source-guards.test.ts

apps/dashboard/test/source-guards.test.ts

1. /**
2. * Two whole-tree guards against rot that compiles, passes, and looks fine.
3. *
4. * The first is the credentials decision, which is a security decision and the
5. * kind that erodes by accident. The second is source searchability; see its own
6. * note further down.
7. *
8. * Credentials come from the process environment only, exported from the shell
9. * profile. There is no `.env` reader in this repo and there must not be one: a
10. * credentials file in the working tree is readable by every tool and agent that
11. * touches the repo, and a secret that has been read has to be rotated.
12. *
13. * The failure this catches is social, not technical: a README line or an error
14. * message telling people to create a credentials file, shown at the moment they
15. * are stuck and most likely to comply. Nothing is broken and the advice is
16. * wrong, which is the hardest combination to notice. A single helpful error
17. * message is all it takes to put the file back.
18. *
19. * It also pins the template to empty values, because a template is exactly where
20. * a real secret gets pasted "just for a minute".
21. */
23. import { readdir, readFile, stat } from 'node:fs/promises'
24. import { join, relative } from 'node:path'
25. import { fileURLToPath } from 'node:url'
26. import { describe, expect, it } from 'vitest'
28. const ROOT = fileURLToPath(new URL('../../../', import.meta.url))
30. const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'coverage', '.wrangler', '__pycache__'])
32. /**
33. * This file is skipped because it necessarily contains every pattern it looks
34. * for.
35. */
36. const SKIP_FILES = new Set([
37. 'apps/dashboard/test/source-guards.test.ts',
38. ])
40. // A file type the walk does not know about is a file type both guards below silently stop
41. // covering, which is this test's own failure mode.
42. const EXTS = ['.ts', '.py', '.md', '.sh', '.json', '.jsonc', '.sql']
44. async function sources(): Promise<{ path: string; text: string }[]> {
45. const out: { path: string; text: string }[] = []
46. async function walk(dir: string): Promise<void> {
47. for (const entry of await readdir(dir)) {
48. if (SKIP_DIRS.has(entry)) continue
49. const full = join(dir, entry)
50. const rel = relative(ROOT, full)
51. if ((await stat(full)).isDirectory()) {
52. await walk(full)
53. continue
54. }
55. if (!EXTS.some((e) => entry.endsWith(e))) continue
56. if (SKIP_FILES.has(rel) || entry === 'pnpm-lock.yaml') continue
57. out.push({ path: rel, text: await readFile(full, 'utf8') })
58. }
59. }
60. await walk(ROOT)
61. return out
62. }
64. /**
65. * Only unambiguous instructions and mechanisms. Deliberately does not match the
66. * many correct sentences saying there is no such file; the point is to catch
67. * something telling a person or a build to use one.
68. */
69. const FORBIDDEN: { pattern: RegExp; why: string }[] = [
70. { pattern: /\bdotenv\b/i, why: 'a dotenv dependency reintroduces the file' },
71. { pattern: /--env-file/, why: 'a script loading an env file' },
72. { pattern: /\.env\.example/, why: 'the deleted template; credentials.example.sh replaced it' },
73. { pattern: /\b(cp|copy|mv|touch)\s+\.env/i, why: 'an instruction to create the file' },
74. { pattern: /source\s+\.env/, why: 'an instruction to source the file' },
75. { pattern: /load_dotenv/, why: 'a Python dotenv loader' },
76. ]
78. describe('nothing tells anyone to create a .env', () => {
79. it('has no instruction or loader anywhere in the tree', async () => {
80. const hits: string[] = []
81. for (const { path, text } of await sources()) {
82. for (const { pattern, why } of FORBIDDEN) {
83. const lines = text.split('\n')
84. lines.forEach((line, i) => {
85. if (pattern.test(line)) hits.push(`${path}:${i + 1}: ${why}\n ${line.trim()}`)
86. })
87. }
88. }
89. expect(hits, `\n${hits.join('\n')}\n`).toEqual([])
90. })
92. it('scanned a believable number of files, so a broken walk cannot pass silently', async () => {
93. // An empty scan would satisfy the test above without checking anything.
94. const files = await sources()
95. expect(files.length).toBeGreaterThan(40)
96. expect(files.map((f) => f.path)).toContain('README.md')
97. })
98. })
100. describe('the credentials template carries no secrets', () => {
101. const template = () => readFile(join(ROOT, 'credentials.example.sh'), 'utf8')
103. it('exists, because it is what the docs now point at', async () => {
104. expect((await template()).length).toBeGreaterThan(0)
105. })
107. it('leaves every secret empty', async () => {
108. // A model name and the public API URL are not secrets and may carry a value.
109. const NOT_SECRET = new Set(['ANTHROPIC_MODEL', 'ANTHROPIC_BASE_URL'])
110. for (const line of (await template()).split('\n')) {
111. const m = /^export\s+([A-Z0-9_]+)=(.*)$/.exec(line.trim())
112. if (!m || NOT_SECRET.has(m[1]!)) continue
113. expect(m[2]!.replace(/["']/g, ''), `${m[1]} has a value in the template`).toBe('')
114. }
115. })
117. it('names every credential the code actually reads', async () => {
118. const text = await template()
119. for (const key of ['NINETY_TOKEN', 'BITRIX_WEBHOOK_URL', 'PLINTH_API_KEY', 'ANTHROPIC_API_KEY']) {
120. expect(text, `${key} is missing from the template`).toContain(key)
121. }
122. })
123. })
125. /**
126. * A literal 0x00 byte in a source file (say, a separator in a composite Map key)
127. * compiles happily, but `file` then classifies the source as binary and grep
128. * prints nothing for it: no error, no "binary file matches", just silence. That
129. * is a silent false negative on every search of that file, for a person or an
130. * agent. Write the character as an escape; this keeps every source file that
131. * way.
132. */
133. describe('source files stay searchable', () => {
134. it('has no raw control byte anywhere in source', async () => {
135. // Tabs, newlines and carriage returns are ordinary whitespace. Everything
136. // else below 0x20, plus DEL, makes grep treat the whole file as binary.
137. const hits: string[] = []
138. for (const { path, text } of await sources()) {
139. for (let i = 0; i < text.length; i++) {
140. const c = text.charCodeAt(i)
141. const ok = c === 0x09 || c === 0x0a || c === 0x0d
142. if ((c < 0x20 && !ok) || c === 0x7f) {
143. const line = text.slice(0, i).split('\n').length
144. hits.push(
145. `${path}:${line}: raw 0x${c.toString(16).padStart(2, '0')}. ` +
146. `Write it as an escape; a raw one makes grep silently skip the file.`,
147. )
148. break
149. }
150. }
151. }
152. expect(hits, `\n${hits.join('\n')}\n`).toEqual([])
153. })
154. })