Provision instance bank credentials automatically (Refs #146)

2026-10-12 20:44:01 -04:00
parent e071e5b574
commit d14c6a7ff4
21 changed files with 634 additions and 109 deletions
@@ -416,3 +416,47 @@ describe('asynchronous native launch preparation', () => {
        expect(await operationFor(second.deploymentId)).toBeDefined();
    });
 });
+
+it('injects unique persistent bank credentials only into private runtime files', async () => {
+    const job = await queue();
+    await runPass();
+    const op = await operationFor(job.deploymentId);
+    const { getHostOperation } = await import('../../src/lib/server/hosts/index.js');
+    const { nativeInstance } = await import('../../src/lib/server/backends/native.js');
+    const { bankCredential, authenticateBank } = await import('../../src/lib/server/auth/bank.js');
+    const { recipeForDeployment } = await import('../../src/lib/server/fleet/launch-recipes.js');
+    const instance = nativeInstance(job.name)!;
+    const credential = bankCredential(instance.id);
+    const payload = getHostOperation(op!.id)!.payload as {
+        bank: { token: string; configPath: string };
+        files: { path: string }[];
+        env: Record<string, string>;
+    };
+    expect(payload.bank).toEqual({
+        token: credential,
+        configPath: 'configs/electric_cherry_bank.cfg'
+    });
+    expect(payload.files.some((file) => file.path.endsWith('electric_cherry_bank.cfg'))).toBe(
+        false
+    );
+    const { db } = await import('../../src/lib/server/db/index.js');
+    expect(
+        db()
+            .prepare('SELECT count(*) AS n FROM file_blobs WHERE instr(content,?) > 0')
+            .get(Buffer.from(credential))
+    ).toEqual({ n: 0 });
+    expect(payload.env.PLUTAINER_EXTRA_ARGS).toContain(
+        '+exec electric_cherry_bank.cfg +set tws_server_id'
+    );
+    expect(
+        authenticateBank(
+            new Request('https://test', { headers: { Authorization: `Bearer ${credential}` } })
+        )
+    ).toMatchObject({ ok: true, server: job.name, instanceId: instance.id });
+    expect(JSON.stringify(recipeForDeployment(job.deploymentId))).not.toContain(credential);
+    expect(
+        recipeForDeployment(job.deploymentId)!.recipe.files.some(
+            (file) => file.path === 'electric_cherry_bank.cfg'
+        )
+    ).toBe(false);
+});