feat(e2e): detect legacy ciphertext rewrites in migration Runs

.github/workflows/tests.yml

@@ -503,6 +503,18 @@ jobs:
         env:
           DATABASE_URL: ${{ steps.db.outputs.database-url }}
 
+      # Deterministic Fake Migrators only: no model credentials or token spend.
+      # Only the live file reads HARNESS_LIVE; migration-harness.yml runs the
+      # rest of the self-test on harness changes. Independent of the steps
+      # above: the harness installs @cipherstash/stack from npm inside its
+      # isolated containers and never loads this job's native bindings, so an
+      # unrelated failure earlier in the job must not hide its result.
+      - name: Run the credentialed Migration Harness self-test
+        if: ${{ !cancelled() }}
+        run: pnpm exec turbo run harness:selftest --filter @cipherstash/e2e --env-mode=loose -- migration-harness/__tests__/no-rewrite-live.test.ts
+        env:
+          HARNESS_LIVE: '1'
+
       # Guarded on the project being set: if the stack never came up there is
       # nothing to tear down, and an unguarded `-p ""` would mask the real error.
       - name: Stop postgres

e2e/migration-harness/__tests__/no-rewrite-live.test.ts

@@ -0,0 +1,86 @@
+import 'dotenv/config'
+import assert from 'node:assert/strict'
+import { randomUUID } from 'node:crypto'
+import { mkdtemp, rm } from 'node:fs/promises'
+import { tmpdir } from 'node:os'
+import { resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { test } from 'vitest'
+import { createIsolation } from '../isolation.mjs'
+import { createRealDriver } from '../run/real-driver.mjs'
+import { run } from '../run/run.mjs'
+
+const keys = [
+  'CS_WORKSPACE_CRN',
+  'CS_CLIENT_ID',
+  'CS_CLIENT_KEY',
+  'CS_CLIENT_ACCESS_KEY',
+]
+// HARNESS_LIVE=1 asks for these Runs, so a missing credential fails them
+// rather than skipping them silently.
+const enabled = process.env.HARNESS_LIVE === '1'
+const missing = keys.filter((key) => !process.env[key])
+for (const rewrite of [false, true]) {
+  test.skipIf(!enabled)(
+    `real Run ${rewrite ? 'detects a read rewrite' : 'keeps Legacy Data unchanged through mutations'}`,
+    async () => {
+      assert.deepEqual(
+        missing,
+        [],
+        `HARNESS_LIVE=1 requires ${keys.join(', ')}`,
+      )
+      const output = await mkdtemp(resolve(tmpdir(), 'mh-no-rewrite-'))
+      const isolation = createIsolation()
+      const manifest = { stack: '^1.2.1', guideHash: null }
+      const replacement =
+        'async get(pk) { if (pk === "legacy") { const customer = await decrypt(await stores.get(pk)); await this.put(customer); }'
+      const script = `import {readFile,writeFile} from "node:fs/promises"; const p="src/app.mjs"; let s=await readFile(p,"utf8"); s=s.replace("async get(pk) {", ${JSON.stringify(replacement)}); await writeFile(p,s); await writeFile("friction.json","[]")`
+      const tool = rewrite
+        ? `node --input-type=module -e '${script}'`
+        : `printf '[]' > friction.json`
+      const adapter = resolve(output, 'adapter.mjs')
+      await (await import('node:fs/promises')).writeFile(
+        adapter,
+        `
+        import {createInterface} from 'node:readline';
+        const lines=createInterface({input:process.stdin});
+        console.log(JSON.stringify({id:'fake',method:'exec',command:['sh','-c',${JSON.stringify(tool)}]}));
+        for await(const line of lines){ const response=JSON.parse(line); process.exitCode=response.result.exitCode; break; }
+        lines.close();
+      `,
+      )
+      const command = `node '${adapter}'`
+      const driver = createRealDriver({
+        // Store names use the first eight characters, so they must vary per Run.
+        id: randomUUID(),
+        root: fileURLToPath(new URL('../../..', import.meta.url)),
+        output,
+        command,
+        isolation,
+        credentials: Object.fromEntries(
+          keys.map((key) => [key, process.env[key] ?? '']),
+        ),
+        manifest,
+      })
+      try {
+        const report = await run({
+          id: 'live-no-rewrite',
+          manifest,
+          driver,
+          supervision: isolation,
+        })
+        const check = report.evidence.find(
+          (e) => e.checkId === 'no-rewrite.legacy-bytes',
+        )
+        assert.ok(check, JSON.stringify(report))
+        assert.equal(Object(check.payload).passed, !rewrite)
+        if (rewrite)
+          assert.match(JSON.stringify(check.payload), /legacy.*__source/)
+      } finally {
+        await driver.close()
+        await rm(output, { recursive: true, force: true })
+      }
+    },
+    600_000,
+  )
+}

e2e/migration-harness/__tests__/no-rewrite.test.ts

@@ -0,0 +1,102 @@
+import assert from 'node:assert/strict'
+import { test } from 'vitest'
+import { requiredOracleChecks } from '../run/migration-checks.mjs'
+import { noRewrite } from '../run/no-rewrite.mjs'
+import { run } from '../run/run.mjs'
+
+const baseline = {
+  dynamo: {
+    Item: {
+      pk: { S: 'legacy' },
+      email__source: { S: 'cipher' },
+      email__hmac: { S: 'term' },
+    },
+  },
+  postgres: [
+    {
+      pk: 'legacy',
+      email: { c: 'pg-cipher', hm: 'pg-term' },
+      notes: { c: 'note' },
+    },
+  ],
+}
+for (const changed of [false, true]) {
+  test(`Run records ${changed ? 'rewritten' : 'unchanged'} Legacy Data`, async () => {
+    const current = structuredClone(baseline)
+    if (changed) current.dynamo.Item.email__source.S = 'rewritten'
+    const report = await run({
+      id: 'rewrite',
+      manifest: { guideHash: 'guide' },
+      driver: {
+        provision: async () => {},
+        installUnmigrated: async () => {},
+        initializeLegacyData: async () => {},
+        snapshot: async () => {},
+        migrate: async () => ({ exitCode: 0 }),
+        friction: async () => [],
+        installAppHost: async () => {},
+        behaviour: async () => [
+          noRewrite(baseline, current),
+          ...requiredOracleChecks
+            .filter((id) => id !== 'no-rewrite.legacy-bytes')
+            .map((id) => ({ id, passed: true })),
+        ],
+      },
+    })
+    assert.equal(report.outcome, changed ? 'behaviour' : 'pass')
+    const check = report.evidence.find(
+      (e) => e.checkId === 'no-rewrite.legacy-bytes',
+    )
+    assert.ok(check)
+    if (changed)
+      assert.match(
+        JSON.stringify(check.payload),
+        /dynamo.*legacy.*email__source/,
+      )
+  })
+}
+
+test('Run rejects a rewritten duplicate Legacy Data row even when the original is last', async () => {
+  const current = structuredClone(baseline)
+  const rewritten = structuredClone(current.postgres[0])
+  rewritten.email.c = 'rewritten'
+  current.postgres.unshift(rewritten)
+  const report = await run({
+    id: 'duplicate-legacy',
+    manifest: { guideHash: 'guide' },
+    driver: {
+      provision: async () => {},
+      installUnmigrated: async () => {},
+      initializeLegacyData: async () => {},
+      snapshot: async () => {},
+      migrate: async () => ({ exitCode: 0 }),
+      friction: async () => [],
+      installAppHost: async () => {},
+      behaviour: async () => [
+        noRewrite(baseline, current),
+        ...requiredOracleChecks
+          .filter((id) => id !== 'no-rewrite.legacy-bytes')
+          .map((id) => ({ id, passed: true })),
+      ],
+    },
+  })
+  assert.equal(report.outcome, 'behaviour')
+  assert.equal(report.editorEligible, true)
+  const check = report.evidence.find(
+    (e) => e.checkId === 'no-rewrite.legacy-bytes',
+  )
+  assert.ok(check, 'a malformed current snapshot still reports the check')
+  assert.equal(Object(check.payload).passed, false)
+})
+
+test('a deleted Legacy Data row is a failed check, while a malformed baseline still throws', () => {
+  const current = structuredClone(baseline)
+  current.postgres = []
+  const check = noRewrite(baseline, current)
+  assert.equal(check.id, 'no-rewrite.legacy-bytes')
+  assert.equal(check.passed, false)
+  assert.throws(
+    () => noRewrite(current, baseline),
+    /exactly one Legacy Data Postgres row/,
+  )
+})