okengine 0.11.2 → 0.12.0

package/src/console/server/traces-replay.test.ts

@@ -0,0 +1,212 @@
+/**
+ * console.traces.replay — real re-invoke via {@link runReplay} (oke replay).
+ */
+
+import { describe, expect, test } from "bun:test";
+import { mkdtemp } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { WideEvent } from "../../runs/types.ts";
+import { startConsoleApp } from "./serve.ts";
+
+function sampleEvent(overrides: Partial<WideEvent> = {}): WideEvent {
+  return {
+    id: "req-replay-1",
+    flow: "notes.create",
+    trigger: "http",
+    plane: "user",
+    gates: [],
+    cache: "none",
+    error: null,
+    input: { title: "hello" },
+    effects: [],
+    logs: [],
+    durationMs: 12,
+    startedAt: 1,
+    endedAt: 13,
+    dimensions: {},
+    ...overrides,
+  };
+}
+
+describe("console.traces.replay", () => {
+  test("POST /console/traces/replay re-invokes through runReplay (not a no-op)", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-replay-"));
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-traces-replay",
+      silentClaim: true,
+    });
+
+    try {
+      const claimRes = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "Password1234!",
+          }),
+        }),
+      );
+      expect(claimRes.status).toBe(200);
+      const { data: session } = (await claimRes.json()) as {
+        data: { accessToken: string };
+      };
+
+      const event = sampleEvent();
+      const runs = handle.app.bootResult?.runs;
+      expect(runs).toBeDefined();
+      await runs!.append(event);
+
+      let seen: { readonly event: WideEvent; readonly dryRun: boolean } | null = null;
+      handle.state.replayTrace = async ({ event: ev, dryRun }) => {
+        seen = { event: ev, dryRun };
+        return { output: { ok: true, title: (ev.input as { title: string }).title } };
+      };
+
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/traces/replay", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${session.accessToken}`,
+          },
+          body: JSON.stringify({ rootId: event.id, dryRun: false }),
+        }),
+      );
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as {
+        data: { ok: true; rootId: string; dryRun: boolean; flow: string };
+        error: null;
+      };
+      expect(body.error).toBeNull();
+      expect(body.data.ok).toBe(true);
+      expect(body.data.rootId).toBe(event.id);
+      expect(body.data.flow).toBe("notes.create");
+      expect(body.data.dryRun).toBe(false);
+
+      expect(seen).not.toBeNull();
+      expect(seen!.event.id).toBe(event.id);
+      expect(seen!.event.input).toEqual({ title: "hello" });
+      expect(seen!.dryRun).toBe(false);
+    } finally {
+      await handle.app.stop();
+    }
+  });
+
+  test("forces dry-run when the ledger has send/ask", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-replay-dry-"));
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-traces-replay-dry",
+      silentClaim: true,
+    });
+
+    try {
+      const claimRes = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "Password1234!",
+          }),
+        }),
+      );
+      const { data: session } = (await claimRes.json()) as {
+        data: { accessToken: string };
+      };
+
+      const event = sampleEvent({
+        id: "req-send",
+        effects: [
+          {
+            kind: "send",
+            resource: "mail",
+            timestamp: 1,
+            duration: 2,
+            reversibility: "irreversible",
+          },
+        ],
+      });
+      await handle.app.bootResult!.runs!.append(event);
+
+      let dry: boolean | undefined;
+      handle.state.replayTrace = async ({ dryRun }) => {
+        dry = dryRun;
+        return { output: { ok: true } };
+      };
+
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/traces/replay", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${session.accessToken}`,
+          },
+          body: JSON.stringify({ rootId: event.id, dryRun: false }),
+        }),
+      );
+      expect(res.status).toBe(200);
+      const body = (await res.json()) as { data: { dryRun: boolean } };
+      expect(body.data.dryRun).toBe(true);
+      expect(dry).toBe(true);
+    } finally {
+      await handle.app.stop();
+    }
+  });
+
+  test("rejects runs with no stored input", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-replay-noinput-"));
+    const handle = await startConsoleApp({
+      cwd,
+      secret: "test-secret-traces-replay-noinput",
+      silentClaim: true,
+    });
+
+    try {
+      const claimRes = await handle.app.fetch(
+        new Request("http://console.test/console/setup/claim", {
+          method: "POST",
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({
+            claimCode: handle.state.claim.code,
+            email: "ops@example.com",
+            name: "Ops",
+            password: "Password1234!",
+          }),
+        }),
+      );
+      const { data: session } = (await claimRes.json()) as {
+        data: { accessToken: string };
+      };
+
+      const event = sampleEvent({ id: "req-no-input", input: undefined });
+      await handle.app.bootResult!.runs!.append(event);
+
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/traces/replay", {
+          method: "POST",
+          headers: {
+            "content-type": "application/json",
+            authorization: `Bearer ${session.accessToken}`,
+          },
+          body: JSON.stringify({ rootId: event.id, dryRun: true }),
+        }),
+      );
+      expect(res.status).toBe(400);
+      const body = (await res.json()) as {
+        error: { code: string; data?: { reason?: string } };
+      };
+      expect(body.error.code).toBe("ReplayUnavailable");
+      expect(body.error.data?.reason).toBe("no_stored_input");
+    } finally {
+      await handle.app.stop();
+    }
+  });
+});

package/src/console/server/vault-http.test.ts

@@ -0,0 +1,458 @@
+/**
+ * Console Vault HTTP — audit verify + rotate-master (lease, continue, overlap).
+ */
+
+import { afterAll, beforeAll, describe, expect, test } from "bun:test";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { createOperator } from "../../auth/operator.ts";
+import { issueSession } from "../../auth/index.ts";
+import { connectPglite } from "../../drivers/pglite.ts";
+import {
+  createBuiltinVaultAdapter,
+  sqlConnectionAsExec,
+} from "../../elements/vault/builtin-adapter.ts";
+import type { Manifest } from "../../manifest/types.ts";
+import { startConsoleApp, type ConsoleAppHandle } from "./serve.ts";
+
+/** Repo `okengine/config` — absolute import so a temp `oke.config.ts` needs no install. */
+const CONFIG_MOD = resolve(import.meta.dir, "../../config/index.ts");
+
+const PASSWORD = "Password1234!";
+
+type Json = {
+  data?: Record<string, unknown> | null;
+  error?: { code: string; data?: { reason?: string; phrase?: string } } | null;
+};
+
+async function claimOperator(
+  handle: ConsoleAppHandle,
+  email: string,
+  name: string,
+): Promise<{ token: string; operatorId: string }> {
+  const res = await handle.app.fetch(
+    new Request("http://console.test/console/setup/claim", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        claimCode: handle.state.claim.code,
+        email,
+        name,
+        password: PASSWORD,
+      }),
+    }),
+  );
+  expect(res.status).toBe(200);
+  const body = (await res.json()) as { data: { accessToken: string; operatorId: string } };
+  return { token: body.data.accessToken, operatorId: body.data.operatorId };
+}
+
+async function secondOperator(
+  handle: ConsoleAppHandle,
+  email: string,
+  name: string,
+): Promise<{ token: string; operatorId: string }> {
+  const op = await createOperator(handle.state.operators, {
+    email,
+    name,
+    password: PASSWORD,
+  });
+  const issued = await issueSession(
+    handle.state.sessions,
+    { secret: handle.state.secret, now: handle.state.now },
+    { id: op.id, plane: "operator", scopes: [] },
+  );
+  return { token: issued.accessToken, operatorId: op.id };
+}
+
+function authHeaders(token: string): Record<string, string> {
+  return {
+    "content-type": "application/json",
+    authorization: `Bearer ${token}`,
+  };
+}
+
+async function seedVault(datadir: string, secretCount: number, batchSize: number): Promise<string> {
+  const conn = await connectPglite({ url: datadir });
+  try {
+    const adapter = createBuiltinVaultAdapter({
+      db: sqlConnectionAsExec(conn),
+      kekRewrapBatchSize: batchSize,
+    });
+    const init = await adapter.initialize();
+    await adapter.unseal(init.masterKey);
+    for (let i = 0; i < secretCount; i += 1) {
+      await adapter.set(`prod/s/${i}`, `value-${i}`);
+    }
+    return init.masterKey;
+  } finally {
+    await conn.close();
+  }
+}
+
+describe("console vault HTTP — audit verify", () => {
+  let datadir: string;
+  let masterKey: string;
+  let handle: ConsoleAppHandle;
+  let token: string;
+
+  beforeAll(async () => {
+    datadir = await mkdtemp(join(tmpdir(), "oke-console-vault-verify-"));
+    masterKey = await seedVault(datadir, 2, 100);
+    handle = await startConsoleApp({
+      silentClaim: true,
+      secret: "vault-http-verify",
+      okeConfig: { drivers: { vault: { dev: "vault", test: "vault", prod: "vault" } } },
+      vaultProcessEnv: {
+        DATABASE_URL: datadir,
+        OKE_VAULT_MASTER_KEY: masterKey,
+      },
+    });
+    const claimed = await claimOperator(handle, "ops@example.com", "Ops");
+    token = claimed.token;
+  }, 30_000);
+
+  afterAll(async () => {
+    await handle.app.stop();
+    await rm(datadir, { recursive: true, force: true });
+  });
+
+  test("intact chain returns ok with null brokenAt and row", async () => {
+    const res = await handle.app.fetch(
+      new Request("http://console.test/console/vault/audit/verify", {
+        headers: { authorization: `Bearer ${token}` },
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Json;
+    expect(body.error).toBeFalsy();
+    expect(body.data).toEqual({
+      ok: true,
+      brokenAt: null,
+      reason: null,
+      row: null,
+    });
+  });
+
+  test("tampered row surfaces brokenAt + reason + row", async () => {
+    const conn = await connectPglite({ url: datadir });
+    try {
+      const rows = await conn.query(`SELECT id FROM oke_vault_audit ORDER BY seq ASC`);
+      const victim = typeof rows[1]?.id === "string" ? rows[1].id : undefined;
+      expect(victim).toBeDefined();
+      await conn.exec(`UPDATE oke_vault_audit SET action = 'delete' WHERE id = $1`, [victim]);
+    } finally {
+      await conn.close();
+    }
+
+    const res = await handle.app.fetch(
+      new Request("http://console.test/console/vault/audit/verify", {
+        headers: { authorization: `Bearer ${token}` },
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Json;
+    expect(body.error).toBeFalsy();
+    expect(body.data?.ok).toBe(false);
+    expect(typeof body.data?.brokenAt).toBe("string");
+    expect(body.data?.reason).toBe("payload");
+    const row = body.data?.row as { id: string } | null;
+    expect(row?.id).toBe(typeof body.data?.brokenAt === "string" ? body.data.brokenAt : undefined);
+  });
+});
+
+describe("console vault HTTP — rotate-master", () => {
+  let datadir: string;
+  let masterKey: string;
+  let handle: ConsoleAppHandle;
+  let tokenA: string;
+  let tokenB: string;
+  let hold: Promise<void>;
+  let releaseHold: (() => void) | undefined;
+  let enteredHold: (() => void) | undefined;
+
+  beforeAll(async () => {
+    datadir = await mkdtemp(join(tmpdir(), "oke-console-vault-rotate-"));
+    masterKey = await seedVault(datadir, 10, 2);
+    hold = Promise.resolve();
+    handle = await startConsoleApp({
+      silentClaim: true,
+      secret: "vault-http-rotate",
+      production: true,
+      okeConfig: { drivers: { vault: { dev: "vault", test: "vault", prod: "vault" } } },
+      vaultProcessEnv: {
+        DATABASE_URL: datadir,
+        OKE_VAULT_MASTER_KEY: masterKey,
+      },
+      vaultKekRewrapBatchSize: 2,
+      rotateBatchHold: async () => {
+        enteredHold?.();
+        await hold;
+      },
+    });
+    const a = await claimOperator(handle, "a@example.com", "Ops A");
+    tokenA = a.token;
+    const b = await secondOperator(handle, "b@example.com", "Ops B");
+    tokenB = b.token;
+  }, 30_000);
+
+  afterAll(async () => {
+    await handle.app.stop();
+    await rm(datadir, { recursive: true, force: true });
+  });
+
+  test("missing confirm is ConfirmRequired ROTATE_MASTER", async () => {
+    const res = await handle.app.fetch(
+      new Request("http://console.test/console/vault/rotate-master", {
+        method: "POST",
+        headers: authHeaders(tokenA),
+        body: JSON.stringify({}),
+      }),
+    );
+    const body = (await res.json()) as Json;
+    expect(body.error?.code).toBe("ConfirmRequired");
+    expect(body.error?.data?.phrase).toBe("ROTATE_MASTER");
+  });
+
+  test("T1 start race: exactly one wins, loser is VaultRotateBusy", async () => {
+    const body = JSON.stringify({
+      confirmation: "ROTATE_MASTER",
+      reason: "start race",
+    });
+    const [ra, rb] = await Promise.all([
+      handle.app.fetch(
+        new Request("http://console.test/console/vault/rotate-master", {
+          method: "POST",
+          headers: authHeaders(tokenA),
+          body,
+        }),
+      ),
+      handle.app.fetch(
+        new Request("http://console.test/console/vault/rotate-master", {
+          method: "POST",
+          headers: authHeaders(tokenB),
+          body,
+        }),
+      ),
+    ]);
+    const ba = (await ra.json()) as Json;
+    const bb = (await rb.json()) as Json;
+    const ok = [ba, bb].filter((x) => x.data?.ok === true);
+    const busy = [ba, bb].filter((x) => x.error?.code === "VaultRotateBusy");
+    expect(ok).toHaveLength(1);
+    expect(busy).toHaveLength(1);
+    expect(busy[0]?.error?.data?.reason ?? "").toMatch(/lease held|already in progress/i);
+    expect(ok[0]?.data?.kekVersion).toBe(2);
+    expect((ok[0]?.data?.remaining as number) > 0).toBe(true);
+    const conn = await connectPglite({ url: datadir });
+    try {
+      const v2 = await conn.query(
+        `SELECT COUNT(*)::text AS n FROM oke_vault_keys WHERE kek_version = 2`,
+      );
+      expect(Number(v2[0]?.n ?? 0)).toBeLessThanOrEqual(2);
+    } finally {
+      await conn.close();
+    }
+  });
+
+  test("T2 cross-operator continue is system-level, not session-scoped", async () => {
+    const res = await handle.app.fetch(
+      new Request("http://console.test/console/vault/rotate-master", {
+        method: "POST",
+        headers: authHeaders(tokenB),
+        body: JSON.stringify({
+          confirmation: "ROTATE_MASTER",
+          reason: "continue as B",
+        }),
+      }),
+    );
+    expect(res.status).toBe(200);
+    const body = (await res.json()) as Json;
+    expect(body.error).toBeFalsy();
+    expect(body.data?.ok).toBe(true);
+    expect(body.data?.kekVersion).toBe(2);
+    expect(body.data?.masterKey).toBeNull();
+    expect((body.data?.remaining as number) > 0).toBe(true);
+    expect((body.data?.remaining as number) < 10).toBe(true);
+  });
+
+  test("T3 overlap while a batch is in-flight is busy, then B can continue", async () => {
+    hold = new Promise<void>((resolve) => {
+      releaseHold = resolve;
+    });
+    const entered = new Promise<void>((resolve) => {
+      enteredHold = resolve;
+    });
+
+    const aFetch = handle.app.fetch(
+      new Request("http://console.test/console/vault/rotate-master", {
+        method: "POST",
+        headers: authHeaders(tokenA),
+        body: JSON.stringify({
+          confirmation: "ROTATE_MASTER",
+          reason: "overlap A",
+        }),
+      }),
+    );
+    await entered;
+
+    const bBusy = await handle.app.fetch(
+      new Request("http://console.test/console/vault/rotate-master", {
+        method: "POST",
+        headers: authHeaders(tokenB),
+        body: JSON.stringify({
+          confirmation: "ROTATE_MASTER",
+          reason: "overlap B",
+        }),
+      }),
+    );
+    const busyBody = (await bBusy.json()) as Json;
+    expect(busyBody.error?.code).toBe("VaultRotateBusy");
+    expect(busyBody.error?.data?.reason ?? "").toMatch(/already in progress/i);
+
+    releaseHold?.();
+    const aRes = await aFetch;
+    const aBody = (await aRes.json()) as Json;
+    expect(aBody.data?.ok === true || aBody.error?.code === "VaultRotateBusy").toBe(true);
+
+    hold = Promise.resolve();
+    enteredHold = undefined;
+    const bContinue = await handle.app.fetch(
+      new Request("http://console.test/console/vault/rotate-master", {
+        method: "POST",
+        headers: authHeaders(tokenB),
+        body: JSON.stringify({
+          confirmation: "ROTATE_MASTER",
+          reason: "finish after overlap",
+        }),
+      }),
+    );
+    const cont = (await bContinue.json()) as Json;
+    expect(cont.error).toBeFalsy();
+    expect(cont.data?.ok).toBe(true);
+    expect(cont.data?.kekVersion).toBe(2);
+    expect(cont.data?.masterKey).toBeNull();
+  });
+
+  test("POST /console/vault/rotate still only rotates a value", async () => {
+    const res = await handle.app.fetch(
+      new Request("http://console.test/console/vault/rotate", {
+        method: "POST",
+        headers: authHeaders(tokenA),
+        body: JSON.stringify({
+          name: "missing",
+          value: "x",
+          confirmation: "ROTATE",
+          reason: "not master",
+        }),
+      }),
+    );
+    const body = (await res.json()) as Json;
+    expect(body.error?.code).toBe("VaultNotFound");
+  });
+});
+
+describe("console vault HTTP — sealed rotate-master", () => {
+  test("no master key is VaultSealed", async () => {
+    const datadir = await mkdtemp(join(tmpdir(), "oke-console-vault-sealed-"));
+    await seedVault(datadir, 1, 100);
+    const handle = await startConsoleApp({
+      silentClaim: true,
+      secret: "vault-http-sealed",
+      okeConfig: { drivers: { vault: { dev: "vault", test: "vault", prod: "vault" } } },
+      vaultProcessEnv: { DATABASE_URL: datadir },
+    });
+    try {
+      const { token } = await claimOperator(handle, "ops@example.com", "Ops");
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/vault/rotate-master", {
+          method: "POST",
+          headers: authHeaders(token),
+          body: JSON.stringify({
+            confirmation: "ROTATE_MASTER",
+            reason: "sealed",
+          }),
+        }),
+      );
+      const body = (await res.json()) as Json;
+      expect(body.error?.code).toBe("VaultSealed");
+    } finally {
+      await handle.app.stop();
+      await rm(datadir, { recursive: true, force: true });
+    }
+  }, 30_000);
+});
+
+describe("console vault HTTP — set without a pre-bound runtime", () => {
+  test("binds the env driver and writes the value", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-vault-set-"));
+    const handle = await startConsoleApp({
+      cwd,
+      silentClaim: true,
+      secret: "vault-http-set",
+      manifest: {
+        oke: "1.0",
+        app: "keel",
+        vault: {
+          GITHUB_TOKEN: { description: "GitHub Issues sync token", rotate: "90d" },
+        },
+      } as Manifest,
+    });
+    try {
+      expect(handle.state.vaultRuntime).toBeNull();
+      const { token } = await claimOperator(handle, "ops@example.com", "Ops");
+      const res = await handle.app.fetch(
+        new Request("http://console.test/console/vault/set", {
+          method: "POST",
+          headers: authHeaders(token),
+          body: JSON.stringify({
+            name: "GITHUB_TOKEN",
+            value: "ghp_dev_keel_github_sync",
+            reason: "first",
+          }),
+        }),
+      );
+      const body = (await res.json()) as Json;
+      expect(body.error).toBeFalsy();
+      expect(body.data?.ok).toBe(true);
+      expect(body.data?.name).toBe("GITHUB_TOKEN");
+      expect(handle.state.vaultRuntime).toBeTruthy();
+      const listed = await handle.state.listVault();
+      expect(listed.backend?.driverId).toBe("env");
+    } finally {
+      await handle.app.stop();
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+
+  test("loads drivers.vault from oke.config.ts so the lock-path is built-in", async () => {
+    const cwd = await mkdtemp(join(tmpdir(), "oke-console-vault-pin-"));
+    await writeFile(
+      join(cwd, "oke.config.ts"),
+      `import { defineConfig } from ${JSON.stringify(CONFIG_MOD)};
+export default defineConfig({ drivers: { vault: { dev: "vault" } } });
+`,
+    );
+    const handle = await startConsoleApp({
+      cwd,
+      silentClaim: true,
+      secret: "vault-http-pin",
+      manifest: {
+        oke: "1.0",
+        app: "keel",
+        vault: {
+          GITHUB_TOKEN: { description: "GitHub Issues sync token", rotate: "90d" },
+        },
+      } as Manifest,
+    });
+    try {
+      const listed = await handle.state.listVault();
+      expect(listed.backend?.driverId).toBe("vault");
+      expect(listed.backend?.builtin).toBe(true);
+    } finally {
+      await handle.app.stop();
+      await rm(cwd, { recursive: true, force: true });
+    }
+  });
+});