feat(devicepolicy): support managed npm settings

cmd/stepsecurity-dev-machine-guard/main.go

@@ -893,6 +893,7 @@ func runPackageConfigLanes(exec executor.Executor, log *progress.Logger, fetcher
 }
 
 func runNPMPackageConfigLane(ctx context.Context, exec executor.Executor, log *progress.Logger, fetcher devicepolicy.Fetcher, reporter devicepolicy.Reporter, customerID, serial, platform string) error {
+	var w *devicepolicy.NPMRCWriter
 	r := &devicepolicy.Reconciler{
 		Fetcher:    fetcher,
 		Reporter:   reporter,
@@ -909,12 +910,12 @@ func runNPMPackageConfigLane(ctx context.Context, exec executor.Executor, log *p
 		OwnershipStateValue: devicepolicy.NPMOwnershipValue,
 		Logf:                func(format string, args ...any) { log.Debug(format, args...) },
 	}
-
-	w, err := devicepolicy.NewNPMRCWriter(exec)
-	if err != nil {
-		r.WriterInitErr = err
-	} else {
-		defer w.Close()
+	r.InitWriter = func() error {
+		var err error
+		w, err = devicepolicy.NewNPMRCWriter(exec)
+		if err != nil {
+			return err
+		}
 		w.SetLogf(func(format string, args ...any) { log.Debug(format, args...) })
 		r.Writer = w
 		r.Converged = w.Converged
@@ -923,8 +924,13 @@ func runNPMPackageConfigLane(ctx context.Context, exec executor.Executor, log *p
 		r.ProbeExpected = w.ProbeExpected
 		r.RestoreSnapshot = w.RestoreSnapshot
 		r.ProbeContent = w.ProbeContentNPM
+		return nil
+	}
+	err := r.Reconcile(ctx)
+	if w != nil {
+		_ = w.Close()
 	}
-	return r.Reconcile(ctx)
+	return err
 }
 
 func runPyPIPackageConfigLane(ctx context.Context, exec executor.Executor, log *progress.Logger, fetcher devicepolicy.Fetcher, reporter devicepolicy.Reporter, customerID, serial, platform string) error {

cmd/stepsecurity-dev-machine-guard/main_devicepolicy_test.go

@@ -53,6 +53,17 @@ func (npmLaneFetcher) Fetch(context.Context, string, string, string, string) (de
 	}, nil
 }
 
+type invalidNPMSettingsFetcher struct{}
+
+func (invalidNPMSettingsFetcher) Fetch(context.Context, string, string, string, string) (devicepolicy.EffectivePolicy, error) {
+	return devicepolicy.EffectivePolicy{
+		Category: devicepolicy.CategoryPackageConfig,
+		Target:   devicepolicy.TargetNPM,
+		Policy:   []byte(`{"ecosystem":"npm","registry_url":"https://registry-int.stepsecurity.io/javascript","auth":{"scheme":"stepsecurity_device_token","api_key":"device-secret"},"settings":null}`),
+		Hash:     "sha256:npm",
+	}, nil
+}
+
 type countingTargetExecutor struct {
 	*executor.Mock
 	user  *user.User
@@ -120,6 +131,17 @@ func TestNPMPackageConfigLanePersistsSecretFreeOwnership(t *testing.T) {
 	}
 }
 
+func TestNPMPackageConfigLane_ValidatesSettingsBeforeResolvingTargetUser(t *testing.T) {
+	exec := &countingTargetExecutor{Mock: executor.NewMock()}
+	err := runNPMPackageConfigLane(context.Background(), exec, progress.NewNoop(), invalidNPMSettingsFetcher{}, packageConfigReporter{}, "customer", "serial", "linux")
+	if err == nil {
+		t.Fatal("invalid settings must fail")
+	}
+	if got, want := exec.calls, 0; got != want {
+		t.Fatalf("LoggedInUser calls = %d, want %d", got, want)
+	}
+}
+
 func TestPackageConfigLanes_FailureDoesNotSuppressSibling(t *testing.T) {
 	t.Setenv("STEPSECURITY_HOME", t.TempDir())
 	tests := []struct {

internal/devicepolicy/go_env_writer.go

@@ -15,9 +15,9 @@ import (
 )
 
 const (
-	dmgGoEnvBegin          = "# BEGIN StepSecurity Go Secure Registry GOPROXY -- managed by dmg"
-	mdmGoEnvBegin          = "# BEGIN StepSecurity Go Secure Registry GOPROXY -- managed by mdm"
-	goEnvEnd               = "# END StepSecurity Go Secure Registry GOPROXY"
+	dmgGoEnvBegin          = "# BEGIN StepSecurity Package Configuration go -- managed by dmg"
+	mdmGoEnvBegin          = "# BEGIN StepSecurity Package Configuration go -- managed by mdm"
+	goEnvEnd               = "# END StepSecurity Package Configuration go"
 	dmgGoEnvDisabledPrefix = "# [stepsecurity-go-env-dmg] "
 	mdmGoEnvDisabledPrefix = "# [stepsecurity-go-env-mdm] "
 	dmgGoEnvCreatedFile    = "# [stepsecurity-go-env-dmg] created=true"

internal/devicepolicy/netrc_writer.go

@@ -14,15 +14,15 @@ import (
 )
 
 const (
-	dmgNetrcBegin = "#stepsecurity-secure-registry-credential-dmg-begin"
-	dmgNetrcEnd   = "#stepsecurity-secure-registry-credential-end"
+	dmgNetrcBegin = "#stepsecurity-package-config-credential-dmg-begin"
+	dmgNetrcEnd   = "#stepsecurity-package-config-credential-end"
 
-	mdmNetrcBegin = "#stepsecurity-secure-registry-credential-mdm-begin"
-	mdmNetrcEnd   = "#stepsecurity-secure-registry-credential-end"
+	mdmNetrcBegin = "#stepsecurity-package-config-credential-mdm-begin"
+	mdmNetrcEnd   = "#stepsecurity-package-config-credential-end"
 
-	dmgNetrcDisabledPrefix = "#stepsecurity-secure-registry-credential-dmg-disabled:"
-	mdmNetrcDisabledPrefix = "#stepsecurity-secure-registry-credential-mdm-disabled:"
-	mdmNetrcCreated        = "#stepsecurity-secure-registry-credential-mdm-created"
+	dmgNetrcDisabledPrefix = "#stepsecurity-package-config-credential-dmg-disabled:"
+	mdmNetrcDisabledPrefix = "#stepsecurity-package-config-credential-mdm-disabled:"
+	mdmNetrcCreated        = "#stepsecurity-package-config-credential-mdm-created"
 	netrcBackupPrefix      = ".dmg-"
 )
 

internal/devicepolicy/netrc_writer_test.go

@@ -27,13 +27,13 @@ func TestNetrcMarkers_Canonical(t *testing.T) {
 		got  string
 		want string
 	}{
-		{"DMG begin", dmgNetrcBegin, "#stepsecurity-secure-registry-credential-dmg-begin"},
-		{"DMG end", dmgNetrcEnd, "#stepsecurity-secure-registry-credential-end"},
-		{"MDM begin", mdmNetrcBegin, "#stepsecurity-secure-registry-credential-mdm-begin"},
-		{"MDM end", mdmNetrcEnd, "#stepsecurity-secure-registry-credential-end"},
-		{"DMG disabled prefix", dmgNetrcDisabledPrefix, "#stepsecurity-secure-registry-credential-dmg-disabled:"},
-		{"MDM disabled prefix", mdmNetrcDisabledPrefix, "#stepsecurity-secure-registry-credential-mdm-disabled:"},
-		{"MDM created", mdmNetrcCreated, "#stepsecurity-secure-registry-credential-mdm-created"},
+		{"DMG begin", dmgNetrcBegin, "#stepsecurity-package-config-credential-dmg-begin"},
+		{"DMG end", dmgNetrcEnd, "#stepsecurity-package-config-credential-end"},
+		{"MDM begin", mdmNetrcBegin, "#stepsecurity-package-config-credential-mdm-begin"},
+		{"MDM end", mdmNetrcEnd, "#stepsecurity-package-config-credential-end"},
+		{"DMG disabled prefix", dmgNetrcDisabledPrefix, "#stepsecurity-package-config-credential-dmg-disabled:"},
+		{"MDM disabled prefix", mdmNetrcDisabledPrefix, "#stepsecurity-package-config-credential-mdm-disabled:"},
+		{"MDM created", mdmNetrcCreated, "#stepsecurity-package-config-credential-mdm-created"},
 	}
 	for _, tc := range tests {
 		t.Run(tc.name, func(t *testing.T) {
@@ -82,7 +82,7 @@ func TestNetrcWriter_CredentialOwnershipLinesAreSingleTokens(t *testing.T) {
 				t.Fatalf("credential ownership lines = %q, want %d", ownershipLines, tc.wantLines)
 			}
 			for _, line := range ownershipLines {
-				if !strings.HasPrefix(line, "#stepsecurity-secure-registry-credential") || strings.ContainsAny(line, " \t\r") {
+				if !strings.HasPrefix(line, "#stepsecurity-package-config-credential") || strings.ContainsAny(line, " \t\r") {
 					t.Errorf("credential ownership line %q is not one whitespace-free token", line)
 				}
 			}