unbound-cli 1.16.19 → 1.16.21

package/test/flags.test.js

@@ -0,0 +1,236 @@
+const { test } = require('node:test');
+const assert = require('node:assert/strict');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const {
+  buildDataSecurityQuery,
+  buildTerminalQuery,
+  dataSecurityRows,
+  maskValue,
+  redactDataSecurityLog,
+  resolveGuardrailIds,
+  resolveTraceId,
+  terminalRows,
+} = require('../src/lib/flags');
+
+const TRACE = '225c6413-26e4-4cd2-85a6-8c5ccfc3c5ef';
+
+test('terminal query asks only for flagged runs when no --action is given', () => {
+  const q = buildTerminalQuery({});
+  assert.deepEqual(q.policy_actions, ['block', 'approval', 'warn', 'audit']);
+  assert.equal(q.page, 1);
+  assert.equal(q.time_window, 'THIRTY_DAYS');
+});
+
+test('terminal query narrows to the given outcomes, policies and trace', () => {
+  const q = buildTerminalQuery({ action: 'Block,warn', policy: '12,13', trace: TRACE.toUpperCase(), page: '2' });
+  assert.deepEqual(q.policy_actions, ['block', 'warn']);
+  assert.deepEqual(q.policy_ids, ['12', '13']);
+  assert.equal(q.search, TRACE);
+  assert.equal(q.page, 2);
+});
+
+test('terminal query rejects an unknown outcome, a bad page and a non-UUID trace', () => {
+  assert.throws(() => buildTerminalQuery({ action: 'nuke' }), /Invalid --action "nuke"/);
+  assert.throws(() => buildTerminalQuery({ page: '0' }), /Invalid --page/);
+  assert.throws(() => buildTerminalQuery({ trace: 'abc' }), /Invalid trace ID/);
+});
+
+test('data security query maps --findings to the backend values', () => {
+  assert.deepEqual(buildDataSecurityQuery({}).findings, ['real']);
+  assert.deepEqual(buildDataSecurityQuery({ findings: 'false-positive' }).findings, ['false_positive']);
+  assert.deepEqual(buildDataSecurityQuery({ findings: 'all' }).findings, ['real', 'false_positive']);
+  assert.throws(() => buildDataSecurityQuery({ findings: 'maybe' }), /Invalid --findings/);
+  const trace = '3f2a6c1e-8b7d-4e2f-9a1c-5d6e7f8a9b0c';
+  assert.deepEqual(buildDataSecurityQuery({ trace }).findings, ['real', 'false_positive']);
+  assert.deepEqual(buildDataSecurityQuery({ trace, findings: 'real' }).findings, ['real']);
+});
+
+test('guardrail names resolve to IDs case-insensitively, and an unknown name lists the choices', () => {
+  const available = [{ id: 4, name: 'PII' }, { id: 11, name: 'Secrets' }];
+  assert.deepEqual(resolveGuardrailIds('secrets,4', available), ['11', '4']);
+  assert.throws(() => resolveGuardrailIds('nope', available), /Available: PII, Secrets/);
+});
+
+test('maskValue keeps only the ends of a long value', () => {
+  assert.equal(maskValue('AKIAE2ETESTKEY0000001'), 'AK****01');
+  assert.equal(maskValue('short'), '****');
+  assert.equal(maskValue(''), '');
+});
+
+const LOG = {
+  id: 7,
+  trace_id: TRACE,
+  timestamp: '2026-09-24T19:17:53.790Z',
+  user_email: 'ada@example.com',
+  application_name: 'CLAUDE_CODE',
+  guardrails: ['Secrets'],
+  guardrail_actions: ['Block'],
+  sensitive_contents: ['AKIAE2ETESTKEY0000001'],
+  sensitive_content_details: [{
+    action_id: 1, action: 'Block', guardrail_name: 'Secrets', sensitive_content: 'AKIAE2ETESTKEY0000001', is_false_positive: false,
+  }],
+  prompt: { user_prompt: 'my key is AKIAE2ETESTKEY0000001' },
+};
+
+test('redacted data security JSON carries no detected value and no prompt', () => {
+  const text = JSON.stringify(redactDataSecurityLog(LOG));
+  assert.ok(!text.includes('AKIAE2ETESTKEY0000001'), text);
+  assert.ok(!('prompt' in redactDataSecurityLog(LOG)));
+});
+
+test('data security rows list one line per detection, masked unless revealed', () => {
+  const [row] = dataSecurityRows([LOG]);
+  assert.equal(row[0], '1');
+  assert.equal(row[1], '2026-09-24 19:17');
+  assert.equal(row[6], 'AK****01');
+  assert.equal(dataSecurityRows([LOG], { reveal: true })[0][6], 'AKIAE2ETESTKEY0000001');
+});
+
+test('terminal rows show policies with their action and the feedback as a label', () => {
+  const [row] = terminalRows([{
+    id: 554681,
+    created_at: '2026-09-24T19:17:53.790Z',
+    email: 'ada@example.com',
+    terminal_command: 'git status',
+    all_matched_policies: [{ name: 'Warn AWS', action: 'warn' }],
+    policy_action: 'warn',
+    risk_score: 5,
+    user_feedback: { feedback_type: 'reject' },
+    trace_id: TRACE,
+  }]);
+  assert.deepEqual(row, ['554681', '2026-09-24 19:17', 'ada@example.com', 'git status', 'Warn AWS (warn)',
+    'warn', 5, 'False positive', TRACE]);
+});
+
+test('resolveTraceId lowercases and trims', () => {
+  assert.equal(resolveTraceId(`  ${TRACE.toUpperCase()} `), TRACE);
+});
+
+// End to end through the real binary, against a fake backend that records requests.
+
+function startServer(routes) {
+  const seen = [];
+  const server = http.createServer((req, res) => {
+    let body = '';
+    req.on('data', (c) => { body += c; });
+    req.on('end', () => {
+      const url = new URL(req.url, 'http://x');
+      seen.push({ method: req.method, path: url.pathname, query: url.searchParams, body: body ? JSON.parse(body) : null });
+      const [status, payload] = routes(req.method, url) || [404, { error: 'no route' }];
+      res.writeHead(status, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(payload));
+    });
+  });
+  return new Promise((resolve) => server.listen(0, '127.0.0.1', () => resolve({ server, seen, port: server.address().port })));
+}
+
+function runCli(port, args) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'flags-test-'));
+  fs.mkdirSync(path.join(home, '.unbound'));
+  fs.writeFileSync(path.join(home, '.unbound', 'config.json'),
+    JSON.stringify({ api_key: 'test-key', base_url: `http://127.0.0.1:${port}` }));
+  return new Promise((resolve) => {
+    const child = spawn('node', [path.join(__dirname, '..', 'src', 'index.js'), ...args], {
+      env: { ...process.env, HOME: home, UNBOUND_API_URL: '', UNBOUND_TELEMETRY: '0', UNBOUND_NO_UPDATE_CHECK: '1' },
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.on('data', (d) => { stdout += d; });
+    child.stderr.on('data', (d) => { stderr += d; });
+    child.on('close', (code) => {
+      fs.rmSync(home, { recursive: true, force: true });
+      resolve({ code, stdout, stderr });
+    });
+  });
+}
+
+test('flags terminal mark-fp posts a reject feedback for the run', async () => {
+  const { server, seen, port } = await startServer((method, url) =>
+    (method === 'POST' && url.pathname === '/api/v1/analytics/feedback/'
+      ? [201, { status: 'success', action: 'created', feedback_id: 3 }] : null));
+  try {
+    const r = await runCli(port, ['flags', 'terminal', 'mark-fp', '554681', '--risk-score', '8', '--comment', 'build script']);
+    assert.equal(r.code, 0, r.stderr);
+    const post = seen.find((s) => s.method === 'POST');
+    assert.deepEqual(post.body, {
+      prompt_analytics_id: 554681, analytics_type: 'terminal_command', feedback_type: 'reject', risk_score: 8, comment: 'build script',
+    });
+  } finally {
+    server.close();
+  }
+});
+
+test('flags data-security mark-fp posts the detection ID', async () => {
+  const { server, seen, port } = await startServer((method, url) =>
+    (method === 'POST' && url.pathname === '/api/v1/analytics/guardrails/mark_false_positive/'
+      ? [200, { message: 'ok' }] : null));
+  try {
+    const r = await runCli(port, ['flags', 'data-security', 'mark-fp', '5521']);
+    assert.equal(r.code, 0, r.stderr);
+    assert.deepEqual(seen.find((s) => s.method === 'POST').body, { guardrail_action_id: 5521 });
+  } finally {
+    server.close();
+  }
+});
+
+test('trace keeps only exact log matches, masks values, and exits 1 when a source fails', async () => {
+  const { server, port } = await startServer((method, url) => {
+    if (url.pathname === '/api/v1/logs/prompts/') {
+      return [200, { prompts: [
+        { id: '1', traceId: TRACE, userPrompt: 'my key is AKIAE2ETESTKEY0000001' },
+        { id: '2', traceId: null, userPrompt: `mentions ${TRACE}` },
+      ] }];
+    }
+    if (url.pathname === '/api/v1/analytics/terminal_commands/') return [403, { error: 'Manager or admin access required' }];
+    if (url.pathname === '/api/v1/analytics/guardrails/') {
+      // A trace lookup must ask for false positives too.
+      const all = url.searchParams.getAll('findings').join() === 'real,false_positive';
+      return all ? [200, { logs: { data: [LOG] } }] : [400, { error: 'findings must be all' }];
+    }
+    return null;
+  });
+  try {
+    const r = await runCli(port, ['trace', TRACE, '--json']);
+    assert.equal(r.code, 1);
+    const out = JSON.parse(r.stdout);
+    assert.deepEqual(out.logs.rows.map((p) => p.id), ['1']);
+    assert.equal(out.terminal_runs.error, 'Manager or admin access required');
+    assert.equal(out.data_security.rows.length, 1);
+    assert.ok(!r.stdout.includes('AKIAE2ETESTKEY0000001'), 'values must be masked without --reveal');
+  } finally {
+    server.close();
+  }
+});
+
+test('trace reads every page of a source and hides log prompts in the table', async () => {
+  const { server, seen, port } = await startServer((method, url) => {
+    const page = url.searchParams.get('page');
+    if (url.pathname === '/api/v1/logs/prompts/') {
+      return [200, { prompts: [{ id: '1', traceId: TRACE, userPrompt: 'my key is AKIAE2ETESTKEY0000001' }], total_pages: 1 }];
+    }
+    if (url.pathname === '/api/v1/analytics/terminal_commands/') {
+      // A row from another trace stands in for an older backend that ignores search.
+      return [200, { terminal_commands: [{ id: Number(page), trace_id: TRACE }, { id: 99, trace_id: 'other' }], has_more: page === '1' }];
+    }
+    if (url.pathname === '/api/v1/analytics/guardrails/') return [200, { logs: { data: [], total_pages: 0 } }];
+    return null;
+  });
+  try {
+    const json = await runCli(port, ['trace', TRACE, '--json']);
+    assert.equal(json.code, 0, json.stderr);
+    assert.deepEqual(JSON.parse(json.stdout).terminal_runs.rows.map((row) => row.id), [1, 2]);
+    assert.deepEqual(seen.filter((s) => s.path === '/api/v1/analytics/terminal_commands/').map((s) => s.query.get('page')),
+      ['1', '2']);
+    const table = await runCli(port, ['trace', TRACE]);
+    assert.ok(!table.stdout.includes('AKIAE2ETESTKEY0000001'), table.stdout);
+    const revealed = await runCli(port, ['trace', TRACE, '--reveal', '--wide']);
+    assert.ok(revealed.stdout.includes('AKIAE2ETESTKEY0000001'), revealed.stdout);
+  } finally {
+    server.close();
+  }
+});

package/test/onboard-failure-exit.test.js

@@ -27,6 +27,9 @@ function loadOnboard({ isRoot, setupOk, reportThrows }) {
   const setupReport = require('../src/setup-report');
 
   setup.hasRootPrivileges = () => isRoot;
+  // Detection and the Pi step are covered in tool-detect.test.js; here pi is absent,
+  // so the bundle is the only setup call.
+  require('../src/toolDetect').detectInstalledTools = (names) => ({ detected: [], missing: names });
   // Mirror runBatch's real behavior: on failure it sets exitCode and (best-effort)
   // reports, then returns { ok: false }. We model both the report call and the
   // exitCode side effect so the test exercises onboard's own handling.

package/test/onboard-scope.test.js

@@ -57,6 +57,9 @@ async function runOnboard(isRoot, { setCron = false, discoveryKey = 'd', domain,
   const scheduled = require('../src/scheduled');
 
   setup.hasRootPrivileges = () => isRoot;
+  // Detection and the Pi step are covered in tool-detect.test.js; here pi is absent,
+  // so the bundle is the only setup call.
+  require('../src/toolDetect').detectInstalledTools = (names) => ({ detected: [], missing: names });
   setup.runMdmSetupAllBundle = async () => { calls.mdm++; return { ok: true, skipped: [] }; };
   setup.runSetupAllBundle = async () => { calls.user++; return { ok: true, skipped: [] }; };
   discover.runDiscoveryScan = async (o) => { calls.discovery++; calls.discoveryArgs = o; };