276 lines
18 KiB
JavaScript
276 lines
18 KiB
JavaScript
import test from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
|
|
import os from "node:os";
|
|
import path from "node:path";
|
|
import configModule from "../src/main/config-store.cjs";
|
|
|
|
const { ConfigStore } = configModule;
|
|
|
|
async function storeFixture(t) {
|
|
const directory = await mkdtemp(path.join(os.tmpdir(), "forgeflow-config-store-"));
|
|
t.after(() => rm(directory, { recursive: true, force: true }));
|
|
return { directory, store: new ConfigStore(directory) };
|
|
}
|
|
|
|
test("config migration normalizes legacy deployments, inventory and validator state", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
const migrated = store.migrate({
|
|
schemaVersion: 2,
|
|
workspaceRoots: [" C:/Projects ", "C:/Projects", ""],
|
|
favorites: ["Owner/App", "owner/app"],
|
|
inventoryReviewDecisions: { server: [{ workloadId: "one" }] },
|
|
gitValidator: { policies: { "owner/app": { id: "strict" } }, suppressions: { "owner/app": [{ checkId: "x" }] }, trends: { "owner/app": [{ score: 70 }] } },
|
|
deploymentProfiles: {
|
|
"owner/app": [{ id: "legacy", provider: "ssh-unraid", remoteFolder: "MyApp", composeFile: "compose.yml", containerName: "MyApp", iconUrl: "https://itworx.tech/assets/itworx-icon.png", serverGitAccess: { deployKeyId: "4" } }],
|
|
},
|
|
operations: [{ id: "op", runnerLog: "secret", status: "success" }],
|
|
});
|
|
assert.equal(migrated.schemaVersion, 13);
|
|
assert.deepEqual(migrated.workspaceRoots, ["C:/Projects"]);
|
|
assert.deepEqual(migrated.favorites, ["owner/app"]);
|
|
const profile = migrated.deploymentProfiles["owner/app"][0];
|
|
assert.equal(profile.deploymentMode, "push-bundle");
|
|
assert.equal(profile.composeService, "myapp");
|
|
assert.equal(profile.iconMode, "builtin");
|
|
assert.equal("runnerLog" in migrated.operations[0], false);
|
|
assert.equal(migrated.gitValidator.policies["owner/app"].id, "strict");
|
|
});
|
|
|
|
test("load creates missing config and recovers malformed JSON", async (t) => {
|
|
const { directory, store } = await storeFixture(t);
|
|
let state = await store.load();
|
|
assert.equal(state.schemaVersion, 13);
|
|
assert.equal(JSON.parse(await readFile(store.filePath, "utf8")).appearance, "dark");
|
|
await writeFile(store.filePath, "{ malformed", "utf8");
|
|
state = await store.load();
|
|
assert.equal(state.setupComplete, false);
|
|
assert.ok((await readdir(directory)).some((name) => name.includes(".corrupt-")));
|
|
});
|
|
|
|
test("server normalization rejects unsafe targets and preserves bounded scan configuration", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
assert.throws(() => store.normalizeServer({ host: "bad host", username: "root" }), /hostname/);
|
|
assert.throws(() => store.normalizeServer({ host: "unraid", username: "bad user" }), /username/);
|
|
assert.throws(() => store.normalizeServer({ host: "unraid", username: "root", basePath: "relative" }), /absolute Unix/);
|
|
const server = store.normalizeServer({ host: "unraid.local", username: "root", port: 70000, basePath: "/mnt/user/appdata/", scanRoots: ["/mnt/user/appdata/", "relative"], scanExcludes: ["backup*", "bad/path"], authType: "privateKey", privateKeyPath: "C:/key" });
|
|
assert.equal(server.port, 65535);
|
|
assert.deepEqual(server.scanRoots, ["/mnt/user/appdata"]);
|
|
assert.deepEqual(server.scanExcludes, ["backup*"]);
|
|
store.data.servers = [{ ...server, encryptedPassword: "hidden", encryptedPassphrase: "hidden" }];
|
|
assert.equal(store.getPublicServer(store.data.servers[0]).hasPassphrase, true);
|
|
assert.equal("encryptedPassword" in store.getPublicState().servers[0], false);
|
|
assert.throws(() => store.getServerCredentials("missing"), /no longer exists/);
|
|
});
|
|
|
|
test("deployment profiles validate both Gitea Actions and safe Unraid topology", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
const actions = await store.saveDeploymentProfile("Owner/App", { id: "actions", environment: "production", branch: "main", provider: "gitea-actions", workflowFile: "deploy.yml", rollbackWorkflowFile: "rollback.yml", statusUrl: "https://app.test/status" });
|
|
assert.equal(actions.provider, "gitea-actions");
|
|
const unraid = await store.saveDeploymentProfile("Owner/App", { id: "unraid", name: "Production", environment: "production", branch: "main", provider: "ssh-unraid", serverId: "server", remoteFolder: "App", deploymentMode: "server-git", composeFiles: ["compose.yml"], composeServices: ["Web", "worker"], containerName: "Visible-App", cloneUrl: "git@gitea.test:owner/app.git", hostPort: 99999, containerPort: 0, webUiUrl: "http://[IP]:[PORT:3000]/", iconMode: "none", dockerShell: "/bin/bash", preservePaths: [".env", "data"], composeProject: "App_prod", composeWorkingDir: "/mnt/user/appdata/App", serverGitAccess: { configured: true, deployKeyId: "42", keyFingerprint: "SHA256:key", hostFingerprint: "SHA256:host" } });
|
|
assert.equal(unraid.composeService, "web");
|
|
assert.deepEqual(unraid.composeServices, ["web", "worker"]);
|
|
assert.equal(unraid.hostPort, 65535);
|
|
assert.equal(unraid.containerPort, null);
|
|
assert.equal(unraid.serverGitAccess.deployKeyId, 42);
|
|
assert.equal(store.getDeploymentProfiles("owner/app").length, 2);
|
|
assert.equal(store.getDeploymentProfile("owner/app", "unraid").containerName, "Visible-App");
|
|
assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", environment: "prod", branch: "main", remoteFolder: "../escape", composeFiles: ["compose.yml"] }), /escape|relative path|safe path/i);
|
|
assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", environment: "prod", branch: "main", remoteFolder: "app", composeFiles: ["compose.yml"], composeService: "bad service" }), /Compose service/);
|
|
await store.deleteDeploymentProfile("owner/app", "actions");
|
|
assert.equal(store.getDeploymentProfiles("owner/app").length, 1);
|
|
});
|
|
|
|
test("configuration mutations persist mappings, favorites, reviews, trends, operations and bounded preferences", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
await store.saveMapping("Owner/App", "C:/Projects/App");
|
|
assert.equal(store.data.repositoryMappings["owner/app"], "C:/Projects/App");
|
|
await store.setFavorite("Owner/App", true);
|
|
await store.setFavorite("Owner/App", false);
|
|
assert.deepEqual(store.data.favorites, []);
|
|
await store.setUpdatePreferences({ owner: " Team ", repo: " App ", branch: "release/1", autoCheck: false });
|
|
assert.equal(store.data.updates.branch, "release/1");
|
|
await store.saveInventoryReviewDecision("server", { workloadId: "workload", evidenceHash: "a".repeat(64), action: "monitor-only" });
|
|
assert.equal(store.getInventoryReviewDecisions("server").length, 1);
|
|
await store.deleteInventoryReviewDecision("server", "workload");
|
|
await assert.rejects(() => store.saveInventoryReviewDecision("", {}), /evidence hash/);
|
|
await store.setGitValidatorPolicy("Owner/App", { id: "production" });
|
|
await store.addGitValidatorSuppression("Owner/App", { checkId: "signed-tags" });
|
|
await store.appendGitValidatorTrend("Owner/App", { score: 81 });
|
|
assert.equal(store.getGitValidatorState("owner/app").trends[0].score, 81);
|
|
await store.saveDeploymentState("profile", { liveSha: "a".repeat(40) });
|
|
assert.equal(store.getDeploymentState("profile").liveSha.length, 40);
|
|
await store.addOperation({ id: "operation", status: "running" });
|
|
await store.addOperation({ id: "operation", status: "success" });
|
|
assert.equal(store.getOperation("operation").status, "success");
|
|
const state = await store.setPreferences({ repositoryPollSeconds: 0, operationPollSeconds: 999, fetchIntervalMinutes: 999, preferredCloneProtocol: "invalid", diagnosticLevel: "invalid", logRetentionDays: 0, maxLogFileMb: 100, editor: { executable: "code", args: ["{file}"] }, terminal: null, closeToTray: true, startAtLogin: true });
|
|
assert.equal(state.preferences.repositoryPollSeconds, 4);
|
|
assert.equal(state.preferences.operationPollSeconds, 120);
|
|
assert.equal(state.preferences.fetchIntervalMinutes, 240);
|
|
assert.equal(state.preferences.preferredCloneProtocol, "https");
|
|
assert.equal(state.preferences.diagnosticLevel, "info");
|
|
assert.equal(state.preferences.maxLogFileMb, 50);
|
|
const manualRemoteAwareness = await store.setPreferences({ fetchIntervalMinutes: 0 });
|
|
assert.equal(manualRemoteAwareness.preferences.fetchIntervalMinutes, 0);
|
|
await store.removeMapping("owner/app");
|
|
assert.equal(store.data.repositoryMappings["owner/app"], undefined);
|
|
});
|
|
|
|
test("server deletion removes only linked profiles and their deployment state", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
store.data.servers = [{ id: "remove", host: "old" }, { id: "keep", host: "new" }];
|
|
store.data.deploymentProfiles = {
|
|
"owner/app": [{ id: "old-profile", serverId: "remove" }, { id: "keep-profile", serverId: "keep" }],
|
|
"owner/only-old": [{ id: "only-old", serverId: "remove" }]
|
|
};
|
|
store.data.deploymentStates = { "old-profile": { healthy: true }, "only-old": { healthy: true }, "keep-profile": { healthy: true } };
|
|
await store.deleteServer("remove");
|
|
assert.deepEqual(store.data.servers.map((server) => server.id), ["keep"]);
|
|
assert.deepEqual(store.data.deploymentProfiles["owner/app"].map((profile) => profile.id), ["keep-profile"]);
|
|
assert.equal(store.data.deploymentProfiles["owner/only-old"], undefined);
|
|
assert.equal(store.data.deploymentStates["old-profile"], undefined);
|
|
assert.equal(store.data.deploymentStates["only-old"], undefined);
|
|
assert.equal(store.data.deploymentStates["keep-profile"].healthy, true);
|
|
});
|
|
|
|
test("configuration restore retains credentials only for unchanged endpoints and never restores operations", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
store.data.gitea = { baseUrl: "https://gitea.test", user: { login: "jens" }, encryptedToken: "encrypted-token" };
|
|
store.data.servers = [
|
|
{ ...store.normalizeServer({ id: "same", host: "same", username: "root", authType: "password" }), encryptedPassword: "password", encryptedPassphrase: null },
|
|
{ ...store.normalizeServer({ id: "changed", host: "old", username: "root", authType: "privateKey", privateKeyPath: "C:/old" }), encryptedPassword: null, encryptedPassphrase: "passphrase" }
|
|
];
|
|
store.data.operations = [{ id: "current-operation" }];
|
|
const backup = structuredClone(store.data);
|
|
backup.servers[1].host = "new";
|
|
backup.operations = [{ id: "untrusted-operation" }];
|
|
await store.restoreConfiguration(backup);
|
|
assert.equal(store.data.gitea.encryptedToken, "encrypted-token");
|
|
assert.equal(store.getServer("same").encryptedPassword, "password");
|
|
assert.equal(store.getServer("changed").encryptedPassphrase, null);
|
|
assert.deepEqual(store.data.operations, [{ id: "current-operation" }]);
|
|
|
|
await store.restoreConfiguration({ ...backup, gitea: { ...backup.gitea, baseUrl: "https://other.test" } });
|
|
assert.equal(store.data.gitea.encryptedToken, null);
|
|
});
|
|
|
|
test("profile, review and operation lookups return safe empty values", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
assert.equal(store.getPublicServer(null), null);
|
|
assert.equal(store.getServer("missing"), null);
|
|
assert.deepEqual(store.getDeploymentProfiles("missing/repo"), []);
|
|
assert.equal(store.getDeploymentProfile("missing/repo", "profile"), null);
|
|
assert.deepEqual(store.getInventoryReviewDecisions("missing"), []);
|
|
assert.equal(store.getDeploymentState("missing"), null);
|
|
assert.equal(store.getOperation("missing"), null);
|
|
assert.deepEqual(store.getGitValidatorState("missing/repo"), { policy: { id: "standard" }, suppressions: [], trends: [] });
|
|
await store.deleteInventoryReviewDecision("missing", "workload");
|
|
await store.deleteDeploymentProfile("missing/repo", "profile");
|
|
});
|
|
|
|
test("session credentials preserve, replace and clear safely when OS encryption is unavailable", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
assert.deepEqual(store.setToken(" session-token "), { persistent: false, preserved: false });
|
|
assert.equal(store.getToken(), "session-token");
|
|
assert.deepEqual(store.setToken("", { preserveExisting: true }), { persistent: false, preserved: true });
|
|
assert.equal(store.getToken(), "session-token");
|
|
assert.deepEqual(store.setToken("replacement"), { persistent: false, preserved: false });
|
|
assert.equal(store.getToken(), "replacement");
|
|
assert.deepEqual(store.setToken(""), { persistent: true, preserved: false });
|
|
assert.equal(store.getToken(), "");
|
|
assert.throws(() => store.encryptSecret("password"), (error) => error.code === "SECURE_STORAGE_UNAVAILABLE");
|
|
assert.equal(store.encryptSecret(""), null);
|
|
assert.equal(store.decryptSecret(null), "");
|
|
assert.equal(store.decryptSecret("not-base64-encrypted-data"), "");
|
|
});
|
|
|
|
test("setup, Gitea updates and generic patches retain normalized public state", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
const completed = await store.completeSetup({
|
|
baseUrl: "https://gitea.test", token: "token", user: { login: "jens" },
|
|
workspaceRoots: [" C:/Projects ", "C:/Projects", ""]
|
|
});
|
|
assert.equal(completed.state.setupComplete, true);
|
|
assert.equal(completed.state.gitea.hasToken, true);
|
|
assert.deepEqual(completed.state.workspaceRoots, ["C:/Projects"]);
|
|
await assert.rejects(
|
|
store.updateGitea({ baseUrl: "https://new.test", token: "", user: null }),
|
|
(error) => error.code === "GITEA_TOKEN_ORIGIN_CHANGED"
|
|
);
|
|
const update = await store.updateGitea({ baseUrl: "https://gitea.test", token: "", user: null });
|
|
assert.equal(update.preserved, true);
|
|
assert.equal(store.data.gitea.user.login, "jens");
|
|
const patched = await store.patch({ appearance: "light", workspaceRoots: ["D:/Code", "D:/Code"] });
|
|
assert.equal(patched.appearance, "light");
|
|
assert.deepEqual(patched.workspaceRoots, ["D:/Code"]);
|
|
assert.equal("encryptedToken" in patched.gitea, false);
|
|
});
|
|
|
|
test("server saves reject absent credentials before mutating configuration", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
await assert.rejects(
|
|
store.saveServer({ host: "unraid", username: "root", authType: "password", basePath: "/mnt/apps" }),
|
|
/password is required/i
|
|
);
|
|
await assert.rejects(
|
|
store.saveServer({ host: "unraid", username: "root", authType: "privateKey", basePath: "/mnt/apps", privateKeyPath: "" }),
|
|
/select a private key/i
|
|
);
|
|
assert.deepEqual(store.data.servers, []);
|
|
});
|
|
|
|
test("server credentials and trust are cleared when the connection identity changes", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
store.encryptSecret = (value) => `encrypted:${value}`;
|
|
const saved = await store.saveServer({ host: "server-one", username: "deploy", authType: "password", basePath: "/mnt/apps", hostFingerprint: "SHA256:trusted" }, { password: "test-password" });
|
|
await assert.rejects(
|
|
store.saveServer({ ...saved, host: "server-two" }, {}),
|
|
/password is required/i
|
|
);
|
|
assert.equal(store.data.servers[0].host, "server-one");
|
|
const changed = await store.saveServer({ ...saved, host: "server-two" }, { password: "replacement-password" });
|
|
assert.equal(changed.hostFingerprint, "");
|
|
assert.equal(changed.hasPassword, true);
|
|
});
|
|
|
|
test("deployment profile normalization covers safe defaults and every optional Unraid control", async (t) => {
|
|
const { store } = await storeFixture(t);
|
|
const actions = store.normalizeDeploymentProfile({ environment: "qa", statusUrl: "https://app.test/status" });
|
|
assert.equal(actions.provider, "gitea-actions");
|
|
assert.equal(actions.name, "qa");
|
|
assert.equal(actions.branch, "main");
|
|
assert.equal(actions.workflowFile, "deploy.yml");
|
|
assert.equal(actions.rollbackWorkflowFile, "");
|
|
assert.equal(actions.confirmationRequired, true);
|
|
|
|
const unraid = store.normalizeDeploymentProfile({
|
|
id: "all-options", name: " Server ", environment: "production", provider: "ssh-unraid", branch: "release",
|
|
serverId: " server ", remoteFolder: "apps/App", deploymentMode: "monitor-only", generatedCompose: true,
|
|
composeFiles: [], composeServices: ["WEB", "Worker"], composeProject: "App.prod", composeWorkingDir: "/mnt/apps/App",
|
|
containerName: "Visible.App", cloneUrl: "https://gitea.test/Owner/App.git", alignRemote: true,
|
|
hostPort: -2, containerPort: 70000, webUiUrl: "http://[IP]:[PORT:3000]/", iconMode: "upload",
|
|
iconFilePath: "C:/icon.png", dockerShell: "/bin/bash", preservePaths: [], adoptedFromServer: true,
|
|
serverSourceOfTruth: true, manageDockerMan: true, forceRecreate: true, removeOrphans: true,
|
|
workloadIdentity: { workloadId: "one" }, serverGitAccess: { configured: true, deployKeyId: "invalid", keyFingerprint: "", hostFingerprint: "", configuredAt: "now" },
|
|
provenance: { remoteFolder: "server" }, detectedMetadata: { source: "docker" }, serverIconReference: " icon ",
|
|
deploymentPolicy: { frozen: true, freezeReason: " maintenance ", requireNote: true, maintenanceWindows: [{ days: [0, 0, 6, 7, "bad"], start: "01:00", end: "02:00" }] }
|
|
});
|
|
assert.equal(unraid.name, "Server");
|
|
assert.equal(unraid.serverId, "server");
|
|
assert.equal(unraid.composeFile, "docker-compose.yml");
|
|
assert.deepEqual(unraid.composeServices, ["web", "worker"]);
|
|
assert.equal(unraid.hostPort, 1);
|
|
assert.equal(unraid.containerPort, 65535);
|
|
assert.equal(unraid.iconMode, "upload");
|
|
assert.equal(unraid.dockerShell, "/bin/bash");
|
|
assert.equal(unraid.serverGitAccess.deployKeyId, null);
|
|
assert.equal(unraid.serverGitAccess.keyFingerprint, null);
|
|
assert.deepEqual(unraid.deploymentPolicy.maintenanceWindows[0].days, [0, 6]);
|
|
assert.equal(unraid.serverIconReference, "icon");
|
|
|
|
assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", composeService: "app", composeServices: ["bad service"] }), /Compose services/);
|
|
assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", composeProject: "bad project!" }), /Compose project/);
|
|
assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", composeWorkingDir: "relative" }), /working directory/);
|
|
assert.throws(() => store.normalizeDeploymentProfile({ provider: "ssh-unraid", remoteFolder: "app", environment: "prod", containerName: "bad name" }), /Container name/);
|
|
});
|