Add Step-up rechallenge implementation

__tests__/bin/vip-app-deploy-rechallenge.js

@@ -0,0 +1,157 @@
+import { beforeEach, describe, expect, it, jest } from '@jest/globals';
+
+const httpResponse = ( status, body ) => {
+	return Promise.resolve( {
+		ok: status >= 200 && status < 300,
+		status,
+		headers: {
+			get: name => ( name.toLowerCase() === 'content-type' ? 'application/json' : null ),
+		},
+		json: () => Promise.resolve( body ),
+		text: () => Promise.resolve( JSON.stringify( body ) ),
+	} );
+};
+
+describe( 'vip app deploy rechallenge smoke', () => {
+	let appDeployCmd;
+	let http;
+	let runRechallenge;
+	let exitWithError;
+
+	beforeEach( () => {
+		jest.resetModules();
+
+		jest.doMock( '../../src/lib/cli/command', () => {
+			const commandMock = {
+				argv: () => commandMock,
+				examples: () => commandMock,
+				option: () => commandMock,
+				command: () => commandMock,
+			};
+			return jest.fn( () => commandMock );
+		} );
+
+		jest.doMock( '../../src/lib/client-file-uploader', () => ( {
+			getFileMeta: jest.fn().mockResolvedValue( {
+				fileName: '/vip/skeleton.zip',
+				basename: 'skeleton.zip',
+				fileSize: 123,
+				isCompressed: true,
+			} ),
+			uploadImportFileToS3: jest.fn().mockResolvedValue( {
+				fileMeta: {
+					basename: 'skeleton.zip',
+					fileName: '/vip/skeleton.zip',
+					fileSize: 123,
+					isCompressed: true,
+				},
+				checksum: 'abc123',
+				result: 'ok',
+			} ),
+		} ) );
+
+		jest.doMock( '../../src/lib/custom-deploy/custom-deploy', () => ( {
+			validateFile: jest.fn().mockResolvedValue( true ),
+			validateLargeArchiveFiles: jest.fn().mockResolvedValue( true ),
+			promptToContinue: jest.fn().mockResolvedValue( true ),
+			validateCustomDeployKey: jest.fn().mockResolvedValue( {
+				appId: 123,
+				envId: 456,
+				envType: 'develop',
+				envUniqueLabel: 'develop',
+				primaryDomainName: 'example.com/develop',
+				launched: false,
+			} ),
+		} ) );
+
+		jest.doMock( '../../src/lib/tracker', () => ( {
+			trackEventWithEnv: jest.fn( () => Promise.resolve() ),
+		} ) );
+
+		jest.doMock( '../../src/lib/api/http', () => ( {
+			__esModule: true,
+			default: jest.fn(),
+		} ) );
+
+		jest.doMock( '../../src/lib/rechallenge/flow', () => ( {
+			runRechallenge: jest.fn(),
+			isInteractiveContext: () => false,
+			shouldWaitForRechallenge: () => true,
+		} ) );
+
+		jest.doMock( '../../src/lib/rechallenge/token-cache', () => ( {
+			__esModule: true,
+			default: {
+				get: jest.fn( () => Promise.resolve( null ) ),
+				set: jest.fn( () => Promise.resolve() ),
+				clearScope: jest.fn(),
+				clearAll: jest.fn(),
+			},
+		} ) );
+
+		const exitModule = require( '../../src/lib/cli/exit' );
+		exitWithError = jest.spyOn( exitModule, 'withError' ).mockImplementation( () => {
+			throw new Error( 'exit.withError called' );
+		} );
+
+		appDeployCmd = require( '../../src/bin/vip-app-deploy' ).appDeployCmd;
+		http = require( '../../src/lib/api/http' ).default;
+		runRechallenge = require( '../../src/lib/rechallenge/flow' ).runRechallenge;
+
+		process.env.NODE_ENV = 'test';
+		process.env.WPVIP_DEPLOY_TOKEN = 'deploy-token';
+		jest.spyOn( console, 'log' ).mockImplementation( () => {} );
+		jest.spyOn( console, 'error' ).mockImplementation( () => {} );
+	} );
+
+	it( 'retries app deploy mutation with elevated header in API chain', async () => {
+		runRechallenge.mockResolvedValueOnce( {
+			token: 'manual-elevated-token',
+			expiresAt: new Date( Date.now() + 60_000 ).toISOString(),
+			purpose: 'validate-elevated-permissions',
+		} );
+
+		http
+			.mockReturnValueOnce(
+				httpResponse( 200, {
+					data: null,
+					errors: [
+						{
+							message: 'Missing elevated token',
+							extensions: {
+								code: 'elevated-permission-required',
+								rechallenge: {
+									version: 'v2',
+									createSessionPath: '/rechallenge/v2/sessions',
+									statusPathTemplate: '/rechallenge/v2/sessions/{challengeId}',
+									exchangePathTemplate: '/rechallenge/v2/sessions/{challengeId}/exchange',
+									elevatedHeaderName: 'x-elevated-token',
+								},
+							},
+						},
+					],
+				} )
+			)
+			.mockReturnValueOnce(
+				httpResponse( 200, {
+					data: {
+						startCustomDeploy: {
+							success: true,
+							message: 'ok',
+						},
+					},
+				} )
+			);
+
+		await expect(
+			appDeployCmd( [ '/vip/skeleton.zip' ], { app: 1, env: 2, force: true } )
+		).resolves.toBeUndefined();
+
+		expect( runRechallenge ).toHaveBeenCalledTimes( 1 );
+		expect( http ).toHaveBeenCalledTimes( 2 );
+		const secondCallInit = http.mock.calls[ 1 ][ 1 ];
+		expect( secondCallInit.headers[ 'x-elevated-token' ] ).toBe( 'manual-elevated-token' );
+		expect( secondCallInit.headers.authorization ).toBe( 'Bearer deploy-token' );
+		expect( exitWithError ).not.toHaveBeenCalled();
+	} );
+} );

__tests__/bin/vip-defensive-mode-configure.js

@@ -0,0 +1,176 @@
+import { describe, expect, it, jest, beforeEach } from '@jest/globals';
+
+import { defensiveModeConfigureCommand } from '../../src/bin/vip-defensive-mode-configure';
+import command from '../../src/lib/cli/command';
+import { updateDefensiveModeConfig } from '../../src/lib/defensive-mode/api';
+import { trackEvent } from '../../src/lib/tracker';
+
+function mockExit() {
+	throw 'EXIT';
+}
+jest.spyOn( console, 'log' ).mockImplementation( () => {} );
+jest.spyOn( console, 'error' ).mockImplementation( () => {} );
+jest.spyOn( process, 'exit' ).mockImplementation( mockExit );
+
+jest.mock( '../../src/lib/cli/command', () => {
+	const commandMock = {
+		argv: () => commandMock,
+		examples: () => commandMock,
+		option: () => commandMock,
+	};
+	return jest.fn( () => commandMock );
+} );
+
+jest.mock( '../../src/lib/defensive-mode/api', () => ( {
+	updateDefensiveModeConfig: jest.fn( () =>
+		Promise.resolve( { success: true, message: 'configured' } )
+	),
+	appQuery: 'mock-app-query',
+} ) );
+
+jest.mock( '../../src/lib/tracker', () => ( {
+	trackEvent: jest.fn( () => Promise.resolve() ),
+} ) );
+
+jest.mock( '../../src/lib/envvar/input', () => ( {
+	confirm: jest.fn( () => Promise.resolve( true ) ),
+} ) );
+
+function baseOpts() {
+	return {
+		app: { id: 7, name: 'demo', organization: { id: 1, salesforceId: 'X' } },
+		env: { id: 9, type: 'develop' },
+		skipConfirmation: true,
+	};
+}
+
+describe( 'vip defensive-mode configure', () => {
+	it( 'registers as a command', () => {
+		expect( command ).toHaveBeenCalled();
+	} );
+} );
+
+describe( 'defensiveModeConfigureCommand', () => {
+	beforeEach( () => {
+		jest.clearAllMocks();
+	} );
+
+	it( 'applies full input when all flags are supplied', async () => {
+		await defensiveModeConfigureCommand( [], {
+			...baseOpts(),
+			enabled: 'true',
+			challengeType: '1',
+			connectionThresholdAbsolute: '1000',
+			connectionThresholdPercentage: '50',
+		} );
+		expect( updateDefensiveModeConfig ).toHaveBeenCalledWith( {
+			appId: 7,
+			envId: 9,
+			enabled: true,
+			challengeType: 1,
+			connectionThresholdAbsolute: 1000,
+			connectionThresholdPercentage: 50,
+		} );
+	} );
+
+	it( 'errors when required flags missing in non-interactive mode', async () => {
+		await expect(
+			defensiveModeConfigureCommand( [], {
+				...baseOpts(),
+				nonInteractive: true,
+			} )
+		).rejects.toBe( 'EXIT' );
+		expect( updateDefensiveModeConfig ).not.toHaveBeenCalled();
+	} );
+
+	it( 'rejects non-boolean enabled values', async () => {
+		await expect(
+			defensiveModeConfigureCommand( [], {
+				...baseOpts(),
+				enabled: 'maybe',
+				challengeType: '1',
+				nonInteractive: true,
+			} )
+		).rejects.toBe( 'EXIT' );
+	} );
+
+	it( 'rejects non-integer challenge-type', async () => {
+		await expect(
+			defensiveModeConfigureCommand( [], {
+				...baseOpts(),
+				enabled: 'true',
+				challengeType: 'oops',
+				nonInteractive: true,
+			} )
+		).rejects.toBe( 'EXIT' );
+	} );
+
+	it( 'tracks success', async () => {
+		await defensiveModeConfigureCommand( [], {
+			...baseOpts(),
+			enabled: 'false',
+			challengeType: '1',
+		} );
+		expect( trackEvent ).toHaveBeenCalledWith(
+			'defensive_mode_configure_command_success',
+			expect.any( Object )
+		);
+	} );
+
+	it( 'logs the proposed configuration before mutating', async () => {
+		const consoleSpy = jest.spyOn( console, 'log' );
+		await defensiveModeConfigureCommand( [], {
+			...baseOpts(),
+			enabled: 'true',
+			challengeType: '2',
+		} );
+		const allArgs = consoleSpy.mock.calls.flat().filter( arg => typeof arg === 'string' );
+		const settingsTable = allArgs.find( arg => arg.includes( 'Challenge type' ) );
+		expect( settingsTable ).toBeDefined();
+		expect( settingsTable ).toContain( 'Enabled' );
+		expect( settingsTable ).toContain( 'true' );
+		expect( settingsTable ).toContain( '2' );
+		expect( settingsTable ).toContain( '(not specified)' );
+	} );
+
+	it( 'rejects bare threshold flags (boolean true)', async () => {
+		await expect(
+			defensiveModeConfigureCommand( [], {
+				...baseOpts(),
+				enabled: 'true',
+				challengeType: '1',
+				connectionThresholdAbsolute: true,
+				nonInteractive: true,
+			} )
+		).rejects.toBe( 'EXIT' );
+		expect( updateDefensiveModeConfig ).not.toHaveBeenCalled();
+	} );
+
+	it( 'refuses production mutation in non-interactive mode without --skip-confirmation', async () => {
+		await expect(
+			defensiveModeConfigureCommand( [], {
+				...baseOpts(),
+				env: { id: 9, type: 'production' },
+				skipConfirmation: false,
+				nonInteractive: true,
+				enabled: 'false',
+				challengeType: '1',
+			} )
+		).rejects.toBe( 'EXIT' );
+		expect( updateDefensiveModeConfig ).not.toHaveBeenCalled();
+	} );
+
+	it( 'allows production mutation in non-interactive mode with --skip-confirmation', async () => {
+		await defensiveModeConfigureCommand( [], {
+			...baseOpts(),
+			env: { id: 9, type: 'production' },
+			skipConfirmation: true,
+			nonInteractive: true,
+			enabled: 'false',
+			challengeType: '1',
+		} );
+		expect( updateDefensiveModeConfig ).toHaveBeenCalledWith(
+			expect.objectContaining( { envId: 9, enabled: false, challengeType: 1 } )
+		);
+	} );
+} );