111 lines
5.3 KiB
Bash
Executable File
111 lines
5.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)
|
|
verify="$root/scripts/verify-dwh-auth-docs.sh"
|
|
temp_root=
|
|
|
|
report_pass() {
|
|
printf 'case=%s status=PASS\n' "$1"
|
|
}
|
|
|
|
report_fail() {
|
|
printf 'case=%s status=FAIL\n' "$1" >&2
|
|
exit 1
|
|
}
|
|
|
|
cleanup() {
|
|
if [[ "$temp_root" == /tmp/thothii-dwh-auth-docs.* && -d "$temp_root" ]]; then
|
|
rm -rf -- "$temp_root"
|
|
fi
|
|
}
|
|
trap cleanup EXIT
|
|
|
|
[[ -x "$verify" ]] || report_fail verifier_missing
|
|
|
|
temp_root=$(mktemp -d /tmp/thothii-dwh-auth-docs.XXXXXXXX) || report_fail fixture_root
|
|
fixture_root="$temp_root/fixture"
|
|
mkdir -p "$fixture_root/docs/install" "$fixture_root/docs/operations" \
|
|
"$fixture_root/docs/testing/evidence" "$fixture_root/scripts" "$fixture_root/deploy/psd"
|
|
|
|
for relative in \
|
|
docs/install/dwh-auth-server.md \
|
|
docs/install/dwh-auth-client-enrollment.md \
|
|
docs/install/dwh-auth-tls.md \
|
|
docs/operations/psd-dwh-auth-rollout.md \
|
|
docs/testing/dwh-auth-manual-acceptance.md \
|
|
docs/testing/evidence/psd-dwh-auth-rollout-report-template.md \
|
|
docs/install/local-workspace-registry.md \
|
|
docs/install/server-workspace-registry.md \
|
|
docs/install/psd-workspace-setup.md \
|
|
docs/guida-utente.md \
|
|
docs/index.md \
|
|
mkdocs.yml; do
|
|
mkdir -p "$fixture_root/$(dirname "$relative")"
|
|
cp "$root/$relative" "$fixture_root/$relative"
|
|
done
|
|
cp -a "$root/docs/." "$fixture_root/docs/"
|
|
cp "$root/deploy/psd/workspace-bindings.env.example" "$fixture_root/deploy/psd/workspace-bindings.env.example"
|
|
|
|
"$verify" --root "$fixture_root" || report_fail positive_source
|
|
report_pass positive_source
|
|
|
|
expect_rejected() {
|
|
local name=$1 target=$2 addition=$3
|
|
local case_root="$temp_root/$name"
|
|
cp -a "$fixture_root" "$case_root"
|
|
printf '\n%s\n' "$addition" >>"$case_root/$target"
|
|
if "$verify" --root "$case_root" >/dev/null 2>&1; then
|
|
report_fail "$name"
|
|
fi
|
|
report_pass "$name"
|
|
}
|
|
|
|
# Build synthetic only-in-fixture text at runtime: it is never a provisioned credential.
|
|
fake_key="thtdwh_v1.$(printf 'A%.0s' {1..16}).$(printf 'A%.0s' {1..43})"
|
|
fake_digest="$(printf 'A%.0s' {1..43})"
|
|
|
|
expect_rejected credential_literal docs/install/dwh-auth-client-enrollment.md "$fake_key"
|
|
expect_rejected opaque_legacy_header_literal docs/install/dwh-auth-client-enrollment.md "curl --header 'X-API-Key: opaque-legacy-fixture' https://example.invalid/dwh/rpc/ping"
|
|
expect_rejected credential_digest_literal docs/testing/evidence/psd-dwh-auth-rollout-report-template.md "\"secret_sha256\": \"$fake_digest\""
|
|
expect_rejected curl_insecure docs/install/dwh-auth-tls.md 'curl -k https://example.invalid/dwh/rpc/ping'
|
|
expect_rejected tls_disabled docs/install/dwh-auth-tls.md 'verify_tls=false'
|
|
expect_rejected secret_in_environment docs/install/dwh-auth-client-enrollment.md "export THT_WS_PSD_CLINICAL_DWH_API_KEY=$fake_key"
|
|
expect_rejected secret_in_argv docs/install/dwh-auth-client-enrollment.md "curl -H 'X-API-Key: $fake_key' https://example.invalid/dwh/rpc/ping"
|
|
expect_rejected world_readable_secret docs/install/dwh-auth-server.md 'chmod 0644 /root/dwh-auth-provision/client.key'
|
|
expect_rejected sudo_raw_nginx_capture docs/operations/psd-dwh-auth-rollout.md 'sudo nginx -T > /tmp/nginx-full.conf'
|
|
expect_rejected raw_diff_capture docs/operations/psd-dwh-auth-rollout.md 'sudo diff -u /etc/nginx/sites-available/policlinicosandonato /root/backup.conf'
|
|
expect_rejected git_raw_diff_capture docs/operations/psd-dwh-auth-rollout.md 'git diff --no-index /root/old.conf /root/new.conf'
|
|
expect_rejected raw_nginx_capture docs/operations/psd-dwh-auth-rollout.md 'nginx -T > /tmp/nginx-full.conf'
|
|
expect_rejected compose_coupling docs/install/dwh-auth-server.md 'docker compose up dwh-auth'
|
|
|
|
expect_replacement_rejected() {
|
|
local name=$1 target=$2 needle=$3 replacement=$4
|
|
local case_root="$temp_root/$name"
|
|
cp -a "$fixture_root" "$case_root"
|
|
[[ $(grep -Foc -- "$needle" "$case_root/$target") -eq 1 ]] || report_fail "${name}_fixture"
|
|
sed -i "s~$needle~$replacement~" "$case_root/$target"
|
|
if "$verify" --root "$case_root" >/dev/null 2>&1; then report_fail "$name"; fi
|
|
report_pass "$name"
|
|
}
|
|
|
|
|
|
expect_global_replacement_rejected() {
|
|
local name=$1 target=$2 needle=$3 replacement=$4
|
|
local case_root="$temp_root/$name"
|
|
cp -a "$fixture_root" "$case_root"
|
|
[[ $(grep -Foc -- "$needle" "$case_root/$target") -gt 0 ]] || report_fail "${name}_fixture"
|
|
sed -i "s~$needle~$replacement~g" "$case_root/$target"
|
|
if "$verify" --root "$case_root" >/dev/null 2>&1; then report_fail "$name"; fi
|
|
report_pass "$name"
|
|
}
|
|
|
|
expect_replacement_rejected missing_exact_gui_label docs/install/dwh-auth-client-enrollment.md "Validate workspace source" "Validate workspace"
|
|
expect_replacement_rejected server_transport_contradiction docs/operations/psd-dwh-auth-rollout.md 'server PSD: `postgres_direct` read-only' 'server PSD: `rest_api` read-only'
|
|
expect_replacement_rejected missing_mac_local_marker deploy/psd/workspace-bindings.env.example "Mac/local/remota" "server PSD"
|
|
expect_replacement_rejected missing_private_ca docs/install/psd-workspace-setup.md "TLS_CA_FILE" "TLS_CA_REMOVED"
|
|
expect_global_replacement_rejected missing_socket_path docs/install/dwh-auth-server.md "/run/dwh-auth/verify.sock" "/run/dwh-auth/other.sock"
|
|
expect_replacement_rejected rest_transport_flag deploy/psd/workspace-bindings.env.example "THT_WS_PSD_CLINICAL_DWH_TRANSPORT=rest_api" "THT_WS_PSD_CLINICAL_DWH_TRANSPORT=postgres_direct"
|
|
|
|
report_pass summary
|