Janady13/thatstupidcomputer / deploy/release.test.mjs

1import test from 'node:test'; 2import assert from 'node:assert/strict'; 3import { mkdtemp, mkdir, writeFile, readFile, readdir, realpath, symlink, lstat, rm } from 'node:fs/promises'; 4import { tmpdir } from 'node:os'; 5import { join } from 'node:path'; 6import { selectRelease, validateRelease } from './release.mjs'; 7import { createHash } from 'node:crypto'; 8import { projectionFixture } from '../tests/site/fixture.ts'; 9 10async function fixture(t) { 11 const root = await realpath(await mkdtemp(join(tmpdir(), 'tsc-release-test-'))); 12 t.after(() => rm(root, { recursive: true, force: true })); 13 await mkdir(join(root, 'releases')); 14 await mkdir(join(root, 'shared')); 15 for (const id of ['old-reviewed', 'new-reviewed']) { 16 await mkdir(join(root, 'releases', id)); 17 await writeFile(join(root, 'releases', id, 'artifact.txt'), `${id}: synthetic artifact retained`); 18 } 19 return root; 20} 21 22test('atomic release selection and rollback preserve both release directories and artifacts', async t => { 23 const root = await fixture(t); 24 await selectRelease(root, 'current', 'old-reviewed'); 25 await selectRelease(root, 'previous', 'old-reviewed'); 26 await selectRelease(root, 'current', 'new-reviewed'); 27 assert.equal(await realpath(join(root, 'current')), join(root, 'releases/new-reviewed')); 28 assert.equal(await realpath(join(root, 'previous')), join(root, 'releases/old-reviewed')); 29 await selectRelease(root, 'current', 'old-reviewed'); 30 assert.equal(await realpath(join(root, 'current')), join(root, 'releases/old-reviewed')); 31 for (const id of ['old-reviewed', 'new-reviewed']) assert.equal(await readFile(join(root, 'releases', id, 'artifact.txt'), 'utf8'), `${id}: synthetic artifact retained`); 32 assert.deepEqual((await readdir(root)).sort(), ['current', 'previous', 'releases', 'shared']); 33}); 34 35test('selection refuses to overwrite an ordinary current directory', async t => { 36 const root = await fixture(t); 37 await mkdir(join(root, 'current')); 38 await writeFile(join(root, 'current', 'keep.txt'), 'Existing unrelated directory'); 39 await assert.rejects(selectRelease(root, 'current', 'new-reviewed'), /not a symlink/); 40 assert.equal(await readFile(join(root, 'current/keep.txt'), 'utf8'), 'Existing unrelated directory'); 41}); 42 43test('selection refuses to overwrite an ordinary previous file', async t => { 44 const root = await fixture(t); 45 await writeFile(join(root, 'previous'), 'Existing unrelated file'); 46 await assert.rejects(selectRelease(root, 'previous', 'old-reviewed'), /not a symlink/); 47 assert.equal(await readFile(join(root, 'previous'), 'utf8'), 'Existing unrelated file'); 48}); 49 50test('pointer names and traversal release identifiers cannot escape the owned directory', async t => { 51 const root = await fixture(t); 52 for (const id of ['../outside', 'old/../../outside', '..', '/tmp/other', '']) { 53 await assert.rejects(selectRelease(root, 'current', id), /Invalid pointer/); 54 await assert.rejects(validateRelease(root, id), /simple release identifier/); 55 } 56 await assert.rejects(selectRelease(root, '../outside', 'old-reviewed'), /Invalid pointer/); 57 assert.deepEqual((await readdir(root)).sort(), ['releases', 'shared']); 58}); 59 60test('a symlinked release is refused before reading untrusted outside configuration', async t => { 61 const root = await fixture(t); 62 const outside = await mkdtemp(join(tmpdir(), 'tsc-release-outside-')); 63 t.after(() => rm(outside, { recursive: true, force: true })); 64 await writeFile(join(outside, 'untouched'), 'Keep outside'); 65 await symlink(outside, join(root, 'releases/alias')); 66 await assert.rejects(validateRelease(root, 'alias'), /symlink aliases/); 67 assert.equal(await readFile(join(outside, 'untouched'), 'utf8'), 'Keep outside'); 68}); 69 70test('a shipped preview cannot pass deployment preflight or modify the active release', async t => { 71 const root = await fixture(t); 72 await selectRelease(root, 'current', 'old-reviewed'); 73 await mkdir(join(root, 'releases/new-reviewed/.build')); 74 await writeFile(join(root, 'releases/new-reviewed/.build/build-record.json'), JSON.stringify({ deployment: 'preview', truthStatus: 'unavailable-preview' })); 75 await assert.rejects(validateRelease(root, 'new-reviewed'), /completed production build/); 76 assert.equal(await realpath(join(root, 'current')), join(root, 'releases/old-reviewed')); 77 assert.equal((await lstat(join(root, 'releases/new-reviewed'))).isDirectory(), true); 78}); 79 80test('production preflight detects provider-specific policy drift before selecting a release', async t => { 81 const root = await fixture(t); 82 const dir = join(root, 'releases/new-reviewed'); 83 for (const child of ['.build', 'apps/api/src', 'apps/api/dist', 'apps/web/dist', 'packages/site', 'private/truth', 'node_modules']) await mkdir(join(dir, child), { recursive: true }); 84 for (const child of ['runtime-env', 'build-env']) await mkdir(join(root, 'shared', child)); 85 // Import the actual parsers; no fixture replacement of the policy logic being tested. 86 await writeFile(join(dir, 'apps/api/src/config.ts'), `export { loadConfig } from ${JSON.stringify(new URL('../apps/api/src/config.ts', import.meta.url).href)};`); 87 await writeFile(join(dir, 'packages/site/truth.ts'), `export { loadSiteConfig } from ${JSON.stringify(new URL('../packages/site/truth.ts', import.meta.url).href)};`); 88 const projection = JSON.stringify(projectionFixture()); 89 const digest = createHash('sha256').update(projection).digest('hex'); 90 await writeFile(join(dir, 'private/truth/public.json'), projection); 91 await writeFile(join(dir, 'package-lock.json'), '{}'); 92 const routes = ['/', '/services/', '/services/website-design/', '/services/website-rescue/', '/services/search-visibility/', '/services/website-care/', '/work/', '/process/', '/about/', '/contact/', '/privacy/']; 93 for (const route of routes) { await mkdir(join(dir, 'apps/web/dist', route), { recursive: true }); await writeFile(join(dir, 'apps/web/dist', route, 'index.html'), 'Synthetic test artifact'); } 94 for (const artifact of ['apps/api/dist/server.mjs', 'apps/web/dist/404.html', 'apps/web/dist/robots.txt', 'apps/web/dist/sitemap.xml']) await writeFile(join(dir, artifact), 'Synthetic test artifact'); 95 await writeFile(join(dir, '.build/build-record.json'), JSON.stringify({ deployment: 'production', truthStatus: 'approved-projection', lockSha256: createHash('sha256').update('{}').digest('hex'), truthCommit: 'a'.repeat(40), truthSha256: digest, crawlerPolicy: { training: 'allow', openaiTraining: 'allow', anthropicTraining: 'allow', googleExtended: 'allow' }, routes })); 96 const runtimeFile = join(root, 'shared/runtime-env/new-reviewed.env'); 97 await writeFile(runtimeFile, 'NODE_ENV=production\nHOST=127.0.0.1\nPORT=3000\nTRUST_PROXY=127.0.0.1\nPUBLIC_ORIGIN=https://thatstupidcomputer.com\nSMTP_HOST=smtp.example.test\nSMTP_PORT=587\nSMTP_SECURE=false\nSMTP_USER=test\nSMTP_PASS=synthetic-not-real\nSMTP_FROM=sender@example.test\nSMTP_TO=recipient@example.test\n', { mode: 0o600 }); 98 const buildFile = join(root, 'shared/build-env/new-reviewed.env'); 99 const build = `TSC_TRUTH_PROJECTION=${join(dir, 'private/truth/public.json')}\nTSC_TRUTH_COMMIT=${'a'.repeat(40)}\nTSC_TRUTH_SHA256=${digest}\nAI_TRAINING_POLICY=allow\nGOOGLE_EXTENDED_POLICY=allow\n`; 100 await writeFile(buildFile, build, { mode: 0o600 }); 101 await symlink(runtimeFile, join(dir, 'runtime.env')); 102 await symlink(buildFile, join(dir, 'build.env')); 103 assert.equal((await validateRelease(root, 'new-reviewed')).releaseId, 'new-reviewed'); 104 for (const name of ['OPENAI_TRAINING_POLICY', 'ANTHROPIC_TRAINING_POLICY', 'MISTRAL_TRAINING_POLICY']) { 105 await writeFile(buildFile, build + `${name}=deny\n`, { mode: 0o600 }); 106 await assert.rejects(validateRelease(root, 'new-reviewed'), /Crawler policy differs/); 107 } 108}); 109