From bfb5b74b67cad4f0925b6f9150c0d348f319bb02 Mon Sep 17 00:00:00 2001 From: diegosouzapw Date: Tue, 9 Jun 2026 22:03:33 -0300 Subject: [PATCH] test: hermetic auth context for 2 re-wired suites + real headroom on the breaker reset-timeout flake MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CI shards exposed what the dev DATA_DIR was masking locally: detect.test.ts and managementCliToken.test.ts asserted 401/403/reject outcomes that only exist when login protection is configured — on a fresh CI DB isAuthRequired() is false and the policy anonymous-allows. Both now create an isolated DATA_DIR with requireLogin+password (the established pattern). observability-fase04: the breaker reset-timeout test ran with a 5ms margin (resetTimeout 10 / sleep 15) — lazy HALF_OPEN refresh under shard contention flipped the first OPEN assert. Now 250/300ms. --- tests/unit/api/cli-tools/detect.test.ts | 31 +++++++++++++++++++- tests/unit/lib/managementCliToken.test.ts | 35 +++++++++++++++++++++-- tests/unit/observability-fase04.test.ts | 7 +++-- 3 files changed, 67 insertions(+), 6 deletions(-) diff --git a/tests/unit/api/cli-tools/detect.test.ts b/tests/unit/api/cli-tools/detect.test.ts index 4ed1f80bf2..25b4905d68 100644 --- a/tests/unit/api/cli-tools/detect.test.ts +++ b/tests/unit/api/cli-tools/detect.test.ts @@ -1,9 +1,38 @@ import { describe, it, before, after } from "node:test"; import assert from "node:assert"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; import { NextRequest } from "next/server"; -import { GET } from "../../../../src/app/api/cli-tools/detect/route.ts"; + +// Hermetic auth context (6A re-wire fix): without a configured password, +// isAuthRequired() is false on a fresh DB (CI) and the route answers 200 — +// these 401/403 assertions only held locally because the dev DATA_DIR had a +// real password. Create an isolated DATA_DIR with login protection enabled. +const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-cli-detect-")); +const originalDataDir = process.env.DATA_DIR; +process.env.DATA_DIR = TEST_DATA_DIR; + +const core = await import("../../../../src/lib/db/core.ts"); +const settingsDb = await import("../../../../src/lib/db/settings.ts"); +const { GET } = await import("../../../../src/app/api/cli-tools/detect/route.ts"); describe("GET /api/cli-tools/detect", () => { + before(async () => { + await settingsDb.updateSettings({ + requireLogin: true, + setupComplete: true, + password: "test-password-hash", + }); + }); + + after(() => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + if (originalDataDir === undefined) delete process.env.DATA_DIR; + else process.env.DATA_DIR = originalDataDir; + }); + it("returns 401 without authorization", async () => { // @ts-ignore - we can call the handler directly const req = new NextRequest("http://localhost:3000/api/cli-tools/detect"); diff --git a/tests/unit/lib/managementCliToken.test.ts b/tests/unit/lib/managementCliToken.test.ts index a9d9a0952b..0a817e2859 100644 --- a/tests/unit/lib/managementCliToken.test.ts +++ b/tests/unit/lib/managementCliToken.test.ts @@ -1,8 +1,37 @@ import { test, mock } from "node:test"; import assert from "node:assert/strict"; -import { getLegacyCliTokenSync, getMachineTokenSync } from "../../../src/lib/machineToken.ts"; -import { managementPolicy } from "../../../src/server/authz/policies/management.ts"; -import { CLI_TOKEN_HEADER } from "../../../src/server/authz/headers.ts"; +import fs from "node:fs"; +import os from "node:os"; +import path from "node:path"; + +// Hermetic auth context (6A re-wire fix): the "rejects ..." assertions assume +// login protection is ON — on a fresh DB (CI) isAuthRequired() is false and the +// policy anonymous-allows before any token check. Locally this only passed +// because the dev DATA_DIR had a real password. Isolate + enable protection. +const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-mgmt-cli-token-")); +const originalDataDir = process.env.DATA_DIR; +process.env.DATA_DIR = TEST_DATA_DIR; + +const core = await import("../../../src/lib/db/core.ts"); +const settingsDb = await import("../../../src/lib/db/settings.ts"); +await settingsDb.updateSettings({ + requireLogin: true, + setupComplete: true, + password: "test-password-hash", +}); + +const { getLegacyCliTokenSync, getMachineTokenSync } = await import( + "../../../src/lib/machineToken.ts" +); +const { managementPolicy } = await import("../../../src/server/authz/policies/management.ts"); +const { CLI_TOKEN_HEADER } = await import("../../../src/server/authz/headers.ts"); + +test.after(() => { + core.resetDbInstance(); + fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true }); + if (originalDataDir === undefined) delete process.env.DATA_DIR; + else process.env.DATA_DIR = originalDataDir; +}); function makeCtx(headers: Record, requestExtras: Record = {}) { return { diff --git a/tests/unit/observability-fase04.test.ts b/tests/unit/observability-fase04.test.ts index d0af8c0147..ad6cf560ef 100644 --- a/tests/unit/observability-fase04.test.ts +++ b/tests/unit/observability-fase04.test.ts @@ -85,9 +85,12 @@ test("CircuitBreaker: transitions to HALF_OPEN after reset timeout", async () => }); test("CircuitBreaker: status reads refresh OPEN providers after reset timeout", async () => { + // resetTimeout must leave real headroom: with 10ms, any event-loop contention + // between execute() and the first getStatus() already lazily refreshes the + // state to HALF_OPEN and the OPEN assert flakes (seen on CI shard runners). const cb = new CircuitBreaker(`test-status-refresh${cbSuffix}`, { failureThreshold: 1, - resetTimeout: 10, + resetTimeout: 250, }); try { @@ -98,7 +101,7 @@ test("CircuitBreaker: status reads refresh OPEN providers after reset timeout", assert.equal(cb.getStatus().state, STATE.OPEN); - await new Promise((r) => setTimeout(r, 15)); + await new Promise((r) => setTimeout(r, 300)); assert.equal(cb.getStatus().state, STATE.HALF_OPEN); assert.equal(cb.canExecute(), true);