From 54b7e9933d7edbd79b0d098f5a5a6837b05bfbba Mon Sep 17 00:00:00 2001
From: rcourtman <courtmanr@gmail.com>
Date: Sun, 14 Jun 2026 23:32:38 +0100
Subject: [PATCH] Harden integration bootstrap token seed

---
 tests/integration/docker-compose.test.yml  | 29 ++++++++++++++++------
 tests/integration/scripts/pretest.test.mjs | 16 ++++++++++++
 2 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/tests/integration/docker-compose.test.yml b/tests/integration/docker-compose.test.yml
index 8ef594664..1b5488a40 100644
--- a/tests/integration/docker-compose.test.yml
+++ b/tests/integration/docker-compose.test.yml
@@ -10,13 +10,28 @@ services:
       - PGID=${PGID:-1000}
     volumes:
       - test-data:/data
-    command: >
-      sh -c "set -e;
-      umask 077;
-      printf '%s\n' \"$$PULSE_E2E_BOOTSTRAP_TOKEN\" > /data/.bootstrap_token;
-      chown \"$${PUID:-1000}:$${PGID:-1000}\" /data /data/.bootstrap_token;
-      chmod 700 /data;
-      chmod 600 /data/.bootstrap_token"
+    command:
+      - sh
+      - -c
+      - |
+        set -e
+        umask 077
+        : "$${PULSE_E2E_BOOTSTRAP_TOKEN:?PULSE_E2E_BOOTSTRAP_TOKEN is required}"
+        token="$${PULSE_E2E_BOOTSTRAP_TOKEN}"
+        if [ "$${#token}" -ne 48 ]; then
+          echo "PULSE_E2E_BOOTSTRAP_TOKEN must be a 48-character hex token" >&2
+          exit 1
+        fi
+        case "$${token}" in
+          *[!0123456789abcdefABCDEF]*)
+            echo "PULSE_E2E_BOOTSTRAP_TOKEN must be a 48-character hex token" >&2
+            exit 1
+            ;;
+        esac
+        printf '%s\n' "$${token}" > /data/.bootstrap_token
+        chown "$${PUID:-1000}:$${PGID:-1000}" /data /data/.bootstrap_token
+        chmod 700 /data
+        chmod 600 /data/.bootstrap_token
     networks:
       - test-network
 
diff --git a/tests/integration/scripts/pretest.test.mjs b/tests/integration/scripts/pretest.test.mjs
index 3c3fd4f7d..03adf76f0 100644
--- a/tests/integration/scripts/pretest.test.mjs
+++ b/tests/integration/scripts/pretest.test.mjs
@@ -1,4 +1,5 @@
 import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
 import test from 'node:test';
 
 import {
@@ -142,3 +143,18 @@ test('validateBootstrapTokenForFirstRun validates the seed token before first-ru
   assert.equal(calls[1].url, 'http://localhost:7655/api/security/validate-bootstrap-token');
   assert.equal(calls[1].options.body, JSON.stringify({ token: 'token-123' }));
 });
+
+test('docker compose bootstrap seed expands the token inside the seed container shell', () => {
+  const compose = readFileSync(new URL('../docker-compose.test.yml', import.meta.url), 'utf8');
+
+  assert.match(compose, /command:\n\s+- sh\n\s+- -c\n\s+- \|/);
+  assert.ok(
+    compose.includes(': "$${PULSE_E2E_BOOTSTRAP_TOKEN:?PULSE_E2E_BOOTSTRAP_TOKEN is required}"'),
+  );
+  assert.ok(compose.includes('token="$${PULSE_E2E_BOOTSTRAP_TOKEN}"'));
+  assert.ok(compose.includes('if [ "$${#token}" -ne 48 ]; then'));
+  assert.ok(
+    compose.includes('printf \'%s\\n\' "$${token}" > /data/.bootstrap_token'),
+  );
+  assert.doesNotMatch(compose, /"\$\$PULSE_E2E_BOOTSTRAP_TOKEN"/);
+});