import { afterEach, describe, expect, it } from "@effect/vitest";import { BunServices } from "@effect/platform-bun";import { chmodSync, mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";import { tmpdir } from "node:os";import { join } from "node:path";import * as Effect from "effect/Effect"; import { defaultCliServerConnectionProfile, parseCliServerConnectionStore, readCliServerConnectionStore, removeCliServerConnectionProfile, setDefaultCliServerConnectionProfile, upsertCliServerConnectionProfile,} from "./server-profile"; const previousDataDir = process.env.EXECUTOR_DATA_DIR; afterEach(() => { if (previousDataDir === undefined) { delete process.env.EXECUTOR_DATA_DIR; } else { process.env.EXECUTOR_DATA_DIR = previousDataDir; }}); describe("CLI server connection profiles", () => { it.effect("round-trips named server connections and default selection", () => Effect.gen(function* () { const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-")); process.env.EXECUTOR_DATA_DIR = dataDir; try { yield* upsertCliServerConnectionProfile({ name: "remote", connection: { origin: "https://executor.example/api", auth: { kind: "bearer", token: "key_123" }, headers: { "CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" }, }, }, makeDefault: true, }); const store = yield* readCliServerConnectionStore(); expect(store.defaultProfile).toBe("remote"); expect(store.profiles).toHaveLength(1); expect(store.profiles[0]?.connection.kind).toBe("http"); expect(store.profiles[0]?.connection.origin).toBe("https://executor.example"); expect(store.profiles[0]?.connection.apiBaseUrl).toBe("https://executor.example/api"); expect(store.profiles[0]?.connection.auth).toEqual({ kind: "bearer", token: "key_123", }); expect(store.profiles[0]?.connection.headers).toEqual({ "CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" }, }); expect(defaultCliServerConnectionProfile(store)?.name).toBe("remote"); } finally { rmSync(dataDir, { recursive: true, force: true }); } }).pipe(Effect.provide(BunServices.layer)), ); it.effect("switches and removes the default profile", () => Effect.gen(function* () { const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-")); process.env.EXECUTOR_DATA_DIR = dataDir; try { yield* upsertCliServerConnectionProfile({ name: "local", connection: { origin: "localhost:4788" }, makeDefault: true, }); yield* upsertCliServerConnectionProfile({ name: "remote", connection: { origin: "https://executor.example" }, makeDefault: false, }); const switched = yield* setDefaultCliServerConnectionProfile("remote"); expect(switched.defaultProfile).toBe("remote"); const removed = yield* removeCliServerConnectionProfile("remote"); expect(removed.defaultProfile).toBeNull(); expect(removed.profiles.map((profile) => profile.name)).toEqual(["local"]); } finally { rmSync(dataDir, { recursive: true, force: true }); } }).pipe(Effect.provide(BunServices.layer)), ); it("drops malformed profiles when parsing", () => { const store = parseCliServerConnectionStore( JSON.stringify({ version: 1, defaultProfile: "missing", profiles: [ { name: "valid", connection: { origin: "https://executor.example" } }, { name: "bad space", connection: { origin: "https://ignored.example" } }, { name: "no-origin", connection: {} }, ], }), ); expect(store.defaultProfile).toBeNull(); expect(store.profiles.map((profile) => profile.name)).toEqual(["valid"]); }); it("preserves desktop sidecar profile kind", () => { const store = parseCliServerConnectionStore( JSON.stringify({ version: 1, defaultProfile: "desktop", profiles: [ { name: "desktop", connection: { kind: "desktop-sidecar", key: "desktop-sidecar", origin: "http://127.0.0.1:4789", auth: { kind: "basic", username: "executor", password: "secret" }, headers: { "CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID", }, }, }, }, ], }), ); expect(store.defaultProfile).toBe("desktop"); expect(store.profiles[0]?.connection.kind).toBe("desktop-sidecar"); expect(store.profiles[0]?.connection.auth).toEqual({ kind: "basic", username: "executor", password: "secret", }); expect(store.profiles[0]?.connection.headers).toEqual({ "CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" }, }); }); // ------------------------------------------------------------------------- // File permissions. // // This store holds live credentials for a hosted server — a bearer token, or // an OAuth access token and its long-lived refresh token. Nothing pinned its // mode before, so it was created with the process umask (0644 by default) and // readable by every other account on the machine. // // Both cases are covered because they need different mechanisms: `mode` on // create, and a `chmod` for the overwrite. The overwrite is the common path // here, since the store is rewritten on every silent token refresh. // ------------------------------------------------------------------------- it.effect("creates the credential store owner-only", () => Effect.gen(function* () { const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-mode-")); process.env.EXECUTOR_DATA_DIR = dataDir; try { yield* upsertCliServerConnectionProfile({ name: "remote", connection: { origin: "https://executor.example", auth: { kind: "bearer", token: "key_should_not_be_world_readable" }, }, makeDefault: true, }); const mode = statSync(join(dataDir, "server-connections.json")).mode & 0o777; expect(mode).toBe(0o600); } finally { rmSync(dataDir, { recursive: true, force: true }); } }).pipe(Effect.provide(BunServices.layer)), ); it.effect("tightens a pre-existing world-readable credential store on rewrite", () => Effect.gen(function* () { const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-chmod-")); process.env.EXECUTOR_DATA_DIR = dataDir; const storePath = join(dataDir, "server-connections.json"); try { // A store left behind by an older version, world-readable. `mode` on // write is ignored for an existing file, so only the chmod fixes this. writeFileSync(storePath, JSON.stringify({ version: 1, profiles: [] })); chmodSync(storePath, 0o644); yield* upsertCliServerConnectionProfile({ name: "remote", connection: { origin: "https://executor.example", auth: { kind: "bearer", token: "key_should_not_be_world_readable" }, }, makeDefault: true, }); expect(statSync(storePath).mode & 0o777).toBe(0o600); } finally { rmSync(dataDir, { recursive: true, force: true }); } }).pipe(Effect.provide(BunServices.layer)), );});
import { afterEach, describe, expect, it } from "@effect/vitest";
import { BunServices } from "@effect/platform-bun";
import { chmodSync, mkdtempSync, rmSync, statSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";
import * as Effect from "effect/Effect";
import {
defaultCliServerConnectionProfile,
parseCliServerConnectionStore,
readCliServerConnectionStore,
removeCliServerConnectionProfile,
setDefaultCliServerConnectionProfile,
upsertCliServerConnectionProfile,
} from "./server-profile";
const previousDataDir = process.env.EXECUTOR_DATA_DIR;
afterEach(() => {
if (previousDataDir === undefined) {
delete process.env.EXECUTOR_DATA_DIR;
} else {
process.env.EXECUTOR_DATA_DIR = previousDataDir;
}
});
describe("CLI server connection profiles", () => {
it.effect("round-trips named server connections and default selection", () =>
Effect.gen(function* () {
const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-"));
process.env.EXECUTOR_DATA_DIR = dataDir;
try {
yield* upsertCliServerConnectionProfile({
name: "remote",
connection: {
origin: "https://executor.example/api",
auth: { kind: "bearer", token: "key_123" },
headers: {
"CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" },
},
},
makeDefault: true,
});
const store = yield* readCliServerConnectionStore();
expect(store.defaultProfile).toBe("remote");
expect(store.profiles).toHaveLength(1);
expect(store.profiles[0]?.connection.kind).toBe("http");
expect(store.profiles[0]?.connection.origin).toBe("https://executor.example");
expect(store.profiles[0]?.connection.apiBaseUrl).toBe("https://executor.example/api");
expect(store.profiles[0]?.connection.auth).toEqual({
kind: "bearer",
token: "key_123",
});
expect(store.profiles[0]?.connection.headers).toEqual({
"CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" },
});
expect(defaultCliServerConnectionProfile(store)?.name).toBe("remote");
} finally {
rmSync(dataDir, { recursive: true, force: true });
}
}).pipe(Effect.provide(BunServices.layer)),
);
it.effect("switches and removes the default profile", () =>
Effect.gen(function* () {
const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-"));
process.env.EXECUTOR_DATA_DIR = dataDir;
try {
yield* upsertCliServerConnectionProfile({
name: "local",
connection: { origin: "localhost:4788" },
makeDefault: true,
});
yield* upsertCliServerConnectionProfile({
name: "remote",
connection: { origin: "https://executor.example" },
makeDefault: false,
});
const switched = yield* setDefaultCliServerConnectionProfile("remote");
expect(switched.defaultProfile).toBe("remote");
const removed = yield* removeCliServerConnectionProfile("remote");
expect(removed.defaultProfile).toBeNull();
expect(removed.profiles.map((profile) => profile.name)).toEqual(["local"]);
} finally {
rmSync(dataDir, { recursive: true, force: true });
}
}).pipe(Effect.provide(BunServices.layer)),
);
it("drops malformed profiles when parsing", () => {
const store = parseCliServerConnectionStore(
JSON.stringify({
version: 1,
defaultProfile: "missing",
profiles: [
{ name: "valid", connection: { origin: "https://executor.example" } },
{ name: "bad space", connection: { origin: "https://ignored.example" } },
{ name: "no-origin", connection: {} },
],
}),
);
expect(store.defaultProfile).toBeNull();
expect(store.profiles.map((profile) => profile.name)).toEqual(["valid"]);
});
it("preserves desktop sidecar profile kind", () => {
const store = parseCliServerConnectionStore(
JSON.stringify({
version: 1,
defaultProfile: "desktop",
profiles: [
{
name: "desktop",
connection: {
kind: "desktop-sidecar",
key: "desktop-sidecar",
origin: "http://127.0.0.1:4789",
auth: { kind: "basic", username: "executor", password: "secret" },
headers: {
"CF-Access-Client-Id": {
kind: "env",
name: "EXECUTOR_CF_ACCESS_CLIENT_ID",
},
},
},
},
],
}),
);
expect(store.defaultProfile).toBe("desktop");
expect(store.profiles[0]?.connection.kind).toBe("desktop-sidecar");
expect(store.profiles[0]?.connection.auth).toEqual({
kind: "basic",
username: "executor",
password: "secret",
});
expect(store.profiles[0]?.connection.headers).toEqual({
"CF-Access-Client-Id": { kind: "env", name: "EXECUTOR_CF_ACCESS_CLIENT_ID" },
});
});
// -------------------------------------------------------------------------
// File permissions.
//
// This store holds live credentials for a hosted server — a bearer token, or
// an OAuth access token and its long-lived refresh token. Nothing pinned its
// mode before, so it was created with the process umask (0644 by default) and
// readable by every other account on the machine.
//
// Both cases are covered because they need different mechanisms: `mode` on
// create, and a `chmod` for the overwrite. The overwrite is the common path
// here, since the store is rewritten on every silent token refresh.
// -------------------------------------------------------------------------
it.effect("creates the credential store owner-only", () =>
Effect.gen(function* () {
const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-mode-"));
process.env.EXECUTOR_DATA_DIR = dataDir;
try {
yield* upsertCliServerConnectionProfile({
name: "remote",
connection: {
origin: "https://executor.example",
auth: { kind: "bearer", token: "key_should_not_be_world_readable" },
},
makeDefault: true,
});
const mode = statSync(join(dataDir, "server-connections.json")).mode & 0o777;
expect(mode).toBe(0o600);
} finally {
rmSync(dataDir, { recursive: true, force: true });
}
}).pipe(Effect.provide(BunServices.layer)),
);
it.effect("tightens a pre-existing world-readable credential store on rewrite", () =>
Effect.gen(function* () {
const dataDir = mkdtempSync(join(tmpdir(), "executor-server-profiles-chmod-"));
process.env.EXECUTOR_DATA_DIR = dataDir;
const storePath = join(dataDir, "server-connections.json");
try {
// A store left behind by an older version, world-readable. `mode` on
// write is ignored for an existing file, so only the chmod fixes this.
writeFileSync(storePath, JSON.stringify({ version: 1, profiles: [] }));
chmodSync(storePath, 0o644);
yield* upsertCliServerConnectionProfile({
name: "remote",
connection: {
origin: "https://executor.example",
auth: { kind: "bearer", token: "key_should_not_be_world_readable" },
},
makeDefault: true,
});
expect(statSync(storePath).mode & 0o777).toBe(0o600);
} finally {
rmSync(dataDir, { recursive: true, force: true });
}
}).pipe(Effect.provide(BunServices.layer)),
);
});