qualty 0.1.30 → 0.1.32

package/bin/auth-ci-bundle.js

@@ -0,0 +1,348 @@
+import { gunzipSync, gzipSync } from "node:zlib";
+import { mkdirSync, readFileSync, writeFileSync, chmodSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export const AUTH_BUNDLE_VERSION = 2;
+export const GITHUB_SECRET_MAX_BYTES = 64 * 1024;
+export const GITHUB_SECRET_SAFE_BYTES = GITHUB_SECRET_MAX_BYTES - 1024;
+export const AUTH_SECRET_PRIMARY = "QUALTY_AUTH_STATE_B64";
+export const AUTH_SHARDS_VARIABLE = "QUALTY_AUTH_SHARDS";
+export const AUTH_PROFILES_VARIABLE = "QUALTY_AUTH_PROFILES";
+export const MAX_AUTH_SHARDS = 10;
+
+const QUALTY_SHARED_CREDS_DIR = join(homedir(), ".qualty");
+
+export function safePathSegment(value, fallback = "default") {
+  const out = String(value || "")
+    .trim()
+    .replace(/[^a-zA-Z0-9._-]+/g, "_")
+    .replace(/^_+|_+$/g, "");
+  return out || fallback;
+}
+
+export function localAuthStatePath({ orgId, projectId, profile }) {
+  const orgSeg = safePathSegment(orgId || "default-org", "default-org");
+  const projectSeg = safePathSegment(projectId || "default-project", "default-project");
+  const profileSeg = safePathSegment(profile || "default", "default");
+  return join(QUALTY_SHARED_CREDS_DIR, "local-contexts", orgSeg, projectSeg, `${profileSeg}.json`);
+}
+
+export function authShardSecretName(shardIndex) {
+  const index = Number(shardIndex);
+  if (!Number.isInteger(index) || index < 1) {
+    throw new Error(`Invalid auth shard index: ${shardIndex}`);
+  }
+  return index === 1 ? AUTH_SECRET_PRIMARY : `${AUTH_SECRET_PRIMARY}_${index}`;
+}
+
+export function loadStorageStateFromPath(statePath) {
+  const raw = readFileSync(statePath, "utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Invalid auth JSON at ${statePath}: ${err.message}`);
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+    throw new Error(`Invalid auth JSON at ${statePath}: expected an object`);
+  }
+  return parsed;
+}
+
+export function buildAuthBundleManifest({ orgId, projectId, profileEntries }) {
+  const profiles = {};
+  for (const entry of profileEntries) {
+    const name = String(entry.name || "").trim();
+    if (!name) continue;
+    const localProfileName =
+      String(entry.localProfileName || entry.local_profile_name || name).trim() || name;
+    const state =
+      entry.state && typeof entry.state === "object"
+        ? entry.state
+        : loadStorageStateFromPath(entry.statePath);
+    profiles[name] = {
+      local_profile_name: localProfileName,
+      state,
+    };
+  }
+  if (Object.keys(profiles).length === 0) {
+    throw new Error("No auth profiles to export.");
+  }
+  return {
+    version: AUTH_BUNDLE_VERSION,
+    org_id: String(orgId || "").trim(),
+    project_id: String(projectId || "").trim(),
+    profiles,
+  };
+}
+
+export function encodeAuthBundleManifest(manifest) {
+  const raw = Buffer.from(JSON.stringify(manifest), "utf8");
+  return {
+    encoding: "gzip+base64",
+    payload: gzipSync(raw).toString("base64"),
+    rawBytes: raw.length,
+  };
+}
+
+function isPlaywrightStorageState(value) {
+  return (
+    value &&
+    typeof value === "object" &&
+    !Array.isArray(value) &&
+    (Array.isArray(value.cookies) || Array.isArray(value.origins))
+  );
+}
+
+export function decodeAuthPayload(payloadB64) {
+  const trimmed = String(payloadB64 || "").trim();
+  if (!trimmed) {
+    throw new Error("Empty auth payload.");
+  }
+  let decoded;
+  try {
+    decoded = Buffer.from(trimmed, "base64");
+  } catch (err) {
+    throw new Error(`Invalid base64 auth payload: ${err.message}`);
+  }
+
+  let jsonText;
+  try {
+    jsonText = gunzipSync(decoded).toString("utf8");
+  } catch {
+    jsonText = decoded.toString("utf8");
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(jsonText);
+  } catch (err) {
+    throw new Error(`Auth payload is not valid JSON: ${err.message}`);
+  }
+
+  if (parsed?.version === AUTH_BUNDLE_VERSION && parsed?.profiles && typeof parsed.profiles === "object") {
+    return { format: "bundle", manifest: parsed };
+  }
+  if (isPlaywrightStorageState(parsed)) {
+    return { format: "legacy-single", state: parsed };
+  }
+  throw new Error("Unrecognized auth payload format.");
+}
+
+function manifestSubset(manifest, profileNames) {
+  const profiles = {};
+  for (const name of profileNames) {
+    if (manifest.profiles?.[name]) {
+      profiles[name] = manifest.profiles[name];
+    }
+  }
+  return {
+    version: AUTH_BUNDLE_VERSION,
+    org_id: manifest.org_id,
+    project_id: manifest.project_id,
+    profiles,
+  };
+}
+
+export function shardAuthBundleManifest(manifest) {
+  const profileNames = Object.keys(manifest.profiles || {});
+  if (profileNames.length === 0) {
+    throw new Error("Auth bundle has no profiles.");
+  }
+
+  const singles = profileNames.map((name) => {
+    const encoded = encodeAuthBundleManifest(manifestSubset(manifest, [name]));
+    return { name, encoded, bytes: Buffer.byteLength(encoded.payload, "utf8") };
+  });
+
+  const allEncoded = encodeAuthBundleManifest(manifest);
+  if (Buffer.byteLength(allEncoded.payload, "utf8") <= GITHUB_SECRET_SAFE_BYTES) {
+    return [
+      {
+        secretName: AUTH_SECRET_PRIMARY,
+        payload: allEncoded.payload,
+        encoding: allEncoded.encoding,
+        rawBytes: allEncoded.rawBytes,
+        profileNames,
+      },
+    ];
+  }
+
+  const shards = [];
+  let currentNames = [];
+  let currentBytes = 0;
+
+  const flush = () => {
+    if (currentNames.length === 0) return;
+    const encoded = encodeAuthBundleManifest(manifestSubset(manifest, currentNames));
+    const bytes = Buffer.byteLength(encoded.payload, "utf8");
+    if (bytes > GITHUB_SECRET_SAFE_BYTES) {
+      throw new Error(
+        `Profile "${currentNames.join(", ")}" is too large for a GitHub secret on its own ` +
+          `(${bytes} bytes; limit ~${GITHUB_SECRET_SAFE_BYTES}). Try a shorter-lived session.`
+      );
+    }
+    shards.push({
+      secretName: authShardSecretName(shards.length + 1),
+      payload: encoded.payload,
+      encoding: encoded.encoding,
+      rawBytes: encoded.rawBytes,
+      profileNames: [...currentNames],
+    });
+    currentNames = [];
+    currentBytes = 0;
+  };
+
+  for (const row of singles) {
+    if (row.bytes > GITHUB_SECRET_SAFE_BYTES) {
+      throw new Error(
+        `Profile "${row.name}" is too large for a GitHub secret (${row.bytes} bytes; limit ~${GITHUB_SECRET_SAFE_BYTES}).`
+      );
+    }
+    const nextNames = [...currentNames, row.name];
+    const nextEncoded = encodeAuthBundleManifest(manifestSubset(manifest, nextNames));
+    const nextBytes = Buffer.byteLength(nextEncoded.payload, "utf8");
+    if (nextBytes > GITHUB_SECRET_SAFE_BYTES && currentNames.length > 0) {
+      flush();
+    }
+    currentNames.push(row.name);
+    currentBytes = Buffer.byteLength(
+      encodeAuthBundleManifest(manifestSubset(manifest, currentNames)).payload,
+      "utf8"
+    );
+  }
+  flush();
+
+  if (shards.length > MAX_AUTH_SHARDS) {
+    throw new Error(
+      `Auth bundle requires ${shards.length} GitHub secrets (max ${MAX_AUTH_SHARDS}). ` +
+        "Export fewer profiles with --profiles or --suite-id / --ids."
+    );
+  }
+  return shards;
+}
+
+export function collectAuthShardPayloadsFromEnv(env = process.env) {
+  const payloads = [];
+  for (let index = 1; index <= MAX_AUTH_SHARDS; index += 1) {
+    const secretName = authShardSecretName(index);
+    const value = String(env[secretName] || "").trim();
+    if (!value) break;
+    payloads.push({ secretName, payload: value });
+  }
+  return payloads;
+}
+
+export function mergeAuthManifests(manifests) {
+  const mergedProfiles = {};
+  let orgId = "";
+  let projectId = "";
+  for (const manifest of manifests) {
+    orgId = orgId || String(manifest.org_id || "").trim();
+    projectId = projectId || String(manifest.project_id || "").trim();
+    for (const [name, entry] of Object.entries(manifest.profiles || {})) {
+      mergedProfiles[name] = entry;
+    }
+  }
+  return {
+    version: AUTH_BUNDLE_VERSION,
+    org_id: orgId,
+    project_id: projectId,
+    profiles: mergedProfiles,
+  };
+}
+
+export function restoreAuthBundleToDisk({
+  orgId,
+  projectId,
+  manifest,
+  fallbackProfile = "",
+}) {
+  const restored = [];
+  for (const [name, entry] of Object.entries(manifest.profiles || {})) {
+    const localProfileName =
+      String(entry?.local_profile_name || name).trim() || name;
+    const state = entry?.state;
+    if (!isPlaywrightStorageState(state)) {
+      throw new Error(`Profile "${name}" has invalid storage state in auth bundle.`);
+    }
+    const authFile = localAuthStatePath({
+      orgId,
+      projectId,
+      profile: localProfileName,
+    });
+    mkdirSync(join(authFile, ".."), { recursive: true });
+    writeFileSync(authFile, `${JSON.stringify(state)}\n`, "utf8");
+    try {
+      chmodSync(authFile, 0o600);
+    } catch {
+      // ignore
+    }
+    restored.push({ name, localProfileName, path: authFile });
+  }
+  return restored;
+}
+
+export function restoreLegacySingleAuthToDisk({ orgId, projectId, state, fallbackProfile }) {
+  const profile = String(fallbackProfile || "").trim();
+  if (!profile) {
+    throw new Error(
+      "Legacy single-profile auth payload requires QUALTY_AUTH_PROFILE (or --profile)."
+    );
+  }
+  const authFile = localAuthStatePath({ orgId, projectId, profile });
+  mkdirSync(join(authFile, ".."), { recursive: true });
+  writeFileSync(authFile, `${JSON.stringify(state)}\n`, "utf8");
+  try {
+    chmodSync(authFile, 0o600);
+  } catch {
+    // ignore
+  }
+  return [{ name: profile, localProfileName: profile, path: authFile }];
+}
+
+export function restoreAuthPayloadsToDisk({
+  payloads,
+  orgId,
+  projectId,
+  fallbackProfile = "",
+}) {
+  const manifests = [];
+  let legacySingle = null;
+
+  for (const row of payloads) {
+    const decoded = decodeAuthPayload(row.payload);
+    if (decoded.format === "bundle") {
+      manifests.push(decoded.manifest);
+      continue;
+    }
+    if (legacySingle) {
+      throw new Error("Multiple legacy single-profile auth payloads are not supported.");
+    }
+    legacySingle = decoded.state;
+  }
+
+  if (manifests.length > 0) {
+    const merged = mergeAuthManifests(manifests);
+    const effectiveOrgId = String(orgId || merged.org_id || "").trim();
+    const effectiveProjectId = String(projectId || merged.project_id || "").trim();
+    return restoreAuthBundleToDisk({
+      orgId: effectiveOrgId,
+      projectId: effectiveProjectId,
+      manifest: merged,
+      fallbackProfile,
+    });
+  }
+
+  if (legacySingle) {
+    return restoreLegacySingleAuthToDisk({
+      orgId,
+      projectId,
+      state: legacySingle,
+      fallbackProfile,
+    });
+  }
+
+  throw new Error("No auth payloads to restore.");
+}

package/bin/local-runner.js

@@ -289,6 +289,19 @@ function authSetupCommand(projectId, profileName) {
   return `qualty auth setup --project ${pid} --profile "${name}"`;
 }
 
+function loadStorageStateForBackend(statePath) {
+  if (!statePath) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(statePath, "utf8"));
+    if (!parsed || typeof parsed !== "object") return null;
+    return parsed;
+  } catch (err) {
+    // eslint-disable-next-line no-console
+    console.warn(`[qualty][auth] could not read local auth state for backend injection: ${err?.message || err}`);
+    return null;
+  }
+}
+
 export function summarizeStorageStateFile(statePath) {
   const path = String(statePath || "").trim();
   if (!path || !existsSync(path)) {
@@ -774,8 +787,9 @@ async function runLocalSingleCombination({
     explicitAuthProfile: String(authProfile || "").trim(),
     noAuthState: Boolean(noAuthState),
   });
+  const explicitAuthProfile = String(authProfile || "").trim();
   const claimProfile = localProfileLabel(claimSavedLogin);
-  const effectiveProfile = String(authProfile || "").trim() || setupFromClaim?.profile || claimProfile;
+  const effectiveProfile = explicitAuthProfile || setupFromClaim?.profile || claimProfile;
   const resolvedStoragePath =
     !noAuthState && effectiveProfile
       ? localAuthStatePath({
@@ -787,17 +801,20 @@ async function runLocalSingleCombination({
   const finalStoragePath =
     !noAuthState && setupFromClaim?.path && existsSync(setupFromClaim.path)
       ? setupFromClaim.path
-      : !noAuthState && storageStatePath && existsSync(storageStatePath)
-      ? storageStatePath
-      : !noAuthState && resolvedStoragePath && existsSync(resolvedStoragePath)
-        ? resolvedStoragePath
-        : null;
+      : !noAuthState &&
+          explicitAuthProfile &&
+          storageStatePath &&
+          existsSync(storageStatePath)
+        ? storageStatePath
+        : !noAuthState && resolvedStoragePath && existsSync(resolvedStoragePath)
+          ? resolvedStoragePath
+          : null;
 
   let authSource = "none";
   if (!noAuthState && finalStoragePath) {
     if (setupFromClaim?.path && finalStoragePath === setupFromClaim.path) {
       authSource = "interactive setup during run";
-    } else if (storageStatePath && finalStoragePath === storageStatePath) {
+    } else if (explicitAuthProfile && storageStatePath && finalStoragePath === storageStatePath) {
       authSource = "--auth-profile flag";
     } else if (resolvedStoragePath && finalStoragePath === resolvedStoragePath) {
       authSource = claimProfile ? "dashboard saved login profile" : "resolved profile path";
@@ -842,6 +859,8 @@ async function runLocalSingleCombination({
 
   let cloudflared = null;
   try {
+    const storageStateForBackend = loadStorageStateForBackend(finalStoragePath);
+
     const wsParts = parseWsEndpoint(cdpEndpoint);
     if (!Number.isFinite(wsParts.port) || wsParts.port < 1 || wsParts.port > 65535) {
       throw new Error(`Could not parse local browser WebSocket port from ${cdpEndpoint}`);
@@ -874,8 +893,13 @@ async function runLocalSingleCombination({
         connect_url: publicConnectUrl,
         connect_kind: "playwright",
         start_url: url,
+        ...(storageStateForBackend ? { storage_state: storageStateForBackend } : {}),
       }),
     });
+    if (storageStateForBackend) {
+      // eslint-disable-next-line no-console
+      console.log("[qualty][auth] sent local auth state to backend for browser context injection");
+    }
     // eslint-disable-next-line no-console
     console.log(`[qualty] Registered local browser tunnel for ${effectiveDevice}`);
     const result = await waitForCombinationDone({