claude-hdb
a10349d835
Public tool, private state. cast holds no hostnames, no bindings, no secrets: it joins a product repo's .infra/ manifest with a state directory you point it at, and makes Coolify match. Extracted from heavy-duty/infra, which was half tool and half state — the inconsistency that made it impossible to say whether "infra" named a CLI or a runbook. rig builds the boxes; cast fills them; infra is what they are filled with. Two changes were required to make it genuinely stateless and publishable: - The implicit cwd contract (environments.yaml / secrets/ / .coolify.env resolved against the working directory, silently reading the wrong file from the wrong place) is now an explicit --state <dir> / $CAST_STATE. - BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the only product knowledge in the executor — becomes the generic, operator- owned environments.<env>.forbidden_var_patterns. The guard now lives in private state, so a product-side change cannot lower its own guard, and it is a pattern rather than a list, so it catches unforeseen siblings. Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then ~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended apply mechanism, with no environment names known to the tool. Instance identity (org names, the GitHub App name, founder domains) is out of the fixtures and out of register-github-app.sh, which took APP_NAME and ORG as arguments rather than baking them in. 69 tests green; bin/cast + curl installer mirror rig's shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
60 lines
2.3 KiB
TypeScript
60 lines
2.3 KiB
TypeScript
import { execFileSync } from "node:child_process";
|
|
import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { describe, expect, it } from "vitest";
|
|
import { decryptSecrets, keyFileFor, secretsFileFor } from "../src/secrets.js";
|
|
|
|
describe("decryptSecrets", () => {
|
|
it("round-trips an env file through age", () => {
|
|
const dir = mkdtempSync(join(tmpdir(), "infra-age-"));
|
|
const keyFile = join(dir, "key.txt");
|
|
execFileSync("age-keygen", ["-o", keyFile]);
|
|
const recipient = execFileSync("age-keygen", ["-y", keyFile], {
|
|
encoding: "utf8",
|
|
}).trim();
|
|
const plain = join(dir, "s.env");
|
|
writeFileSync(plain, "MAILGUN_KEY=mk-123\nOPENROUTER_KEY=or-456\n");
|
|
const enc = join(dir, "s.env.age");
|
|
execFileSync("age", ["-r", recipient, "-o", enc, plain]);
|
|
expect(decryptSecrets(enc, keyFile)).toEqual({
|
|
MAILGUN_KEY: "mk-123",
|
|
OPENROUTER_KEY: "or-456",
|
|
});
|
|
});
|
|
});
|
|
|
|
describe("secretsFileFor", () => {
|
|
it("resolves the age store under the state dir it is given, not the cwd", () => {
|
|
expect(secretsFileFor("/srv/state", "widget", "prod")).toBe(
|
|
"/srv/state/secrets/widget.prod.env.age",
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("keyFileFor", () => {
|
|
it("an env with no injected var and no standing key refuses, naming both ways in", () => {
|
|
Reflect.deleteProperty(process.env, "CAST_AGE_KEY_FILE_PROD");
|
|
expect(() => keyFileFor("prod")).toThrow(
|
|
/no age key for prod.*CAST_AGE_KEY_FILE_PROD.*age-prod\.key/s,
|
|
);
|
|
});
|
|
it("the injected var wins, and is resolved per environment name", () => {
|
|
process.env.CAST_AGE_KEY_FILE_PROD = "/tmp/prod.key";
|
|
expect(keyFileFor("prod")).toBe("/tmp/prod.key");
|
|
Reflect.deleteProperty(process.env, "CAST_AGE_KEY_FILE_PROD");
|
|
});
|
|
it("falls back to a standing key on disk when one exists", () => {
|
|
const home = process.env.HOME;
|
|
const dir = mkdtempSync(join(tmpdir(), "cast-home-"));
|
|
const cfg = join(dir, ".config", "cast");
|
|
mkdirSync(cfg, { recursive: true });
|
|
writeFileSync(join(cfg, "age-staging.key"), "AGE-SECRET-KEY-1\n");
|
|
process.env.HOME = dir; // os.homedir() reads $HOME on POSIX
|
|
try {
|
|
expect(keyFileFor("staging")).toBe(join(cfg, "age-staging.key"));
|
|
} finally {
|
|
process.env.HOME = home;
|
|
}
|
|
});
|
|
});
|