jb/eden
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: add durable asset synchronization worker

Browse Source
This commit is contained in:
jb
2026-09-19 22:15:23 -04:00
parent 2675ea8114
commit fe7d218195
36 changed files with 2218 additions and 189 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/infisical.test.ts
+19 -1
View File
@@ -20,6 +20,10 @@ describe('Infisical boundary', () => {
test('accepts Bun-forwarded commands and preserves child --help arguments', () => {
expect(parseArguments(['run', 'docker', 'compose', 'config', '--quiet']).command).toEqual(['docker', 'compose', 'config', '--quiet']);
expect(parseArguments(['run', '--deployment', '--', 'bun', 'tool.ts', '--help'])).toMatchObject({ deployment: true, command: ['bun', 'tool.ts', '--help'] });
expect(parseArguments(['run', '--worker', '--', 'bun', 'workers/sync.ts'])).toMatchObject({ worker: true, command: ['bun', 'workers/sync.ts'] });
expect(() => parseArguments(['run', '--configure', '--', 'bun', 'scripts/configure-convex.ts'])).toThrow('--configure requires --deployment');
expect(parseArguments(['run', '--deployment', '--configure', '--', 'bun', 'scripts/configure-convex.ts'])).toMatchObject({ deployment: true, configure: true, command: ['bun', 'scripts/configure-convex.ts'] });
expect(() => parseArguments(['run', '--worker', '--deployment', '--', 'bun', 'worker.ts'])).toThrow();
expect(parseArguments(['status']).action).toBe('status');
expect(() => parseArguments(['run', '--unknown'])).toThrow();
expect(() => parseArguments(['status', '--', 'printenv'])).toThrow();
@@ -87,10 +91,11 @@ describe('Infisical boundary', () => {
test('child processes receive only managed app keys, without bootstrap or ambient admin credentials', () => {
const base = { PATH: '/usr/bin', INFISICAL_TOKEN: 'token', [ADMIN_KEY]: 'ambient-admin', ...credentials, TYPESAFE_API_KEY: 'stale-key' };
const values = { EVE_CLIENT_ID: 'client', EVE_CLIENT_SECRET: 'secret', [ADMIN_KEY]: 'vault-admin', NODE_OPTIONS: 'not-injected' };
const values = { EVE_CLIENT_ID: 'client', EVE_CLIENT_SECRET: 'secret', CONVEX_BRIDGE_SECRET: 'bridge', CONVEX_SYNC_WORKER_SECRET: 'worker', APP_AUTH_PRIVATE_KEY: 'private', APP_AUTH_JWKS: 'jwks', [ADMIN_KEY]: 'vault-admin', NODE_OPTIONS: 'not-injected' };
const config = { APP_ORIGIN: 'https://dev.evebot.app' };
const env = applicationEnvironment(base, values, config);
expect(env.EVE_CLIENT_SECRET).toBe('secret');
expect(env.CONVEX_SYNC_WORKER_SECRET).toBeUndefined();
expect(env.PATH).toBe('/usr/bin');
expect(env.APP_ORIGIN).toBe(config.APP_ORIGIN);
expect(env.TYPESAFE_API_KEY).toBeUndefined();
@@ -98,6 +103,19 @@ describe('Infisical boundary', () => {
expect(env.NODE_OPTIONS).toBeUndefined();
expect(Object.keys(env).some(key => key.startsWith('INFISICAL_'))).toBe(false);
expect(applicationEnvironment(base, values, config, true)[ADMIN_KEY]).toBe('vault-admin');
const workerEnv = applicationEnvironment(base, values, config, false, 'worker');
expect(workerEnv.CONVEX_SYNC_WORKER_SECRET).toBe('worker');
expect(workerEnv.CONVEX_BRIDGE_SECRET).toBeUndefined();
expect(workerEnv.APP_AUTH_PRIVATE_KEY).toBeUndefined();
expect(workerEnv.APP_AUTH_JWKS).toBeUndefined();
const configureEnv = applicationEnvironment(base, values, { ...config, APP_AUTH_ISSUER: 'https://issuer.example', APP_CAPABILITY_ALLOWLIST: 'asset_sync' }, true, 'configure');
expect(configureEnv.CONVEX_BRIDGE_SECRET).toBe('bridge');
expect(configureEnv.CONVEX_SYNC_WORKER_SECRET).toBe('worker');
expect(configureEnv.APP_AUTH_JWKS).toBe('jwks');
expect(configureEnv[ADMIN_KEY]).toBe('vault-admin');
expect(configureEnv.APP_AUTH_ISSUER).toBe('https://issuer.example');
expect(configureEnv.APP_CAPABILITY_ALLOWLIST).toBe('asset_sync');
for (const excluded of ['TOKEN_ENCRYPTION_KEY', 'APP_AUTH_PRIVATE_KEY', 'EVE_CLIENT_ID', 'EVE_CLIENT_SECRET', 'TYPESAFE_API_KEY']) expect(configureEnv[excluded]).toBeUndefined();
expect(() => applicationEnvironment(base, values, { INFISICAL_TOKEN: 'do-not-forward' })).toThrow('Unexpected public');
expect(() => applicationEnvironment(base, values, { NODE_OPTIONS: 'do-not-execute' })).toThrow('Unexpected public');
});