stoke/test/install-apt.test.js

const { test } = require('node:test');
const assert = require('node:assert/strict');
const { spawnSync } = require('node:child_process');
const fs = require('node:fs');
const os = require('node:os');
const path = require('node:path');

const SCRIPT = path.join(__dirname, '..', 'scripts', 'install-apt.sh');

// Runs install-apt.sh against a throwaway apt directory (STOKE_APT_ETC) with
// every external command stubbed via PATH. Scenario knobs:
//   candInitial        `apt-cache policy` Candidate before any update
//   candAfterUpdate    Candidate after any `apt-get update`
//   candAfterNodesource Candidate after an update once nodesource.list exists
// The apt-cache stub localizes the "Candidate:" label unless LC_ALL=C is set,
// so every scenario doubles as a regression test for locale-safe parsing.
const cleanups = [];
process.on('exit', () => { for (const dir of cleanups) fs.rmSync(dir, { recursive: true, force: true }); });

function runScenario({ candInitial, candAfterUpdate, candAfterNodesource, preexistingNodesourceList }) {
  const root = fs.mkdtempSync(path.join(os.tmpdir(), 'stoke-apt-test-'));
  cleanups.push(root);
  const bin = path.join(root, 'bin');
  const state = path.join(root, 'state');
  const aptEtc = path.join(root, 'etc', 'apt');
  fs.mkdirSync(bin, { recursive: true });
  fs.mkdirSync(state, { recursive: true });
  fs.mkdirSync(path.join(aptEtc, 'sources.list.d'), { recursive: true });
  fs.writeFileSync(path.join(state, 'candidate'), candInitial);
  if (preexistingNodesourceList !== undefined) {
    fs.writeFileSync(path.join(aptEtc, 'sources.list.d', 'nodesource.list'), preexistingNodesourceList);
  }

  const stub = (name, body) => {
    const p = path.join(bin, name);
    fs.writeFileSync(p, `#!/usr/bin/env bash\n${body}\n`, { mode: 0o755 });
  };

  // Force the non-root path so every mutation goes through the sudo stub.
  stub('id', 'echo 1000');
  stub('sudo', 'exec "$@"');
  stub('curl', 'echo "FAKE-KEY"');
  stub('stoke', 'echo 1.2.0');
  stub('apt-cache', [
    'cand="$(cat "$STATE_DIR/candidate")"',
    '[ "$cand" = "absent" ] && exit 0',
    'label="Candidato"',
    '[ "${LC_ALL:-}" = "C" ] && label="Candidate"',
    'printf "nodejs:\\n  Installed: (none)\\n  %s: %s\\n" "$label" "$cand"',
  ].join('\n'));
  stub('apt-get', [
    'echo "apt-get $*" >> "$STATE_DIR/apt-get.log"',
    'for a in "$@"; do',
    '  if [ "$a" = update ]; then',
    '    if [ -e "$STOKE_APT_ETC/sources.list.d/nodesource.list" ] && [ -n "${CAND_AFTER_NODESOURCE:-}" ]; then',
    '      echo "$CAND_AFTER_NODESOURCE" > "$STATE_DIR/candidate"',
    '    elif [ -n "${CAND_AFTER_UPDATE:-}" ]; then',
    '      echo "$CAND_AFTER_UPDATE" > "$STATE_DIR/candidate"',
    '    fi',
    '  fi',
    'done',
    'exit 0',
  ].join('\n'));

  // Restrictive umask: apt-readable 0644 files must come from the script's
  // explicit chmod, not from a lucky default.
  const res = spawnSync('bash', ['-c', 'umask 077 && exec bash "$1"', 'bash', SCRIPT], {
    encoding: 'utf8',
    env: {
      ...process.env,
      PATH: `${bin}:${process.env.PATH}`,
      STOKE_APT_ETC: aptEtc,
      STATE_DIR: state,
      CAND_AFTER_UPDATE: candAfterUpdate || '',
      CAND_AFTER_NODESOURCE: candAfterNodesource || '',
      LC_ALL: 'es_ES.UTF-8', // localized environment; the script must force C
    },
  });

  const read = (p) => (fs.existsSync(p) ? fs.readFileSync(p, 'utf8') : null);
  const mode = (p) => (fs.existsSync(p) ? fs.statSync(p).mode & 0o777 : null);
  return {
    aptEtc,
    nodesourceList: read(path.join(aptEtc, 'sources.list.d', 'nodesource.list')),
    nodesourceListMode: mode(path.join(aptEtc, 'sources.list.d', 'nodesource.list')),
    nodesourceKey: read(path.join(aptEtc, 'keyrings', 'nodesource.asc')),
    nodesourceKeyMode: mode(path.join(aptEtc, 'keyrings', 'nodesource.asc')),
    forgeKeyMode: mode(path.join(aptEtc, 'keyrings', 'forgejo-heavy-duty.asc')),
    aptGetLog: read(path.join(state, 'apt-get.log')) || '',
  };
  // Drop the throwaway tree after we have read everything we need.
  fs.rmSync(root, { recursive: true, force: true });
  return result;
}

test('suitable nodejs candidate already available: installs without touching NodeSource', () => {
  // Epoch-prefixed version also covers the epoch-stripping in the comparison.
  const s = runScenario({ candInitial: '1:22.23.1-1nodesource1' });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.equal(s.nodesourceList, null);
  assert.match(s.aptGetLog, /install -y stoke/);
  assert.equal(s.forgeKeyMode, 0o644, 'forge keyring must be readable by _apt');
});

test('no cached metadata: refreshes apt lists before deciding, no NodeSource needed', () => {
  const s = runScenario({ candInitial: 'absent', candAfterUpdate: '22.23.1-1nodesource1' });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.equal(s.nodesourceList, null);
  assert.match(s.aptGetLog, /install -y stoke/);
});

test('distro nodejs too old: bootstraps NodeSource and installs', () => {
  const s = runScenario({
    candInitial: '20.19.2+dfsg-1+deb13u2',
    candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
    candAfterNodesource: '22.23.1-1nodesource1',
  });
  assert.equal(s.res.status, 0, s.res.stderr);
  assert.match(s.nodesourceList, /deb \[signed-by=.*nodesource\.asc\] https:\/\/deb\.nodesource\.com\/node_22\.x nodistro main/);
  assert.equal(s.nodesourceKey, 'FAKE-KEY\n');
  assert.equal(s.nodesourceKeyMode, 0o644, 'NodeSource keyring must be readable by _apt');
  assert.equal(s.nodesourceListMode, 0o644, 'NodeSource list must be readable by _apt');
  assert.match(s.aptGetLog, /install -y stoke/);
});

test('bootstrap failure: NodeSource still lacks a suitable nodejs, exits with error', () => {
  const s = runScenario({
    candInitial: '20.19.2+dfsg-1+deb13u2',
    candAfterUpdate: '20.19.2+dfsg-1+deb13u2',
    candAfterNodesource: '20.19.2+dfsg-1+deb13u2',
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, /still no nodejs >= 22\.12/);
  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});

test('pre-existing user-managed nodesource.list is never overwritten', () => {
  const marker = '# user-managed entry\n';
  const s = runScenario({
    candInitial: '18.19.1+dfsg-6ubuntu5',
    candAfterUpdate: '18.19.1+dfsg-6ubuntu5',
    preexistingNodesourceList: marker,
  });
  assert.notEqual(s.res.status, 0);
  assert.match(s.res.stderr, /refusing to overwrite/);
  assert.equal(s.nodesourceList, marker);
  assert.doesNotMatch(s.aptGetLog, /install -y stoke/);
});