492 lines
18 KiB
Go
492 lines
18 KiB
Go
package setup
|
|
|
|
import (
|
|
"bytes"
|
|
"errors"
|
|
"os"
|
|
"os/exec"
|
|
"path/filepath"
|
|
"runtime"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/aritmolab/thothii/tools/tht/internal/config"
|
|
"github.com/aritmolab/thothii/tools/tht/internal/safeio"
|
|
"github.com/aritmolab/thothii/tools/tht/internal/testsupport"
|
|
)
|
|
|
|
func TestEnsureFilesCreatesDiscoverableConfigurationInProjectWithSpaces(t *testing.T) {
|
|
root := newProject(t, "checkout with spaces")
|
|
secrets := newExternalSecrets(t, root)
|
|
setNonInteractiveAnswers(t, secrets)
|
|
|
|
trackedExample := filepath.Join(root, "deploy", "env", "local.env.example")
|
|
before, err := os.ReadFile(trackedExample)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
result, err := EnsureFiles(Request{
|
|
ProjectRoot: root, InstallationID: "local-dev", Profile: "local", NonInteractive: true,
|
|
}, strings.NewReader(""), ioDiscard{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
wantDirectory := filepath.Join(root, "deploy", "local-dev")
|
|
if result.DescriptorPath != filepath.Join(wantDirectory, "thothii-installation.yaml") {
|
|
t.Fatalf("descriptor = %q", result.DescriptorPath)
|
|
}
|
|
if result.EnvironmentPath != filepath.Join(wantDirectory, "operator.env") {
|
|
t.Fatalf("environment = %q", result.EnvironmentPath)
|
|
}
|
|
for _, path := range []string{result.DescriptorPath, result.EnvironmentPath} {
|
|
info, statErr := os.Stat(path)
|
|
if statErr != nil {
|
|
t.Fatalf("generated file %s: %v", path, statErr)
|
|
}
|
|
if info.Mode().Perm()&0o077 != 0 {
|
|
t.Errorf("generated file %s has permissions %o, want owner-only", path, info.Mode().Perm())
|
|
}
|
|
}
|
|
installation, err := config.Load(result.DescriptorPath)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := safeio.ValidatePrivateDirectory(installation.AuthenticationDirectory()); err != nil {
|
|
t.Fatalf("authentication directory is not private: %v", err)
|
|
}
|
|
|
|
descriptor, err := os.ReadFile(result.DescriptorPath)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
environment, err := os.ReadFile(result.EnvironmentPath)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.Contains(string(environment), "THT_AUTH_CONFIG_ROOT=") {
|
|
t.Fatalf("generated environment does not declare the authentication config root: %s", environment)
|
|
}
|
|
for _, secretValue := range []string{"super-secret-value", "pi-secret-value", "private-key-value"} {
|
|
if bytes.Contains(descriptor, []byte(secretValue)) || bytes.Contains(environment, []byte(secretValue)) {
|
|
t.Fatalf("generated configuration contains a secret value %q", secretValue)
|
|
}
|
|
}
|
|
for _, path := range []string{secrets.secrets, secrets.piAuth, secrets.sshKey, secrets.knownHosts} {
|
|
contents, readErr := os.ReadFile(path)
|
|
if readErr != nil || len(contents) == 0 {
|
|
t.Fatalf("existing secret file %s was not preserved: %v", path, readErr)
|
|
}
|
|
}
|
|
if _, err := config.Resolve("", nil, root); err != nil {
|
|
t.Fatalf("generated descriptor was not discoverable: %v", err)
|
|
}
|
|
after, err := os.ReadFile(trackedExample)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !bytes.Equal(before, after) {
|
|
t.Fatal("tracked example was modified")
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesIsIdempotentForCompatibleFiles(t *testing.T) {
|
|
root := newProject(t, "linked worktree")
|
|
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
|
request := Request{ProjectRoot: root, InstallationID: "worktree", Profile: "local", NonInteractive: true}
|
|
|
|
first, err := EnsureFiles(request, strings.NewReader(""), ioDiscard{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
before, err := os.ReadFile(first.EnvironmentPath)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second, err := EnsureFiles(request, strings.NewReader(""), ioDiscard{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(second.Created) != 0 {
|
|
t.Fatalf("compatible rerun created %v, want no files", second.Created)
|
|
}
|
|
after, err := os.ReadFile(first.EnvironmentPath)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !bytes.Equal(before, after) {
|
|
t.Fatal("compatible environment was rewritten")
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesRefusesConflictingConfiguration(t *testing.T) {
|
|
root := newProject(t, "conflict")
|
|
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
|
directory := filepath.Join(root, "deploy", "existing")
|
|
if err := os.Mkdir(directory, 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
descriptor := filepath.Join(directory, "thothii-installation.yaml")
|
|
if err := os.WriteFile(descriptor, []byte("profile: server\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "existing", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err == nil || !strings.Contains(err.Error(), descriptor) || !strings.Contains(err.Error(), "different installation ID") {
|
|
t.Fatalf("EnsureFiles() error = %v, want exact file and corrective action", err)
|
|
}
|
|
if _, statErr := os.Stat(filepath.Join(directory, "operator.env")); !errors.Is(statErr, os.ErrNotExist) {
|
|
t.Fatalf("operator.env was created after conflict: %v", statErr)
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesRemovesOwnFilesWhenAtomicWriteIsInterrupted(t *testing.T) {
|
|
root := newProject(t, "interrupted")
|
|
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
|
previous := atomicWriteNewFile
|
|
t.Cleanup(func() { atomicWriteNewFile = previous })
|
|
calls := 0
|
|
atomicWriteNewFile = func(path string, contents []byte, mode os.FileMode) error {
|
|
calls++
|
|
if calls == 2 {
|
|
return errors.New("interrupted write")
|
|
}
|
|
return previous(path, contents, mode)
|
|
}
|
|
|
|
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "interrupted", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err == nil || !strings.Contains(err.Error(), "interrupted write") {
|
|
t.Fatalf("EnsureFiles() error = %v, want interrupted write", err)
|
|
}
|
|
directory := filepath.Join(root, "deploy", "interrupted")
|
|
for _, name := range []string{"thothii-installation.yaml", "operator.env"} {
|
|
if _, statErr := os.Stat(filepath.Join(directory, name)); !errors.Is(statErr, os.ErrNotExist) {
|
|
t.Fatalf("%s remains after interrupted write: %v", name, statErr)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesCreatesSecretTemplatesOnlyAfterExplicitConfirmation(t *testing.T) {
|
|
root := newProject(t, "secret prompt")
|
|
var output bytes.Buffer
|
|
input := strings.Join([]string{
|
|
"demo", "local", "", "", "https://git.example.invalid/workspaces.git", "main", "https", "", "", "", "", "yes",
|
|
}, "\n") + "\n"
|
|
result, err := EnsureFiles(Request{ProjectRoot: root}, strings.NewReader(input), &output)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.Contains(output.String(), "Create blank secret-file templates") {
|
|
t.Fatalf("prompt = %q, want explicit secret-template confirmation", output.String())
|
|
}
|
|
for _, path := range []string{
|
|
filepath.Join(root, "deploy", "demo", "secrets", "thothii.secrets"),
|
|
filepath.Join(root, "deploy", "demo", "secrets", "pi-auth.json"),
|
|
filepath.Join(root, "deploy", "demo", "secrets", "workspace-git-credentials"),
|
|
filepath.Join(root, "deploy", "demo", "secrets", "workspace-git-ca.pem"),
|
|
} {
|
|
info, statErr := os.Stat(path)
|
|
if statErr != nil {
|
|
t.Fatalf("secret template %s: %v", path, statErr)
|
|
}
|
|
if info.Mode().Perm()&0o077 != 0 {
|
|
t.Errorf("secret template %s has permissions %o, want owner-only", path, info.Mode().Perm())
|
|
}
|
|
}
|
|
if _, err := os.Stat(result.DescriptorPath); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesRequiresExplicitNonInteractiveAnswers(t *testing.T) {
|
|
root := newProject(t, "noninteractive")
|
|
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "ci", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err == nil || !strings.Contains(err.Error(), "THT_SETUP_WORKSPACE_REMOTE") {
|
|
t.Fatalf("EnsureFiles() error = %v, want non-interactive environment guidance", err)
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesIncludesServerStorageLocations(t *testing.T) {
|
|
root := newProject(t, "server profile")
|
|
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
|
result, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "server", Profile: "server", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
contents, err := os.ReadFile(result.EnvironmentPath)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, name := range []string{"THT_DATA_ROOT", "THT_PI_STATE_ROOT", "THT_WORKSPACE_REGISTRY_ROOT", "THT_BACKUP_ROOT"} {
|
|
if !strings.Contains(string(contents), name+"=") {
|
|
t.Errorf("server configuration is missing %s: %s", name, contents)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesRejectsUnsafeServiceEndpointsBeforeWritingConfiguration(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name, environment, value string
|
|
}{
|
|
{"DWH user info", "THT_SETUP_DWH_REST_URL", "https://operator@dwh.example.invalid/api"},
|
|
{"DWH password", "THT_SETUP_DWH_REST_URL", "https://operator:password@dwh.example.invalid/api"},
|
|
{"DWH query", "THT_SETUP_DWH_REST_URL", "https://dwh.example.invalid/api?token=secret"},
|
|
{"LLM fragment", "THT_SETUP_LLM_URL", "https://llm.example.invalid/api#secret"},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
root := newProject(t, "unsafe endpoint")
|
|
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
|
t.Setenv(test.environment, test.value)
|
|
id := "rejected"
|
|
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: id, Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err == nil || !strings.Contains(err.Error(), "endpoint") {
|
|
t.Fatalf("EnsureFiles() error = %v, want endpoint rejection", err)
|
|
}
|
|
assertNoConfigurationOutput(t, root, id)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesRejectsUnsafeExistingSecretFiles(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name string
|
|
mutate func(t *testing.T, paths *secretPaths)
|
|
}{
|
|
{
|
|
name: "directory",
|
|
mutate: func(t *testing.T, paths *secretPaths) {
|
|
paths.piAuth = filepath.Dir(paths.piAuth)
|
|
},
|
|
},
|
|
{
|
|
name: "symlink",
|
|
mutate: func(t *testing.T, paths *secretPaths) {
|
|
link := paths.piAuth + ".link"
|
|
testsupport.SymlinkOrSkip(t, paths.piAuth, link)
|
|
paths.piAuth = link
|
|
},
|
|
},
|
|
{
|
|
name: "path beneath a symlinked directory",
|
|
mutate: func(t *testing.T, paths *secretPaths) {
|
|
link := filepath.Join(filepath.Dir(paths.piAuth), "parent-link")
|
|
testsupport.SymlinkOrSkip(t, filepath.Dir(paths.piAuth), link)
|
|
paths.piAuth = filepath.Join(link, filepath.Base(paths.piAuth))
|
|
},
|
|
},
|
|
{
|
|
name: "unreadable file",
|
|
mutate: func(t *testing.T, paths *secretPaths) {
|
|
if runtime.GOOS == "windows" {
|
|
t.Skip("POSIX read permissions are not portable to Windows")
|
|
}
|
|
if err := os.Chmod(paths.piAuth, 0o000); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = os.Chmod(paths.piAuth, 0o600) })
|
|
file, err := os.Open(paths.piAuth)
|
|
if err == nil {
|
|
_ = file.Close()
|
|
t.Skip("effective user can read mode 000 files")
|
|
}
|
|
},
|
|
},
|
|
{
|
|
name: "stat error",
|
|
mutate: func(t *testing.T, paths *secretPaths) {
|
|
paths.knownHosts = filepath.Join(paths.sshKey, "not-a-directory")
|
|
},
|
|
},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
root := newProject(t, "unsafe secret")
|
|
paths := newExternalSecrets(t, root)
|
|
test.mutate(t, &paths)
|
|
setNonInteractiveAnswers(t, paths)
|
|
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "rejected", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err == nil || (!strings.Contains(err.Error(), "readable regular file") && !strings.Contains(err.Error(), "could not be inspected")) {
|
|
t.Fatalf("EnsureFiles() error = %v, want unsafe secret-file rejection", err)
|
|
}
|
|
assertNoConfigurationOutput(t, root, "rejected")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestEnsureFilesRejectsUnwritableDeploymentDirectory(t *testing.T) {
|
|
if runtime.GOOS == "windows" {
|
|
t.Skip("POSIX directory write permissions are not portable to Windows")
|
|
}
|
|
root := newProject(t, "unwritable deployment")
|
|
setNonInteractiveAnswers(t, newExternalSecrets(t, root))
|
|
deploy := filepath.Join(root, "deploy")
|
|
if err := os.Chmod(deploy, 0o500); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { _ = os.Chmod(deploy, 0o700) })
|
|
_, err := EnsureFiles(Request{ProjectRoot: root, InstallationID: "rejected", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err == nil {
|
|
t.Skip("effective user can create files in a mode 0500 directory")
|
|
}
|
|
assertNoConfigurationOutput(t, root, "rejected")
|
|
}
|
|
|
|
func TestEnsureFilesIgnoresGeneratedFilesInActualLinkedGitWorktree(t *testing.T) {
|
|
if _, err := exec.LookPath("git"); err != nil {
|
|
t.Skip("git is unavailable")
|
|
}
|
|
worktree := newLinkedGitWorktree(t)
|
|
secrets := newExternalSecretsAt(t, filepath.Join(t.TempDir(), "external secrets"))
|
|
setNonInteractiveAnswers(t, secrets)
|
|
result, err := EnsureFiles(Request{ProjectRoot: worktree, InstallationID: "linked", Profile: "local", NonInteractive: true}, strings.NewReader(""), ioDiscard{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, path := range []string{result.DescriptorPath, result.EnvironmentPath} {
|
|
gitRun(t, worktree, "check-ignore", "--quiet", path)
|
|
if err := exec.Command("git", "-C", worktree, "ls-files", "--error-unmatch", "--", path).Run(); err == nil {
|
|
t.Fatalf("generated path %s was added to the Git index", path)
|
|
}
|
|
}
|
|
status := gitOutput(t, worktree, "status", "--porcelain", "--untracked-files=all")
|
|
if status != "" {
|
|
t.Fatalf("generated configuration appears in linked-worktree Git status: %q", status)
|
|
}
|
|
}
|
|
|
|
func assertNoConfigurationOutput(t *testing.T, root, id string) {
|
|
t.Helper()
|
|
directory := filepath.Join(root, "deploy", id)
|
|
for _, name := range []string{"thothii-installation.yaml", "operator.env"} {
|
|
if _, err := os.Lstat(filepath.Join(directory, name)); !errors.Is(err, os.ErrNotExist) {
|
|
t.Fatalf("unexpected configuration output %s: %v", name, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func newLinkedGitWorktree(t *testing.T) string {
|
|
t.Helper()
|
|
repository := newProject(t, "source repository")
|
|
if err := os.WriteFile(filepath.Join(repository, ".gitignore"), []byte("deploy/*/thothii-installation.yaml\ndeploy/*/operator.env\ndeploy/*/secrets/*\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
gitRun(t, repository, "init")
|
|
gitRun(t, repository, "config", "user.email", "tests@example.invalid")
|
|
gitRun(t, repository, "config", "user.name", "ThothII tests")
|
|
gitRun(t, repository, "add", ".")
|
|
gitRun(t, repository, "commit", "-m", "fixture")
|
|
worktree := filepath.Join(t.TempDir(), "linked worktree")
|
|
gitRun(t, repository, "worktree", "add", "-b", "linked-fixture", worktree)
|
|
canonical, err := filepath.EvalSymlinks(worktree)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return canonical
|
|
}
|
|
|
|
func gitRun(t *testing.T, directory string, args ...string) {
|
|
t.Helper()
|
|
command := exec.Command("git", append([]string{"-C", directory}, args...)...)
|
|
if output, err := command.CombinedOutput(); err != nil {
|
|
t.Fatalf("git %s: %v: %s", strings.Join(args, " "), err, output)
|
|
}
|
|
}
|
|
|
|
func gitOutput(t *testing.T, directory string, args ...string) string {
|
|
t.Helper()
|
|
command := exec.Command("git", append([]string{"-C", directory}, args...)...)
|
|
output, err := command.Output()
|
|
if err != nil {
|
|
t.Fatalf("git %s: %v", strings.Join(args, " "), err)
|
|
}
|
|
return string(output)
|
|
}
|
|
|
|
func newProject(t *testing.T, name string) string {
|
|
t.Helper()
|
|
root := filepath.Join(t.TempDir(), name)
|
|
for _, path := range []string{
|
|
filepath.Join(root, "deploy", "env"),
|
|
filepath.Join(root, "deploy"),
|
|
filepath.Join(root, ".git"),
|
|
filepath.Join(root, "backend"),
|
|
filepath.Join(root, "frontend"),
|
|
filepath.Join(root, "harness"),
|
|
filepath.Join(root, "tools"),
|
|
} {
|
|
if err := os.MkdirAll(path, 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
for path, contents := range map[string]string{
|
|
filepath.Join(root, "compose.yaml"): "services: {}\n",
|
|
filepath.Join(root, "deploy", "compose.local.yaml"): "services: {}\n",
|
|
filepath.Join(root, "deploy", "compose.git-ssh.yaml"): "services: {}\n",
|
|
filepath.Join(root, "deploy", "compose.git-https.yaml"): "services: {}\n",
|
|
filepath.Join(root, "deploy", "env", "local.env.example"): "tracked example\n",
|
|
} {
|
|
if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
canonical, err := filepath.EvalSymlinks(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return canonical
|
|
}
|
|
|
|
type secretPaths struct {
|
|
secrets, piAuth, sshKey, knownHosts string
|
|
}
|
|
|
|
func newExternalSecrets(t *testing.T, root string) secretPaths {
|
|
t.Helper()
|
|
return newExternalSecretsAt(t, filepath.Join(root, "external secrets"))
|
|
}
|
|
|
|
func newExternalSecretsAt(t *testing.T, directory string) secretPaths {
|
|
t.Helper()
|
|
if err := os.Mkdir(directory, 0o700); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
canonical, err := filepath.EvalSymlinks(directory)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
directory = canonical
|
|
paths := secretPaths{
|
|
secrets: filepath.Join(directory, "thothii.secrets"), piAuth: filepath.Join(directory, "pi-auth.json"),
|
|
sshKey: filepath.Join(directory, "git-key"), knownHosts: filepath.Join(directory, "known-hosts"),
|
|
}
|
|
for path, contents := range map[string]string{
|
|
paths.secrets: "super-secret-value\n", paths.piAuth: "pi-secret-value\n", paths.sshKey: "private-key-value\n", paths.knownHosts: "git.example.invalid ssh-ed25519 AAAA\n",
|
|
} {
|
|
if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
return paths
|
|
}
|
|
|
|
func setNonInteractiveAnswers(t *testing.T, paths secretPaths) {
|
|
t.Helper()
|
|
for name, value := range map[string]string{
|
|
"THT_SETUP_WORKSPACE_REMOTE": "git@git.example.invalid:team/workspaces.git",
|
|
"THT_SETUP_WORKSPACE_BRANCH": "main",
|
|
"THT_SETUP_WORKSPACE_ACCESS": "ssh",
|
|
"THT_SETUP_SECRETS_FILE": paths.secrets,
|
|
"THT_SETUP_PI_AUTH_FILE": paths.piAuth,
|
|
"THT_SETUP_GIT_SSH_KEY_FILE": paths.sshKey,
|
|
"THT_SETUP_GIT_KNOWN_HOSTS_FILE": paths.knownHosts,
|
|
"THT_SETUP_DWH_REST_URL": "https://dwh.example.invalid",
|
|
"THT_SETUP_LLM_URL": "https://llm.example.invalid",
|
|
} {
|
|
t.Setenv(name, value)
|
|
}
|
|
}
|
|
|
|
type ioDiscard struct{}
|
|
|
|
func (ioDiscard) Write(value []byte) (int, error) { return len(value), nil }
|