|
1 | | -import { describe, expect, test } from "bun:test"; |
| 1 | +import { readFileSync } from "node:fs"; |
| 2 | +import { describe, expect, spyOn, test } from "bun:test"; |
2 | 3 | import { configuredAuthProviders, loadConfig } from "../src/config"; |
3 | 4 |
|
4 | 5 | // Intelligence is part of the MINIMUM contract, so it belongs in the base environment every other |
@@ -27,6 +28,19 @@ const baseEnvironment = { |
27 | 28 | * The provider tests need the opposite starting point, or "Microsoft is configured" cannot be told |
28 | 29 | * apart from "Microsoft and the Google that was already there". |
29 | 30 | */ |
| 31 | +/** |
| 32 | + * A deployment that is actually deployed. |
| 33 | + * |
| 34 | + * `baseEnvironment` carries the example encryption key, which is refused under |
| 35 | + * `NODE_ENV=production` — so a production case built on it fails on the key before it reaches |
| 36 | + * whatever it meant to test. A real key here keeps each production test about its own subject. |
| 37 | + */ |
| 38 | +const productionEnvironment = { |
| 39 | + ...baseEnvironment, |
| 40 | + NODE_ENV: "production", |
| 41 | + KEY_ENCRYPTION_KEY: "b3BlbmJvdC1wcm9kdWN0aW9uLXRlc3Qta2V5LTMyMzI=", |
| 42 | +}; |
| 43 | + |
30 | 44 | const { |
31 | 45 | GOOGLE_OAUTH_CLIENT_ID: _googleId, |
32 | 46 | GOOGLE_OAUTH_CLIENT_SECRET: _googleSecret, |
@@ -418,6 +432,127 @@ describe("deployment configuration", () => { |
418 | 432 | expect(loadConfig(baseEnvironment).computer).toBeUndefined(); |
419 | 433 | }); |
420 | 434 |
|
| 435 | + // `.env.example` used to ship AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS=true, and copying that file is the |
| 436 | + // ordinary way a deployment gets its environment. So the way a hosted deployment ends up reaching |
| 437 | + // its own network is not forgetting to set something, it is inheriting something. Refused in |
| 438 | + // production for the same reason the example encryption key is: convenient locally, and an opening |
| 439 | + // anywhere else. |
| 440 | + test("refuses to start when a production deployment allows private hosts", () => { |
| 441 | + expect(() => |
| 442 | + loadConfig({ |
| 443 | + ...productionEnvironment, |
| 444 | + AGENT_COMPUTER_URL: "http://localhost:4100", |
| 445 | + AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS: "true", |
| 446 | + }), |
| 447 | + ).toThrow("AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS"); |
| 448 | + }); |
| 449 | + |
| 450 | + // Both sides of the comparison come out of the same env file, and the switch is read through |
| 451 | + // `optional`, which trims. Comparing NODE_ENV raw would mean a trailing space typed into that file |
| 452 | + // slipped past the refusal while the switch beside it still counted as set. |
| 453 | + test("refuses a production deployment whose NODE_ENV carries whitespace", () => { |
| 454 | + expect(() => |
| 455 | + loadConfig({ |
| 456 | + ...productionEnvironment, |
| 457 | + NODE_ENV: "production ", |
| 458 | + AGENT_COMPUTER_URL: "http://localhost:4100", |
| 459 | + AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS: "true", |
| 460 | + }), |
| 461 | + ).toThrow("AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS"); |
| 462 | + }); |
| 463 | + |
| 464 | + // The refusal has to name the way out, because the person reading it at boot is looking at a file |
| 465 | + // they copied and does not necessarily know which line is the problem. |
| 466 | + test("says to remove the line, and that it is local only", () => { |
| 467 | + const attempt = () => |
| 468 | + loadConfig({ |
| 469 | + ...productionEnvironment, |
| 470 | + AGENT_COMPUTER_URL: "http://localhost:4100", |
| 471 | + AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS: "true", |
| 472 | + }); |
| 473 | + |
| 474 | + expect(attempt).toThrow("local development only"); |
| 475 | + expect(attempt).toThrow("Remove it"); |
| 476 | + }); |
| 477 | + |
| 478 | + // The half of the matrix that was always right and has to stay right: absent means off, including |
| 479 | + // in the environment where the new refusal lives. |
| 480 | + test("starts in production when nothing asked for private hosts", () => { |
| 481 | + const config = loadConfig({ |
| 482 | + ...productionEnvironment, |
| 483 | + AGENT_COMPUTER_URL: "http://localhost:4100", |
| 484 | + COMPUTER_TOKEN: "computer-token", |
| 485 | + }); |
| 486 | + |
| 487 | + expect(config.computer?.allowPrivateHosts).toBe(false); |
| 488 | + }); |
| 489 | + |
| 490 | + // The local workflow is the reason the flag exists, so outside production it still does exactly |
| 491 | + // what it did. Warned about, because a laptop is where a deployment is configured and the warning |
| 492 | + // is the only chance to say this line does not travel. |
| 493 | + test.each(["development", undefined])( |
| 494 | + "warns and still allows private hosts under NODE_ENV=%p", |
| 495 | + (nodeEnv) => { |
| 496 | + const consoleWarn = spyOn(console, "warn").mockImplementation(() => {}); |
| 497 | + |
| 498 | + try { |
| 499 | + const config = loadConfig({ |
| 500 | + ...baseEnvironment, |
| 501 | + ...(nodeEnv ? { NODE_ENV: nodeEnv } : {}), |
| 502 | + AGENT_COMPUTER_URL: "http://localhost:4100", |
| 503 | + AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS: "true", |
| 504 | + }); |
| 505 | + |
| 506 | + expect(config.computer?.allowPrivateHosts).toBe(true); |
| 507 | + // Searched rather than indexed: `baseEnvironment` carries the example encryption key, which |
| 508 | + // warns on its own account first. |
| 509 | + const warning = consoleWarn.mock.calls |
| 510 | + .map(([first]) => String(first)) |
| 511 | + .find((line) => line.includes("AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS")); |
| 512 | + |
| 513 | + expect(warning).toBeDefined(); |
| 514 | + expect(warning).toContain("local development only"); |
| 515 | + expect(warning).toContain("Remove it before deploying"); |
| 516 | + } finally { |
| 517 | + consoleWarn.mockRestore(); |
| 518 | + } |
| 519 | + }, |
| 520 | + ); |
| 521 | + |
| 522 | + // The refusal above only helps a deployment that reads it. The reason there was anything to refuse |
| 523 | + // is that the file everybody copies arrived with the switch on, so the file is worth asserting |
| 524 | + // about directly: a live line here is the regression, whatever the code does afterwards. |
| 525 | + test("the shipped example does not turn private hosts on", () => { |
| 526 | + const example = readFileSync( |
| 527 | + new URL("../../.env.example", import.meta.url), |
| 528 | + "utf8", |
| 529 | + ); |
| 530 | + |
| 531 | + // Commented-out mentions are wanted — that is how the switch stays discoverable for a laptop. |
| 532 | + const live = example |
| 533 | + .split("\n") |
| 534 | + .filter((line) => |
| 535 | + /^\s*AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS\s*=/.test(line), |
| 536 | + ); |
| 537 | + |
| 538 | + expect(live).toEqual([]); |
| 539 | + }); |
| 540 | + |
| 541 | + // Anything that is not the exact opt-in is not an opt-in, so it is not the thing being refused |
| 542 | + // either. A deployment that wrote something else has private hosts off and starts. |
| 543 | + test.each(["false", "1", "yes", ""])( |
| 544 | + "starts in production on AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS=%p", |
| 545 | + (value) => { |
| 546 | + const config = loadConfig({ |
| 547 | + ...productionEnvironment, |
| 548 | + AGENT_COMPUTER_URL: "http://localhost:4100", |
| 549 | + AGENT_COMPUTER_ALLOW_PRIVATE_HOSTS: value, |
| 550 | + }); |
| 551 | + |
| 552 | + expect(config.computer?.allowPrivateHosts).toBe(false); |
| 553 | + }, |
| 554 | + ); |
| 555 | + |
421 | 556 | test.each([ |
422 | 557 | ["Docker", "COMPUTER_SUPERVISOR_URL"], |
423 | 558 | ["shared", "AGENT_COMPUTER_URL"], |
|
0 commit comments