uptime', 'hostname -I']);
     expect(commands.join('\n')).to.not.match(/<[a-z-]+>/);
-    expect(commands).to.not.include('underpost cmt --switch-repo');
+    expect(commands).to.not.include('node bin cmt --switch-repo');
   });
 
   it('labels a --cmd fleet run as a command, not a sync', () => {
@@ -1462,7 +1462,7 @@ describe('engine sync', () => {
     process.env.GITHUB_USERNAME = 'someone';
     Underpost.repo.getDefaultBranch = () => 'trunk';
     expect(UnderpostWireguard.API.syncCommands().map((step) => step.command)).to.include(
-      'underpost cmt --switch-repo someone/engine --target-branch trunk',
+      'node bin cmt --switch-repo someone/engine --target-branch trunk',
     );
   });
 
@@ -1542,10 +1542,10 @@ describe('engine sync', () => {
     const at = (command) => commands.indexOf(command);
 
     expect(at('node bin host set ENGINE_SRC_REPO underpostnet/engine-test-cyberia')).to.be.greaterThan(
-      at('underpost cmt --switch-repo underpostnet/engine-test-cyberia --target-branch master'),
+      at('node bin cmt --switch-repo underpostnet/engine-test-cyberia --target-branch master'),
     );
     expect(at('node bin host set ENGINE_SRC_PRIVATE_REPO underpostnet/engine-cyberia-private')).to.be.greaterThan(
-      at('underpost cmt --switch-repo underpostnet/engine-test-cyberia --target-branch master'),
+      at('node bin cmt --switch-repo underpostnet/engine-test-cyberia --target-branch master'),
     );
   });
 
@@ -1563,23 +1563,63 @@ describe('engine sync', () => {
   });
 
   it.skipIf(!shipsCyberiaPackageScript)(
-    'runs a deploy package script only when the deploy being synced ships one',
+    'runs a deploy package script when the deploy ships one, and installs the checkout when it does not',
     () => {
       process.env.GITHUB_USERNAME = 'someone';
       const scripts = (repoEngine) =>
-        UnderpostWireguard.API.syncCommands({ repoEngine }).filter((step) => step.command.startsWith('bash '));
+        UnderpostWireguard.API.syncCommands({ repoEngine })
+          .filter((step) => step.command.startsWith('bash '))
+          .map((step) => step.command);
 
-      // Both occurrences or neither: the halting one turns a missing script into a failed sync
-      // rather than a missing install.
-      expect(scripts('underpostnet/engine-test-cyberia').map((step) => step.command)).to.deep.equal([
-        'bash ./deploy/dd-cyberia/package.sh',
-        'bash ./deploy/dd-cyberia/package.sh',
-      ]);
+      expect(scripts('underpostnet/engine-test-cyberia')).to.deep.equal(['bash ./deploy/dd-cyberia/package.sh']);
       expect(scripts('underpostnet/engine-test-absent')).to.deep.equal([]);
       expect(scripts('underpostnet/engine')).to.deep.equal([]);
+
+      // A sync that belongs to no deploy still lands new source, so the install is never dropped
+      // — it falls back to the checkout's own manifest rather than leaving none.
+      const commands = (repoEngine) => UnderpostWireguard.API.syncCommands({ repoEngine }).map((step) => step.command);
+      expect(commands('underpostnet/engine')).to.include('npm install');
+      expect(commands('underpostnet/engine-test-cyberia')).to.not.include('npm install');
     },
   );
 
+  it('installs after the source switch with no CLI step in between', () => {
+    process.env.GITHUB_USERNAME = 'someone';
+    // Regression: the conf switch sat between the source switch and the install, so it ran the
+    // freshly landed source against the previous `node_modules` and died importing a dependency
+    // that switch had just added. Every step here is the node's own CLI, so none of them may
+    // observe a checkout whose packages predate it.
+    for (const repoEngine of ['underpostnet/engine', 'underpostnet/engine-test-cyberia']) {
+      const commands = UnderpostWireguard.API.syncCommands({ repoEngine, nodeRole: 'control' }).map(
+        (step) => step.command,
+      );
+      const switchAt = commands.findIndex(
+        (command) => command.startsWith('node bin cmt --switch-repo') && !command.includes('./engine-private'),
+      );
+      const installAt = commands.findIndex(
+        (command, index) => index > switchAt && (command.startsWith('bash ') || command === 'npm install'),
+      );
+
+      expect(switchAt, repoEngine).to.be.greaterThan(-1);
+      expect(installAt, repoEngine).to.equal(switchAt + 1);
+      // The conf switch has to precede it, since the install reads the manifest that switch lands.
+      expect(
+        commands.findIndex((command) => command.includes('./engine-private --switch-repo')),
+        repoEngine,
+      ).to.be.lessThan(switchAt);
+    }
+  });
+
+  it('restores the checkout manifest before the bootstrap install', () => {
+    process.env.GITHUB_USERNAME = 'someone';
+    // A previous sync left the deploy manifest copied over ./package.json, so installing without
+    // restoring it reinstalls the previous scope and leaves the CLI unable to load new source.
+    const commands = UnderpostWireguard.API.syncCommands().map((step) => step.command);
+    expect(commands[0]).to.equal('git checkout -- package.json; npm install');
+    // Sequenced, not chained: a tree that is not a repository still has to reach the install.
+    expect(commands[0]).to.not.include('&&');
+  });
+
   it('neutralizes advisory steps in place and chains the rest', () => {
     process.env.GITHUB_USERNAME = 'someone';
     const script = UnderpostWireguard.API.syncScript();

package/test/integration/infra/3-cluster/mongo-express-deploy.test.js

@@ -0,0 +1,156 @@
+'use strict';
+
+import { expect } from 'chai';
+import fs from 'fs-extra';
+// Named import: js-yaml's ESM build exports no default.
+import { load } from 'js-yaml';
+import {
+  MONGO_EXPRESS_BASE_URL,
+  MONGO_EXPRESS_IMAGE,
+  MONGO_EXPRESS_NAME,
+  MONGO_EXPRESS_NODE_PORT,
+  MONGO_EXPRESS_PORT,
+  MONGO_EXPRESS_SECRET_NAME,
+  MONGO_EXPRESS_SERVICE_NAME,
+  mongoAuthEnabledFactory,
+  mongoExpressManifestPathFactory,
+  mongoExpressNodePortManifestFactory,
+  parseMongodArgs,
+} from '../../../../src/db/mongo/MongoExpress.js';
+
+const MONGODB_AUTH_ARGS = load(fs.readFileSync('./manifests/mongodb/statefulset.yaml', 'utf8')).spec.template.spec
+  .containers[0].args;
+const MONGODB_4_4_ARGS = load(fs.readFileSync('./manifests/mongodb-4.4/statefulset.yaml', 'utf8')).spec.template.spec
+  .containers[0].args;
+
+const readYaml = (path) => load(fs.readFileSync(path, 'utf8'));
+const manifestDir = (authEnabled) => mongoExpressManifestPathFactory({ authEnabled });
+const container = (deployment) => deployment.spec.template.spec.containers[0];
+const envEntry = (deployment, name) => container(deployment).env.find((entry) => entry.name === name);
+
+describe('mongo-express auth mode selection', () => {
+  it('reads authentication from the deployed statefulset, not from the invocation flags', () => {
+    // The set that is running decides, whichever flag this invocation carries.
+    expect(mongoAuthEnabledFactory({ args: MONGODB_AUTH_ARGS, options: { mongodb4: true } })).to.equal(true);
+    expect(mongoAuthEnabledFactory({ args: MONGODB_4_4_ARGS, options: { mongodb: true } })).to.equal(false);
+  });
+
+  it('falls back to the flags only when no statefulset is deployed', () => {
+    expect(mongoAuthEnabledFactory({ args: null, options: { mongodb4: true } })).to.equal(false);
+    expect(mongoAuthEnabledFactory({ args: null, options: { mongodb: true } })).to.equal(true);
+    expect(mongoAuthEnabledFactory({})).to.equal(true);
+  });
+
+  it('separates an undeployed statefulset from one that declares no arguments', () => {
+    expect(parseMongodArgs('')).to.equal(null);
+    expect(parseMongodArgs('   ')).to.equal(null);
+    expect(parseMongodArgs('mongodb|--replSet|rs0|--auth|')).to.deep.equal(['--replSet', 'rs0', '--auth']);
+    // An empty vector is a deployed server running on its defaults: no --auth, so no credentials,
+    // and the flags of this invocation do not get to overrule it.
+    expect(mongoAuthEnabledFactory({ args: parseMongodArgs('mongodb|'), options: { mongodb: true } })).to.equal(false);
+    expect(mongoAuthEnabledFactory({ args: parseMongodArgs(''), options: { mongodb: true } })).to.equal(true);
+  });
+
+  it('routes each auth mode to a kustomization that exists', () => {
+    for (const authEnabled of [true, false]) {
+      const path = manifestDir(authEnabled);
+      expect(fs.existsSync(`${path}/kustomization.yaml`), path).to.equal(true);
+    }
+    expect(manifestDir(true)).to.not.equal(manifestDir(false));
+    expect(mongoExpressManifestPathFactory({ underpostRoot: '/npm/underpost', authEnabled: true })).to.equal(
+      '/npm/underpost/manifests/deployment/mongo-express',
+    );
+  });
+});
+
+describe('mongo-express manifests', () => {
+  const base = manifestDir(true);
+  const deployment = readYaml(`${base}/deployment.yaml`);
+  const service = readYaml(`${base}/service.yaml`);
+  const kustomization = readYaml(`${base}/kustomization.yaml`);
+
+  it('projects both credential pairs from the statefulset secret', () => {
+    // The client owns no credential of its own: the same secret the StatefulSet consumes gates
+    // the mongod connection and the UI session.
+    for (const name of [
+      'ME_CONFIG_MONGODB_ADMINUSERNAME',
+      'ME_CONFIG_MONGODB_ADMINPASSWORD',
+      'ME_CONFIG_BASICAUTH_USERNAME',
+      'ME_CONFIG_BASICAUTH_PASSWORD',
+    ]) {
+      const entry = envEntry(deployment, name);
+      expect(entry, name).to.be.an('object');
+      expect(entry.value, name).to.equal(undefined);
+      expect(entry.valueFrom.secretKeyRef.name, name).to.equal(MONGO_EXPRESS_SECRET_NAME);
+      expect(entry.valueFrom.secretKeyRef.key, name).to.be.oneOf(['username', 'password']);
+    }
+  });
+
+  it('targets the in-cluster statefulset identity, which is identical under kind, kubeadm and k3s', () => {
+    expect(envEntry(deployment, 'ME_CONFIG_MONGODB_SERVER').value).to.equal('mongodb-0.mongodb-service');
+    expect(envEntry(deployment, 'ME_CONFIG_MONGODB_PORT').value).to.equal('27017');
+    expect(envEntry(deployment, 'ME_CONFIG_MONGODB_ENABLE_ADMIN').value).to.equal('true');
+    // The deploy surface reports the URL operators open; the manifest decides what it is.
+    expect(envEntry(deployment, 'ME_CONFIG_SITE_BASEURL').value).to.equal(MONGO_EXPRESS_BASE_URL);
+  });
+
+  it('pins the image the pull path preloads', () => {
+    expect(container(deployment).image).to.equal(MONGO_EXPRESS_IMAGE);
+    expect(MONGO_EXPRESS_IMAGE).to.match(/:.+$/);
+  });
+
+  it('keeps the service names and ports the deploy surface reports', () => {
+    expect(deployment.metadata.name).to.equal(MONGO_EXPRESS_NAME);
+    expect(service.metadata.name).to.equal(MONGO_EXPRESS_SERVICE_NAME);
+    expect(service.spec.type).to.equal('ClusterIP');
+    expect(service.spec.ports[0].port).to.equal(MONGO_EXPRESS_PORT);
+    expect(container(deployment).ports[0].containerPort).to.equal(MONGO_EXPRESS_PORT);
+  });
+
+  it('leaves node exposure out of the kustomization', () => {
+    // An admin UI reaches the node network only through `--node-port`.
+    const nodePortManifest = mongoExpressNodePortManifestFactory({});
+    expect(kustomization.resources).to.deep.equal(['deployment.yaml', 'service.yaml']);
+    const nodePortService = readYaml(nodePortManifest);
+    expect(nodePortService.spec.type).to.equal('NodePort');
+    expect(nodePortService.spec.ports[0].nodePort).to.equal(MONGO_EXPRESS_NODE_PORT);
+    expect(nodePortService.spec.selector).to.deep.equal(deployment.spec.selector.matchLabels);
+  });
+
+  it('drops only the credentials a no-auth mongod would reject', () => {
+    const overlay = manifestDir(false);
+    const overlayKustomization = readYaml(`${overlay}/kustomization.yaml`);
+    expect(overlayKustomization.resources).to.deep.equal(['../mongo-express']);
+    const patchPath = `${overlay}/${overlayKustomization.patches[0].path}`;
+    const deleted = readYaml(patchPath)
+      .spec.template.spec.containers[0].env.filter((entry) => entry.$patch === 'delete')
+      .map((entry) => entry.name);
+    expect(deleted).to.deep.equal([
+      'ME_CONFIG_MONGODB_ADMINUSERNAME',
+      'ME_CONFIG_MONGODB_ADMINPASSWORD',
+      'ME_CONFIG_MONGODB_AUTH_DATABASE',
+    ]);
+    // The UI session stays gated: dropping the server credentials must not publish the client.
+    expect(deleted).to.not.include('ME_CONFIG_BASICAUTH_USERNAME');
+    expect(deleted).to.not.include('ME_CONFIG_BASICAUTH_PASSWORD');
+  });
+});
+
+describe('mongo-express cluster wiring', () => {
+  const clusterSource = fs.readFileSync('./src/cli/cluster.js', 'utf8');
+
+  it('registers the flag on the cluster command', () => {
+    expect(fs.readFileSync('./src/cli/index.js', 'utf8')).to.include("'--mongo-express'");
+  });
+
+  it('deploys the client after the statefulset branches', () => {
+    expect(clusterSource).to.include('if (options.mongoExpress)');
+    expect(clusterSource.indexOf('options.mongoExpress')).to.be.greaterThan(clusterSource.indexOf('options.mongodb4'));
+  });
+
+  it('keeps one deploy path shared with the service runner', () => {
+    const runSource = fs.readFileSync('./src/cli/run.js', 'utf8');
+    expect(runSource).to.include('MongoExpress.deploy(');
+    expect(runSource).to.not.include('manifests/deployment/mongo-express/deployment.yaml');
+  });
+});

package/test/integration/infra/4-ingress/api-cross-origin.test.js

@@ -0,0 +1,79 @@
+'use strict';
+
+import { expect } from 'chai';
+import {
+  buildCrudController,
+  serviceHandler,
+  setCrossOriginHeaders,
+} from '../../../../src/server/network/middlewares.js';
+
+// Minimal Express doubles: the middleware only sets headers and sends one JSON envelope.
+const requestFrom = (origin) => ({ query: {}, params: {}, path: '/', headers: origin ? { origin } : {} });
+const responseSpy = () => {
+  const headers = {};
+  const response = {
+    headers,
+    body: undefined,
+    statusCode: 0,
+    set: (key, value) => (headers[key] = value),
+    setHeader: (key, value) => (headers[key] = value),
+    status(code) {
+      this.statusCode = code;
+      return this;
+    },
+    json(body) {
+      this.body = body;
+      return this;
+    },
+  };
+  return response;
+};
+
+const crudService = {
+  get: async () => ({ data: [], total: 0 }),
+  post: async () => ({}),
+  put: async () => ({}),
+  delete: async () => ({}),
+};
+
+describe('public API cross-origin policy', () => {
+  it('answers a browser read with the origin it came from', async () => {
+    // The browser client is served from its own origin: a read without this header arrives with
+    // status 200 and is then discarded by the same-origin policy, which looks like a broken
+    // feature rather than a failed request.
+    const response = responseSpy();
+    await buildCrudController(crudService).get(requestFrom('http://localhost:8082'), response, {});
+    expect(response.headers['Access-Control-Allow-Origin']).to.equal('http://localhost:8082');
+    expect(response.headers['Cross-Origin-Resource-Policy']).to.equal('cross-origin');
+    expect(response.statusCode).to.equal(200);
+    expect(response.body.status).to.equal('success');
+  });
+
+  it('falls back to any origin when the request declares none', async () => {
+    const response = responseSpy();
+    await buildCrudController(crudService).get(requestFrom(), response, {});
+    expect(response.headers['Access-Control-Allow-Origin']).to.equal('*');
+  });
+
+  it('keeps writes same-origin: only reads are public', async () => {
+    const response = responseSpy();
+    await buildCrudController(crudService).post(requestFrom('http://localhost:8082'), response, {});
+    expect(response.headers).to.not.have.property('Access-Control-Allow-Origin');
+  });
+
+  it('carries the same policy on a hand-written read handler', async () => {
+    // `setCrossOriginHeaders` is the one place the policy lives, so a custom route opts in with it
+    // rather than restating the headers.
+    const response = responseSpy();
+    await serviceHandler(async () => ({ ok: true }), { crossOrigin: true })(
+      requestFrom('https://www.cyberiaonline.com'),
+      response,
+      {},
+    );
+    expect(response.headers['Access-Control-Allow-Origin']).to.equal('https://www.cyberiaonline.com');
+
+    const direct = responseSpy();
+    setCrossOriginHeaders(requestFrom('https://www.cyberiaonline.com'), direct);
+    expect(direct.headers).to.deep.equal(response.headers);
+  });
+});

package/test/integration/infra/4-ingress/underpost-ingress.test.js

@@ -263,7 +263,7 @@ describe('shared ingress front', () => {
       );
       const testCandidate = install.indexOf("execIngress('nginx -t -c /tmp/nginx.candidate.conf'");
       const reload = install.indexOf('nginx -s reload -c /tmp/nginx.conf', testCandidate);
-      const persist = install.indexOf("shellExec(`kubectl apply -f - -n ${namespace} <<'EOF'", reload);
+      const persist = install.indexOf("`kubectl apply -f - -n ${namespace} <<'EOF'", reload);
       expect(testCandidate).to.be.greaterThan(-1);
       expect(reload).to.be.greaterThan(testCandidate);
       expect(persist).to.be.greaterThan(reload);

package/test/unit/catalog.test.js

@@ -14,6 +14,12 @@ import { TEST_TIERS } from '../../src/server/build/testing.js';
 const catalogs = await loadProductCatalogs();
 const describeProducts = describe.skipIf(catalogs.length === 0);
 
+// A product template keeps its own catalog but has every other product sliced away, so only
+// the unsliced engine tree carries every catalog and every tier directory. `buildTemplate`
+// drops `build:template` from the manifest and every product manifest inherits that, which
+// makes the script the one durable marker of the unsliced tree.
+const unsliced = !!JSON.parse(fs.readFileSync('./package.json', 'utf8')).scripts?.['build:template'];
+
 describeProducts('product catalogs', () => {
   it('every catalog carries the uniform shape', () => {
     for (const catalog of catalogs)
@@ -54,14 +60,19 @@ describeProducts('product catalogs and the test tiers', () => {
     catalogs.some(({ stripPaths }) => stripPaths.includes(`./${directory}`)),
   );
 
-  it('has products that own at least one tier', () => {
+  it.skipIf(!unsliced)('has products that own at least one tier', () => {
     expect(strippedTiers).to.not.be.empty;
   });
 
-  it('gives every tier a directory that exists in an unsliced tree', () => {
+  it.skipIf(!unsliced)('gives every tier a directory that exists in an unsliced tree', () => {
     for (const { name, directory } of TEST_TIERS) expect(fs.existsSync(directory), name).to.equal(true);
   });
 
+  it('carries the directory of every tier a present product owns', () => {
+    // Holds in a product template too: what it kept of itself must be whole.
+    for (const { name, directory } of strippedTiers) expect(fs.existsSync(directory), name).to.equal(true);
+  });
+
   it('ships every tier it strips from the base template', () => {
     for (const { name, directory } of strippedTiers) {
       const owner = catalogs.find(({ stripPaths }) => stripPaths.includes(`./${directory}`));