pepr 0.33.0 → 0.34.0

package/src/lib/queue.test.ts

@@ -0,0 +1,58 @@
+import { beforeEach, describe, expect, jest, test } from "@jest/globals";
+import { KubernetesObject } from "@kubernetes/client-node";
+import { WatchPhase } from "kubernetes-fluent-client/dist/fluent/types";
+import { Queue } from "./queue";
+
+describe("Queue", () => {
+  let queue: Queue<KubernetesObject>;
+
+  beforeEach(() => {
+    queue = new Queue();
+  });
+
+  test("enqueue should add a pod to the queue and return a promise", async () => {
+    const pod = {
+      metadata: { name: "test-pod", namespace: "test-pod" },
+    };
+    const promise = queue.enqueue(pod, WatchPhase.Added);
+    expect(promise).toBeInstanceOf(Promise);
+    await promise;
+  });
+
+  test("dequeue should process pods in FIFO order", async () => {
+    const mockPod = {
+      metadata: { name: "test-pod", namespace: "test-namespace" },
+    };
+    const mockPod2 = {
+      metadata: { name: "test-pod-2", namespace: "test-namespace-2" },
+    };
+
+    // Enqueue two packages
+    const promise1 = queue.enqueue(mockPod, WatchPhase.Added);
+    const promise2 = queue.enqueue(mockPod2, WatchPhase.Modified);
+
+    // Wait for both promises to resolve
+    await promise1;
+    await promise2;
+  });
+
+  test("dequeue should handle errors in pod processing", async () => {
+    const mockPod = {
+      metadata: { name: "test-pod", namespace: "test-namespace" },
+    };
+    const error = new Error("reconciliation failed");
+    jest.spyOn(queue, "setReconcile").mockRejectedValueOnce(error as never);
+
+    try {
+      await queue.enqueue(mockPod, WatchPhase.Added);
+    } catch (e) {
+      expect(e).toBe(error);
+    }
+
+    // Ensure that the queue is ready to process the next pod
+    const mockPod2 = {
+      metadata: { name: "test-pod-2", namespace: "test-namespace-2" },
+    };
+    await queue.enqueue(mockPod2, WatchPhase.Modified);
+  });
+});

package/src/lib/schedule.test.ts

@@ -0,0 +1,217 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { beforeEach, describe, expect, it, jest, afterEach } from "@jest/globals";
+import { OnSchedule, Schedule } from "./schedule";
+import { Unsubscribe } from "./storage";
+
+export class MockStorage {
+  private storage: Record<string, string> = {};
+  subscription: string;
+  constructor() {
+    this.subscription = "";
+  }
+
+  getItem(key: string): string | null {
+    return this.storage[key] || null;
+  }
+
+  setItem(key: string, value: string): void {
+    this.storage[key] = value;
+  }
+
+  setItemAndWait(key: string, value: string): Promise<void> {
+    return new Promise(resolve => {
+      this.storage[key] = value;
+      resolve();
+    });
+  }
+
+  removeItem(key: string): void {
+    delete this.storage[key];
+  }
+
+  removeItemAndWait(key: string): Promise<void> {
+    return new Promise(resolve => {
+      delete this.storage[key];
+      resolve();
+    });
+  }
+
+  clear(): void {
+    this.storage = {};
+  }
+
+  subscribe(): Unsubscribe {
+    // Expected 'this' to be used by class method 'subscribe'
+    this.subscription = "";
+    return true as unknown as Unsubscribe;
+  }
+
+  onReady(): void {
+    // Expected 'this' to be used by class method 'onReady'
+    this.subscription = "";
+    return;
+  }
+}
+
+describe("OnSchedule", () => {
+  const mockSchedule: Schedule = {
+    name: "test",
+    every: 1,
+    unit: "minutes",
+    run: jest.fn(),
+  };
+
+  afterEach(() => {
+    jest.clearAllMocks();
+    jest.useRealTimers();
+    jest.clearAllTimers();
+    jest.resetModules();
+  });
+
+  beforeEach(() => {
+    jest.useFakeTimers();
+  });
+
+  it("should create an instance of OnSchedule", () => {
+    const onSchedule = new OnSchedule(mockSchedule);
+    onSchedule.setStore(new MockStorage());
+    expect(onSchedule).toBeInstanceOf(OnSchedule);
+  });
+
+  it("should startInterval, run, and start", () => {
+    const onSchedule = new OnSchedule(mockSchedule);
+    onSchedule.setStore(new MockStorage());
+    onSchedule.completions = 0;
+
+    onSchedule.start();
+
+    onSchedule.startTime = new Date(new Date().getTime() + 100000);
+
+    onSchedule.setupInterval();
+    jest.advanceTimersByTime(100000);
+
+    const secondSchedule = new OnSchedule(mockSchedule);
+    onSchedule.setStore(new MockStorage());
+    secondSchedule.completions = 9;
+    secondSchedule.duration = 1;
+    secondSchedule.start();
+    jest.advanceTimersByTime(100000);
+    expect(secondSchedule.completions).toBe(0);
+    jest.runOnlyPendingTimers();
+    jest.clearAllTimers();
+  });
+
+  it("should stop, removeItem, and removeItem", () => {
+    const onSchedule = new OnSchedule(mockSchedule);
+    onSchedule.setStore(new MockStorage());
+    const removeItemSpy = jest.spyOn(onSchedule.store as MockStorage, "removeItem");
+
+    onSchedule.startInterval();
+    onSchedule.stop();
+
+    expect(onSchedule.intervalId).toBeNull();
+    expect(removeItemSpy).toHaveBeenCalled();
+
+    onSchedule.intervalId = 9 as unknown as NodeJS.Timeout;
+    onSchedule.stop();
+    expect(onSchedule.intervalId).toBeNull();
+    jest.runOnlyPendingTimers();
+    jest.clearAllTimers();
+  });
+
+  it("should getDuration", () => {
+    // test second
+    mockSchedule.every = 10;
+    mockSchedule.unit = "seconds";
+    const onSchedule = new OnSchedule(mockSchedule);
+    onSchedule.getDuration();
+    expect(onSchedule.duration).toBe(10000);
+
+    // test second error
+    mockSchedule.every = 8;
+    try {
+      onSchedule.getDuration();
+    } catch (e) {
+      expect(e).toEqual(new Error("10 Seconds in the smallest interval allowed"));
+    }
+
+    // test minute(s)
+    onSchedule.unit = "minutes";
+    onSchedule.getDuration();
+    expect(onSchedule.duration).toBe(600000);
+    onSchedule.unit = "minute";
+    onSchedule.getDuration();
+    expect(onSchedule.duration).toBe(600000);
+
+    // test hour(s)
+    onSchedule.unit = "hours";
+    onSchedule.getDuration();
+    expect(onSchedule.duration).toBe(36000000);
+    onSchedule.unit = "hour";
+    onSchedule.getDuration();
+    expect(onSchedule.duration).toBe(36000000);
+
+    // test invalid unit
+    onSchedule.unit = "second";
+    try {
+      onSchedule.getDuration();
+    } catch (e) {
+      expect(e).toEqual(new Error("Invalid time unit"));
+    }
+  });
+
+  it("should setupInterval", () => {
+    // startTime and lastTimestamp should set startTime to undefined
+    mockSchedule.startTime = new Date();
+    mockSchedule.unit = "seconds";
+    mockSchedule.every = 10;
+    const onSchedule = new OnSchedule(mockSchedule);
+    onSchedule.setStore(new MockStorage());
+    onSchedule.lastTimestamp = new Date();
+    onSchedule.setupInterval();
+    expect(onSchedule.startTime).toBeUndefined();
+  });
+
+  it("should call setItem during saveToStore", () => {
+    const onSchedule = new OnSchedule(mockSchedule);
+    onSchedule.setStore(new MockStorage());
+
+    const setItemSpy = jest.spyOn(onSchedule.store as MockStorage, "setItem");
+    onSchedule.saveToStore();
+    expect(setItemSpy).toHaveBeenCalledTimes(1);
+  });
+  it("checkStore retrieves values from the store", () => {
+    mockSchedule.run = () => {};
+    const onSchedule = new OnSchedule(mockSchedule);
+    onSchedule.setStore(new MockStorage());
+    const getItemSpy = jest.spyOn(onSchedule.store as MockStorage, "getItem");
+    const startTime = "doesn't";
+    const lastTimestamp = "matter";
+    getItemSpy.mockReturnValue(
+      JSON.stringify({
+        completions: 1,
+        startTime,
+        lastTimestamp,
+      }),
+    );
+    onSchedule.checkStore();
+
+    expect(getItemSpy).toHaveBeenCalledTimes(1);
+
+    // // Verify that the values were correctly retrieved and assigned
+    expect(onSchedule.completions).toBe(1);
+    expect(onSchedule.startTime).toEqual(startTime);
+    expect(onSchedule.lastTimestamp).toEqual(lastTimestamp);
+
+    getItemSpy.mockReturnValue(
+      JSON.stringify({
+        lastTimestamp: undefined,
+      }),
+    );
+    onSchedule.checkStore();
+
+    expect(onSchedule.lastTimestamp).toEqual(undefined);
+  });
+});

package/src/lib/storage.test.ts

@@ -0,0 +1,203 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+import { DataStore, Storage, v2StoreKey, stripV2Prefix } from "./storage";
+import fc from "fast-check";
+
+describe("stripV2Prefix", () => {
+  it("should remove the v2 prefix", () => {
+    const keys = ["v2-key1", "v2-key2", "v2-key3", "v2-key4", "v2-key5"];
+    const results = ["key1", "key2", "key3", "key4", "key5"];
+
+    for (let i = 0; i < keys.length; i++) {
+      const result = stripV2Prefix(keys[i]);
+      expect(result).toEqual(results[i]);
+    }
+  });
+});
+describe("v2StoreKey", () => {
+  it("should prefix the key with v2", () => {
+    const keys = ["key1", "key2", "key3", "key4", "key5"];
+    const results = ["v2-key1", "v2-key2", "v2-key3", "v2-key4", "v2-key5"];
+
+    for (let i = 0; i < keys.length; i++) {
+      const result = v2StoreKey(keys[i]);
+      expect(result).toEqual(results[i]);
+    }
+  });
+});
+describe("Storage with fuzzing and property-based tests", () => {
+  let storage: Storage;
+
+  beforeEach(() => {
+    storage = new Storage();
+    storage.registerSender(jest.fn());
+  });
+
+  it("should correctly set and retrieve items", () => {
+    fc.assert(
+      fc.property(fc.string(), fc.string(), (key, value) => {
+        storage.setItem(key, value);
+        const mockData: DataStore = { [v2StoreKey(key)]: value };
+        storage.receive(mockData);
+        if (value === "") {
+          expect(storage.getItem(key)).toBeNull();
+        } else {
+          expect(storage.getItem(key)).toEqual(value);
+        }
+      }),
+      { numRuns: 100 },
+    );
+  });
+
+  it("should return null for non-existing items", () => {
+    fc.assert(
+      fc.property(fc.string(), key => {
+        expect(storage.getItem(key)).toBeNull();
+      }),
+      { numRuns: 100 },
+    );
+  });
+
+  it("should correctly remove items", () => {
+    fc.assert(
+      fc.property(fc.string(), fc.string(), (key, value) => {
+        storage.setItem(key, value);
+        storage.removeItem(key);
+        expect(storage.getItem(key)).toBeNull();
+      }),
+      { numRuns: 100 },
+    );
+  });
+
+  it("should ensure all set items are v2-coded internally", () => {
+    fc.assert(
+      fc.property(fc.string(), fc.string(), (key, value) => {
+        storage.setItem(key, value);
+        const mockData: DataStore = { [v2StoreKey(key)]: value };
+        storage.receive(mockData);
+        if (value === "") {
+          expect(storage.getItem(key)).toBeNull();
+        } else {
+          expect(storage.getItem(key)).toEqual(value);
+        }
+      }),
+      { numRuns: 100 },
+    );
+  });
+});
+describe("Storage", () => {
+  let storage: Storage;
+
+  beforeEach(() => {
+    storage = new Storage();
+  });
+
+  it("should set an item", () => {
+    const mockSender = jest.fn();
+    storage.registerSender(mockSender);
+    const key = "key1";
+    storage.setItem(key, "value1");
+
+    expect(mockSender).toHaveBeenCalledWith("add", [v2StoreKey(key)], "value1");
+  });
+
+  it("should set an item and wait", () => {
+    const mockSender = jest.fn();
+    storage.registerSender(mockSender);
+    jest.useFakeTimers();
+    const key = "key1";
+
+    // asserting on sender invocation rather than Promise so no need to wait
+    void storage.setItemAndWait(key, "value1");
+
+    expect(mockSender).toHaveBeenCalledWith("add", [v2StoreKey(key)], "value1");
+    jest.useRealTimers();
+  });
+
+  it("should remove an item and wait", () => {
+    const mockSender = jest.fn();
+    storage.registerSender(mockSender);
+    jest.useFakeTimers();
+
+    const key = "key1";
+    // asserting on sender invocation rather than Promise so no need to wait
+    void storage.removeItemAndWait(key);
+
+    expect(mockSender).toHaveBeenCalledWith("remove", [v2StoreKey(key)], undefined);
+    jest.useRealTimers();
+  });
+
+  it("should remove an item", () => {
+    const mockSender = jest.fn();
+    storage.registerSender(mockSender);
+    const key = "key1";
+    storage.removeItem(key);
+
+    expect(mockSender).toHaveBeenCalledWith("remove", [v2StoreKey(key)], undefined);
+  });
+
+  it("should clear all items", () => {
+    const mockSender = jest.fn();
+    storage.registerSender(mockSender);
+
+    storage.receive({ key1: "value1", key2: "value2" });
+    storage.clear();
+
+    expect(mockSender).toHaveBeenCalledWith("remove", ["key1", "key2"], undefined);
+  });
+
+  it("should get an item", () => {
+    const keys = ["key1", "!", "!", "pepr", "https://google.com", "sftp://here:22", "!"];
+    const results = ["value1", null, "!", "was-here", "3f7dd007-568f-4f4a-bbac-2e6bfff93860", "your-machine", " "];
+
+    keys.map((key, i) => {
+      const mockData: DataStore = { [v2StoreKey(key)]: results[i]! };
+
+      storage.receive(mockData);
+      const value = storage.getItem(keys[i]);
+      expect(value).toEqual(results[i]);
+    });
+  });
+
+  it("should return null for non-existing item", () => {
+    const value = storage.getItem("key1");
+
+    expect(value).toBeNull();
+  });
+
+  it("should subscribe and unsubscribe", () => {
+    const mockSubscriber = jest.fn();
+    const unsubscribe = storage.subscribe(mockSubscriber);
+
+    storage.receive({ key1: "value1" });
+
+    expect(mockSubscriber).toHaveBeenCalledWith({ key1: "value1" });
+
+    unsubscribe();
+
+    storage.receive({ key2: "value2" });
+
+    // Should not be called again after unsubscribe
+    expect(mockSubscriber).toHaveBeenCalledTimes(1);
+  });
+
+  it("should call onReady handlers", () => {
+    const mockReadyHandler = jest.fn();
+
+    storage.onReady(mockReadyHandler);
+    storage.receive({ key1: "value1" });
+
+    expect(mockReadyHandler).toHaveBeenCalledWith({ key1: "value1" });
+  });
+
+  it("should handle null data in receive method", () => {
+    const mockSubscriber = jest.fn();
+    storage.subscribe(mockSubscriber);
+
+    storage.receive(null as unknown as DataStore);
+
+    expect(mockSubscriber).toHaveBeenCalledWith({});
+  });
+});

package/src/lib/tls.test.ts

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { expect, test, describe } from "@jest/globals";
+import { genTLS } from "./tls";
+
+describe("tls", () => {
+  test("genTLS should generate a valid TLSOut object", () => {
+    const tls = genTLS("test");
+    expect(tls).toHaveProperty("ca");
+    expect(tls).toHaveProperty("crt");
+    expect(tls).toHaveProperty("key");
+    expect(tls).toHaveProperty("pem");
+    expect(tls.pem).toHaveProperty("ca");
+    expect(tls.pem).toHaveProperty("crt");
+    expect(tls.pem).toHaveProperty("key");
+  });
+});

package/src/lib/utils.test.ts

@@ -0,0 +1,69 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { expect, test, describe } from "@jest/globals";
+import { convertToBase64Map, convertFromBase64Map, base64Decode, base64Encode } from "./utils";
+
+describe("utils", () => {
+  test("convertToBase64Map should encode all ascii values and skip listed values in skip array", () => {
+    const obj = {
+      data: {
+        test1: "test1",
+        test2: "test2",
+        test3: "test3",
+        test4: "test4",
+      },
+    };
+    const skip = ["test2", "test4"];
+    convertToBase64Map(obj, skip);
+    expect(obj.data["test1"]).toBe(base64Encode("test1"));
+    expect(obj.data["test2"]).toBe("test2");
+    expect(obj.data["test3"]).toBe(base64Encode("test3"));
+    expect(obj.data["test4"]).toBe("test4");
+  });
+
+  test("convertFromBase64Map should decode all ascii values and skip values in skip array", () => {
+    const obj = {
+      data: {
+        test1: base64Encode("test1"),
+        test2: "test2",
+        test3: base64Encode("test3"),
+        test4: "test4",
+        test5: undefined as unknown as string,
+      },
+    };
+    const skip = convertFromBase64Map(obj);
+    expect(obj.data["test1"]).toBe("test1");
+    expect(obj.data["test2"]).toBe("test2");
+    expect(obj.data["test3"]).toBe("test3");
+    expect(obj.data["test4"]).toBe("test4");
+    expect(skip).toEqual(["test2", "test4"]);
+    expect(obj.data["test5"]).toBe("");
+  });
+
+  test("base64Decode should decode a base64 string", () => {
+    const data = "dGVzdDE=";
+    expect(base64Decode(data)).toBe("test1");
+  });
+
+  test("base64Encode should encode a string to base64", () => {
+    const data = "test1";
+    expect(base64Encode(data)).toBe("dGVzdDE=");
+  });
+
+  test("convertToBase64Map empty object", () => {
+    const obj = {};
+    const objOut = { data: {} };
+    convertToBase64Map(obj, []);
+    expect(obj).toStrictEqual(objOut);
+  });
+
+  test("convertFromBase64Map empty object", () => {
+    const obj = {};
+    const objOut = { data: {} };
+    const skip = convertFromBase64Map(obj);
+    expect(obj).toStrictEqual(objOut);
+    expect(skip).toEqual([]);
+  });
+});
+// Path: src/lib/utils.ts

package/src/lib/validate-request.test.ts

@@ -0,0 +1,124 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { beforeEach, describe, expect, it } from "@jest/globals";
+import { KubernetesObject } from "kubernetes-fluent-client";
+
+import { Operation, AdmissionRequest } from "./k8s";
+import { ValidateActionResponse } from "./types";
+import { PeprValidateRequest } from "./validate-request";
+
+describe("PeprValidateRequest", () => {
+  let mockRequest: AdmissionRequest<KubernetesObject>;
+
+  beforeEach(() => {
+    mockRequest = {
+      operation: Operation.CREATE,
+      uid: "test-uid",
+      kind: {
+        group: "",
+        version: "v1",
+        kind: "Pod",
+      },
+      resource: {
+        group: "",
+        version: "v1",
+        resource: "pods",
+      },
+      name: "test-pod",
+      userInfo: {
+        username: "test-user",
+        groups: ["test-group"],
+      },
+      object: {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: {
+          name: "test-pod",
+          labels: {
+            "test-label": "true",
+          },
+          annotations: {
+            "test-annotation": "true",
+          },
+        },
+      },
+    };
+  });
+
+  it("should initialize correctly for non-DELETE operations", () => {
+    const wrapper = new PeprValidateRequest(mockRequest);
+    expect(wrapper.Raw).toEqual(mockRequest.object);
+  });
+
+  it("should initialize correctly for DELETE operations", () => {
+    mockRequest = {
+      ...mockRequest,
+      operation: Operation.DELETE,
+      oldObject: {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: {
+          name: "test-pod",
+        },
+      },
+    };
+
+    const wrapper = new PeprValidateRequest(mockRequest);
+    expect(wrapper.Raw).toEqual(mockRequest.oldObject);
+  });
+
+  it("should provide access to old resource", () => {
+    mockRequest = {
+      ...mockRequest,
+      oldObject: {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: {
+          name: "old-test-pod",
+        },
+      },
+    };
+    const wrapper = new PeprValidateRequest(mockRequest);
+    expect(wrapper.OldResource).toEqual(mockRequest.oldObject);
+  });
+
+  it("should provide access to the request object", () => {
+    const wrapper = new PeprValidateRequest(mockRequest);
+    expect(wrapper.Request).toEqual(mockRequest);
+  });
+
+  it("should check if a label exists", () => {
+    const wrapper = new PeprValidateRequest(mockRequest);
+    expect(wrapper.HasLabel("test-label")).toBeTruthy();
+    expect(wrapper.HasLabel("non-existent-label")).toBeFalsy();
+  });
+
+  it("should check if an annotation exists", () => {
+    const wrapper = new PeprValidateRequest(mockRequest);
+    expect(wrapper.HasAnnotation("test-annotation")).toBeTruthy();
+    expect(wrapper.HasAnnotation("non-existent-annotation")).toBeFalsy();
+  });
+
+  it("should create an approval response", () => {
+    const wrapper = new PeprValidateRequest(mockRequest);
+    const response: ValidateActionResponse = wrapper.Approve();
+    expect(response).toEqual({ allowed: true });
+  });
+
+  it("should create a denial response", () => {
+    const wrapper = new PeprValidateRequest(mockRequest);
+    const response: ValidateActionResponse = wrapper.Deny("Not allowed", 403);
+    expect(response).toEqual({ allowed: false, statusMessage: "Not allowed", statusCode: 403 });
+  });
+
+  it("should throw an error if the request object is not available", () => {
+    mockRequest = {
+      ...mockRequest,
+      object: undefined as unknown as KubernetesObject,
+    };
+    expect(() => new PeprValidateRequest(mockRequest)).toThrowError(
+      "unable to load the request object into PeprRequest.Raw",
+    );
+  });
+});