Codex
263 lines
13 KiB
TypeScript
263 lines
13 KiB
TypeScript
import { spawn } from "node:child_process";
|
|
import { existsSync, readFileSync } from "node:fs";
|
|
|
|
type RunnerDisposition = "ready" | "infra-blocked" | "business-failed";
|
|
|
|
interface FailureContract {
|
|
failureKind: string;
|
|
httpStatus: number;
|
|
runnerDisposition: RunnerDisposition;
|
|
retryable: boolean;
|
|
}
|
|
|
|
const docPath = "docs/reference/auth-broker.md";
|
|
const doc = readFileSync(docPath, "utf8");
|
|
const rustMainPath = "src/components/microservices/auth-broker/src/main.rs";
|
|
const rustCargoPath = "src/components/microservices/auth-broker/Cargo.toml";
|
|
const cliAdapterPath = "scripts/src/auth-broker.ts";
|
|
|
|
function assertCondition(condition: unknown, message: string, detail: unknown = {}): void {
|
|
if (!condition) throw new Error(`${message}: ${JSON.stringify(detail)}`);
|
|
}
|
|
|
|
function assertDocContains(text: string): void {
|
|
assertCondition(doc.includes(text), `missing auth broker doc text: ${text}`);
|
|
}
|
|
|
|
function runCli(args: string[], env: Record<string, string | undefined> = {}): Promise<{ status: number | null; stdout: string; stderr: string; json: Record<string, unknown> | null }> {
|
|
const childEnv = { ...process.env, ...env };
|
|
delete childEnv.GH_TOKEN;
|
|
delete childEnv.GITHUB_TOKEN;
|
|
delete childEnv.UNIDESK_AUTH_BROKER_URL;
|
|
delete childEnv.AUTH_BROKER_URL;
|
|
if (env.GH_TOKEN !== undefined) childEnv.GH_TOKEN = env.GH_TOKEN;
|
|
if (env.GITHUB_TOKEN !== undefined) childEnv.GITHUB_TOKEN = env.GITHUB_TOKEN;
|
|
if (env.UNIDESK_AUTH_BROKER_URL !== undefined) childEnv.UNIDESK_AUTH_BROKER_URL = env.UNIDESK_AUTH_BROKER_URL;
|
|
if (env.AUTH_BROKER_URL !== undefined) childEnv.AUTH_BROKER_URL = env.AUTH_BROKER_URL;
|
|
return new Promise((resolve, reject) => {
|
|
const child = spawn("bun", ["scripts/cli.ts", ...args], {
|
|
cwd: process.cwd(),
|
|
env: childEnv,
|
|
});
|
|
const stdoutChunks: Buffer[] = [];
|
|
const stderrChunks: Buffer[] = [];
|
|
child.stdout.on("data", (chunk) => stdoutChunks.push(Buffer.from(chunk)));
|
|
child.stderr.on("data", (chunk) => stderrChunks.push(Buffer.from(chunk)));
|
|
child.on("error", reject);
|
|
child.on("close", (status) => {
|
|
const stdout = Buffer.concat(stdoutChunks).toString("utf8");
|
|
let json: Record<string, unknown> | null = null;
|
|
try {
|
|
json = JSON.parse(stdout) as Record<string, unknown>;
|
|
} catch {
|
|
json = null;
|
|
}
|
|
resolve({ status, stdout, stderr: Buffer.concat(stderrChunks).toString("utf8"), json });
|
|
});
|
|
});
|
|
}
|
|
|
|
function dataOf(response: Record<string, unknown>): Record<string, unknown> {
|
|
assertCondition(typeof response.data === "object" && response.data !== null && !Array.isArray(response.data), "CLI response data should be object", response);
|
|
return response.data as Record<string, unknown>;
|
|
}
|
|
|
|
const requiredOperations = [
|
|
"github.auth.status",
|
|
"github.issue.list",
|
|
"github.issue.read",
|
|
"github.pr.list",
|
|
"github.pr.read",
|
|
"github.pr.create",
|
|
"github.pr.comment.create",
|
|
];
|
|
|
|
const forbiddenBoundaries = [
|
|
"gh pr merge",
|
|
"arbitrary `gh api`",
|
|
"Docker registry login",
|
|
"deploy commands",
|
|
];
|
|
|
|
const requiredAuditFields = [
|
|
"requestId",
|
|
"observedAt",
|
|
"caller.plane",
|
|
"operation",
|
|
"repo",
|
|
"credentialRef",
|
|
"credentialValuePrinted",
|
|
"runnerDisposition",
|
|
"retryable",
|
|
];
|
|
|
|
const failureContracts: FailureContract[] = [
|
|
{ failureKind: "auth-not-configured", httpStatus: 503, runnerDisposition: "infra-blocked", retryable: false },
|
|
{ failureKind: "broker-unavailable", httpStatus: 503, runnerDisposition: "infra-blocked", retryable: true },
|
|
{ failureKind: "unauthorized-caller", httpStatus: 403, runnerDisposition: "infra-blocked", retryable: false },
|
|
{ failureKind: "repo-not-allowed", httpStatus: 403, runnerDisposition: "business-failed", retryable: false },
|
|
{ failureKind: "operation-not-allowed", httpStatus: 403, runnerDisposition: "business-failed", retryable: false },
|
|
{ failureKind: "dry-run-required", httpStatus: 409, runnerDisposition: "business-failed", retryable: false },
|
|
{ failureKind: "validation-failed", httpStatus: 400, runnerDisposition: "business-failed", retryable: false },
|
|
{ failureKind: "github-egress-failed", httpStatus: 502, runnerDisposition: "infra-blocked", retryable: true },
|
|
{ failureKind: "github-rate-limited", httpStatus: 429, runnerDisposition: "infra-blocked", retryable: true },
|
|
{ failureKind: "github-permission-denied", httpStatus: 403, runnerDisposition: "infra-blocked", retryable: false },
|
|
{ failureKind: "scope-insufficient", httpStatus: 403, runnerDisposition: "infra-blocked", retryable: false },
|
|
{ failureKind: "repo-not-found", httpStatus: 404, runnerDisposition: "business-failed", retryable: false },
|
|
{ failureKind: "upstream-invalid-response", httpStatus: 502, runnerDisposition: "infra-blocked", retryable: true },
|
|
];
|
|
|
|
const samplePreflightResponse = {
|
|
ok: true,
|
|
runnerDisposition: "ready" as const,
|
|
failureKind: null,
|
|
degradedReason: null,
|
|
tokenCoverage: {
|
|
ok: true,
|
|
source: "auth-broker",
|
|
scope: "broker-held-github-credential",
|
|
runnerEnvTokenRequired: false,
|
|
valuesPrinted: false,
|
|
},
|
|
prCapabilityContract: {
|
|
targetBranch: "master",
|
|
systemGhBinaryRequiredForWrites: false,
|
|
preflightCreatesPr: false,
|
|
preflightMergesPr: false,
|
|
brokerProxy: {
|
|
ok: true,
|
|
operations: ["github.auth.status", "github.pr.create"],
|
|
writesRemote: false,
|
|
},
|
|
},
|
|
};
|
|
|
|
function walk(value: unknown, path: string[] = []): void {
|
|
if (typeof value === "string") {
|
|
assertCondition(!/gh[pousr]_[A-Za-z0-9_]{20,}/u.test(value), "sample must not contain GitHub token-like values", { path, value });
|
|
assertCondition(!/github_pat_[A-Za-z0-9_]+/u.test(value), "sample must not contain GitHub PAT-like values", { path, value });
|
|
assertCondition(!/^Bearer\s+/iu.test(value), "sample must not contain Authorization header values", { path, value });
|
|
return;
|
|
}
|
|
if (Array.isArray(value)) {
|
|
value.forEach((item, index) => walk(item, [...path, String(index)]));
|
|
return;
|
|
}
|
|
if (typeof value === "object" && value !== null) {
|
|
for (const [key, entry] of Object.entries(value)) {
|
|
assertCondition(!["token", "secret", "authorization", "cookie"].includes(key.toLowerCase()), "sample must not expose secret-bearing keys", { path, key });
|
|
walk(entry, [...path, key]);
|
|
}
|
|
}
|
|
}
|
|
|
|
async function main(): Promise<void> {
|
|
for (const heading of ["## Existing Paths", "## API", "## Permission Boundary", "## Audit Fields", "## Failure Semantics", "## D601 Dev Acceptance"]) {
|
|
assertDocContains(heading);
|
|
}
|
|
for (const path of [
|
|
"scripts/src/gh.ts",
|
|
"scripts/src/auth-broker.ts",
|
|
"src/components/microservices/auth-broker/Cargo.toml",
|
|
"src/components/microservices/auth-broker/src/main.rs",
|
|
"scripts/code-queue-pr-preflight-example.ts",
|
|
"src/components/microservices/code-queue/src/runtime-preflight.ts",
|
|
"scripts/src/code-queue.ts",
|
|
"src/components/microservices/code-queue/src/index.ts",
|
|
"src/components/microservices/code-queue/docker-compose.d601.yml",
|
|
"src/components/microservices/code-queue/Dockerfile",
|
|
]) {
|
|
assertDocContains(path);
|
|
}
|
|
for (const operation of requiredOperations) assertDocContains(operation);
|
|
for (const boundary of forbiddenBoundaries) assertDocContains(boundary);
|
|
for (const field of requiredAuditFields) assertDocContains(field);
|
|
for (const failure of failureContracts) {
|
|
assertDocContains(failure.failureKind);
|
|
assertCondition(Number.isInteger(failure.httpStatus) && failure.httpStatus >= 400, "failure HTTP status must be an error status", failure);
|
|
}
|
|
assertCondition(new Set(failureContracts.map((item) => item.failureKind)).size === failureContracts.length, "failure kinds must be unique", failureContracts);
|
|
assertCondition(samplePreflightResponse.tokenCoverage.source === "auth-broker", "preflight should use broker token coverage", samplePreflightResponse.tokenCoverage);
|
|
assertCondition(samplePreflightResponse.tokenCoverage.runnerEnvTokenRequired === false, "runner env token must not be required", samplePreflightResponse.tokenCoverage);
|
|
assertCondition(samplePreflightResponse.prCapabilityContract.brokerProxy.writesRemote === false, "P0 preflight must not write remotely", samplePreflightResponse.prCapabilityContract);
|
|
assertCondition(samplePreflightResponse.prCapabilityContract.preflightMergesPr === false, "P0 preflight must not merge PRs", samplePreflightResponse.prCapabilityContract);
|
|
walk(samplePreflightResponse);
|
|
|
|
for (const path of [rustCargoPath, rustMainPath, cliAdapterPath]) {
|
|
assertCondition(existsSync(path), `required auth broker implementation file is missing: ${path}`);
|
|
}
|
|
const rustMain = readFileSync(rustMainPath, "utf8");
|
|
const cliAdapter = readFileSync(cliAdapterPath, "utf8");
|
|
assertCondition(rustMain.includes("GET") && rustMain.includes("/health"), "Rust skeleton should expose GET /health", rustMainPath);
|
|
assertCondition(rustMain.includes("/v1/github/gh"), "Rust skeleton should expose credential-request endpoint", rustMainPath);
|
|
assertCondition(rustMain.includes("/v1/github/pr-preflight"), "Rust skeleton should expose pr-preflight endpoint", rustMainPath);
|
|
assertCondition(rustMain.includes("credential_value_printed: false"), "audit event must force credentialValuePrinted=false", rustMainPath);
|
|
assertCondition(!rustMain.includes("GH_TOKEN") && !rustMain.includes("GITHUB_TOKEN"), "Rust skeleton must not read runner token env keys", rustMainPath);
|
|
assertCondition(cliAdapter.includes("valuesRead: false") && cliAdapter.includes("valuesPrinted: false"), "CLI adapter must declare secret values unread/unprinted", cliAdapterPath);
|
|
assertCondition(cliAdapter.includes("broker-needed") && cliAdapter.includes("auth-missing"), "CLI adapter must expose broker-needed/auth-missing shape", cliAdapterPath);
|
|
|
|
const noToken = await runCli(["auth-broker", "pr-preflight", "--repo", "pikasTech/unidesk", "--base", "master", "--head", "feature/auth-broker", "--issue", "59", "--dry-run"]);
|
|
assertCondition(noToken.status === 1, "missing broker endpoint should exit 1", { status: noToken.status, stdout: noToken.stdout, stderr: noToken.stderr });
|
|
assertCondition(noToken.json?.ok === false, "missing token response envelope should fail", noToken.json);
|
|
const noTokenData = dataOf(noToken.json ?? {});
|
|
assertCondition(noTokenData.failureKind === "auth-missing", "missing token should classify as auth-missing", noTokenData);
|
|
assertCondition(noTokenData.degradedReason === "broker-needed", "missing token should classify as broker-needed", noTokenData);
|
|
assertCondition(noTokenData.brokerNeeded === true, "missing token should set brokerNeeded", noTokenData);
|
|
assertCondition(!noToken.stdout.includes("contract-secret-marker"), "missing-token response must not leak secret marker strings", noToken.stdout);
|
|
|
|
const brokerReady = await runCli([
|
|
"auth-broker",
|
|
"pr-preflight",
|
|
"--repo",
|
|
"pikasTech/unidesk",
|
|
"--base",
|
|
"master",
|
|
"--head",
|
|
"feature/auth-broker",
|
|
"--issue",
|
|
"59",
|
|
"--dry-run",
|
|
"--endpoint",
|
|
"http://user:pass@127.0.0.1:4291?credential=abc",
|
|
]);
|
|
assertCondition(brokerReady.status === 0, "configured broker dry-run should exit 0", { status: brokerReady.status, stdout: brokerReady.stdout, stderr: brokerReady.stderr });
|
|
assertCondition(brokerReady.json?.ok === true, "configured broker dry-run envelope should succeed", brokerReady.json);
|
|
const readyData = dataOf(brokerReady.json ?? {});
|
|
const tokenCoverage = readyData.tokenCoverage as Record<string, unknown>;
|
|
const brokerCoverage = readyData.brokerCoverage as Record<string, unknown>;
|
|
const prCapability = readyData.prCapabilityContract as Record<string, unknown>;
|
|
const brokerProxy = prCapability.brokerProxy as Record<string, unknown>;
|
|
assertCondition(tokenCoverage.source === "auth-broker", "ready token coverage should come from broker", tokenCoverage);
|
|
assertCondition(tokenCoverage.runnerEnvTokenRequired === false, "ready token coverage should not require runner env token", tokenCoverage);
|
|
assertCondition(tokenCoverage.valuesPrinted === false, "ready token coverage must not print values", tokenCoverage);
|
|
assertCondition(String(brokerCoverage.endpoint).includes("http://***:***@127.0.0.1:4291/?..."), "endpoint should be sanitized", brokerCoverage);
|
|
assertCondition(prCapability.targetBranch === "master", "P0 capability should preserve target branch", prCapability);
|
|
assertCondition(prCapability.preflightCreatesPr === false && prCapability.preflightMergesPr === false, "P0 PR preflight must not write or merge", prCapability);
|
|
assertCondition(brokerProxy.writesRemote === false, "P0 broker proxy should not write remote", brokerProxy);
|
|
assertCondition(Array.isArray(brokerProxy.operations) && brokerProxy.operations.includes("github.pr.create"), "P0 broker proxy should include PR create dry-run operation", brokerProxy);
|
|
walk(readyData);
|
|
|
|
process.stdout.write(`${JSON.stringify({
|
|
ok: true,
|
|
docPath,
|
|
implementation: {
|
|
rustMainPath,
|
|
rustCargoPath,
|
|
cliAdapterPath,
|
|
},
|
|
operations: requiredOperations,
|
|
failureKinds: failureContracts.map((item) => item.failureKind),
|
|
p0Safety: {
|
|
runnerEnvTokenRequired: false,
|
|
preflightWritesRemote: false,
|
|
secretValuesPrinted: false,
|
|
liveWritesDefault: "dry-run-required",
|
|
},
|
|
}, null, 2)}\n`);
|
|
}
|
|
|
|
main().catch((error) => {
|
|
process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`);
|
|
process.exitCode = 1;
|
|
});
|