fix: keep database passwords in ephemeral channels

Author: chubes4

packages/cli/src/runtime-services.ts

@@ -243,7 +243,7 @@ async function provisionMysqlDockerService(service: WorkspaceRecipeRuntimeServic
     evidence.lifecycle = "provisioned"
     const values: Record<string, string> = { host: "127.0.0.1", port: String(port), username: "runtime", password, database: "runtime" }
     return {
-      env: Object.fromEntries(Object.entries(service.outputs).map(([output, name]) => [name, values[output] ?? ""])),
+      env: runtimeServiceOutputEnvironment(service, values, new Set(["password"])),
       secretEnv: service.outputs.password ? { [service.outputs.password]: password } : {},
       evidence,
       async control(action, options) { return await controlDockerService(container, evidence, dependencies, action, options, async (customAction) => {
@@ -352,7 +352,7 @@ async function provisionMysqlExternalService(service: WorkspaceRecipeRuntimeServ
     evidence.lifecycle = "provisioned"
     const values: Record<string, string> = { host: connection.host, port: String(connection.port), username, password, database }
     return {
-      env: Object.fromEntries(Object.entries(service.outputs).map(([output, name]) => [name, values[output] ?? ""])),
+      env: runtimeServiceOutputEnvironment(service, values, new Set(["password"])),
       secretEnv: service.outputs.password ? { [service.outputs.password]: password } : {},
       evidence,
       async control(action) {
@@ -419,6 +419,12 @@ function mysqlConnectionArgs(host: string, port: number, username: string): stri
   return ["--batch", "--skip-column-names", "--protocol=TCP", "--host", host, "--port", String(port), "--user", username]
 }
 
+function runtimeServiceOutputEnvironment(service: WorkspaceRecipeRuntimeService, values: Record<string, string>, secretOutputs: ReadonlySet<string> = new Set()): Record<string, string> {
+  return Object.fromEntries(Object.entries(service.outputs)
+    .filter(([output]) => !secretOutputs.has(output))
+    .map(([output, name]) => [name, values[output] ?? ""]))
+}
+
 function validateGeneratedMysqlIdentifier(identifier: string): string {
   if (!/^[a-z][a-z0-9_]{0,63}$/.test(identifier)) throw new Error("Generated MySQL isolation identifier is unsafe")
   return identifier

packages/runtime-playground/src/playground-cli-runner.ts

@@ -80,7 +80,7 @@ export async function startPlaygroundCliServer(spec: RuntimeCreateSpec, mounts:
     const wordpressInstallMode = spec.environment.wordpressInstallMode ?? "install-from-existing-files"
     const bootstrapIniEntries = runtimeBootstrapPhpIniEntries(spec)
     const useProgrammaticRunner = shouldUseProgrammaticPlaygroundRunner(spec, options)
-    const requestWorkerEndpoint = useProgrammaticRunner ? undefined : {
+    const requestWorkerEndpoint = useProgrammaticRunner || spec.environment.databaseSetup === "external" ? undefined : {
       route: `/wp-codebox-execute-${randomBytes(12).toString("hex")}.php`,
       token: randomBytes(32).toString("base64url"),
       payloadDirectory: join(spec.artifactsDirectory ?? "artifacts", "playground-internal-shared"),
@@ -182,7 +182,8 @@ export async function startPlaygroundCliServer(spec: RuntimeCreateSpec, mounts:
       fixedPreviewPort: spec.preview?.port ?? null,
     })
 
-    const proxiedServer = await withPreviewLeaseProvider(await withPreviewProxy({ ...server, ...(requestWorkerEndpoint ? { requestWorkerEndpoint } : {}) }, spec.preview?.port ?? 0, spec.preview?.bind), spec)
+    const connectorServer = withConnectorSecretEnvironment(server, spec)
+    const proxiedServer = await withPreviewLeaseProvider(await withPreviewProxy({ ...connectorServer, ...(requestWorkerEndpoint ? { requestWorkerEndpoint } : {}) }, spec.preview?.port ?? 0, spec.preview?.bind), spec)
     emitProgress("preview:ready", "complete", "Preview ready", {
       localUrl: proxiedServer.serverUrl,
       upstreamUrl: server.serverUrl,
@@ -451,19 +452,18 @@ function runtimeAutoPrependPhp(spec: RuntimeCreateSpec): string {
 }
 
 function runtimeAutoPrependPhpBody(spec: RuntimeCreateSpec): string {
-  const runtimeEnv = spec.environment.databaseSetup === "external" ? phpEnvAssignments(connectorRuntimeEnv(spec)) : ""
+  const runtimeEnv = spec.environment.databaseSetup === "external" ? phpEnvAssignments(spec.runtimeEnv ?? {}) : ""
   return `${runtimeEnv}${distributionBootstrapPhp(spec)}`
 }
 
 function externalDatabaseWpConfig(spec: RuntimeCreateSpec): string | undefined {
   if (spec.environment.databaseSetup !== "external") return undefined
-  const connectorEnv = connectorRuntimeEnv(spec)
-  const host = connectorEnv.DB_HOST
+  const host = spec.runtimeEnv?.DB_HOST
   if (!host) return undefined
-  const port = connectorEnv.DB_PORT
+  const port = spec.runtimeEnv?.DB_PORT
   const values = {
-    DB_NAME: connectorEnv.DB_NAME ?? "runtime",
-    DB_USER: connectorEnv.DB_USER ?? "root",
+    DB_NAME: spec.runtimeEnv?.DB_NAME ?? "runtime",
+    DB_USER: spec.runtimeEnv?.DB_USER ?? "root",
     DB_HOST: port ? `${host}:${port}` : host,
   }
   return `<?php
@@ -479,8 +479,18 @@ require_once ABSPATH . 'wp-settings.php';
 `
 }
 
-function connectorRuntimeEnv(spec: RuntimeCreateSpec): Record<string, string> {
-  return { ...(spec.runtimeEnv ?? {}), ...(spec.secretEnv ?? {}) }
+function withConnectorSecretEnvironment(server: PlaygroundCliServer, spec: RuntimeCreateSpec): PlaygroundCliServer {
+  const password = spec.environment.databaseSetup === "external" ? spec.secretEnv?.DB_PASSWORD : undefined
+  if (password === undefined) return server
+  return {
+    ...server,
+    playground: {
+      ...server.playground,
+      async run(options) {
+        return await server.playground.run({ ...options, env: { ...(options.env ?? {}), DB_PASSWORD: password } })
+      },
+    },
+  }
 }
 
 function distributionBootstrapPhp(spec: RuntimeCreateSpec): string {

packages/runtime-playground/src/preview-server.ts

@@ -10,7 +10,7 @@ export interface PlaygroundServerRunResponse {
 
 export interface PlaygroundCliServer {
   playground: {
-    run(options: { code: string } | { scriptPath: string }): Promise<PlaygroundServerRunResponse>
+    run(options: ({ code: string } | { scriptPath: string }) & { env?: Record<string, string> }): Promise<PlaygroundServerRunResponse>
     onMessage?(listener: (data: string) => Promise<string | void> | string | void): Promise<(() => Promise<void> | void) | void> | (() => Promise<void> | void) | void
     readFileAsText?(path: string): string | Promise<string>
     unlink?(path: string): Promise<void> | void

tests/external-mysql-runtime-service.test.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict"
-import { mkdtemp, readFile, rm } from "node:fs/promises"
+import { mkdtemp, readFile, readdir, rm } from "node:fs/promises"
 import { tmpdir } from "node:os"
 import { join } from "node:path"
 import { executeRuntimeServiceProcess, provisionRuntimeServices, RuntimeServiceProvisionError, runtimeServicePlan, type RuntimeServiceDependencies } from "../packages/cli/src/runtime-services.ts"
@@ -116,45 +116,52 @@ assert.equal(provisioned.env.DB_HOST, "database.internal")
 assert.equal(provisioned.env.DB_PORT, "3307")
 assert.match(provisioned.env.DB_NAME ?? "", /^wp_codebox_[a-f0-9]{24}$/)
 assert.match(provisioned.env.DB_USER ?? "", /^wpcb_[a-f0-9]{24}$/)
-assert.equal(provisioned.secretEnv.DB_PASSWORD, provisioned.env.DB_PASSWORD)
+const generatedPassword = provisioned.secretEnv.DB_PASSWORD ?? ""
+assert.match(generatedPassword, /^[A-Za-z0-9_-]+$/)
+assert.equal(provisioned.env.DB_PASSWORD, undefined, "password is absent from the non-secret output channel")
 assert.equal(provisioned.evidence[0]?.provider, "external")
 assert.equal(provisioned.evidence[0]?.readiness, "ready")
 const createDatabase = successFake.calls.find((call) => call.stdin?.startsWith("CREATE DATABASE"))
 const createUser = successFake.calls.find((call) => call.stdin?.startsWith("CREATE USER"))
 assert.match(createDatabase?.stdin ?? "", /^CREATE DATABASE `wp_codebox_[a-f0-9]{24}`;\n$/)
 assert.match(createUser?.stdin ?? "", /^CREATE USER 'wpcb_[a-f0-9]{24}'@'%' IDENTIFIED BY '[A-Za-z0-9_-]+';\n$/)
-assert.equal(successFake.calls.some((call) => call.args.some((arg) => arg.includes(adminPassword) || arg.includes(provisioned.env.DB_PASSWORD ?? ""))), false, "passwords never enter argv")
+assert.equal(successFake.calls.some((call) => call.args.some((arg) => arg.includes(adminPassword) || arg.includes(generatedPassword))), false, "passwords never enter argv")
 assert.equal(JSON.stringify(runtimeServicePlan([externalService])).includes(adminPassword), false)
 assert.equal(JSON.stringify(provisioned.evidence).includes(adminPassword), false)
-assert.equal(JSON.stringify(provisioned.evidence).includes(provisioned.env.DB_PASSWORD ?? ""), false)
+assert.equal(JSON.stringify(provisioned.evidence).includes(generatedPassword), false)
 const bootstrapRoot = await mkdtemp(join(tmpdir(), "wp-codebox-external-mysql-bootstrap-"))
 const wordpressRoot = await mkdtemp(join(tmpdir(), "wp-codebox-external-mysql-wordpress-"))
 try {
   const bootstrapCalls: Parameters<PlaygroundCliModule["runCLI"]>[0][] = []
+  const bootstrapRuns: Array<({ code: string } | { scriptPath: string }) & { env?: Record<string, string> }> = []
   const cliModule: PlaygroundCliModule = { async runCLI(options) {
     bootstrapCalls.push(options)
-    return { serverUrl: "http://127.0.0.1:65535", playground: { async run() { return { text: "" } } }, async [Symbol.asyncDispose]() {} }
+    return { serverUrl: "http://127.0.0.1:65535", playground: { async run(runOptions) { bootstrapRuns.push(runOptions); return { text: runOptions.env?.DB_PASSWORD ?? "" } } }, async [Symbol.asyncDispose]() {} }
   } }
-  const { DB_PASSWORD: _password, ...runtimeEnv } = provisioned.env
   const runtimeSpec: RuntimeCreateSpec = {
     backend: "wordpress-playground",
     environment: { version: "mounted", wordpressInstallMode: "do-not-attempt-installing", databaseSetup: "external", assets: { wordpressDirectory: wordpressRoot }, blueprint: {} },
     policy,
-    runtimeEnv,
+    runtimeEnv: provisioned.env,
     secretEnv: provisioned.secretEnv,
     artifactsDirectory: bootstrapRoot,
   }
   const server = await startPlaygroundCliServer(runtimeSpec, [], { cliModule })
+  const connectorResponse = await server.playground.run({ code: "<?php echo getenv('DB_PASSWORD');" })
+  assert.equal(connectorResponse.text, generatedPassword, "generated password reaches PHP through the ephemeral run environment")
+  assert.equal(bootstrapRuns[0]?.env?.DB_PASSWORD, generatedPassword)
   await server[Symbol.asyncDispose]()
   const mounts = bootstrapCalls[0]?.["mount-before-install"] ?? []
   const autoPrependPath = mounts.find((mount) => mount.vfsPath === "/internal/shared/wp-codebox-auto-prepend.php")?.hostPath
   const wpConfigPath = mounts.find((mount) => mount.vfsPath === "/wordpress/wp-config.php")?.hostPath
   assert.ok(autoPrependPath && wpConfigPath)
   const autoPrepend = await readFile(autoPrependPath, "utf8")
   const wpConfig = await readFile(wpConfigPath, "utf8")
-  assert.match(autoPrepend, new RegExp(`putenv\\("DB_PASSWORD=${provisioned.env.DB_PASSWORD}`), "generated password reaches the connector bootstrap environment")
   assert.match(wpConfig, /getenv\('DB_PASSWORD'\)/)
-  assert.equal(wpConfig.includes(provisioned.env.DB_PASSWORD ?? ""), false, "generated password is not serialized into wp-config")
+  assert.equal(autoPrepend.includes(generatedPassword), false, "generated password is not serialized into auto-prepend PHP")
+  assert.equal(wpConfig.includes(generatedPassword), false, "generated password is not serialized into wp-config")
+  assert.equal(await directoryContains(bootstrapRoot, generatedPassword), false, "generated password is absent from persisted artifact files")
+  assert.equal(await directoryContains(wordpressRoot, generatedPassword), false, "generated password is absent from persisted WordPress files")
 } finally {
   await rm(bootstrapRoot, { recursive: true, force: true })
   await rm(wordpressRoot, { recursive: true, force: true })
@@ -243,3 +250,15 @@ await assert.rejects(executeRuntimeServiceProcess(process.execPath, ["-e", "proc
 })
 
 console.log("external MySQL runtime service tests passed")
+
+async function directoryContains(root: string, needle: string): Promise<boolean> {
+  for (const entry of await readdir(root, { withFileTypes: true })) {
+    const path = join(root, entry.name)
+    if (entry.isDirectory()) {
+      if (await directoryContains(path, needle)) return true
+    } else if (entry.isFile() && (await readFile(path)).includes(Buffer.from(needle))) {
+      return true
+    }
+  }
+  return false
+}

tests/playground-cli-runner-bootstrap-ini.test.ts

@@ -9,15 +9,17 @@ import type { RuntimeCreateSpec } from "../packages/runtime-core/src/index.js"
 const wordpressDevelopDirectory = await mkdtemp(join(tmpdir(), "wp-codebox-wordpress-develop-"))
 const artifactsDirectory = await mkdtemp(join(tmpdir(), "wp-codebox-artifacts-"))
 const calls: Parameters<PlaygroundCliModule["runCLI"]>[0][] = []
+const runs: Array<({ code: string } | { scriptPath: string }) & { env?: Record<string, string> }> = []
 
 const cliModule: PlaygroundCliModule = {
   async runCLI(options) {
     calls.push(options)
     return {
       serverUrl: "http://127.0.0.1:65535",
       playground: {
-        async run() {
-          return { text: "" }
+        async run(options) {
+          runs.push(options)
+          return { text: options.env?.DB_PASSWORD ?? "" }
         },
       },
       async [Symbol.asyncDispose]() {},
@@ -62,17 +64,16 @@ try {
   }
 
   const server = await startPlaygroundCliServer(spec, [], { cliModule })
+  assert.equal((await server.playground.run({ code: "<?php echo getenv('DB_PASSWORD');" })).text, "secret")
   await server[Symbol.asyncDispose]()
 
   assert.equal(calls.length, 1)
-  assert.equal(calls[0]["mount-before-install"]?.length, 6)
+  assert.equal(calls[0]["mount-before-install"]?.length, 4)
   assert.equal(calls[0]["mount-before-install"]?.[0]?.vfsPath, "/internal/shared/php.ini")
   assert.equal(calls[0]["mount-before-install"]?.[1]?.vfsPath, "/internal/shared/wp-codebox-auto-prepend.php")
-  assert.equal(calls[0]["mount-before-install"]?.[2]?.vfsPath, "/internal/wp-codebox")
-  assert.match(calls[0]["mount-before-install"]?.[3]?.vfsPath ?? "", /^\/wordpress\/wp-codebox-execute-[a-f0-9]{24}\.php$/)
   // A wordpress-develop checkout is the runtime root, not an ordinary post-startup mount.
-  assert.equal(calls[0]["mount-before-install"]?.[4]?.vfsPath, "/wordpress/wp-config.php")
-  assert.deepEqual(calls[0]["mount-before-install"]?.[5], { hostPath: wordpressDevelopDirectory, vfsPath: "/wordpress" })
+  assert.equal(calls[0]["mount-before-install"]?.[2]?.vfsPath, "/wordpress/wp-config.php")
+  assert.deepEqual(calls[0]["mount-before-install"]?.[3], { hostPath: wordpressDevelopDirectory, vfsPath: "/wordpress" })
   assert.deepEqual(calls[0].mount, [])
   assert.equal(calls[0].workers, 6)
   assert.equal(calls[0].wordpressInstallMode, "do-not-attempt-installing")
@@ -93,14 +94,9 @@ try {
   const sharedAutoPrepend = await readFile(sharedAutoPrependPath as string, "utf8")
   assert.match(sharedAutoPrepend, /require_once '\/internal\/shared\/auto_prepend_file\.php'/)
   assert.match(sharedAutoPrepend, /putenv\("TC_MYSQL_PORT=33060"\);/)
-  assert.match(sharedAutoPrepend, /putenv\("DB_PASSWORD=secret"\);/)
-  const requestWorkerPath = calls[0]["mount-before-install"]?.[3]?.hostPath
-  assert.equal(typeof requestWorkerPath, "string")
-  const requestWorker = await readFile(requestWorkerPath as string, "utf8")
-  assert.match(requestWorker, /HTTP_X_WP_CODEBOX_EXECUTION_TOKEN/)
-  assert.match(requestWorker, /hash_equals/)
-  assert.match(requestWorker, /\$_ENV\[\$wp_codebox_name\] = \$wp_codebox_value/)
-  const externalWpConfigPath = calls[0]["mount-before-install"]?.[4]?.hostPath
+  assert.doesNotMatch(sharedAutoPrepend, /secret|DB_PASSWORD/)
+  assert.equal(runs[0]?.env?.DB_PASSWORD, "secret")
+  const externalWpConfigPath = calls[0]["mount-before-install"]?.[2]?.hostPath
   assert.equal(typeof externalWpConfigPath, "string")
   const externalWpConfig = await readFile(externalWpConfigPath as string, "utf8")
   assert.match(externalWpConfig, /define\('DB_HOST', "127\.0\.0\.1:33061"\)/)

tests/runtime-services.test.ts

@@ -117,19 +117,21 @@ const dependencies: RuntimeServiceDependencies = {
   async waitForReady() {},
 }
 const provisioned = await provisionRuntimeServices([service], { dependencies })
+const provisionedPassword = Buffer.alloc(24, 7).toString("base64url")
 assert.equal(provisioned.env.DB_PORT, "41001")
-assert.equal(provisioned.env.DB_PASSWORD, Buffer.alloc(24, 7).toString("base64url"))
+assert.equal(provisioned.env.DB_PASSWORD, undefined, "password is excluded from the non-secret output channel")
+assert.equal(provisioned.secretEnv.DB_PASSWORD, provisionedPassword)
 const runCall = calls.find((call) => call.args[0] === "run")
 assert.ok(runCall?.args.includes("MYSQL_PASSWORD"))
 assert.ok(runCall?.args.includes("127.0.0.1::3306"), "Docker publishes MySQL on a loopback ephemeral port")
 assert.deepEqual(runCall?.args.slice(runCall.args.indexOf("--tmpfs"), runCall.args.indexOf("--tmpfs") + 2), ["--tmpfs", "/var/lib/mysql"])
 assert.equal(runCall?.args.includes("--volume") || runCall?.args.includes("--mount"), false, "Docker uses no persistent volume")
-assert.equal(runCall?.args.some((arg) => arg.includes(provisioned.env.DB_PASSWORD)), false, "credentials never enter Docker argv")
+assert.equal(runCall?.args.some((arg) => arg.includes(provisionedPassword)), false, "credentials never enter Docker argv")
 const readinessCall = calls.find((call) => call.args[0] === "exec")
 assert.ok(readinessCall?.args.includes("mysql"), "MySQL readiness authenticates against the initialized database")
-assert.equal(readinessCall?.args.some((arg) => arg.includes(provisioned.env.DB_PASSWORD)), false, "readiness credentials never enter Docker argv")
-assert.equal(readinessCall?.env?.MYSQL_PWD, provisioned.env.DB_PASSWORD, "readiness credentials use the child environment")
-assert.equal(JSON.stringify(provisioned.evidence).includes(provisioned.env.DB_PASSWORD), false, "credentials never enter evidence")
+assert.equal(readinessCall?.args.some((arg) => arg.includes(provisionedPassword)), false, "readiness credentials never enter Docker argv")
+assert.equal(readinessCall?.env?.MYSQL_PWD, provisionedPassword, "readiness credentials use the child environment")
+assert.equal(JSON.stringify(provisioned.evidence).includes(provisionedPassword), false, "credentials never enter evidence")
 assert.equal(runCall?.env?.DOCKER_HOST, process.env.DOCKER_HOST, "Docker provider context is preserved")
 assert.equal(calls[0]?.args[0], "image", "the provider checks the image before starting the service")
 await provisioned.release()