feat(setup): generate local installation configuration
This commit is contained in:
@@ -0,0 +1,291 @@
|
||||
package setup
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/aritmolab/thothii/tools/tht/internal/config"
|
||||
)
|
||||
|
||||
func TestEnsureFilesCreatesDiscoverableConfigurationInProjectWithSpaces(t *testing.T) {
|
||||
root := newProject(t, "checkout with spaces")
|
||||
secrets := newExternalSecrets(t, root)
|
||||
setNonInteractiveAnswers(t, secrets)
|
||||
|
||||
trackedExample := filepath.Join(root, "deploy", "env", "local.env.example")
|
||||
before, err := os.ReadFile(trackedExample)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
result, err := EnsureFiles(Request{
|
||||
ProjectRoot: root, InstallationID: "local-dev", Profile: "local", NonInteractive: true,
|
||||
}, strings.NewReader(""), ioDiscard{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
wantDirectory := filepath.Join(root, "deploy", "local-dev")
|
||||
if result.DescriptorPath != filepath.Join(wantDirectory, "thothii-installation.yaml") {
|
||||
t.Fatalf("descriptor = %q", result.DescriptorPath)
|
||||
}
|
||||
if result.EnvironmentPath != filepath.Join(wantDirectory, "operator.env") {
|
||||
t.Fatalf("environment = %q", result.EnvironmentPath)
|
||||
}
|
||||
for _, path := range []string{result.DescriptorPath, result.EnvironmentPath} {
|
||||
info, statErr := os.Stat(path)
|
||||
if statErr != nil {
|
||||
t.Fatalf("generated file %s: %v", path, statErr)
|
||||
}
|
||||
if info.Mode().Perm()&0o077 != 0 {
|
||||
t.Errorf("generated file %s has permissions %o, want owner-only", path, info.Mode().Perm())
|
||||
}
|
||||
}
|
||||
|
||||
descriptor, err := os.ReadFile(result.DescriptorPath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
environment, err := os.ReadFile(result.EnvironmentPath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, secretValue := range []string{"super-secret-value", "pi-secret-value", "private-key-value"} {
|
||||
if bytes.Contains(descriptor, []byte(secretValue)) || bytes.Contains(environment, []byte(secretValue)) {
|
||||
t.Fatalf("generated configuration contains a secret value %q", secretValue)
|
||||
}
|
||||
}
|
||||
for _, path := range []string{secrets.secrets, secrets.piAuth, secrets.sshKey, secrets.knownHosts} {
|
||||
contents, readErr := os.ReadFile(path)
|
||||
if readErr != nil || len(contents) == 0 {
|
||||
t.Fatalf("existing secret file %s was not preserved: %v", path, readErr)
|
||||
}
|
||||
}
|
||||
if _, err := config.Resolve("", nil, root); err != nil {
|
||||
t.Fatalf("generated descriptor was not discoverable: %v", err)
|
||||
}
|
||||
after, err := os.ReadFile(trackedExample)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(before, after) {
|
||||
t.Fatal("tracked example was modified")
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureFilesIsIdempotentForCompatibleFiles(t *testing.T) {
|
||||
root := newProject(t, "linked worktree")
|
||||
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
||||
request := Request{ProjectRoot: root, InstallationID: "worktree", Profile: "local", NonInteractive: true}
|
||||
|
||||
first, err := EnsureFiles(request, strings.NewReader(""), ioDiscard{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
before, err := os.ReadFile(first.EnvironmentPath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
second, err := EnsureFiles(request, strings.NewReader(""), ioDiscard{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(second.Created) != 0 {
|
||||
t.Fatalf("compatible rerun created %v, want no files", second.Created)
|
||||
}
|
||||
after, err := os.ReadFile(first.EnvironmentPath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !bytes.Equal(before, after) {
|
||||
t.Fatal("compatible environment was rewritten")
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureFilesRefusesConflictingConfiguration(t *testing.T) {
|
||||
root := newProject(t, "conflict")
|
||||
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
||||
directory := filepath.Join(root, "deploy", "existing")
|
||||
if err := os.Mkdir(directory, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
descriptor := filepath.Join(directory, "thothii-installation.yaml")
|
||||
if err := os.WriteFile(descriptor, []byte("profile: server\n"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "existing", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
||||
if err == nil || !strings.Contains(err.Error(), descriptor) || !strings.Contains(err.Error(), "different installation ID") {
|
||||
t.Fatalf("EnsureFiles() error = %v, want exact file and corrective action", err)
|
||||
}
|
||||
if _, statErr := os.Stat(filepath.Join(directory, "operator.env")); !errors.Is(statErr, os.ErrNotExist) {
|
||||
t.Fatalf("operator.env was created after conflict: %v", statErr)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureFilesRemovesOwnFilesWhenAtomicWriteIsInterrupted(t *testing.T) {
|
||||
root := newProject(t, "interrupted")
|
||||
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
||||
previous := atomicWriteNewFile
|
||||
t.Cleanup(func() { atomicWriteNewFile = previous })
|
||||
calls := 0
|
||||
atomicWriteNewFile = func(path string, contents []byte, mode os.FileMode) error {
|
||||
calls++
|
||||
if calls == 2 {
|
||||
return errors.New("interrupted write")
|
||||
}
|
||||
return previous(path, contents, mode)
|
||||
}
|
||||
|
||||
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "interrupted", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
||||
if err == nil || !strings.Contains(err.Error(), "interrupted write") {
|
||||
t.Fatalf("EnsureFiles() error = %v, want interrupted write", err)
|
||||
}
|
||||
directory := filepath.Join(root, "deploy", "interrupted")
|
||||
for _, name := range []string{"thothii-installation.yaml", "operator.env"} {
|
||||
if _, statErr := os.Stat(filepath.Join(directory, name)); !errors.Is(statErr, os.ErrNotExist) {
|
||||
t.Fatalf("%s remains after interrupted write: %v", name, statErr)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureFilesCreatesSecretTemplatesOnlyAfterExplicitConfirmation(t *testing.T) {
|
||||
root := newProject(t, "secret prompt")
|
||||
var output bytes.Buffer
|
||||
input := strings.Join([]string{
|
||||
"demo", "local", "", "", "https://git.example.invalid/workspaces.git", "main", "https", "", "", "", "", "yes",
|
||||
}, "\n") + "\n"
|
||||
result, err := EnsureFiles(Request{ProjectRoot: root}, strings.NewReader(input), &output)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !strings.Contains(output.String(), "Create blank secret-file templates") {
|
||||
t.Fatalf("prompt = %q, want explicit secret-template confirmation", output.String())
|
||||
}
|
||||
for _, path := range []string{
|
||||
filepath.Join(root, "deploy", "demo", "secrets", "thothii.secrets"),
|
||||
filepath.Join(root, "deploy", "demo", "secrets", "pi-auth.json"),
|
||||
filepath.Join(root, "deploy", "demo", "secrets", "workspace-git-credentials"),
|
||||
filepath.Join(root, "deploy", "demo", "secrets", "workspace-git-ca.pem"),
|
||||
} {
|
||||
info, statErr := os.Stat(path)
|
||||
if statErr != nil {
|
||||
t.Fatalf("secret template %s: %v", path, statErr)
|
||||
}
|
||||
if info.Mode().Perm()&0o077 != 0 {
|
||||
t.Errorf("secret template %s has permissions %o, want owner-only", path, info.Mode().Perm())
|
||||
}
|
||||
}
|
||||
if _, err := os.Stat(result.DescriptorPath); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureFilesRequiresExplicitNonInteractiveAnswers(t *testing.T) {
|
||||
root := newProject(t, "noninteractive")
|
||||
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "ci", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
||||
if err == nil || !strings.Contains(err.Error(), "THT_SETUP_WORKSPACE_REMOTE") {
|
||||
t.Fatalf("EnsureFiles() error = %v, want non-interactive environment guidance", err)
|
||||
}
|
||||
}
|
||||
|
||||
func TestEnsureFilesIncludesServerStorageLocations(t *testing.T) {
|
||||
root := newProject(t, "server profile")
|
||||
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
||||
result, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "server", Profile: "server", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
contents, err := os.ReadFile(result.EnvironmentPath)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, name := range []string{"THT_DATA_ROOT", "THT_PI_STATE_ROOT", "THT_WORKSPACE_REGISTRY_ROOT", "THT_BACKUP_ROOT"} {
|
||||
if !strings.Contains(string(contents), name+"=") {
|
||||
t.Errorf("server configuration is missing %s: %s", name, contents)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func newProject(t *testing.T, name string) string {
|
||||
t.Helper()
|
||||
root := filepath.Join(t.TempDir(), name)
|
||||
for _, path := range []string{
|
||||
filepath.Join(root, "deploy", "env"),
|
||||
filepath.Join(root, "deploy"),
|
||||
filepath.Join(root, ".git"),
|
||||
filepath.Join(root, "backend"),
|
||||
filepath.Join(root, "frontend"),
|
||||
filepath.Join(root, "harness"),
|
||||
filepath.Join(root, "tools"),
|
||||
} {
|
||||
if err := os.MkdirAll(path, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
for path, contents := range map[string]string{
|
||||
filepath.Join(root, "compose.yaml"): "services: {}\n",
|
||||
filepath.Join(root, "deploy", "compose.local.yaml"): "services: {}\n",
|
||||
filepath.Join(root, "deploy", "compose.git-ssh.yaml"): "services: {}\n",
|
||||
filepath.Join(root, "deploy", "compose.git-https.yaml"): "services: {}\n",
|
||||
filepath.Join(root, "deploy", "env", "local.env.example"): "tracked example\n",
|
||||
} {
|
||||
if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
canonical, err := filepath.EvalSymlinks(root)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return canonical
|
||||
}
|
||||
|
||||
type secretPaths struct {
|
||||
secrets, piAuth, sshKey, knownHosts string
|
||||
}
|
||||
|
||||
func newExternalSecrets(t *testing.T, root string) secretPaths {
|
||||
t.Helper()
|
||||
directory := filepath.Join(root, "external secrets")
|
||||
if err := os.Mkdir(directory, 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
paths := secretPaths{
|
||||
secrets: filepath.Join(directory, "thothii.secrets"), piAuth: filepath.Join(directory, "pi-auth.json"),
|
||||
sshKey: filepath.Join(directory, "git-key"), knownHosts: filepath.Join(directory, "known-hosts"),
|
||||
}
|
||||
for path, contents := range map[string]string{
|
||||
paths.secrets: "super-secret-value\n", paths.piAuth: "pi-secret-value\n", paths.sshKey: "private-key-value\n", paths.knownHosts: "git.example.invalid ssh-ed25519 AAAA\n",
|
||||
} {
|
||||
if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
return paths
|
||||
}
|
||||
|
||||
func setNonInteractiveAnswers(t *testing.T, paths secretPaths) {
|
||||
t.Helper()
|
||||
for name, value := range map[string]string{
|
||||
"THT_SETUP_WORKSPACE_REMOTE": "git@git.example.invalid:team/workspaces.git",
|
||||
"THT_SETUP_WORKSPACE_BRANCH": "main",
|
||||
"THT_SETUP_WORKSPACE_ACCESS": "ssh",
|
||||
"THT_SETUP_SECRETS_FILE": paths.secrets,
|
||||
"THT_SETUP_PI_AUTH_FILE": paths.piAuth,
|
||||
"THT_SETUP_GIT_SSH_KEY_FILE": paths.sshKey,
|
||||
"THT_SETUP_GIT_KNOWN_HOSTS_FILE": paths.knownHosts,
|
||||
"THT_SETUP_DWH_REST_URL": "https://dwh.example.invalid",
|
||||
"THT_SETUP_LLM_URL": "https://llm.example.invalid",
|
||||
} {
|
||||
t.Setenv(name, value)
|
||||
}
|
||||
}
|
||||
|
||||
type ioDiscard struct{}
|
||||
|
||||
func (ioDiscard) Write(value []byte) (int, error) { return len(value), nil }
|
||||
Reference in New Issue
Block a user