[Duplicate Code] Extract shared VMM account validation helper

[github-actions]

Duplicate Code Opportunity

Summary

• Pattern: resolveAndValidateAccount() in the Cloud Hypervisor VMM identity path and the NVX runtime lifecycle path repeat the same id -u/-g/-G + getent passwd validation flow, including the supplementary-group check and unsafe passwd-state guard.
• Locations: src/cloud-hypervisor/vmm-identity.ts lines 278-309; src/nvx/runtime-lifecycle.ts lines 322-353.
• Impact: Roughly 18 duplicated lines per site in a security-sensitive validation path. Any change to account validation rules must currently be mirrored in two places.

Evidence

// src/cloud-hypervisor/vmm-identity.ts:278-309
const [
  { stdout: uidText },
  { stdout: gidText },
  { stdout: groupsText },
  { stdout: passwdText },
] = await Promise.all([
  this.dependencies.run(this.tools.id, ['-u', name]),
  this.dependencies.run(this.tools.id, ['-g', name]),
  this.dependencies.run(this.tools.id, ['-G', name]),
  this.dependencies.run(this.tools.getent, ['passwd', name]),
]);
const uid = parsePositiveInteger(uidText, 'uid');
const gid = parsePositiveInteger(gidText, 'gid');
const groups = groupsText.trim().split((s/redacted)+/).filter(Boolean).map((value) =>
  parsePositiveInteger(value, 'supplementary group'));
if (groups.length !== 1 || groups[0] !== gid) {
  throw new Error(
    `Cloud Hypervisor VMM account ${name} inherited supplementary groups: ${groups.join(' ')}`,
  );
}
const passwd = passwdText.trim().split(':');
if (
  passwd.length !== 7 ||
  passwd[0] !== name ||
  passwd[2] !== String(uid) ||
  passwd[3] !== String(gid) ||
  passwd[5] !== '/nonexistent' ||
  passwd[6] !== '/usr/sbin/nologin'
) {
  throw new Error(`Cloud Hypervisor VMM account ${name} has unsafe passwd state`);
}

// src/nvx/runtime-lifecycle.ts:322-353
const [
  { stdout: uidText },
  { stdout: gidText },
  { stdout: groupsText },
  { stdout: passwdText },
] = await Promise.all([
  this.dependencies.run(this.tools.id, ['-u', name]),
  this.dependencies.run(this.tools.id, ['-g', name]),
  this.dependencies.run(this.tools.id, ['-G', name]),
  this.dependencies.run(this.tools.getent, ['passwd', name]),
]);
const uid = parsePositiveInteger(uidText, 'uid');
const gid = parsePositiveInteger(gidText, 'gid');
const groups = groupsText.trim().split((s/redacted)+/).filter(Boolean)
  .map((value) => parsePositiveInteger(value, 'supplementary group'));
if (groups.length !== 1 || groups[0] !== gid) {
  throw new Error(`NVX VMM account ${name} inherited supplementary groups: ${groups.join(' ')}`);
}
const passwd = passwdText.trim().split(':');
if (
  passwd.length !== 7 ||
  passwd[0] !== name ||
  passwd[2] !== String(uid) ||
  passwd[3] !== String(gid) ||
  passwd[5] !== '/nonexistent' ||
  passwd[6] !== '/usr/sbin/nologin' ||
  !passwd[4].includes(this.runId)
) {
  throw new Error(`NVX VMM account ${name} has unsafe passwd state`);
}

Suggested Refactoring

Extract a shared helper for resolving and validating a VMM account, with a small callback or options object for the NVX-specific passwd assertion. The helper should own the shared id/getent parsing and group-safety checks, leaving only the extra runId constraint in the caller.

Affected Files

• src/cloud-hypervisor/vmm-identity.ts — lines 278-309
• src/nvx/runtime-lifecycle.ts — lines 322-353

Effort Estimate

Medium

---

Detected by Duplicate Code Detector workflow. Run date: 2026-09-25

Generated by Duplicate Code Detector · copilot · gpt50mini · 14.2 AIC · ⊞ 21K · ◷

• expires on Oct 25, 2026, 9:45 PM UTC