gamertan
00d1dd4209
Publish the reviewed allowlisted snapshot whose exact binary completed maintenance deployment, rollback, and reactivation exercises for Gamertan and Sandwich Hime. Private-Source-Commit: 4d7094c8b7c61991bfb67b11fc1558724c874eb2 Private-Source-Tree: 54a2f74804f7acddf3755d7d4da5b97f5fc28381 AI-Assistance: OpenAI Codex assisted implementation, testing, security review, and release verification. Signed-off-by: Cole Speelman <crspeelman@gmail.com>
60 lines
2.1 KiB
Go
60 lines
2.1 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-only
|
|
|
|
package serverpolicy
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestParseAcceptsStrictServiceMap(t *testing.T) {
|
|
body := `{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{"example-site":{"config":"/etc/tend/services/example-site.json","max_artifact_bytes":1048576}}}`
|
|
policy, err := Parse(strings.NewReader(body))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if policy.Services["example-site"].MaxArtifactBytes != 1<<20 {
|
|
t.Fatalf("policy=%+v", policy)
|
|
}
|
|
}
|
|
|
|
func TestRejectEnvironmentKeyProtectsSingletonCandidateOverride(t *testing.T) {
|
|
directory := t.TempDir()
|
|
path := filepath.Join(directory, "service.env")
|
|
for _, test := range []struct {
|
|
name string
|
|
body string
|
|
wantErr bool
|
|
}{
|
|
{name: "shared values only", body: "APP_SECRET=private\n"},
|
|
{name: "exact listen key", body: "EXAMPLE_LISTEN=127.0.0.1:8092\n", wantErr: true},
|
|
{name: "spaced listen key", body: " EXAMPLE_LISTEN = 127.0.0.1:8092\n", wantErr: true},
|
|
{name: "commented listen key", body: "# EXAMPLE_LISTEN=127.0.0.1:8092\n"},
|
|
{name: "longer key", body: "EXAMPLE_LISTENER=safe\n"},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
if err := os.WriteFile(path, []byte(test.body), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
err := rejectEnvironmentKey(path, "EXAMPLE_LISTEN")
|
|
if (err != nil) != test.wantErr {
|
|
t.Fatalf("error=%v wantErr=%v", err, test.wantErr)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestParseRejectsUnknownAndForgedPaths(t *testing.T) {
|
|
tests := []string{
|
|
`{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{"example-site":{"config":"/tmp/example.json","max_artifact_bytes":1048576}}}`,
|
|
`{"schema_version":1,"config_root":"/etc/tend/services","incoming_root":"/var/lib/tend/incoming","shared_lock_file":"/run/lock/tend-deploy.lock","services":{},"surprise":true}`,
|
|
}
|
|
for _, body := range tests {
|
|
if _, err := Parse(strings.NewReader(body)); err == nil {
|
|
t.Fatalf("accepted %s", body)
|
|
}
|
|
}
|
|
}
|