fix: harden thothctl diagnostics
This commit is contained in:
@@ -0,0 +1,205 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestRunLogsRedactsAnUnlabelledDeclaredSecret(t *testing.T) {
|
||||
fixture := newCLIFixture(t, "UNLABELLED_SECRET_FILE=%s\n")
|
||||
secretPath := filepath.Join(fixture.root, "operator-secret")
|
||||
if err := os.WriteFile(secretPath, []byte("unlabelled-secret\r\n"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
fixture.setEnvironment(t, secretPath)
|
||||
t.Setenv("THOTHCTL_FAKE_LOG", "fake Docker log: unlabelled-secret")
|
||||
|
||||
var stdout, stderr bytes.Buffer
|
||||
exitCode := run(context.Background(), []string{"--installation", fixture.installationPath, "logs"}, &stdout, &stderr)
|
||||
|
||||
if exitCode != 0 {
|
||||
t.Fatalf("run() exit code = %d, stderr = %s", exitCode, stderr.String())
|
||||
}
|
||||
if strings.Contains(stdout.String(), "unlabelled-secret") {
|
||||
t.Fatalf("logs exposed an unlabelled secret: %q", stdout.String())
|
||||
}
|
||||
if stdout.String() != "fake Docker log: [REDACTED]\n" {
|
||||
t.Errorf("logs = %q, want redacted output", stdout.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunStatusUsesStableComposeArguments(t *testing.T) {
|
||||
fixture := newCLIFixture(t, "SAFE_VALUE=1\n")
|
||||
fixture.setEnvironment(t)
|
||||
|
||||
for range 2 {
|
||||
var stdout, stderr bytes.Buffer
|
||||
if exitCode := run(context.Background(), []string{"--installation", fixture.installationPath, "status"}, &stdout, &stderr); exitCode != 0 {
|
||||
t.Fatalf("run() exit code = %d, stderr = %s", exitCode, stderr.String())
|
||||
}
|
||||
}
|
||||
|
||||
invocations := fixture.invocations(t)
|
||||
if len(invocations) != 2 {
|
||||
t.Fatalf("docker invocations = %d, want 2", len(invocations))
|
||||
}
|
||||
if strings.Join(invocations[0], "\x00") != strings.Join(invocations[1], "\x00") {
|
||||
t.Errorf("Compose arguments changed between identical status calls: %#v then %#v", invocations[0], invocations[1])
|
||||
}
|
||||
wantSuffix := []string{
|
||||
"--project-directory", fixture.projectDirectory,
|
||||
"--env-file", fixture.envFile,
|
||||
"-f", filepath.Join(fixture.projectDirectory, "compose.yaml"),
|
||||
"-f", filepath.Join(fixture.projectDirectory, "deploy", "compose.local.yaml"),
|
||||
"ps", "--format", "json",
|
||||
}
|
||||
got := invocations[0]
|
||||
if len(got) != len(wantSuffix)+3 || got[0] != "compose" || got[1] != "--project-name" || !strings.HasPrefix(got[2], "thothii-") {
|
||||
t.Fatalf("unexpected Compose prefix: %#v", got)
|
||||
}
|
||||
for index, want := range wantSuffix {
|
||||
if got[index+3] != want {
|
||||
t.Errorf("argument %d = %q, want %q", index+3, got[index+3], want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunExplainsWhenDockerIsNotAvailable(t *testing.T) {
|
||||
fixture := newCLIFixture(t, "SAFE_VALUE=1\n")
|
||||
fixture.setEnvironment(t)
|
||||
t.Setenv("PATH", t.TempDir())
|
||||
|
||||
var stdout, stderr bytes.Buffer
|
||||
exitCode := run(context.Background(), []string{"--installation", fixture.installationPath, "status"}, &stdout, &stderr)
|
||||
|
||||
if exitCode != 127 {
|
||||
t.Errorf("run() exit code = %d, want 127", exitCode)
|
||||
}
|
||||
if !strings.Contains(stderr.String(), "Docker is not installed or is not on PATH") {
|
||||
t.Errorf("stderr = %q, want Docker-not-found guidance", stderr.String())
|
||||
}
|
||||
if strings.Contains(stderr.String(), "executable file") {
|
||||
t.Errorf("stderr leaked a process implementation detail: %q", stderr.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunDoctorValidatesTheRenderedInstallation(t *testing.T) {
|
||||
fixture := newCLIFixture(t, "SAFE_VALUE=1\n")
|
||||
fixture.setEnvironment(t)
|
||||
|
||||
var stdout, stderr bytes.Buffer
|
||||
exitCode := run(context.Background(), []string{"--installation", fixture.installationPath, "doctor"}, &stdout, &stderr)
|
||||
|
||||
if exitCode != 0 {
|
||||
t.Fatalf("run() exit code = %d, stderr = %s", exitCode, stderr.String())
|
||||
}
|
||||
if stdout.String() != "Doctor checks passed.\n" {
|
||||
t.Errorf("stdout = %q, want doctor success", stdout.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestRunPreservesChildExitCodes(t *testing.T) {
|
||||
fixture := newCLIFixture(t, "SAFE_VALUE=1\n")
|
||||
fixture.setEnvironment(t)
|
||||
t.Setenv("THOTHCTL_FAKE_EXIT", "42")
|
||||
|
||||
var stdout, stderr bytes.Buffer
|
||||
exitCode := run(context.Background(), []string{"--installation", fixture.installationPath, "update", "--check-only"}, &stdout, &stderr)
|
||||
|
||||
if exitCode != 42 {
|
||||
t.Errorf("run() exit code = %d, want 42", exitCode)
|
||||
}
|
||||
if stderr.String() != "fake Docker failure\n" {
|
||||
t.Errorf("stderr = %q, want child stderr", stderr.String())
|
||||
}
|
||||
}
|
||||
|
||||
type cliFixture struct {
|
||||
root string
|
||||
installationPath string
|
||||
projectDirectory string
|
||||
envFile string
|
||||
argsFile string
|
||||
pathDirectory string
|
||||
envTemplate string
|
||||
}
|
||||
|
||||
func newCLIFixture(t *testing.T, envTemplate string) cliFixture {
|
||||
t.Helper()
|
||||
root := t.TempDir()
|
||||
projectDirectory := filepath.Join(root, "project")
|
||||
if err := os.MkdirAll(filepath.Join(projectDirectory, "deploy"), 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, path := range []string{filepath.Join(projectDirectory, "compose.yaml"), filepath.Join(projectDirectory, "deploy", "compose.local.yaml")} {
|
||||
if err := os.WriteFile(path, []byte("services: {}\n"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
envFile := filepath.Join(root, "installation.env")
|
||||
installationPath := filepath.Join(root, "thothii-installation.yaml")
|
||||
contents := "profile: local\nprojectDirectory: " + projectDirectory + "\nenvFile: " + envFile + "\n"
|
||||
if err := os.WriteFile(installationPath, []byte(contents), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
pathDirectory := filepath.Join(root, "bin")
|
||||
if err := os.Mkdir(pathDirectory, 0o755); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
argsFile := filepath.Join(root, "docker-args")
|
||||
fakeDocker := `#!/bin/sh
|
||||
printf '%s\n' "$@" >> "$THOTHCTL_FAKE_ARGS"
|
||||
printf '%s\n' -- >> "$THOTHCTL_FAKE_ARGS"
|
||||
case " $* " in
|
||||
*" config --format json "*) printf '%s\n' '{"volumes":{"settings":{}}}' ;;
|
||||
*" ps --format json "*) printf '%s\n' '[{"Service":"core","State":"running","Health":"healthy"},{"Service":"frontend","State":"running","Health":"healthy"}]' ;;
|
||||
*" logs "*) printf '%s\n' "$THOTHCTL_FAKE_LOG" ;;
|
||||
esac
|
||||
if [ "${THOTHCTL_FAKE_EXIT:-0}" -ne 0 ]; then
|
||||
printf '%s\n' 'fake Docker failure' >&2
|
||||
fi
|
||||
exit "${THOTHCTL_FAKE_EXIT:-0}"
|
||||
`
|
||||
if err := os.WriteFile(filepath.Join(pathDirectory, "docker"), []byte(fakeDocker), 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return cliFixture{root: root, installationPath: installationPath, projectDirectory: projectDirectory, envFile: envFile, argsFile: argsFile, pathDirectory: pathDirectory, envTemplate: envTemplate}
|
||||
}
|
||||
|
||||
func (f cliFixture) setEnvironment(t *testing.T, values ...string) {
|
||||
t.Helper()
|
||||
env := f.envTemplate
|
||||
if len(values) > 0 {
|
||||
env = strings.Replace(env, "%s", values[0], 1)
|
||||
}
|
||||
if err := os.WriteFile(f.envFile, []byte(env), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Setenv("PATH", f.pathDirectory)
|
||||
t.Setenv("THOTHCTL_FAKE_ARGS", f.argsFile)
|
||||
t.Setenv("THOTHCTL_FAKE_EXIT", "0")
|
||||
t.Setenv("THOTHCTL_FAKE_LOG", "")
|
||||
}
|
||||
|
||||
func (f cliFixture) invocations(t *testing.T) [][]string {
|
||||
t.Helper()
|
||||
contents, err := os.ReadFile(f.argsFile)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var invocations [][]string
|
||||
var invocation []string
|
||||
for _, line := range strings.Split(strings.TrimSuffix(string(contents), "\n"), "\n") {
|
||||
if line == "--" {
|
||||
invocations = append(invocations, invocation)
|
||||
invocation = nil
|
||||
continue
|
||||
}
|
||||
invocation = append(invocation, line)
|
||||
}
|
||||
return invocations
|
||||
}
|
||||
Reference in New Issue
Block a user