run/config/package_config_test.go

package config

import (
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestLoadPackageConfigAppliesServerScopedIdentity(t *testing.T) {
	path := writePackageConfig(t, PackageConfig{
		Kind:             PackageComponentRun,
		ServerInstanceID: "server-1",
		PluginID:         "game.minecraft",
		RunEndpointID:    "run-server-1",
		ProfileKey:       "run-local",
		TargetOS:         "linux",
		TargetArch:       "amd64",
		SecretRef:        "secret://runtime-keys/server-1/run/current",
		KeyGeneration:    3,
		AuthKey:          "opaque-runtime-key",
	})

	pkg, err := LoadPackageConfig(path)
	if err != nil {
		t.Fatalf("load package config: %v", err)
	}
	cfg := ApplyPackageConfig(Config{RunEndpointID: DefaultEndpointID, DisplayName: DefaultDisplayName}, pkg)
	if cfg.RegistrationToken != "opaque-runtime-key" || cfg.RunEndpointID != "run-server-1" || cfg.ServerInstanceID != "server-1" || cfg.ComponentKey != "" || cfg.KeyGeneration != 3 {
		t.Fatalf("expected package identity to be applied, got %+v", cfg)
	}
	diagnostics := pkg.IdentityDiagnostics()
	for _, value := range diagnostics {
		if strings.Contains(value, "opaque-runtime-key") || strings.Contains(value, "/Users/") || strings.Contains(value, "password=") {
			t.Fatalf("diagnostics exposed sensitive value: %+v", diagnostics)
		}
	}
	if diagnostics["keyFingerprint"] == "" || diagnostics["secretRef"] != "secret://runtime-keys/server-1/run/current" {
		t.Fatalf("expected key fingerprint and logical secret ref, got %+v", diagnostics)
	}
}

func TestLoadPackageConfigRejectsUnsafeOrIncompletePackages(t *testing.T) {
	valid := PackageConfig{
		Kind:             PackageComponentRun,
		ServerInstanceID: "server-1",
		PluginID:         "game.scum",
		TargetOS:         "windows",
		TargetArch:       "amd64",
		SecretRef:        "secret://runtime-keys/server-1/run/current",
		KeyGeneration:    1,
		AuthKey:          "opaque-runtime-key",
	}
	cases := map[string]func(PackageConfig) PackageConfig{
		"old zero generation": func(cfg PackageConfig) PackageConfig { cfg.KeyGeneration = 0; return cfg },
		"raw path":            func(cfg PackageConfig) PackageConfig { cfg.ServerInstanceID = "/Users/tasia/server"; return cfg },
		"socket":              func(cfg PackageConfig) PackageConfig { cfg.SecretRef = "unix:///tmp/run.sock"; return cfg },
		"legacy component":    func(cfg PackageConfig) PackageConfig { cfg.Kind = "client-manager"; return cfg },
	}
	for name, mutate := range cases {
		if err := ValidatePackageConfig(mutate(valid)); err == nil {
			t.Fatalf("expected %s package to be rejected", name)
		}
	}
}

func TestPackageConfigTreatsAuthKeyAsOpaqueValue(t *testing.T) {
	cfg := PackageConfig{
		Kind:             PackageComponentRun,
		ServerInstanceID: "server-1",
		PluginID:         "game.scum",
		TargetOS:         "windows",
		TargetArch:       "amd64",
		SecretRef:        "secret://runtime-keys/server-1/run/current",
		KeyGeneration:    1,
		AuthKey:          "password=raw sk-test-value bearer literal",
	}
	if err := ValidatePackageConfig(cfg); err != nil {
		t.Fatalf("authKey must be treated as opaque package data, got %v", err)
	}
}

func TestAuthenticatePackageGenerationRejectsStalePackages(t *testing.T) {
	pkg := PackageConfig{
		Kind:             PackageComponentRun,
		ServerInstanceID: "server-1",
		PluginID:         "game.minecraft",
		ProfileKey:       "run-local",
		TargetOS:         "linux",
		TargetArch:       "amd64",
		SecretRef:        "secret://runtime-keys/server-1/run/current",
		KeyGeneration:    1,
		AuthKey:          "opaque-runtime-key",
	}
	err := AuthenticatePackageGeneration(pkg, ComponentAuthResult{
		ServerInstanceID: "server-1",
		Kind:             PackageComponentRun,
		KeyGeneration:    2,
		Allowed:          true,
		Reason:           "current key accepted",
	})
	if err == nil || !strings.Contains(err.Error(), "generation") {
		t.Fatalf("expected stale generation rejection, got %v", err)
	}
	err = AuthenticatePackageGeneration(pkg, ComponentAuthResult{
		ServerInstanceID: "server-1",
		Kind:             PackageComponentRun,
		KeyGeneration:    1,
		Allowed:          true,
		Reason:           "current key accepted",
	})
	if err != nil {
		t.Fatalf("expected current generation to authenticate: %v", err)
	}
}

func TestLoadPackageConfigFromEnv(t *testing.T) {
	path := writePackageConfig(t, PackageConfig{
		Kind:             PackageComponentRun,
		ServerInstanceID: "server-1",
		PluginID:         "game.scum",
		RunEndpointID:    "run-server-1",
		ProfileKey:       "run-local",
		TargetOS:         "windows",
		TargetArch:       "amd64",
		SecretRef:        "secret://runtime-keys/server-1/run/current",
		KeyGeneration:    4,
		AuthKey:          "opaque-run-key",
	})
	t.Setenv(PackageConfigEnv, path)

	cfg, ok, err := LoadPackageConfigFromEnv()
	if err != nil || !ok {
		t.Fatalf("expected env package config, ok=%v err=%v", ok, err)
	}
	if cfg.Kind != PackageComponentRun || cfg.ProfileKey != "run-local" {
		t.Fatalf("unexpected package config: %+v", cfg)
	}

	t.Setenv(PackageConfigEnv, "")
	_, ok, err = LoadPackageConfigFromEnv()
	if err != nil || ok {
		t.Fatalf("expected no env package config, ok=%v err=%v", ok, err)
	}
}

func writePackageConfig(t *testing.T, cfg PackageConfig) string {
	t.Helper()
	body, err := json.Marshal(cfg)
	if err != nil {
		t.Fatalf("marshal package config: %v", err)
	}
	path := filepath.Join(t.TempDir(), "run-package.json")
	if err := os.WriteFile(path, body, 0o600); err != nil {
		t.Fatalf("write package config: %v", err)
	}
	return path
}