Compare commits

...

3 Commits

Author SHA1 Message Date
Zakaria 432d9d4ce1 ci: run lint, type-check, tests and build on Gitea Actions
CI / checks (pull_request) Successful in 28m29s
Runs on pushes to main and on every pull request.
2026-10-23 11:12:51 -04:00
Zakaria b171f745db test: bring stale tests and lint in line with the current UI
- CodeDeploy: query the redesigned form's labels.
- CloudFormation: expect the parameters and capabilities fields the form
  now submits.
- ALB listeners: advance the five-second minimum create state before
  deleting, since row actions are disabled while it is pending.
- Lightsail: cast the fetch mock as a whole so it type-checks.
- TargetGroupPanel: depend on the stable refetch function to satisfy
  react-hooks/exhaustive-deps.
2026-10-23 11:12:51 -04:00
Zakaria f5e70a78d8 Merge pull request 'fix(api): block open redirects, add health check and body limits, run as non-root' (#4) from fix/api-hardening into main
Reviewed-on: #4
2026-10-23 14:59:32 +00:00
6 changed files with 77 additions and 21 deletions
+46
View File
@@ -0,0 +1,46 @@
name: CI
on:
push:
branches: [main]
pull_request:
concurrency:
group: ci-${{ github.ref }}
cancel-in-progress: true
jobs:
checks:
runs-on: ubuntu-latest
timeout-minutes: 20
steps:
- uses: actions/checkout@v4
- uses: pnpm/action-setup@v4
- uses: actions/setup-node@v4
with:
node-version: 22
cache: pnpm
- uses: oven-sh/setup-bun@v2
with:
bun-version: 1.4.2
- name: Install dependencies
run: pnpm install --frozen-lockfile
- name: Lint
run: pnpm lint
- name: Type-check
run: pnpm type-check
- name: API tests
run: pnpm test
- name: Frontend tests
run: pnpm --filter @floci/frontend test
- name: Build
run: pnpm build
@@ -60,9 +60,9 @@ describe('AwsLightsailAdapter', () => {
test('merges diagnostic host-port mappings into UI metadata', async () => { test('merges diagnostic host-port mappings into UI metadata', async () => {
process.env.FLOCI_ENDPOINT = 'http://core.test:4566' process.env.FLOCI_ENDPOINT = 'http://core.test:4566'
const fetchMock = globalThis.fetch const fetchMock = globalThis.fetch
globalThis.fetch = async () => new Response(JSON.stringify({mappings: [ globalThis.fetch = (async () => new Response(JSON.stringify({mappings: [
{instancePort: 80, host: 'localhost', hostPort: 18080, protocol: 'tcp'}, {instancePort: 80, host: 'localhost', hostPort: 18080, protocol: 'tcp'},
]})) ]}))) as unknown as typeof fetch
try { try {
const resource = await new AwsLightsailAdapter(stubLightsail().client).get('web') const resource = await new AwsLightsailAdapter(stubLightsail().client).get('web')
expect(resource?.metadata.hostPortMappings).toEqual([ expect(resource?.metadata.hostPortMappings).toEqual([
@@ -17,6 +17,6 @@ describe('CloudFormationCreatePanel', () => {
fireEvent.change(screen.getByPlaceholderText('orders-stack'), {target: {value: 'orders-stack'}}) fireEvent.change(screen.getByPlaceholderText('orders-stack'), {target: {value: 'orders-stack'}})
fireEvent.change(screen.getByLabelText('Template S3 URL'), {target: {value: 'http://templates.localhost:4566/orders.yaml'}}) fireEvent.change(screen.getByLabelText('Template S3 URL'), {target: {value: 'http://templates.localhost:4566/orders.yaml'}})
fireEvent.click(screen.getByRole('button', {name: 'Create stack'})) fireEvent.click(screen.getByRole('button', {name: 'Create stack'}))
expect(onSubmit).toHaveBeenCalledWith({stackName: 'orders-stack', templateBody: '', templateUrl: 'http://templates.localhost:4566/orders.yaml'}) expect(onSubmit).toHaveBeenCalledWith({stackName: 'orders-stack', templateBody: '', templateUrl: 'http://templates.localhost:4566/orders.yaml', parameters: '{}', capabilities: ''})
}) })
}) })
@@ -9,12 +9,12 @@ describe('CodeDeployCreatePanel', () => {
const onSubmit = vi.fn() const onSubmit = vi.fn()
render(<CodeDeployCreatePanel isSubmitting={false} submitError={null} onCancel={vi.fn()} onSubmit={onSubmit}/>) render(<CodeDeployCreatePanel isSubmitting={false} submitError={null} onCancel={vi.fn()} onSubmit={onSubmit}/>)
await user.type(screen.getByLabelText('Application name'), 'orders') await user.type(screen.getByLabelText(/^Application name/), 'orders')
await user.type(screen.getByLabelText('Deployment group name'), 'production') await user.type(screen.getByLabelText(/^Deployment group name/), 'production')
await user.type(screen.getByLabelText('CodeDeploy service role ARN'), 'role-arn') await user.type(screen.getByLabelText(/^Service role ARN/), 'role-arn')
await user.click(screen.getByRole('button', {name: 'Create deployment group'})) await user.click(screen.getByRole('button', {name: 'Create deployment group'}))
expect(screen.queryByLabelText('ECS cluster name')).not.toBeInTheDocument() expect(screen.queryByLabelText(/^Cluster name/)).not.toBeInTheDocument()
expect(onSubmit).toHaveBeenCalledWith({applicationName: 'orders', deploymentGroupName: 'production', computePlatform: 'Lambda', serviceRoleArn: 'role-arn', deploymentConfig: 'AllAtOnce', rollbackOnFailure: true}) expect(onSubmit).toHaveBeenCalledWith({applicationName: 'orders', deploymentGroupName: 'production', computePlatform: 'Lambda', serviceRoleArn: 'role-arn', deploymentConfig: 'AllAtOnce', rollbackOnFailure: true})
}) })
@@ -24,16 +24,16 @@ describe('CodeDeployCreatePanel', () => {
render(<CodeDeployCreatePanel isSubmitting={false} submitError={null} onCancel={vi.fn()} onSubmit={onSubmit}/>) render(<CodeDeployCreatePanel isSubmitting={false} submitError={null} onCancel={vi.fn()} onSubmit={onSubmit}/>)
await user.selectOptions(screen.getByLabelText('Compute platform'), 'ECS') await user.selectOptions(screen.getByLabelText('Compute platform'), 'ECS')
await user.type(screen.getByLabelText('Application name'), 'orders') await user.type(screen.getByLabelText(/^Application name/), 'orders')
await user.type(screen.getByLabelText('Deployment group name'), 'production') await user.type(screen.getByLabelText(/^Deployment group name/), 'production')
await user.type(screen.getByLabelText('CodeDeploy service role ARN'), 'role-arn') await user.type(screen.getByLabelText(/^Service role ARN/), 'role-arn')
await user.type(screen.getByLabelText('ECS cluster name'), 'orders-cluster') await user.type(screen.getByLabelText(/^Cluster name/), 'orders-cluster')
await user.type(screen.getByLabelText('ECS service name'), 'orders-service') await user.type(screen.getByLabelText(/^Service name/), 'orders-service')
await user.type(screen.getByLabelText('Blue target group name'), 'orders-blue') await user.type(screen.getByLabelText(/Current production target group/), 'orders-blue')
await user.type(screen.getByLabelText('Green target group name'), 'orders-green') await user.type(screen.getByLabelText(/Replacement target group/), 'orders-green')
await user.type(screen.getByLabelText('Production listener ARN'), 'listener-arn') await user.type(screen.getByLabelText(/^Production listener ARN/), 'listener-arn')
await user.selectOptions(screen.getByLabelText('Traffic configuration'), 'Linear10PercentEvery3Minutes') await user.selectOptions(screen.getByLabelText('Traffic configuration'), 'Linear10PercentEvery3Minutes')
await user.click(screen.getByLabelText('Roll back automatically on deployment failure')) await user.click(screen.getByLabelText(/Automatic rollback/))
await user.click(screen.getByRole('button', {name: 'Create deployment group'})) await user.click(screen.getByRole('button', {name: 'Create deployment group'}))
expect(onSubmit).toHaveBeenCalledWith({applicationName: 'orders', deploymentGroupName: 'production', computePlatform: 'ECS', serviceRoleArn: 'role-arn', clusterName: 'orders-cluster', serviceName: 'orders-service', blueTargetGroupName: 'orders-blue', greenTargetGroupName: 'orders-green', productionListenerArn: 'listener-arn', deploymentConfig: 'Linear10PercentEvery3Minutes', rollbackOnFailure: false}) expect(onSubmit).toHaveBeenCalledWith({applicationName: 'orders', deploymentGroupName: 'production', computePlatform: 'ECS', serviceRoleArn: 'role-arn', clusterName: 'orders-cluster', serviceName: 'orders-service', blueTargetGroupName: 'orders-blue', greenTargetGroupName: 'orders-green', productionListenerArn: 'listener-arn', deploymentConfig: 'Linear10PercentEvery3Minutes', rollbackOnFailure: false})
@@ -1,7 +1,7 @@
import {render, screen} from '@testing-library/react' import {render, screen, waitFor} from '@testing-library/react'
import userEvent from '@testing-library/user-event' import userEvent from '@testing-library/user-event'
import {QueryClient, QueryClientProvider} from '@tanstack/react-query' import {QueryClient, QueryClientProvider} from '@tanstack/react-query'
import {expect, test, vi} from 'vitest' import {afterEach, expect, test, vi} from 'vitest'
import {LoadBalancerListenerPanel} from './LoadBalancerListenerPanel' import {LoadBalancerListenerPanel} from './LoadBalancerListenerPanel'
const api = vi.hoisted(() => ({ const api = vi.hoisted(() => ({
@@ -14,8 +14,13 @@ const api = vi.hoisted(() => ({
vi.mock('@/api/cloudProxyClient', () => api) vi.mock('@/api/cloudProxyClient', () => api)
vi.mock('@/lib/accountStore', () => ({useAccountId: () => '000000000000'})) vi.mock('@/lib/accountStore', () => ({useAccountId: () => '000000000000'}))
afterEach(() => {
vi.useRealTimers()
})
test('creates and deletes selected ALB HTTP listeners through generic cloud proxy items', async () => { test('creates and deletes selected ALB HTTP listeners through generic cloud proxy items', async () => {
const user = userEvent.setup() vi.useFakeTimers({shouldAdvanceTime: true})
const user = userEvent.setup({advanceTimers: vi.advanceTimersByTime})
api.listCloudResources.mockResolvedValue([{id: 'target-group-arn', name: 'web-targets'}]) api.listCloudResources.mockResolvedValue([{id: 'target-group-arn', name: 'web-targets'}])
api.listFlatItems.mockResolvedValue({items: [{id: 'listener-arn', body: {protocol: 'HTTP', port: 80, targetGroupArn: 'target-group-arn'}}], nextCursor: null}) api.listFlatItems.mockResolvedValue({items: [{id: 'listener-arn', body: {protocol: 'HTTP', port: 80, targetGroupArn: 'target-group-arn'}}], nextCursor: null})
api.putFlatItem.mockResolvedValue({}) api.putFlatItem.mockResolvedValue({})
@@ -32,6 +37,10 @@ test('creates and deletes selected ALB HTTP listeners through generic cloud prox
await user.click(screen.getByRole('button', {name: /create listener/i})) await user.click(screen.getByRole('button', {name: /create listener/i}))
expect(api.putFlatItem).toHaveBeenCalledWith('aws', 'loadbalancing', 'load-balancer-arn', {port: 8080, targetGroupArn: 'target-group-arn'}) expect(api.putFlatItem).toHaveBeenCalledWith('aws', 'loadbalancing', 'load-balancer-arn', {port: 8080, targetGroupArn: 'target-group-arn'})
// Creation holds its pending state for a minimum of five seconds, which disables the row actions.
await vi.advanceTimersByTimeAsync(5_000)
await waitFor(() => expect(screen.getByRole('button', {name: /delete listener 80/i})).toBeEnabled())
await user.click(screen.getByRole('button', {name: /delete listener 80/i})) await user.click(screen.getByRole('button', {name: /delete listener 80/i}))
expect(api.deleteFlatItem).toHaveBeenCalledWith('aws', 'loadbalancing', 'load-balancer-arn', 'listener-arn') expect(api.deleteFlatItem).toHaveBeenCalledWith('aws', 'loadbalancing', 'load-balancer-arn', 'listener-arn')
}) })
@@ -31,6 +31,7 @@ export function TargetGroupPanel({resource, runtimeReachable}: Props) {
queryFn: ({signal}) => listFlatItems('aws', 'targetgroups', resource?.id ?? '', undefined, signal), queryFn: ({signal}) => listFlatItems('aws', 'targetgroups', resource?.id ?? '', undefined, signal),
enabled: Boolean(resource) && runtimeReachable, enabled: Boolean(resource) && runtimeReachable,
}) })
const refetchHealth = healthQuery.refetch
useEffect(() => { useEffect(() => {
setInstanceId('') setInstanceId('')
@@ -50,10 +51,10 @@ export function TargetGroupPanel({resource, runtimeReachable}: Props) {
return return
} }
const interval = window.setInterval(() => { const interval = window.setInterval(() => {
void healthQuery.refetch() void refetchHealth()
}, 1_000) }, 1_000)
return () => window.clearInterval(interval) return () => window.clearInterval(interval)
}, [pendingTargets.length, healthQuery.refetch]) }, [pendingTargets.length, refetchHealth])
const refresh = () => { const refresh = () => {
void Promise.all([dependenciesQuery.refetch(), healthQuery.refetch()]) void Promise.all([dependenciesQuery.refetch(), healthQuery.refetch()])