68 lines
2.8 KiB
Nix
68 lines
2.8 KiB
Nix
# `checks.script-test-grafana-secret-key` — runs
|
|
# ../host-modules/lib/grafana-secret-key.nix's `grafana_secret_key` against a
|
|
# stub `bao` that keeps its leaves in files. The cases are in
|
|
# ./grafana-secret-key.sh.
|
|
#
|
|
# What runs is the rendered helper, sourced as the unit's script includes it.
|
|
{
|
|
pkgs,
|
|
...
|
|
}:
|
|
let
|
|
# `login` answers from `FAKE_BAO_LOGIN_RC`. `kv get` and `kv put -cas=0` act
|
|
# on a file per leaf under `FAKE_BAO_KV`, and answer as bao does: a missing
|
|
# leaf is "No value found at <path>" on stderr, status 2. `FAKE_BAO_DENY_READ`
|
|
# and `FAKE_BAO_DENY_WRITE` answer 403 as a policy that grants neither does.
|
|
# `FAKE_BAO_RACE` has another run create the leaf with that value between
|
|
# this one's read and its write. Every call is logged without the value
|
|
# `put` reads from stdin.
|
|
fakeBao = pkgs.writeShellScriptBin "bao" ''
|
|
echo "$*" >> "$FAKE_BAO_LOG"
|
|
case "$1 $2" in
|
|
"login -method=cert")
|
|
[ "$FAKE_BAO_LOGIN_RC" = 0 ] || { echo "fake bao: certificate refused" >&2; exit 2; }
|
|
printf 's.fake'
|
|
;;
|
|
"kv get")
|
|
[ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
|
|
[ "$3" = -field=value ] || { echo "fake bao: get without -field=value" >&2; exit 95; }
|
|
leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
|
|
[ -z "''${FAKE_BAO_DENY_READ-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
|
|
if [ -n "''${FAKE_BAO_RACE-}" ] && [ ! -e "$FAKE_BAO_KV/.raced" ]; then
|
|
touch "$FAKE_BAO_KV/.raced"
|
|
printf '%s' "$FAKE_BAO_RACE" > "$leaf"
|
|
echo "No value found at secret/data/x" >&2
|
|
exit 2
|
|
fi
|
|
[ -e "$leaf" ] || { echo "No value found at secret/data/x" >&2; exit 2; }
|
|
cat "$leaf"
|
|
echo
|
|
;;
|
|
"kv put")
|
|
[ "''${BAO_TOKEN-}" = s.fake ] || { echo "fake bao: kv without the login's token" >&2; exit 97; }
|
|
[ "$3" = -cas=0 ] || { echo "fake bao: put without -cas=0" >&2; exit 96; }
|
|
[ "$5" = value=- ] || { echo "fake bao: put with the value as an argument" >&2; exit 94; }
|
|
leaf="$FAKE_BAO_KV/$(printf '%s' "$4" | tr / _)"
|
|
[ -z "''${FAKE_BAO_DENY_WRITE-}" ] || { echo "fake bao: permission denied" >&2; exit 2; }
|
|
[ ! -e "$leaf" ] || { echo "fake bao: check-and-set parameter did not match" >&2; exit 2; }
|
|
cat > "$leaf"
|
|
;;
|
|
*)
|
|
echo "fake bao: unexpected call: $*" >&2
|
|
exit 98
|
|
;;
|
|
esac
|
|
'';
|
|
in
|
|
pkgs.runCommand "hyperhive-script-test-grafana-secret-key"
|
|
{
|
|
HELPER = pkgs.writeText "grafana-secret-key.sh" (
|
|
import ../host-modules/lib/grafana-secret-key.nix { }
|
|
);
|
|
FAKE_BAO_BIN = "${fakeBao}/bin";
|
|
nativeBuildInputs = [ pkgs.coreutils ];
|
|
}
|
|
''
|
|
${pkgs.bash}/bin/bash ${./grafana-secret-key.sh}
|
|
touch "$out"
|
|
''
|