Restore installer tests excluded by gitignore

.gitignore

@@ -30,7 +30,6 @@
 /.nb-gradle/
 /cygnus-onprem-app/target
 /cygnus-cloud-client/target
-/cygnus-installer/src/test
 /cygnus-cloud-service/target
 /cygnus-installer/src/target
 /cygnus-installer/target

cygnus-installer/src/test/java/com/cygnus/installer/DeploymentWriterTest.java

@@ -0,0 +1,206 @@
+package com.cygnus.installer;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.net.URI;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.time.OffsetDateTime;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class DeploymentWriterTest {
+
+    @TempDir
+    Path temporaryDirectory;
+
+    @Test
+    void writesPortableProductDeploymentAndKeepsSecretsLocal() throws Exception {
+        UUID tenantId = UUID.randomUUID();
+        UUID installationId = UUID.randomUUID();
+        UUID installationUuid = UUID.randomUUID();
+        var validation = new ActivationDtos.ValidationResponse(
+                "activation-token",
+                OffsetDateTime.now().plusMinutes(5),
+                tenantId,
+                "matrix-client",
+                "FULL",
+                2);
+        var registration = new ActivationDtos.RegistrationResponse(
+                installationId,
+                installationUuid,
+                tenantId,
+                null,
+                "primary",
+                1,
+                "ACTIVE");
+        var profile = new ProductProfile(
+                "matrix",
+                "Matrix",
+                "matrix-onprem",
+                "MATRIX_IMAGE",
+                "matrix",
+                "installation.yml",
+                "MATRIX_INSTALLATION_CONFIG",
+                "/srv/matrix/config/installation.yml",
+                "8080:8080",
+                "/matrix/",
+                "/oauth2/token",
+                temporaryDirectory.resolve("unused.pem"),
+                temporaryDirectory.resolve("login-public.pem"),
+                "cygnus-login-2026-01",
+                List.of("region"));
+        Files.writeString(profile.loginEncryptionPublicKey(), "login-public-key");
+        var settings = new InstallerSettings(
+                "matrix",
+                URI.create("https://cloud.example.com"),
+                URI.create("http://host.docker.internal:8090"),
+                "/api/v1/installations",
+                "production",
+                temporaryDirectory,
+                temporaryDirectory,
+                "1",
+                new IniDocument(Map.of()));
+
+        Path output = new DeploymentWriter().write(
+                temporaryDirectory.resolve("output"),
+                installationUuid,
+                "primary",
+                "matrix-client",
+                validation,
+                registration,
+                new InstallationKeyService().generate(),
+                "encrypted.assertion.value",
+                settings,
+                profile,
+                "registry.example.com/matrix:1.0.0",
+                Map.of("region", "north"),
+                new RuntimeConfiguration(
+                        "http://host.docker.internal:8090",
+                        "jdbc:postgresql://db:5432/matrix",
+                        "postgres",
+                        "db-secret",
+                        "redis",
+                        "7901",
+                        "redis-secret",
+                        false,
+                        "PT10S",
+                        "PT30S"));
+
+        String config = Files.readString(output.resolve("config/installation.yml"));
+        String compose = Files.readString(output.resolve("compose.yml"));
+        assertThat(config)
+                .contains("client-id: \"matrix-client\"")
+                .contains("installation-id: \"" + installationId + "\"")
+                .contains("cloud-url: \"http://host.docker.internal:8090\"")
+                .contains("token-url: \"http://host.docker.internal:8090/oauth2/token\"")
+                .contains("region: \"north\"")
+                .doesNotContain("activation-token");
+        assertThat(compose)
+                .contains("matrix-onprem:")
+                .contains("- \"8080:8080\"")
+                .contains("./config:/srv/matrix/config:ro")
+                .contains("MATRIX_INSTALLATION_CONFIG");
+        assertThat(Files.readString(output.resolve(".env")))
+                .contains("MATRIX_IMAGE=\"registry.example.com/matrix:1.0.0\"")
+                .contains("MATRIX_DB_URL=\"jdbc:postgresql://db:5432/matrix\"")
+                .contains("REDIS_HOST=\"redis\"")
+                .contains("REDIS_DATABASE=\"1\"")
+                .contains("CYGNUS_CLOUD_BASE_URL=\"http://host.docker.internal:8090\"")
+                .contains("CYGNUS_TOKEN_URL=\"http://host.docker.internal:8090/oauth2/token\"")
+                .contains("CYGNUS_CLIENT_ID=\"matrix-client\"")
+                .contains("CYGNUS_INSTALLATION_ID=\"primary\"")
+                .contains("CYGNUS_CLIENT_ASSERTION=\"file:/srv/matrix/config/machine-assertion.jwt\"")
+                .contains("CYGNUS_LOGIN_PUBLIC_KEY=\"file:/srv/matrix/config/keys/login-public.pem\"");
+        assertThat(output.resolve("config/keys/login-public.pem"))
+                .hasContent("login-public-key");
+        assertThat(output.resolve("config/machine-assertion.jwt")).hasContent(
+                "encrypted.assertion.value");
+        assertThat(output.resolve("config/keys/client-signing-private.pem"))
+                .isRegularFile();
+    }
+
+    @Test
+    void refusesToOverwriteCloudServiceConfiguration() throws Exception {
+        Path cloudConfig = temporaryDirectory.resolve("config");
+        Path cloudKeys = cloudConfig.resolve("keys");
+        Files.createDirectories(cloudKeys);
+        Path assertionPublic = cloudKeys.resolve("assertion-decryption-public.pem");
+        Path loginPublic = cloudKeys.resolve("login-public.pem");
+        Files.writeString(assertionPublic, "assertion-public-key");
+        Files.writeString(loginPublic, "login-public-key");
+
+        var profile = new ProductProfile(
+                "matrix",
+                "Matrix",
+                "matrix-onprem",
+                "MATRIX_IMAGE",
+                "matrix",
+                "installation.yml",
+                "MATRIX_INSTALLATION_CONFIG",
+                "/srv/matrix/config/installation.yml",
+                "8080:8080",
+                "/matrix/",
+                "/oauth2/token",
+                assertionPublic,
+                loginPublic,
+                "cygnus-login-2026-01",
+                List.of());
+
+        assertThatThrownBy(() -> new DeploymentWriter().write(
+                        temporaryDirectory,
+                        UUID.randomUUID(),
+                        "primary",
+                        "matrix-client",
+                        new ActivationDtos.ValidationResponse(
+                                "activation-token",
+                                OffsetDateTime.now().plusMinutes(5),
+                                UUID.randomUUID(),
+                                "matrix-client",
+                                "FULL",
+                                2),
+                        new ActivationDtos.RegistrationResponse(
+                                UUID.randomUUID(),
+                                UUID.randomUUID(),
+                                UUID.randomUUID(),
+                                null,
+                                "primary",
+                                1,
+                                "ACTIVE"),
+                        new InstallationKeyService().generate(),
+                        "assertion",
+                        new InstallerSettings(
+                                "matrix",
+                                URI.create("https://cloud.example.com"),
+                                URI.create("https://cloud.example.com"),
+                                "/api/v1/installations",
+                                "production",
+                                temporaryDirectory,
+                                temporaryDirectory,
+                                "1",
+                                new IniDocument(Map.of())),
+                        profile,
+                        "registry.example.com/matrix:1.0.0",
+                        Map.of(),
+                        new RuntimeConfiguration(
+                                "https://cloud.example.com",
+                                "jdbc:postgresql://db/matrix",
+                                "postgres",
+                                "secret",
+                                "redis",
+                                "7901",
+                                "secret",
+                                false,
+                                "PT10S",
+                                "PT30S")))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessageContaining("cloud-service configuration");
+
+        assertThat(assertionPublic).hasContent("assertion-public-key");
+        assertThat(loginPublic).hasContent("login-public-key");
+    }
+}

cygnus-installer/src/test/java/com/cygnus/installer/DockerPrerequisiteCheckerTest.java

@@ -0,0 +1,34 @@
+package com.cygnus.installer;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import java.time.Duration;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+
+class DockerPrerequisiteCheckerTest {
+
+    @Test
+    void blocksInstallationWhenDockerIsUnavailable() {
+        CommandExecutor executor = executorReturning(new CommandResult(127, "not found"));
+        DockerPrerequisiteChecker checker = new DockerPrerequisiteChecker(executor);
+        assertThrows(PrerequisiteException.class, checker::verify);
+    }
+
+    @Test
+    void acceptsDockerEngineAndComposeV2() {
+        CommandExecutor executor = executorReturning(new CommandResult(0, "ok"));
+        DockerPrerequisiteChecker checker = new DockerPrerequisiteChecker(executor);
+        assertDoesNotThrow(checker::verify);
+    }
+
+    private CommandExecutor executorReturning(CommandResult result) {
+        return new CommandExecutor() {
+            @Override
+            public CommandResult execute(List<String> command, Duration timeout) {
+                return result;
+            }
+        };
+    }
+}

cygnus-installer/src/test/java/com/cygnus/installer/IniConfigurationLoaderTest.java

@@ -0,0 +1,103 @@
+package com.cygnus.installer;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class IniConfigurationLoaderTest {
+
+    @TempDir
+    Path temporaryDirectory;
+
+    private final IniConfigurationLoader loader = new IniConfigurationLoader();
+
+    @Test
+    void loadsAndNormalizesInstallerSettings() throws Exception {
+        Path ini = write("""
+                [installer]
+                product=matrix
+                cloud_service_url=https://cloud.example.com/
+                container_cloud_service_url=http://host.docker.internal:8090/
+                installer_api_base_path=/api/v1/installations/
+                environment=production
+                """);
+
+        InstallerSettings settings = loader.load(ini, "1.2.3");
+
+        assertThat(settings.product()).isEqualTo("matrix");
+        assertThat(settings.cloudServiceUrl().toString())
+                .isEqualTo("https://cloud.example.com");
+        assertThat(settings.containerCloudServiceUrl().toString())
+                .isEqualTo("http://host.docker.internal:8090");
+        assertThat(settings.validationPath())
+                .isEqualTo("/api/v1/installations/activation/validate");
+        assertThat(settings.registrationPath())
+                .isEqualTo("/api/v1/installations/register");
+        assertThat(settings.defaultOutputDirectory())
+                .isEqualTo(Path.of("./matrix-installation"));
+    }
+
+    @Test
+    void defaultsContainerCloudUrlToCanonicalCloudUrl() throws Exception {
+        Path ini = write("""
+                [installer]
+                product=matrix
+                cloud_service_url=https://cloud.example.com/
+                installer_api_base_path=/api/v1/installations
+                environment=production
+                """);
+
+        InstallerSettings settings = loader.load(ini, "1.2.3");
+
+        assertThat(settings.containerCloudServiceUrl())
+                .isEqualTo(settings.cloudServiceUrl());
+    }
+
+    @Test
+    void rejectsUnknownProduct() throws Exception {
+        Path ini = write("""
+                [installer]
+                product=unknown
+                cloud_service_url=https://cloud.example.com
+                installer_api_base_path=/api/v1/installations
+                environment=production
+                """);
+
+        assertThatThrownBy(() -> loader.load(ini, "1"))
+                .isInstanceOf(InstallerConfigurationException.class)
+                .hasMessageContaining("Unsupported product");
+    }
+
+    @Test
+    void rejectsInvalidCloudUrlAndApiPath() throws Exception {
+        Path invalidUrl = write("""
+                [installer]
+                product=cygnus
+                cloud_service_url=cloud.example.com
+                installer_api_base_path=/api/v1/installations
+                environment=production
+                """);
+        assertThatThrownBy(() -> loader.load(invalidUrl, "1"))
+                .hasMessageContaining("absolute http(s) URL");
+
+        Path invalidPath = write("""
+                [installer]
+                product=cygnus
+                cloud_service_url=https://cloud.example.com
+                installer_api_base_path=api/v1/installations
+                environment=production
+                """);
+        assertThatThrownBy(() -> loader.load(invalidPath, "1"))
+                .hasMessageContaining("absolute safe URL path");
+    }
+
+    private Path write(String content) throws Exception {
+        Path path = temporaryDirectory.resolve("installer-" + System.nanoTime() + ".ini");
+        Files.writeString(path, content);
+        return path;
+    }
+}

cygnus-installer/src/test/java/com/cygnus/installer/InstallationServiceTest.java

@@ -0,0 +1,35 @@
+package com.cygnus.installer;
+
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+import java.nio.file.Path;
+import java.util.Map;
+import org.junit.jupiter.api.Test;
+
+class InstallationServiceTest {
+
+    @Test
+    void rejectsIncompleteRequestBeforeCallingInfrastructure() {
+        InstallationService service =
+                new InstallationService(
+                        null, null, null, null, null, null, null, null, null);
+
+        assertThatThrownBy(() -> service.install(
+                        new InstallationRequest(
+                                "",
+                                "",
+                                "",
+                                "",
+                                "",
+                                "",
+                                "",
+                                "",
+                                "",
+                                Path.of("."),
+                                Map.of(),
+                                null),
+                        (percentage, message) -> {}))
+                .isInstanceOf(IllegalArgumentException.class)
+                .hasMessage("Client code is required");
+    }
+}

cygnus-installer/src/test/java/com/cygnus/installer/MachineAssertionServiceTest.java

@@ -0,0 +1,60 @@
+package com.cygnus.installer;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.security.KeyPairGenerator;
+import java.util.Base64;
+import java.util.List;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class MachineAssertionServiceTest {
+
+    @TempDir
+    Path temporaryDirectory;
+
+    @Test
+    void generatesEncryptedAssertionUsingOnlyCloudPublicKey() throws Exception {
+        var generator = KeyPairGenerator.getInstance("RSA");
+        generator.initialize(2048);
+        var cloudKeys = generator.generateKeyPair();
+        Path cloudPublicKey = temporaryDirectory.resolve("cloud-public.pem");
+        Files.writeString(cloudPublicKey, pem(
+                "PUBLIC KEY", cloudKeys.getPublic().getEncoded()));
+        ProductProfile profile = new ProductProfile(
+                "matrix",
+                "Matrix",
+                "matrix-onprem",
+                "MATRIX_IMAGE",
+                "matrix",
+                "installation.yml",
+                "MATRIX_INSTALLATION_CONFIG",
+                "/opt/matrix/config/installation.yml",
+                "8080:8080",
+                "/matrix/",
+                "/oauth2/token",
+                cloudPublicKey,
+                cloudPublicKey,
+                "cygnus-login-2026-01",
+                List.of());
+
+        String assertion = new MachineAssertionService().generate(
+                "matrix-client",
+                "primary",
+                "https://cloud.example.com/oauth2/token",
+                new InstallationKeyService().generate(),
+                profile);
+
+        assertThat(assertion.split("\\.")).hasSize(5);
+        assertThat(assertion).doesNotContain("matrix-client");
+    }
+
+    private String pem(String type, byte[] encoded) {
+        return "-----BEGIN " + type + "-----\n"
+                + Base64.getMimeEncoder(64, new byte[] {'\n'})
+                        .encodeToString(encoded)
+                + "\n-----END " + type + "-----\n";
+    }
+}

cygnus-installer/src/test/java/com/cygnus/installer/ProductProfileRegistryTest.java

@@ -0,0 +1,56 @@
+package com.cygnus.installer;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+class ProductProfileRegistryTest {
+
+    @TempDir
+    Path temporaryDirectory;
+
+    @Test
+    void appliesProductProfileOverridesWithoutInstallerBranching() throws Exception {
+        Path publicKey = temporaryDirectory.resolve("cloud.pem");
+        Files.writeString(publicKey, "test");
+        Path loginPublicKey = temporaryDirectory.resolve("login.pem");
+        Files.writeString(loginPublicKey, "test-login");
+        Path ini = temporaryDirectory.resolve("installer.ini");
+        Files.writeString(ini, """
+                [installer]
+                product=cygnus
+                cloud_service_url=https://cloud.example.com
+                installer_api_base_path=/api/v1/installations
+                environment=production
+
+                [profile.cygnus]
+                display_name=Cygnus
+                assertion_encryption_public_key=cloud.pem
+                login_encryption_public_key=login.pem
+                login_key_id=cygnus-login-2026-01
+                service_name=custom-cygnus
+                image_environment_variable=CYGNUS_IMAGE
+                configuration_root=cygnus
+                configuration_file_name=installation.yml
+                installation_config_environment_variable=CYGNUS_INSTALLATION_CONFIG
+                container_configuration_path=/opt/cygnus/config/installation.yml
+                port_mapping=8080:8080
+                service_path=/matrix/
+                token_path=/oauth2/token
+                optional_fields=region,site_code
+                """);
+
+        InstallerSettings settings = new IniConfigurationLoader().load(ini, "1");
+        ProductProfile profile = new ProductProfileRegistry().resolve(settings);
+
+        assertThat(profile.displayName()).isEqualTo("Cygnus");
+        assertThat(profile.serviceName()).isEqualTo("custom-cygnus");
+        assertThat(profile.optionalInstallationFields())
+                .containsExactly("region", "site_code");
+        assertThat(profile.assertionEncryptionPublicKey()).isEqualTo(publicKey);
+        assertThat(profile.loginEncryptionPublicKey()).isEqualTo(loginPublicKey);
+    }
+}