gamertan
00d1dd4209
Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime. Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2 Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381 AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
73 lines
2.8 KiB
Go
73 lines
2.8 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
package config
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
)
|
|
|
|
func validConfig() Config {
|
|
return Config{
|
|
SchemaVersion: 2,
|
|
Service: Service{Name: "example-site", AllowedHost: "example.test", EnvironmentFile: "/etc/tend/environment/example-site.env"},
|
|
Build: Build{Package: "./cmd/site", Binary: "example-site", Branch: "main"},
|
|
Deployment: Deployment{
|
|
Strategy: "blue_green", Root: "/opt/example-site", LockFile: SharedLockFile,
|
|
StateFile: "/opt/example-site/state.json", HealthPath: "/healthz", ReadinessPath: "/readyz",
|
|
CandidateTimeoutSecs: 30, Smoke: []Smoke{{Path: "/", Contains: "Example"}},
|
|
PublicSmoke: []PublicSmoke{{URL: "https://example.test/", Contains: "Example"}},
|
|
BlueGreen: &BlueGreen{
|
|
CaddyConfig: "/etc/caddy/Caddyfile", CaddyHandler: "/etc/caddy/example.caddy",
|
|
CaddyHandlerTemplate: "/etc/example/caddy.template",
|
|
BootstrapActive: "blue",
|
|
Blue: Slot{Unit: "example-blue.service", Address: "127.0.0.1:8090", Link: "/opt/example-site/slots/blue"},
|
|
Green: Slot{Unit: "example-green.service", Address: "127.0.0.1:8091", Link: "/opt/example-site/slots/green"},
|
|
},
|
|
},
|
|
}
|
|
}
|
|
|
|
func TestValidateAcceptsBlueGreen(t *testing.T) {
|
|
if err := validConfig().Validate(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func TestValidateRejectsHostileValues(t *testing.T) {
|
|
tests := map[string]func(*Config){
|
|
"unknown strategy": func(c *Config) { c.Deployment.Strategy = "shell" },
|
|
"nonloopback": func(c *Config) { c.Deployment.BlueGreen.Blue.Address = "203.0.113.7:80" },
|
|
"root path": func(c *Config) { c.Deployment.Root = "/" },
|
|
"traversal": func(c *Config) { c.Build.Package = "./cmd/../secret" },
|
|
"shared slot": func(c *Config) { c.Deployment.BlueGreen.Green.Link = c.Deployment.BlueGreen.Blue.Link },
|
|
"bad smoke": func(c *Config) { c.Deployment.Smoke[0].Path = "https://attacker.test/" },
|
|
"bad public smoke": func(c *Config) { c.Deployment.PublicSmoke[0].URL = "http://example.test/" },
|
|
"public secret query": func(c *Config) { c.Deployment.PublicSmoke[0].URL = "https://example.test/?token=secret" },
|
|
"environment sibling": func(c *Config) { c.Service.EnvironmentFile = "/etc/tend/environment-old/example.env" },
|
|
}
|
|
for name, mutate := range tests {
|
|
t.Run(name, func(t *testing.T) {
|
|
cfg := validConfig()
|
|
mutate(&cfg)
|
|
if err := cfg.Validate(); err == nil {
|
|
t.Fatal("expected validation failure")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestUnknownJSONFieldRejected(t *testing.T) {
|
|
b, err := json.Marshal(validConfig())
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var raw map[string]any
|
|
if err := json.Unmarshal(b, &raw); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
raw["surprise"] = true
|
|
b, _ = json.Marshal(raw)
|
|
_ = b // Load exercises strict decoding from disk in command tests.
|
|
}
|