@volter/twin-world 0.1.0 → 0.1.2

package/src/runtime-test-support.ts

@@ -0,0 +1,208 @@
+// Shared setup for the runtime test files. Extracted so runtime.test.ts could be split by
+// concern: 25 sequential tests in one process floored the gate at ~24s, and the gate shards
+// per FILE. Every helper lives here — including the five that used to sit BETWEEN tests,
+// whose loss broke the first attempt at this split.
+import { afterEach, expect, spyOn } from 'bun:test';
+import { existsSync, mkdtempSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import net from 'node:net';
+import { spawnSync } from 'node:child_process';
+import { activateScript, doctorWorld, downWorld, ensureWorldProxy, runWithWorldEnv, runWorld, shareWorld, shareWorldServices, statusWorld, unshareWorld, upWorld, urlsWorld, worldShellEnv } from './runtime.ts';
+import { opensslAvailable } from './redirect-proxy.ts';
+import { stateDirName } from '@volter/twin';
+
+/** Test-only seam (see runtime.ts `proxyDaemonDeadlineMs`): force the daemon-poll deadline to `ms`
+ * for the duration of `fn`, then restore whatever was there before — deterministic, no sleeps. */
+export async function withProxyDeadline<T>(ms: number, fn: () => Promise<T> | T): Promise<T> {
+  const prev = process.env.VOLTER_PROXY_DEADLINE_MS;
+  process.env.VOLTER_PROXY_DEADLINE_MS = String(ms);
+  try {
+    return await fn();
+  } finally {
+    if (prev === undefined) delete process.env.VOLTER_PROXY_DEADLINE_MS;
+    else process.env.VOLTER_PROXY_DEADLINE_MS = prev;
+  }
+}
+
+/** Best-effort cleanup for the forced-timeout tests below: with the deadline forced to 0, the
+ * detached proxy-daemon child is still spawned and may go on to write `proxy.json` a little later
+ * (asynchronously, after our synchronous poll already gave up) — kill it so it doesn't linger as an
+ * orphan process once the test's tmp root is discarded. Never gates test pass/fail. */
+export async function reapLeakedProxyDaemon(root: string, name: string): Promise<void> {
+  const proxyJsonPath = join(root, stateDirName(), 'worlds', name, 'proxy.json');
+  const deadline = Date.now() + 3000;
+  while (Date.now() < deadline) {
+    if (existsSync(proxyJsonPath)) {
+      try {
+        const state = JSON.parse(readFileSync(proxyJsonPath, 'utf8')) as { pid?: number };
+        if (state.pid) { try { process.kill(state.pid, 'SIGTERM'); } catch { /* already gone */ } }
+      } catch { /* ignore parse races */ }
+      return;
+    }
+    await new Promise((r) => setTimeout(r, 100));
+  }
+}
+
+/** A hostname under the IANA-reserved `.invalid` TLD (RFC 2606) — guaranteed to NEVER resolve, on
+ * any network, forever. Used as the "untwinned public host" below: it is unambiguously non-local
+ * (so `isLocalOrPrivateHost` never exempts it) and unambiguously not a vendor (so it is never
+ * redirected to a twin), and a real (non-strict-egress) attempt to reach it fails FAST on DNS
+ * resolution — offline and deterministic, no dependency on real internet access. */
+export const UNTWINNED_HOST = 'definitely-untwinned.invalid';
+
+/** Drive a raw CONNECT through the ambient redirect proxy and collect whatever bytes come back
+ * before the socket closes (or `timeoutMs` elapses, as a safety net — a blind-tunnel attempt to an
+ * unresolvable host closes with NO data at all, so this never actually waits the full timeout). */
+export function connectThroughProxy(port: number, host: string, targetHost: string, targetPort = 443, timeoutMs = 3000): Promise<string> {
+  return new Promise((resolvePromise, reject) => {
+    const sock = net.connect(port, host, () => {
+      sock.write(`CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\nHost: ${targetHost}:${targetPort}\r\n\r\n`);
+    });
+    let data = '';
+    const timer = setTimeout(() => { sock.destroy(); resolvePromise(data); }, timeoutMs);
+    sock.on('data', (chunk: Buffer) => { data += chunk.toString('utf8'); });
+    sock.on('close', () => { clearTimeout(timer); resolvePromise(data); });
+    sock.on('error', (err) => { clearTimeout(timer); reject(err); });
+  });
+}
+
+/** Force `opensslAvailable()` to false via its TEST-ONLY seam (see `redirect-proxy.ts`). A
+ * PATH-shim (fake `openssl` binary prepended to PATH) was tried first and does NOT reliably work
+ * here: `opensslAvailable()`'s `spawnSync('openssl', …)` call passes no explicit `env`, and this
+ * runtime resolves the executable against a PATH snapshotted at process start rather than a
+ * same-process `process.env.PATH` mutation made mid-test (verified: a fresh child process DOES
+ * see a shimmed PATH, but mutating PATH in the already-running test process does not change what
+ * THIS process's own `spawnSync` resolves) — so the deterministic, seam-based override is used. */
+export function withNoOpenssl(): { restore: () => void } {
+  const previous = process.env.VOLTER_TEST_NO_OPENSSL;
+  process.env.VOLTER_TEST_NO_OPENSSL = '1';
+  return {
+    restore: () => {
+      if (previous === undefined) delete process.env.VOLTER_TEST_NO_OPENSSL;
+      else process.env.VOLTER_TEST_NO_OPENSSL = previous;
+    },
+  };
+}
+
+export const worlds: Array<{ root: string; name: string }> = [];
+
+/**
+ * Register the teardown hook for the CALLING test file. Every file that pushes to `worlds` must
+ * call this at top level.
+ *
+ * It has to be a function call rather than a module-scope `afterEach`, and that distinction was an
+ * eight-file process leak. A hook registered while this module's body runs belongs to whichever
+ * file happened to import it FIRST; module caching means the body never runs again, so every other
+ * file got no hook at all. Each file individually looked clean — it was the first importer — and
+ * only a whole-directory run leaked, which is exactly the shape that reads as flakiness. The
+ * stray proxy daemons and tunnel stubs then held ports until unrelated HTTP tests started failing.
+ *
+ * Teardown also settles ALL worlds before reporting: the list is spliced empty up front, so a bare
+ * `for … await` loop that rejected on the first world abandoned the rest with nothing left holding
+ * a reference to them. Nothing about a world that failed to stop makes the next one less important
+ * to stop.
+ */
+export function useWorldCleanup(): void {
+  afterEach(async () => {
+    const pending = worlds.splice(0);
+    const failures = await Promise.allSettled(pending.map((w) => downWorld(w.name, w.root)));
+    const errors = failures.filter((f): f is PromiseRejectedResult => f.status === 'rejected');
+    // Reported, never swallowed: a world that cannot be torn down is a real finding about the
+    // runtime, and silently ignoring it is how this stayed invisible for so long.
+    if (errors.length) {
+      throw new Error(`world teardown failed for ${errors.length}/${pending.length} world(s): ${errors.map((e) => String(e.reason)).join('; ')}`);
+    }
+  });
+}
+
+
+export function writeRaceConfig(root: string, id: string): void {
+  mkdirSync(join(root, 'worlds', 'configs'), { recursive: true });
+  writeFileSync(join(root, 'worlds', 'configs', `${id}.json`), JSON.stringify({
+    id,
+    services: [
+      {
+        id: 'app',
+        type: 'process',
+        command: 'node',
+        args: ['-e', "require('node:http').createServer((_req,res)=>res.end('ok')).listen(Number(process.env.PORT),'127.0.0.1')"],
+        env: { NODE_OPTIONS: '' },
+        portArg: false,
+        rootArg: false,
+      },
+    ],
+  }));
+}
+
+/** Bounded wait (no fixed sleeps) for SIGTERM'd services to actually exit after downWorld. */
+export async function waitForWorldDown(name: string, root: string): Promise<boolean> {
+  const deadline = Date.now() + 5_000;
+  while (Date.now() < deadline) {
+    if (!statusWorld(name, root).running) return true;
+    await new Promise((r) => setTimeout(r, 50));
+  }
+  return !statusWorld(name, root).running;
+}
+
+export function pidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// --- TWIN-60: `--mode sealed` must actually ENFORCE strict egress (VOLTER_TWIN_STRICT_EGRESS),
+// not just record intent (VOLTER_WORLD_SEALED) that nothing consumes. One vendor twin (s3) is
+// enough to exercise both enforcement points: the Node injector (control-plane/inject.cjs, HTTP
+// path) and the ambient TLS redirect proxy (redirect-proxy.ts, CONNECT path).
+export function writeSingleTwinConfig(root: string, id: string): void {
+  mkdirSync(join(root, 'worlds', 'configs'), { recursive: true });
+  writeFileSync(join(root, 'worlds', 'configs', `${id}.json`), JSON.stringify({
+    id,
+    services: [
+      {
+        id: 's3',
+        command: 'node',
+        args: ['-e', "require('node:http').createServer((_req,res)=>res.end('s3')).listen(Number(process.env.PORT),'127.0.0.1')"],
+        env: { NODE_OPTIONS: '' },
+        injectEnv: 'S3_TWIN_URL',
+        portArg: false,
+        rootArg: false,
+      },
+    ],
+  }));
+}
+
+/** Twin + a second (non-twin) service — the proxy-attempt loop tries the ambient proxy again
+ * before starting each subsequent service, so this reaches the ambient proxy regardless of
+ * whether the single/last-service re-evaluation (TWIN-64) has landed yet — kept independent of
+ * that fix so this CONNECT-level test exercises TWIN-60's wiring in isolation. */
+export function writeTwinPlusAppConfig(root: string, id: string): void {
+  mkdirSync(join(root, 'worlds', 'configs'), { recursive: true });
+  writeFileSync(join(root, 'worlds', 'configs', `${id}.json`), JSON.stringify({
+    id,
+    services: [
+      {
+        id: 's3',
+        command: 'node',
+        args: ['-e', "require('node:http').createServer((_req,res)=>res.end('s3')).listen(Number(process.env.PORT),'127.0.0.1')"],
+        env: { NODE_OPTIONS: '' },
+        injectEnv: 'S3_TWIN_URL',
+        portArg: false,
+        rootArg: false,
+      },
+      {
+        id: 'app',
+        type: 'process',
+        command: 'node',
+        args: ['-e', "require('node:http').createServer((_req,res)=>res.end('ok')).listen(Number(process.env.PORT),'127.0.0.1')"],
+        env: { NODE_OPTIONS: '' },
+        portArg: false,
+        rootArg: false,
+      },
+    ],
+  }));
+}