test(deploy,config): add deploy network rejection, remediation, reference, and secret non-reflection suites

tests/configuration-reference-examples.test.ts

@@ -0,0 +1,98 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import {
+  PROJECT_CONFIG_FILENAME,
+  resolveProjectConfig,
+} from '../src/config/project.js';
+import { validateStellarForgeConfig } from '../src/config/schema.js';
+import { withTempDirectory } from './helpers/index.js';
+
+const root = join(import.meta.dirname, '..');
+const configurationReference = readFileSync(
+  join(root, 'docs', 'reference', 'configuration.md'),
+  'utf8',
+);
+
+const JSON_BLOCK = /```json\n([\s\S]*?)```/g;
+const jsonMatches = [...configurationReference.matchAll(JSON_BLOCK)];
+const jsonBlocks = jsonMatches.map((match) => (match[1] ?? '').trim());
+
+function writeConfig(dir: string, value: unknown): void {
+  writeFileSync(join(dir, PROJECT_CONFIG_FILENAME), JSON.stringify(value));
+}
+
+describe('configuration reference examples', () => {
+  it('ships at least the schema and precedence examples', () => {
+    expect(jsonBlocks.length).toBeGreaterThanOrEqual(2);
+  });
+
+  it('parses and validates every documented JSON example', () => {
+    for (const block of jsonBlocks) {
+      const parsed: unknown = JSON.parse(block);
+
+      expect(() => validateStellarForgeConfig(parsed)).not.toThrow();
+    }
+  });
+
+  it('documents only supported schema fields in the schema example', () => {
+    const parsed = JSON.parse(jsonBlocks[0] ?? '') as Record<string, unknown>;
+
+    expect(Object.keys(parsed).sort()).toEqual([
+      'identity',
+      'network',
+      'version',
+    ]);
+  });
+
+  it('never places secret material inside a documented example', () => {
+    const combined = jsonBlocks.join('\n').toLowerCase();
+
+    for (const field of [
+      'privatekey',
+      'secret',
+      'seed',
+      'mnemonic',
+      'password',
+      'passphrase',
+      'token',
+    ]) {
+      expect(combined).not.toContain(field);
+    }
+  });
+
+  it('documents a precedence example that the resolver honours', () =>
+    withTempDirectory((dir) => {
+      writeConfig(dir, {
+        version: 1,
+        network: 'testnet',
+        identity: 'team-deployer',
+      });
+
+      expect(resolveProjectConfig(dir)).toEqual({
+        network: 'testnet',
+        identity: 'team-deployer',
+      });
+      expect(
+        resolveProjectConfig(dir, { identity: 'release-deployer' }),
+      ).toEqual({
+        network: 'testnet',
+        identity: 'release-deployer',
+      });
+    }));
+
+  it('documents the precedence order, missing default, and secret boundary', () => {
+    expect(configurationReference).toContain('explicit CLI option;');
+    expect(configurationReference).toContain('project configuration;');
+    expect(configurationReference).toContain('missing.');
+    expect(configurationReference).toContain(
+      'StellarForge does not silently default a missing network to Mainnet or any other network.',
+    );
+    expect(configurationReference).toContain('does not accept raw secret keys');
+    expect(configurationReference).toContain(
+      'A configured network does not bypass command-specific restrictions',
+    );
+    expect(configurationReference).not.toContain('defaults to Mainnet');
+    expect(configurationReference).not.toContain('defaults to mainnet');
+  });
+});

tests/configuration-secret-reflection.test.ts

@@ -0,0 +1,120 @@
+import { writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import {
+  loadProjectConfig,
+  PROJECT_CONFIG_FILENAME,
+} from '../src/config/project.js';
+import {
+  EXIT_CODES,
+  ValidationCliError,
+  runWithCliErrorBoundary,
+} from '../src/errors/index.js';
+import {
+  createCapturedTerminalOutput,
+  withTempDirectory,
+} from './helpers/index.js';
+
+const SECRET_FIELD_NAMES = [
+  'privateKey',
+  'private_key',
+  'private-key',
+  'secretKey',
+  'secret',
+  'seed',
+  'seedPhrase',
+  'mnemonic',
+  'password',
+  'PASSWORD',
+  'passphrase',
+  'token',
+  'apiToken',
+  'authToken',
+  'my_token',
+];
+
+const SECRET_MESSAGE =
+  'StellarForge project configuration must not contain secret material.';
+
+describe('configuration secret non-reflection', () => {
+  it.each(SECRET_FIELD_NAMES)(
+    'rejects secret-bearing field %j without echoing its value',
+    (field) =>
+      withTempDirectory((dir) => {
+        const secret = `SENTINEL-SECRET-${field}`;
+        writeFileSync(
+          join(dir, PROJECT_CONFIG_FILENAME),
+          JSON.stringify({ version: 1, [field]: secret }),
+        );
+
+        try {
+          loadProjectConfig(dir);
+          throw new Error('Expected configuration validation to fail.');
+        } catch (error) {
+          expect(error).toBeInstanceOf(ValidationCliError);
+
+          const message = (error as Error).message;
+          expect(message).toContain('must not contain secret material');
+          expect(message).not.toContain(secret);
+        }
+      }),
+  );
+
+  it('does not reflect secrets from malformed JSON', () =>
+    withTempDirectory((dir) => {
+      writeFileSync(
+        join(dir, PROJECT_CONFIG_FILENAME),
+        '{"version": 1, "privateKey": "SENTINEL-MALFORMED-SECRET"',
+      );
+
+      try {
+        loadProjectConfig(dir);
+        throw new Error('Expected malformed JSON to fail.');
+      } catch (error) {
+        expect(error).toBeInstanceOf(ValidationCliError);
+
+        const message = (error as Error).message;
+        expect(message).toBe('stellarforge.config.json is not valid JSON.');
+        expect(message).not.toContain('SENTINEL-MALFORMED-SECRET');
+      }
+    }));
+
+  it('rejects an unsupported field without echoing it', () =>
+    withTempDirectory((dir) => {
+      writeFileSync(
+        join(dir, PROJECT_CONFIG_FILENAME),
+        JSON.stringify({ version: 1, unsupportedField: 'SENTINEL-UNKNOWN' }),
+      );
+
+      try {
+        loadProjectConfig(dir);
+        throw new Error('Expected configuration validation to fail.');
+      } catch (error) {
+        expect(error).toBeInstanceOf(ValidationCliError);
+
+        const message = (error as Error).message;
+        expect(message).toContain('unsupported field');
+        expect(message).not.toContain('unsupportedField');
+        expect(message).not.toContain('SENTINEL-UNKNOWN');
+      }
+    }));
+
+  it('renders secret validation failures without leaking through the boundary', () =>
+    withTempDirectory(async (dir) => {
+      const secret = 'SENTINEL-BOUNDARY-SECRET';
+      writeFileSync(
+        join(dir, PROJECT_CONFIG_FILENAME),
+        JSON.stringify({ version: 1, privateKey: secret }),
+      );
+
+      const captured = createCapturedTerminalOutput();
+      const exitCode = await runWithCliErrorBoundary(() => {
+        loadProjectConfig(dir);
+      }, captured.output);
+
+      expect(exitCode).toBe(EXIT_CODES.validation);
+      expect(captured.stdoutText()).toBe('');
+      expect(captured.stderrText()).toContain(SECRET_MESSAGE);
+      expect(captured.stderrText()).not.toContain(secret);
+    }));
+});