fix(client): retry a read-only script with EVAL_RO after NOSCRIPT - #3567

// Additional test-only coverage for redis/node-redis#3563, complementary to
// the read-only NOSCRIPT / MULTI fix proposed in redis/node-redis#3567.
// Verifies ACL key-pattern isolation across cold and cached EVAL_RO/EVALSHA_RO
// without modifying the client implementation or flushing scripts.
import { strict as assert } from 'node:assert';
import { randomBytes } from 'node:crypto';
import testUtils, { GLOBAL } from '../test-utils';
import { createClient } from '../../index';
import { defineScript } from '../lua-script';
import { CommandParser } from './parser';
import { BlobStringReply } from '../RESP/types';

const READ_SECOND_KEY_SCRIPT = defineScript({
  SCRIPT: `return redis.call('GET', KEYS[2])`,
  NUMBER_OF_KEYS: 2,
  IS_READ_ONLY: true,
  parseCommand(parser: CommandParser, allowedKey: string, secondKey: string) {
    parser.pushKey(allowedKey);
    parser.pushKey(secondKey);
  },
  transformReply: undefined as unknown as () => BlobStringReply
});

describe('read-only Lua scripts preserve ACL key patterns (#3563)', () => {
  testUtils.isVersionGreaterThanHook([7]);

  testUtils.testWithClient(
    'cached EVALSHA_RO cannot access keys outside the granted ACL pattern',
    async (admin) => {
      const nonce = randomBytes(8).toString('hex');
      const prefix = `ax_acl_allowed_${nonce}:`;
      const allowedFirst = `${prefix}first`;
      const allowedSecond = `${prefix}second`;
      const deniedKey = `ax_acl_denied_${nonce}:secret`;
      const username = `ax_acl_${nonce}`;
      const password = randomBytes(24).toString('hex');
      const client = createClient({
        socket: admin.options.socket,
        RESP: admin.options.RESP,
        username,
        password,
        scripts: { readSecondKey: READ_SECOND_KEY_SCRIPT }
      }).on('error', () => {});

      try {
        await admin.sendCommand([
          'ACL', 'SETUSER', username, 'reset', 'on', `>${password}`,
          `~${prefix}*`, '+hello', '+auth', '+ping', '+get', '+eval_ro', '+evalsha_ro'
        ]);
        await admin.set(allowedFirst, 'first-value');
        await admin.set(allowedSecond, 'allowed-value');
        await admin.set(deniedKey, 'secret-value');

        // Connect the fresh client after its script command class has been created.
        // Do not grant CLIENT SETINFO: Redis 7.0 lacks it and node-redis ignores that
        // best-effort metadata handshake error.
        await client.connect();

        // Cold miss loads via EVAL_RO; second call uses the cached EVALSHA_RO digest.
        assert.equal(await client.readSecondKey(allowedFirst, allowedSecond), 'allowed-value');
        assert.equal(await client.readSecondKey(allowedFirst, allowedSecond), 'allowed-value');

        // The same cached script must not read a key outside the user's key pattern.
        await assert.rejects(
          () => client.readSecondKey(allowedFirst, deniedKey),
          (err: Error) => /NOPERM|permission|access.*key/i.test(err.message)
        );
        assert.equal(await admin.get(deniedKey), 'secret-value');
      } finally {
        try {
          client.destroy();
        } finally {
          try {
            // Also attempted if ACL SETUSER succeeded but its response was lost.
            await admin.sendCommand(['ACL', 'DELUSER', username]);
          } finally {
            await admin.del([allowedFirst, allowedSecond, deniedKey]);
          }
        }
      }
    },
    GLOBAL.SERVERS.OPEN
  );
});