Dune/tools/verify-container.mjs

// Runs only against a disposable container and volume created by this command.
import assert from 'node:assert/strict';
import { execFileSync } from 'node:child_process';
import { randomUUID } from 'node:crypto';
import { setTimeout as delay } from 'node:timers/promises';
import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join as joinPath } from 'node:path';

const image = process.argv[2];
if (!image) throw new Error('Usage: node tools/verify-container.mjs IMAGE');
const name = `dune-verify-${randomUUID()}`;
const volume = `${name}-data`;
const docker = (...args) => execFileSync('docker', args, { encoding: 'utf8' }).trim();
let base;
const adminFiles = mkdtempSync(joinPath(tmpdir(), 'dune-admin-container-'));
let adminCookie;
async function ready() {
  for (let attempt = 0; attempt < 90; attempt++) {
    try {
      const result = await fetch(base, { signal: AbortSignal.timeout(2000) });
      if (result.ok) return;
    } catch { /* Startup includes all additive migrations. */ }
    await delay(1000);
  }
  throw new Error('Container did not become ready');
}
function start(publicOrigin = '') {
  docker('run', '-d', '--name', name, '--init', '--cap-drop=ALL',
    '--security-opt=no-new-privileges:true',
    '-p', '127.0.0.1::3000', '-v', `${volume}:/data`,
    '-e', `DUNE_PUBLIC_ORIGIN=${publicOrigin}`, image);
  base = `http://${docker('port', name, '3000/tcp')}`;
}
const bootstrapKeys = (logs) => logs.match(/dune-admin\.[0-9a-f-]{36}\.[0-9a-f]{64}/g) || [];
function checkBootstrap(count) {
  const keys = bootstrapKeys(docker('logs', name));
  assert.equal(keys.length, count, 'First owner key must be logged exactly once per new database');
  return keys[0];
}
try {
  docker('volume', 'create', volume);
  start();
  await ready();
  const bootstrapKey = checkBootstrap(1);
  const ownerLogin = await fetch(`${base}/api/admin/session`, {
    method: 'POST', headers: { 'content-type': 'application/json', origin: base },
    body: JSON.stringify({ action: 'login', key: bootstrapKey }),
  });
  assert.equal(ownerLogin.status, 200, 'Bootstrapped owner must be able to sign in');
  execFileSync('node', ['tools/admin-access.mjs', '--name', 'Container QA', '--role', 'operator', '--out', joinPath(adminFiles, 'key')]);
  execFileSync('docker', ['exec', '-i', name, 'node', '-e', "require('node:fs').writeFileSync('/tmp/dune-admin-provision.sql', require('node:fs').readFileSync(0), {mode:0o600})"], {
    input: readFileSync(joinPath(adminFiles, 'key/provision.sql')), // Container USER owns this private file.
  });
  docker('exec', name, 'node', 'node_modules/wrangler/bin/wrangler.js', 'd1', 'execute', 'DB', '--local', '--config', 'tools/wrangler.local.json', '--persist-to', '/data', '--file', '/tmp/dune-admin-provision.sql');
  const adminKey = readFileSync(joinPath(adminFiles, 'key/access-key.txt'), 'utf8').trim();
  const adminLogin = await fetch(`${base}/api/admin/session`, {
    method: 'POST', headers: { 'content-type': 'application/json', origin: base },
    body: JSON.stringify({ action: 'login', key: adminKey }),
  });
  assert.equal(adminLogin.status, 200);
  adminCookie = adminLogin.headers.get('set-cookie')?.split(';')[0];
  assert.ok(adminCookie);
  const headers = { 'content-type': 'application/json', origin: base };
  const body = JSON.stringify({ name: 'Container verification', faction: 'atreides', advanced: false, expansions: [] });
  const create = await fetch(`${base}/api/rooms`, { method: 'POST', headers, body });
  assert.equal(create.status, 201, 'Mapped host/port must pass origin validation');
  const cookie = create.headers.get('set-cookie')?.split(';')[0];
  assert.ok(cookie);
  const room = await create.json();
  const foreign = await fetch(`${base}/api/rooms`, {
    method: 'POST', headers: { ...headers, origin: 'http://foreign.invalid' }, body,
  });
  assert.equal(foreign.status, 403);
  async function restored() {
    const result = await fetch(`${base}/api/rooms/${room.code}`, { headers: { cookie } });
    assert.equal(result.status, 200);
    assert.deepEqual(await result.json(), room, 'Saved seat and room must survive replacement');
    if (adminCookie) {
      const admin = await fetch(`${base}/api/admin/session`, { headers: { cookie: adminCookie } });
      assert.equal(admin.status, 200, 'Administrator session must survive replacement');
    }
  }
  docker('restart', '--time', '60', name);
  // Docker may assign a different ephemeral host port after a restart.
  base = `http://${docker('port', name, '3000/tcp')}`;
  await ready();
  assert.equal(checkBootstrap(1), bootstrapKey, 'Restart must not replace the owner key');
  await restored();
  docker('stop', '--time', '60', name);
  docker('rm', name);
  start();
  await ready();
  await restored();
  checkBootstrap(0);
  execFileSync('node', ['tools/verify-admin.mjs', '--url', base, '--key-file', joinPath(adminFiles, 'key/access-key.txt'), '--qa-account', adminKey.split('.')[1], '--out', joinPath(adminFiles, 'http')], { stdio: 'inherit' });
  adminCookie = undefined; // The acceptance test intentionally signs out all sessions.
  execFileSync('npm', ['run', 'test:integration'], {
    stdio: 'inherit', env: { ...process.env, DUNE_TEST_URL: base },
  });
  docker('stop', '--time', '60', name);
  docker('rm', name);
  const publicOrigin = 'https://dune.example.test';
  start(publicOrigin);
  await ready();
  await restored();
  checkBootstrap(0);
  const proxyAdmin = await fetch(`${base}/api/admin/session`, {
    method: 'POST', headers: { 'content-type': 'application/json', origin: publicOrigin },
    body: JSON.stringify({ action: 'login', key: adminKey }),
  });
  assert.equal(proxyAdmin.status, 200);
  assert.ok(proxyAdmin.headers.get('set-cookie')?.includes('; Secure'));
  const proxyCreate = await fetch(`${base}/api/rooms`, {
    method: 'POST', headers: { ...headers, origin: publicOrigin }, body,
  });
  assert.equal(proxyCreate.status, 201, 'HTTPS external origin must work over HTTP upstream');
  assert.ok(proxyCreate.headers.get('set-cookie')?.includes('; Secure'));
  const proxyCookie = proxyCreate.headers.get('set-cookie').split(';')[0];
  const proxyRoom = await proxyCreate.json();
  const join = await fetch(`${base}/api/rooms/${proxyRoom.code}`, {
    method: 'POST', headers: { ...headers, origin: publicOrigin },
    body: JSON.stringify({ type: 'join', name: 'Proxy peer', faction: 'emperor' }),
  });
  assert.equal(join.status, 200);
  assert.ok(join.headers.get('set-cookie')?.includes('; Secure'));
  const message = await fetch(`${base}/api/rooms/${proxyRoom.code}/messages`, {
    method: 'POST', headers: { ...headers, origin: publicOrigin, cookie: proxyCookie },
    body: JSON.stringify({ id: randomUUID(), recipientId: null, text: 'Proxy verification' }),
  });
  assert.equal(message.status, 200, 'Table discussion must work through HTTPS proxy');
  for (const path of ['/api/rooms', `/api/rooms/${proxyRoom.code}`, `/api/rooms/${proxyRoom.code}/control`, `/api/rooms/${proxyRoom.code}/messages`]) {
    const rejected = await fetch(base + path, {
      method: 'POST', headers: { ...headers, origin: 'https://foreign.invalid' }, body,
    });
    assert.equal(rejected.status, 403, path);
  }
  console.log('Container origin, restart, replacement, saved seat and HTTP integration checks passed.');
} catch (error) {
  try { console.error(docker('logs', name).replaceAll(/dune-admin\.[0-9a-f-]{36}\.[0-9a-f]{64}/g, '[REDACTED ADMIN KEY]')); } catch { /* May not exist yet. */ }
  throw error;
} finally {
  // Names are unique to this invocation; never remove an existing application.
  try { docker('rm', '-f', name); } catch { /* Already removed or not created. */ }
  try { docker('volume', 'rm', volume); } catch { /* Failure remains visible. */ }
  rmSync(adminFiles, { recursive: true, force: true });
}