bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat: harden community production foundation through story 1.5

Browse Source
This commit is contained in:
bsodfather
2026-08-14 00:21:59 +03:00
parent c30461cc92
commit f6fc2e5c9b
161 changed files with 16758 additions and 2515 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/admin-api/tests/config_startup.rs
+71
View File
@@ -0,0 +1,71 @@
use std::process::Command;
fn run_with(entries: &[(&str, &str)]) -> String {
let mut command = Command::new(env!("CARGO_BIN_EXE_admin-api"));
for field in crank_config::field_registry() {
command.env_remove(field.env_name);
}
command.envs([
("CRANK_MASTER_KEY", "master"),
("CRANK_SESSION_SECRET", "session"),
("CRANK_PASSWORD_PEPPER", "pepper"),
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
("CRANK_BOOTSTRAP_ADMIN_PASSWORD", "password"),
]);
for (name, value) in entries {
command.env(name, value);
}
let output = command.output().expect("admin binary executes");
assert!(!output.status.success());
let stderr = String::from_utf8(output.stderr).expect("stderr is UTF-8");
assert!(!stderr.contains("CANARY_SECRET_VALUE"));
assert!(!stderr.contains("connection refused"));
assert!(stderr.len() <= 65_536);
stderr
}
#[test]
fn invalid_config_fails_before_database_or_listener_side_effects() {
for (entries, code) in [
(
vec![("CRANK_CONFIG_CANARY_UNKNOWN", "CANARY_SECRET_VALUE")],
"config.unknown_field",
),
(vec![("POSTGRES_PORT", "bad")], "config.invalid_type"),
(
vec![
("CRANK_DATABASE_URL", "postgres://db/crank"),
("POSTGRES_HOST", "other"),
],
"config.conflict",
),
(vec![("CRANK_LOG_LEVEL", "[")], "config.invalid_type"),
] {
let stderr = run_with(&entries);
assert!(stderr.contains(code), "{stderr}");
}
}
#[test]
fn database_driver_failures_are_normalized_and_redacted() {
let stderr = run_with(&[(
"CRANK_DATABASE_URL",
"postgres://CANARY_SECRET_VALUE:CANARY_SECRET_VALUE@127.0.0.1:1/crank",
)]);
assert!(stderr.contains("startup_failed"), "{stderr}");
}
#[tokio::test]
async fn fresh_database_startup_is_read_only() {
let database_url = crank_test_support::postgres_schema_url("admin_startup_read_only").await;
let stderr = run_with(&[("CRANK_DATABASE_URL", &database_url)]);
assert!(stderr.contains("schema_missing"), "{stderr}");
let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
let present: bool = sqlx::query_scalar(
"select to_regclass(format('%I.%I', current_schema(), '__crank_core_migrations')) is not null",
)
.fetch_one(&pool)
.await
.unwrap();
assert!(!present);
}
apps/admin-api/tests/integration.rs
+1
View File
@@ -4,5 +4,6 @@ mod integration {
mod community_access_usage;
mod openapi_import;
mod operations_agents;
mod request_context;
mod secrets_import_auth;
}
apps/admin-api/tests/integration/common.rs
+4
View File
@@ -211,6 +211,10 @@ pub(super) async fn create_lead(Json(payload): Json<Value>) -> Json<Value> {
pub(super) async fn test_registry() -> PostgresRegistry {
let database_url = crank_test_support::postgres_schema_url("test_admin_api").await;
let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
crank_registry::MigrationAuthority::apply(&pool)
.await
.unwrap();
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
let password_hash = hash_password(TEST_AUTH_PASSWORD, TEST_PASSWORD_PEPPER).unwrap();
let user_id = registry
apps/admin-api/tests/integration/operations_agents.rs
+73 -7
View File
@@ -10,7 +10,7 @@ use std::{
};
use async_trait::async_trait;
use axum::{Json, Router, routing::post};
use axum::{Json, Router, extract::State, http::HeaderMap, routing::post};
use crank_core::{
ExecutionConfig, HttpMethod, MembershipRole, OperationSecurityLevel, Protocol,
ResponseCachePolicy, RestTarget, SecretKind, Target, ToolDescription, WorkspaceId,
@@ -97,8 +97,8 @@ impl IdentityProvider for RejectingIdentityProvider {
async fn creates_publishes_and_tests_rest_operation() {
let registry = test_registry().await;
let storage_root = test_storage_root("lifecycle");
let upstream_base_url = spawn_upstream_server().await;
let base_url = spawn_admin_api(build_test_app(registry, storage_root)).await;
let (upstream_base_url, observed_upstream_headers) = spawn_correlation_upstream_server().await;
let base_url = spawn_admin_api(build_test_app(registry.clone(), storage_root)).await;
let client = authorized_client(&base_url).await;
let created = client
@@ -132,18 +132,25 @@ async fn creates_publishes_and_tests_rest_operation() {
.json::<Value>()
.await
.unwrap();
let test_run = client
let test_run_response = client
.post(format!("{base_url}/operations/{operation_id}/test-runs"))
.header("x-request-id", "req_admin_test_run")
.header(
"traceparent",
"00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
)
.json(&json!({
"version": 1,
"input": { "email": "user@example.com" }
}))
.send()
.await
.unwrap()
.json::<Value>()
.await
.unwrap();
assert_eq!(
test_run_response.headers()["x-trace-id"].to_str().unwrap(),
"0af7651916cd43dd8448eb211c80319c"
);
let test_run = test_run_response.json::<Value>().await.unwrap();
assert_eq!(listed["items"][0]["name"], "crm_create_lead");
assert_eq!(
@@ -158,6 +165,65 @@ async fn creates_publishes_and_tests_rest_operation() {
"user@example.com"
);
assert_eq!(test_run["response_preview"]["id"], "lead_123");
let logs = registry
.list_invocation_logs(crank_registry::ListInvocationLogsQuery {
workspace_id: &WorkspaceId::new(DEFAULT_WORKSPACE_ID),
level: None,
search_text: None,
source: Some(crank_core::InvocationSource::AdminTestRun),
operation_id: Some(&crank_core::OperationId::new(&operation_id)),
agent_id: None,
created_after: None,
limit: 10,
})
.await
.unwrap();
assert_eq!(logs.len(), 1);
assert_eq!(
logs[0].log.request_id.as_deref(),
Some("req_admin_test_run")
);
assert_eq!(
logs[0].log.trace_id.as_deref(),
Some("0af7651916cd43dd8448eb211c80319c")
);
let upstream_headers = observed_upstream_headers.lock().await;
let upstream_headers = upstream_headers.as_ref().unwrap();
assert_eq!(
upstream_headers["x-request-id"].to_str().unwrap(),
"req_admin_test_run"
);
assert_eq!(
&upstream_headers["traceparent"].to_str().unwrap()[3..35],
"0af7651916cd43dd8448eb211c80319c"
);
}
async fn spawn_correlation_upstream_server() -> (String, Arc<tokio::sync::Mutex<Option<HeaderMap>>>)
{
let observed = Arc::new(tokio::sync::Mutex::new(None));
let app = Router::new()
.route("/crm/leads", post(capture_correlation_and_create_lead))
.with_state(Arc::clone(&observed));
let listener = TcpListener::bind("127.0.0.1:0").await.unwrap();
let address = listener.local_addr().unwrap();
tokio::spawn(async move {
axum::serve(listener, app).await.unwrap();
});
(format!("http://{address}"), observed)
}
async fn capture_correlation_and_create_lead(
State(observed): State<Arc<tokio::sync::Mutex<Option<HeaderMap>>>>,
headers: HeaderMap,
Json(payload): Json<Value>,
) -> Json<Value> {
*observed.lock().await = Some(headers);
Json(json!({
"id": "lead_123",
"status": "created",
"input": payload,
}))
}
#[tokio::test(flavor = "multi_thread")]
apps/admin-api/tests/integration/request_context.rs
+162 -2
View File
@@ -3,10 +3,10 @@ use std::{
sync::{Arc, Mutex},
};
use admin_api::request_context::{REQUEST_ID_HEADER, apply_request_context};
use admin_api::request_context::{REQUEST_ID_HEADER, TRACE_ID_HEADER, apply_request_context};
use axum::{
Router,
body::Body,
body::{Body, to_bytes},
http::{HeaderMap, HeaderValue, Request, StatusCode},
routing::get,
};
@@ -64,6 +64,11 @@ async fn logs_request_completion_and_rejects_untrusted_values() {
.find(|event: &serde_json::Value| event["event"] == "admin.request.completed")
.unwrap();
assert_eq!(event["request_id"], "req_admin_trace_123");
let trace_id = response.headers()[TRACE_ID_HEADER.as_str()]
.to_str()
.unwrap();
assert_eq!(trace_id.len(), 32);
assert_eq!(event["trace_id"], trace_id);
assert_eq!(event["fields"]["status"], 200);
assert_eq!(event["fields"]["route"], "/probe");
@@ -85,9 +90,144 @@ async fn logs_request_completion_and_rejects_untrusted_values() {
uuid::Uuid::parse_str(generated).unwrap().get_version(),
Some(Version::SortRand)
);
let generated_trace = invalid_response.headers()[TRACE_ID_HEADER.as_str()]
.to_str()
.unwrap();
assert_eq!(generated_trace.len(), 32);
assert_ne!(generated_trace, "canary-invalid-traceparent");
assert!(!writer.output().contains("canary-invalid-traceparent"));
}
#[tokio::test(flavor = "current_thread")]
async fn structured_boundary_error_carries_the_same_safe_ids() {
let _tracing_test_guard = TRACING_TEST_LOCK.lock().await;
let dispatch = tracing::Dispatch::new(tracing_subscriber::registry());
let _dispatch_guard = tracing::dispatcher::set_default(&dispatch);
let response = error_probe_app()
.oneshot(
Request::builder()
.uri("/error")
.header("x-request-id", "request-boundary-error")
.header(
"traceparent",
"00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01",
)
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();
assert_eq!(response.status(), StatusCode::BAD_REQUEST);
assert_eq!(
response.headers()[REQUEST_ID_HEADER],
"request-boundary-error"
);
assert_eq!(
response.headers()[TRACE_ID_HEADER],
"0af7651916cd43dd8448eb211c80319c"
);
let body = to_bytes(response.into_body(), 16 * 1024).await.unwrap();
let payload: serde_json::Value = serde_json::from_slice(&body).unwrap();
assert_eq!(payload["error"]["request_id"], "request-boundary-error");
assert_eq!(
payload["error"]["trace_id"],
"0af7651916cd43dd8448eb211c80319c"
);
}
#[tokio::test(flavor = "current_thread")]
async fn boundary_status_matrix_keeps_ids_and_redacts_internal_causes() {
let _tracing_test_guard = TRACING_TEST_LOCK.lock().await;
let writer = SharedLogWriter::default();
let subscriber = crank_observability::build_subscriber(
ObservabilityConfig::new(
ServiceIdentity::try_new("admin-api", "test", "test").unwrap(),
"info",
RedactionLimits::default(),
),
writer.clone(),
)
.unwrap();
let app = Router::new()
.route(
"/bad-request",
get(|| async { Err::<(), _>(admin_api::error::ApiError::validation("invalid")) }),
)
.route(
"/unauthorized",
get(|| async {
Err::<(), _>(admin_api::error::ApiError::unauthorized("unauthorized"))
}),
)
.route(
"/forbidden",
get(|| async { Err::<(), _>(admin_api::error::ApiError::forbidden("forbidden")) }),
)
.route(
"/internal",
get(|| async {
Err::<(), _>(admin_api::error::ApiError::internal(
"postgres://canary-user:canary-password@private-host/database",
))
}),
)
.route(
"/rate-limited",
get(|| async { StatusCode::TOO_MANY_REQUESTS }),
)
.layer(axum::middleware::from_fn(apply_request_context));
let responses = async {
let mut responses = Vec::new();
for (path, status) in [
("/bad-request", StatusCode::BAD_REQUEST),
("/unauthorized", StatusCode::UNAUTHORIZED),
("/forbidden", StatusCode::FORBIDDEN),
("/missing", StatusCode::NOT_FOUND),
("/rate-limited", StatusCode::TOO_MANY_REQUESTS),
("/internal", StatusCode::INTERNAL_SERVER_ERROR),
] {
let response = app
.clone()
.oneshot(
Request::builder()
.uri(path)
.header(REQUEST_ID_HEADER.as_str(), "matrix-request-id")
.body(Body::empty())
.unwrap(),
)
.await
.unwrap();
assert_eq!(response.status(), status);
assert_eq!(response.headers()[REQUEST_ID_HEADER], "matrix-request-id");
assert_eq!(response.headers()[TRACE_ID_HEADER].as_bytes().len(), 32);
responses.push(to_bytes(response.into_body(), 16 * 1024).await.unwrap());
}
responses
};
let dispatch = tracing::Dispatch::new(subscriber);
let _dispatch_guard = tracing::dispatcher::set_default(&dispatch);
let responses = responses.await;
let combined = responses
.iter()
.flat_map(|body| body.iter().copied())
.collect::<Vec<_>>();
assert!(
!combined
.windows("canary-password".len())
.any(|value| value == b"canary-password")
);
assert!(!writer.output().contains("canary-password"));
let internal_event: serde_json::Value = writer
.output()
.lines()
.map(|line| serde_json::from_str(line).unwrap())
.find(|event: &serde_json::Value| event["event"] == "admin.response.internal_error")
.unwrap();
assert_eq!(internal_event["request_id"], "matrix-request-id");
assert_eq!(internal_event["trace_id"].as_str().unwrap().len(), 32);
}
#[tokio::test(flavor = "current_thread")]
async fn covers_valid_invalid_and_absent_traceparent() {
let _tracing_test_guard = TRACING_TEST_LOCK.lock().await;
@@ -163,6 +303,14 @@ async fn replaces_multiple_request_id_headers_with_one_uuid_v7() {
REQUEST_ID_HEADER,
HeaderValue::from_static("second-request-id"),
);
request.headers_mut().append(
"traceparent",
HeaderValue::from_static("00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"),
);
request.headers_mut().append(
"traceparent",
HeaderValue::from_static("00-1af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01"),
);
let response = probe_app().oneshot(request).await.unwrap();
let generated = response.headers()[REQUEST_ID_HEADER].to_str().unwrap();
@@ -173,6 +321,9 @@ async fn replaces_multiple_request_id_headers_with_one_uuid_v7() {
uuid::Uuid::parse_str(generated).unwrap().get_version(),
Some(Version::SortRand)
);
let trace_id = response.headers()[TRACE_ID_HEADER].to_str().unwrap();
assert_ne!(trace_id, "0af7651916cd43dd8448eb211c80319c");
assert_ne!(trace_id, "1af7651916cd43dd8448eb211c80319c");
}
fn probe_app() -> Router {
@@ -181,6 +332,15 @@ fn probe_app() -> Router {
.layer(axum::middleware::from_fn(apply_request_context))
}
fn error_probe_app() -> Router {
Router::new()
.route(
"/error",
get(|| async { Err::<(), _>(admin_api::error::ApiError::validation("invalid")) }),
)
.layer(axum::middleware::from_fn(apply_request_context))
}
fn trace_probe_app() -> Router {
Router::new()
.route("/trace", get(observed_traceparent))
apps/admin-api/tests/migration_command.rs
+90
View File
@@ -0,0 +1,90 @@
use std::process::{Command, Output};
fn command(arguments: &[&str], database_url: Option<&str>) -> Output {
let mut command = Command::new(env!("CARGO_BIN_EXE_crank-migrate"));
command.args(arguments);
command.current_dir(std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../.."));
for (name, _) in std::env::vars() {
if name.starts_with("CRANK_") || name.starts_with("POSTGRES_") || name.starts_with("OTEL_")
{
command.env_remove(name);
}
}
if let Some(database_url) = database_url {
command.env("CRANK_DATABASE_URL", database_url);
}
command.output().expect("migration command must run")
}
#[test]
fn plan_is_deterministic_and_committed_contract_is_current() {
let first = command(&["plan"], None);
let second = command(&["plan"], None);
assert!(
first.status.success(),
"{}",
String::from_utf8_lossy(&first.stderr)
);
assert_eq!(first.stdout, second.stdout);
let plan: serde_json::Value = serde_json::from_slice(&first.stdout).unwrap();
assert_eq!(plan["sequence"].as_array().unwrap().len(), 3);
let checked = command(&["plan", "--check"], None);
assert!(
checked.status.success(),
"{}",
String::from_utf8_lossy(&checked.stderr)
);
}
#[test]
fn invalid_command_is_bounded_and_does_not_echo_arguments() {
let canary = "secret-command-canary";
let output = command(&[canary], None);
assert!(!output.status.success());
let stderr = String::from_utf8(output.stderr).unwrap();
assert!(stderr.len() < 1_024);
assert!(!stderr.contains(canary));
let diagnostic: serde_json::Value = serde_json::from_str(stderr.trim()).unwrap();
assert_eq!(diagnostic["code"], "invalid_command");
}
#[tokio::test]
async fn database_only_config_can_apply_and_preflight_a_fresh_schema() {
let database_url = crank_test_support::postgres_schema_url("test_migration_command").await;
let applied = command(&["apply"], Some(&database_url));
assert!(
applied.status.success(),
"{}",
String::from_utf8_lossy(&applied.stderr)
);
let result: serde_json::Value = serde_json::from_slice(&applied.stdout).unwrap();
assert_eq!(result["status"], "applied");
let preflight = command(&["preflight"], Some(&database_url));
assert!(
preflight.status.success(),
"{}",
String::from_utf8_lossy(&preflight.stderr)
);
let result: serde_json::Value = serde_json::from_slice(&preflight.stdout).unwrap();
assert_eq!(result["status"], "current");
assert_eq!(result["version"], 3);
}
#[tokio::test]
async fn migration_error_json_preserves_affected_version() {
let database_url = crank_test_support::postgres_schema_url("test_migration_cli_version").await;
assert!(command(&["apply"], Some(&database_url)).status.success());
let pool = sqlx::PgPool::connect(&database_url).await.unwrap();
sqlx::query("update __crank_migrations set checksum = 'tampered' where version = 2")
.execute(&pool)
.await
.unwrap();
let output = command(&["preflight"], Some(&database_url));
assert!(!output.status.success());
let diagnostic: serde_json::Value = serde_json::from_slice(&output.stderr).unwrap();
assert_eq!(diagnostic["code"], "checksum_mismatch");
assert_eq!(diagnostic["version"], 2);
}
apps/admin-api/tests/unit/error.rs
+4 -12
View File
@@ -13,27 +13,19 @@ fn runtime_test_failure_includes_structured_context() {
assert_eq!(
payload["context"],
json!({
"field": "request.headers",
"reason": "must be an object"
"field": "request.headers"
})
);
}
#[test]
fn runtime_error_context_includes_secret_crypto_operation() {
fn runtime_error_context_does_not_expose_secret_crypto_details() {
let context = runtime_error_context(&RuntimeError::SecretCrypto {
operation: "decode secret envelope",
details: "bad base64".to_owned(),
})
.unwrap();
});
assert_eq!(
context,
json!({
"operation": "decode secret envelope",
"details": "bad base64"
})
);
assert_eq!(context, None);
}
#[test]