commit ddd5a60e50eeaed261604f455636d05e08fad1ca
parent 207736cedc162ea297a5de9cee8d87eb991f683e
Author: finwo <finwo@pm.me>
Date: Sun, 27 Sep 2026 19:49:11 +0200
Drop the superseded disabled admin suite
Diffstat:
1 file changed, 0 insertions(+), 386 deletions(-)
diff --git a/test/admin.test.js.disabled b/test/admin.test.js.disabled
@@ -1,386 +0,0 @@
-// test/admin.test.js - the authenticated administration surface
-//
-// The recurring concern here is that secrets are write only: a trigger
-// secret, a worker token and a variable can each be set, but only ever read
-// back once at the moment they are created.
-
-import test from 'node:test';
-import assert from 'node:assert/strict';
-import { startHarness } from './helpers/harness.js';
-
-async function withAdmin(options, fn) {
- const h = await startHarness({ ...options, bootstrap: true });
- try {
- return await fn(h, await h.login());
- } finally {
- await h.stop();
- }
-}
-
-const json = (headers) => ({ ...headers, 'content-type': 'application/json' });
-
-test('login sets a session cookie', async () => {
- await withAdmin({}, async (h) => {
- const res = await h.app.inject({
- method: 'POST',
- url: '/api/auth/login',
- headers: { 'content-type': 'application/json' },
- payload: JSON.stringify({ username: 'admin', password: 'bootstrap-password' }),
- });
-
- assert.equal(res.statusCode, 200);
- const body = res.json();
- assert.equal(body.user.role, 'admin');
- assert.match(res.headers['set-cookie'], /conductor_session=/);
- assert.match(res.headers['set-cookie'], /HttpOnly/);
- });
-});
-
-test('a wrong password and an unknown user are indistinguishable', async () => {
- await withAdmin({}, async (h) => {
- const wrong = await h.app.inject({
- method: 'POST',
- url: '/api/auth/login',
- headers: { 'content-type': 'application/json' },
- payload: JSON.stringify({ username: 'admin', password: 'nope' }),
- });
- const absent = await h.app.inject({
- method: 'POST',
- url: '/api/auth/login',
- headers: { 'content-type': 'application/json' },
- payload: JSON.stringify({ username: 'nobody', password: 'nope' }),
- });
-
- assert.equal(wrong.statusCode, 401);
- assert.equal(absent.statusCode, 401);
- assert.deepEqual(wrong.json(), absent.json());
- });
-});
-
-test('the session cookie authenticates', async () => {
- await withAdmin({}, async (h) => {
- const login = await h.app.inject({
- method: 'POST',
- url: '/api/auth/login',
- headers: { 'content-type': 'application/json' },
- payload: JSON.stringify({ username: 'admin', password: 'bootstrap-password' }),
- });
- const cookie = login.headers['set-cookie'].split(';')[0];
-
- const res = await h.app.inject({ method: 'GET', url: '/api/auth/me', headers: { cookie } });
- assert.equal(res.statusCode, 200);
- assert.equal(res.json().user.username, 'admin');
- });
-});
-
-test('management needs a session, and user administration needs the admin role', async () => {
- await withAdmin({}, async (h, admin) => {
- const anonymous = await h.app.inject({ method: 'GET', url: '/api/projects' });
- assert.equal(anonymous.statusCode, 401);
-
- await h.app.inject({
- method: 'POST',
- url: '/api/admin/users',
- headers: json(admin),
- payload: JSON.stringify({ username: 'viewer1', password: 'viewer-password', role: 'viewer' }),
- });
-
- const login = await h.app.inject({
- method: 'POST',
- url: '/api/auth/login',
- headers: { 'content-type': 'application/json' },
- payload: JSON.stringify({ username: 'viewer1', password: 'viewer-password' }),
- });
- const viewer = { cookie: login.headers['set-cookie'].split(';')[0] };
-
- // An ordinary user manages their own things, and owns nothing yet.
- const own = await h.app.inject({ method: 'GET', url: '/api/projects', headers: viewer });
- assert.equal(own.statusCode, 200);
- assert.deepEqual(own.json().projects, []);
-
- // User administration stays administrator only.
- const forbidden = await h.app.inject({ method: 'GET', url: '/api/admin/users', headers: viewer });
- assert.equal(forbidden.statusCode, 403);
- });
-});
-
-test('a disabled account stops being accepted immediately', async () => {
- await withAdmin({}, async (h, admin) => {
- const created = await h.app.inject({
- method: 'POST',
- url: '/api/admin/users',
- headers: json(admin),
- payload: JSON.stringify({ username: 'temp', password: 'temp-password', role: 'viewer' }),
- });
- const id = created.json().user.id;
-
- const login = await h.app.inject({
- method: 'POST',
- url: '/api/auth/login',
- headers: { 'content-type': 'application/json' },
- payload: JSON.stringify({ username: 'temp', password: 'temp-password' }),
- });
- const headers = { cookie: login.headers['set-cookie'].split(';')[0] };
- assert.equal((await h.app.inject({ method: 'GET', url: '/api/auth/me', headers })).statusCode, 200);
-
- await h.app.inject({
- method: 'PATCH',
- url: `/api/admin/users/${id}`,
- headers: json(admin),
- payload: JSON.stringify({ disabled: true }),
- });
-
- // The token has not expired, but the account is checked on every call.
- assert.equal((await h.app.inject({ method: 'GET', url: '/api/auth/me', headers })).statusCode, 401);
- });
-});
-
-test('the last administrator cannot be removed or demoted', async () => {
- await withAdmin({}, async (h, admin) => {
- const me = (await h.app.inject({ method: 'GET', url: '/api/auth/me', headers: admin })).json().user;
-
- const demote = await h.app.inject({
- method: 'PATCH',
- url: `/api/admin/users/${me.id}`,
- headers: json(admin),
- payload: JSON.stringify({ role: 'viewer' }),
- });
- assert.equal(demote.statusCode, 400);
- assert.match(demote.json().error, /only administrator/);
-
- const removed = await h.app.inject({ method: 'DELETE', url: `/api/admin/users/${me.id}`, headers: admin });
- assert.equal(removed.statusCode, 400);
- });
-});
-
-test('projects can be created, listed and removed, and the secret is shown once', async () => {
- await withAdmin({}, async (h, admin) => {
- const created = await h.app.inject({
- method: 'POST',
- url: '/api/projects',
- headers: json(admin),
- payload: JSON.stringify({ id: 'newproj', name: 'New', repo_url: 'https://git.example.com/new.git' }),
- });
- assert.equal(created.statusCode, 201);
- const secret = created.json().trigger_secret;
- assert.ok(secret && secret.length >= 32);
-
- const listed = await h.app.inject({ method: 'GET', url: '/api/projects', headers: admin });
- const project = listed.json().projects.find((p) => p.id === 'newproj');
- assert.equal(project.has_trigger_secret, true);
- // Listing must never return the value itself.
- assert.equal(project.trigger_secret, undefined);
- assert.ok(!JSON.stringify(listed.json()).includes(secret));
-
- const deleted = await h.app.inject({ method: 'DELETE', url: '/api/projects/newproj', headers: admin });
- assert.equal(deleted.statusCode, 200);
- });
-});
-
-test('a rotated trigger secret actually signs triggers', async () => {
- await withAdmin({}, async (h, admin) => {
- const rotated = await h.app.inject({
- method: 'POST',
- url: '/api/projects/demo/trigger-secret',
- headers: json(admin),
- payload: JSON.stringify({ secret: 'rotated-secret' }),
- });
- assert.equal(rotated.statusCode, 200);
-
- // The old secret stops working, the new one starts.
- const old = await h.trigger({ sha: h.sha, ref: 'refs/heads/main' }, { secret: 'test-secret' });
- assert.equal(old.statusCode, 401);
-
- const fresh = await h.trigger({ sha: h.sha, ref: 'refs/heads/main' }, { secret: 'rotated-secret' });
- assert.equal(fresh.statusCode, 200);
- });
-});
-
-test('worker tokens are issued once and can be revoked', async () => {
- await withAdmin({}, async (h, admin) => {
- const created = await h.app.inject({
- method: 'POST',
- url: '/api/worker-tokens',
- headers: json(admin),
- payload: JSON.stringify({ name: 'builder-2' }),
- });
- assert.equal(created.statusCode, 201);
- const { token, worker_token: record } = created.json();
-
- // It works.
- const poll = await h.app.inject({
- method: 'GET', url: '/api/workers/poll', headers: { authorization: `Bearer ${token}` },
- });
- assert.notEqual(poll.statusCode, 401);
-
- // It is never listed again.
- const listed = await h.app.inject({ method: 'GET', url: '/api/worker-tokens', headers: admin });
- assert.ok(!JSON.stringify(listed.json()).includes(token));
-
- // Disabling it takes effect at once.
- await h.app.inject({
- method: 'PATCH',
- url: `/api/worker-tokens/${record.id}`,
- headers: json(admin),
- payload: JSON.stringify({ enabled: false }),
- });
- const after = await h.app.inject({
- method: 'GET', url: '/api/workers/poll', headers: { authorization: `Bearer ${token}` },
- });
- assert.equal(after.statusCode, 401);
- });
-});
-
-test('project variables reach a job environment and are never listed', async () => {
- await withAdmin({}, async (h, admin) => {
- const set = await h.app.inject({
- method: 'PUT',
- url: '/api/projects/demo/variables/DEPLOY_TOKEN',
- headers: json(admin),
- payload: JSON.stringify({ value: 'super-secret-value', masked: true }),
- });
- assert.equal(set.statusCode, 200);
-
- const listed = await h.app.inject({
- method: 'GET', url: '/api/projects/demo/variables', headers: admin,
- });
- const listing = listed.json().variables;
- assert.equal(listing[0].name, 'DEPLOY_TOKEN');
- assert.equal(listing[0].masked, true);
- // The value must not come back out.
- assert.ok(!JSON.stringify(listing).includes('super-secret-value'));
-
- await h.trigger({ sha: h.sha, ref: 'refs/heads/main' });
- const claimed = await h.poll({});
- const job = claimed.json().job;
-
- assert.equal(job.env.DEPLOY_TOKEN, 'super-secret-value');
- assert.deepEqual(job.masked, ['super-secret-value']);
- });
-});
-
-test('a variable is encrypted at rest and bound to its project and name', async () => {
- await withAdmin({}, async (h, admin) => {
- await h.app.inject({
- method: 'PUT',
- url: '/api/projects/demo/variables/TOKEN',
- headers: json(admin),
- payload: JSON.stringify({ value: 'rest-secret-value' }),
- });
-
- const row = await h.services.db.get(
- 'SELECT value FROM project_variables WHERE project_id = {p} AND name = {n}',
- { p: 'demo', n: 'TOKEN' }
- );
- assert.ok(row.value.startsWith('v1.'), 'expected an encrypted value');
- assert.ok(!row.value.includes('rest-secret-value'));
-
- // The same ciphertext under a different name must not open.
- await h.services.db.run(
- `INSERT INTO project_variables (project_id, name, value, masked, created_at)
- VALUES ({p}, {n}, {v}, 1, {t})`,
- { p: 'demo', n: 'MOVED', v: row.value, t: Date.now() }
- );
- const resolved = await h.services.variables.resolve('demo');
- assert.equal(resolved.env.TOKEN, 'rest-secret-value');
- assert.equal(resolved.env.MOVED, undefined, 'a relocated ciphertext must not open');
- });
-});
-
-test('a pipeline setting wins over a project variable of the same name', async () => {
- const pipeline = `
-version: 1
-jobs:
- a:
- image: alpine
- script: ['true']
- env:
- SHARED: from-pipeline
-`;
- await withAdmin({ pipeline }, async (h, admin) => {
- await h.app.inject({
- method: 'PUT',
- url: '/api/projects/demo/variables/SHARED',
- headers: json(admin),
- payload: JSON.stringify({ value: 'from-variable' }),
- });
-
- await h.trigger({ sha: h.sha, ref: 'refs/heads/main' });
- const job = (await h.poll({})).json().job;
- assert.equal(job.env.SHARED, 'from-pipeline');
- });
-});
-
-test('a masked variable is redacted from ingested logs', async () => {
- await withAdmin({}, async (h, admin) => {
- await h.app.inject({
- method: 'PUT',
- url: '/api/projects/demo/variables/LEAKY',
- headers: json(admin),
- payload: JSON.stringify({ value: 'leaked-secret-value', masked: true }),
- });
-
- await h.trigger({ sha: h.sha, ref: 'refs/heads/main' });
- const job = (await h.poll({})).json().job;
-
- // A worker that does not mask still must not get the secret onto disk.
- await h.app.inject({
- method: 'POST',
- url: `/api/workers/jobs/${encodeURIComponent(job.id)}/log`,
- headers: { ...h.auth, 'content-type': 'application/octet-stream' },
- payload: Buffer.from('echo leaked-secret-value here\n'),
- });
-
- const log = await h.app.inject({ method: 'GET', url: `/api/jobs/${encodeURIComponent(job.id)}/log` });
- assert.ok(!log.body.includes('leaked-secret-value'), `log leaked: ${log.body}`);
- assert.match(log.body, /\[masked\]/);
- });
-});
-
-test('a run can be cancelled and retried through the api', async () => {
- await withAdmin({}, async (h, admin) => {
- const run = (await h.trigger({ sha: h.sha, ref: 'refs/heads/main' })).json().run_id;
-
- const cancelled = await h.app.inject({
- method: 'POST', url: `/api/runs/${run}/cancel`, headers: json(admin), payload: '{}',
- });
- assert.equal(cancelled.statusCode, 200);
-
- const detail = await h.app.inject({ method: 'GET', url: `/api/runs/${run}` });
- assert.equal(detail.json().run.state, 'cancelled');
-
- const retried = await h.app.inject({
- method: 'POST', url: `/api/runs/${run}/retry`, headers: json(admin), payload: '{}',
- });
- assert.equal(retried.statusCode, 201);
- assert.notEqual(retried.json().run_id, run);
-
- const fresh = await h.app.inject({ method: 'GET', url: `/api/runs/${retried.json().run_id}` });
- assert.equal(fresh.json().run.state, 'running');
- assert.equal(fresh.json().run.head_sha, h.sha);
- });
-});
-
-test('with oidc configured, local login is refused', async () => {
- const h = await startHarness({
- oidcDiscoveryUrl: 'https://idp.example.com/realms/ci/.well-known/openid-configuration',
- bootstrap: true,
- });
- try {
- assert.equal(h.cfg.auth.mode, 'oidc');
- const res = await h.app.inject({
- method: 'POST',
- url: '/api/auth/login',
- headers: { 'content-type': 'application/json' },
- payload: JSON.stringify({ username: 'admin', password: 'bootstrap-password' }),
- });
- assert.equal(res.statusCode, 400);
- assert.match(res.json().error, /OIDC/);
-
- const mode = await h.app.inject({ method: 'GET', url: '/api/auth/mode' });
- assert.equal(mode.json().mode, 'oidc');
- assert.equal(mode.json().local_login, false);
- } finally {
- await h.stop();
- }
-});
