|
| 1 | +// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license. |
| 2 | + |
| 3 | +/** |
| 4 | + * #29934 — the ONE data-key file `os dev` and `os start` hand their `serve` |
| 5 | + * child. Each case drives `applyCryptoKeyFileChannel` with the inputs the |
| 6 | + * command passes it (see `commands/dev.ts` and `commands/start.ts`), then |
| 7 | + * builds the provider the child builds over the child env, so the assertion is |
| 8 | + * about the key the child ends up with, not about a path string alone. |
| 9 | + * |
| 10 | + * The public-door reproduction (a real `os dev` boot, then a real `os start` |
| 11 | + * boot, one settings secret) is `test/dev-start-shared-data-key.integration.test.ts`. |
| 12 | + */ |
| 13 | + |
| 14 | +import { afterEach, beforeEach, describe, expect, it } from 'vitest'; |
| 15 | +import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'; |
| 16 | +import { tmpdir } from 'node:os'; |
| 17 | +import { join } from 'node:path'; |
| 18 | +import { randomBytes } from 'node:crypto'; |
| 19 | +import { LocalCryptoProvider } from '@objectstack/service-settings'; |
| 20 | +import { applyCryptoKeyFileChannel } from './internal-crypto-key-file-channel.js'; |
| 21 | + |
| 22 | +const CHANNEL = 'OS_INTERNAL_CRYPTO_KEY_FILE'; |
| 23 | +const ctx = { scope: 'settings', namespace: 'ai', key: 'openai_api_key' } as const; |
| 24 | + |
| 25 | +let home: string; |
| 26 | +let project: string; |
| 27 | +/** The operator's environment: no key of any spelling, `HOME` is this test's. */ |
| 28 | +let operatorEnv: NodeJS.ProcessEnv; |
| 29 | + |
| 30 | +beforeEach(() => { |
| 31 | + home = mkdtempSync(join(tmpdir(), 'os-29934-home-')); |
| 32 | + project = mkdtempSync(join(tmpdir(), 'os-29934-project-')); |
| 33 | + writeFileSync(join(project, 'objectstack.config.ts'), 'export default {};\n'); |
| 34 | + operatorEnv = { HOME: home }; |
| 35 | +}); |
| 36 | +afterEach(() => { |
| 37 | + rmSync(home, { recursive: true, force: true }); |
| 38 | + rmSync(project, { recursive: true, force: true }); |
| 39 | +}); |
| 40 | + |
| 41 | +const canonicalFile = () => join(home, '.objectstack', 'dev-crypto-key'); |
| 42 | +const legacyFile = () => join(project, '.objectstack', 'dev-crypto-key'); |
| 43 | + |
| 44 | +function writeKey(file: string): Buffer { |
| 45 | + const key = randomBytes(32); |
| 46 | + mkdirSync(join(file, '..'), { recursive: true }); |
| 47 | + writeFileSync(file, key.toString('base64'), { mode: 0o600 }); |
| 48 | + return key; |
| 49 | +} |
| 50 | + |
| 51 | +/** `os dev`'s child: the operator env, development posture. */ |
| 52 | +async function devChild(env = operatorEnv) { |
| 53 | + const child: NodeJS.ProcessEnv = { ...env, NODE_ENV: 'development' }; |
| 54 | + const notice = await applyCryptoKeyFileChannel(child, { env, cwd: project, hasProjectConfig: true }); |
| 55 | + return { child, notice }; |
| 56 | +} |
| 57 | + |
| 58 | +/** `os start`'s child: its own home as `OS_HOME`, production posture, the auto-key opt-in. */ |
| 59 | +async function startChild(env = operatorEnv, homeFlag?: string) { |
| 60 | + const child: NodeJS.ProcessEnv = { |
| 61 | + ...env, |
| 62 | + OS_HOME: homeFlag ?? join(project, '.objectstack'), |
| 63 | + NODE_ENV: 'production', |
| 64 | + OS_CRYPTO_AUTOKEY: '1', |
| 65 | + }; |
| 66 | + const notice = await applyCryptoKeyFileChannel(child, { env, cwd: project, hasProjectConfig: true, homeFlag }); |
| 67 | + return { child, notice }; |
| 68 | +} |
| 69 | + |
| 70 | +describe('#29934 — one key file for `os dev` and `os start`', () => { |
| 71 | + it('a secret sealed under `os dev` opens under `os start` over the same project', async () => { |
| 72 | + const dev = await devChild(); |
| 73 | + const sealed = await new LocalCryptoProvider({ env: dev.child }).encrypt('sk-test', ctx); |
| 74 | + |
| 75 | + const start = await startChild(); |
| 76 | + expect(start.child[CHANNEL]).toBe(canonicalFile()); |
| 77 | + expect(await new LocalCryptoProvider({ env: start.child }).decrypt(sealed, ctx)).toBe('sk-test'); |
| 78 | + expect(existsSync(legacyFile())).toBe(false); |
| 79 | + expect([dev.notice, start.notice]).toEqual([undefined, undefined]); |
| 80 | + }); |
| 81 | + |
| 82 | + it('`--home` is start\'s spelling of `OS_HOME`: the key stays in that home', async () => { |
| 83 | + const pinned = join(home, 'pinned-home'); |
| 84 | + const start = await startChild(operatorEnv, pinned); |
| 85 | + expect(start.child[CHANNEL]).toBe(join(pinned, 'dev-crypto-key')); |
| 86 | + expect(start.notice).toBeUndefined(); |
| 87 | + }); |
| 88 | +}); |
| 89 | + |
| 90 | +describe('#29934 — the key file an earlier `os start` kept in the project', () => { |
| 91 | + it('only the legacy file holds a key: both commands read it, and say which file', async () => { |
| 92 | + const legacy = writeKey(legacyFile()); |
| 93 | + const sealed = await new LocalCryptoProvider({ key: legacy }).encrypt('sk-legacy', ctx); |
| 94 | + |
| 95 | + for (const { child, notice } of [await startChild(), await devChild()]) { |
| 96 | + expect(child[CHANNEL]).toBe(legacyFile()); |
| 97 | + expect(notice).toContain(legacyFile()); |
| 98 | + expect(notice).toContain(canonicalFile()); |
| 99 | + expect(await new LocalCryptoProvider({ env: child }).decrypt(sealed, ctx)).toBe('sk-legacy'); |
| 100 | + } |
| 101 | + // Read, never copied or re-minted: the canonical file is still absent. |
| 102 | + expect(existsSync(canonicalFile())).toBe(false); |
| 103 | + }); |
| 104 | + |
| 105 | + it('both files hold different keys: the canonical one is used, and the warning names both', async () => { |
| 106 | + writeKey(legacyFile()); |
| 107 | + const canonical = writeKey(canonicalFile()); |
| 108 | + const sealed = await new LocalCryptoProvider({ key: canonical }).encrypt('sk-canonical', ctx); |
| 109 | + |
| 110 | + for (const { child, notice } of [await startChild(), await devChild()]) { |
| 111 | + expect(child[CHANNEL]).toBe(canonicalFile()); |
| 112 | + expect(notice).toContain(`${canonicalFile()} (used)`); |
| 113 | + expect(notice).toContain(`${legacyFile()} (NOT used)`); |
| 114 | + expect(await new LocalCryptoProvider({ env: child }).decrypt(sealed, ctx)).toBe('sk-canonical'); |
| 115 | + } |
| 116 | + }); |
| 117 | + |
| 118 | + it('both files hold the same key: no warning', async () => { |
| 119 | + const key = writeKey(canonicalFile()); |
| 120 | + mkdirSync(join(project, '.objectstack'), { recursive: true }); |
| 121 | + writeFileSync(legacyFile(), key.toString('hex'), { mode: 0o600 }); |
| 122 | + const start = await startChild(); |
| 123 | + expect(start.child[CHANNEL]).toBe(canonicalFile()); |
| 124 | + expect(start.notice).toBeUndefined(); |
| 125 | + }); |
| 126 | +}); |
| 127 | + |
| 128 | +describe('#29934 — an explicit env key keeps winning, unchanged', () => { |
| 129 | + it.each([ |
| 130 | + ['OS_SECRET_KEY', randomBytes(32).toString('hex')], |
| 131 | + ['OS_DEV_CRYPTO_KEY', randomBytes(32).toString('base64')], |
| 132 | + ])('%s set: no file is named and an inherited channel is removed', async (name, value) => { |
| 133 | + writeKey(legacyFile()); |
| 134 | + const env = { ...operatorEnv, [name]: value, [CHANNEL]: '/inherited/elsewhere' }; |
| 135 | + for (const { child, notice } of [await startChild(env), await devChild(env)]) { |
| 136 | + expect(child[CHANNEL]).toBeUndefined(); |
| 137 | + expect(notice).toBeUndefined(); |
| 138 | + } |
| 139 | + }); |
| 140 | +}); |
![objectstack-fleet[bot]](https://avatars.githubusercontent.com/u/254823548?v=4&size=40){kind=avatar}
0 commit comments