89 lines
2.6 KiB
Shell
89 lines
2.6 KiB
Shell
# Cases for ./grafana-secret-key.nix. Each case sets up the store's leaf, the
|
|
# seed file and the stub's behaviour, runs `grafana_secret_key` the way the
|
|
# unit's script does, and compares its status, the key it hands over and what
|
|
# the store holds afterwards.
|
|
set -uo pipefail
|
|
|
|
failures=0
|
|
leaf=secret/swarm/services/t/secret-key
|
|
|
|
# setup <description>
|
|
setup() {
|
|
case=$1
|
|
dir=$(mktemp -d)
|
|
mkdir "$dir/kv"
|
|
export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
|
|
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE
|
|
: >"$FAKE_BAO_LOG"
|
|
seed=$dir/secret_key
|
|
stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
|
|
}
|
|
|
|
mint() {
|
|
printf 'minted-key\n'
|
|
}
|
|
|
|
# expect <status> <key> <what the store holds, "" for nothing>
|
|
expect() {
|
|
(
|
|
PATH="$FAKE_BAO_BIN:$PATH"
|
|
unset BAO_TOKEN
|
|
# shellcheck source=/dev/null
|
|
. "$HELPER"
|
|
rc=0
|
|
grafana_secret_key "$leaf" "$seed" mint >/dev/null 2>"$dir/err" || rc=$?
|
|
printf '%s' "$rc" >"$dir/rc"
|
|
printf '%s' "$GRAFANA_KEY" >"$dir/key"
|
|
)
|
|
held=$(cat "$stored" 2>/dev/null)
|
|
if [ "$(cat "$dir/rc")" != "$1" ]; then fail "exited $(cat "$dir/rc"), wanted $1: $(cat "$dir/err")"; fi
|
|
if [ "$(cat "$dir/key")" != "$2" ]; then fail "handed over '$(cat "$dir/key")', wanted '$2'"; fi
|
|
if [ "$held" != "$3" ]; then fail "the store holds '$held', wanted '$3'"; fi
|
|
}
|
|
|
|
fail() {
|
|
echo "FAILED: $case: $*" >&2
|
|
failures=$((failures + 1))
|
|
}
|
|
|
|
setup "an empty store takes the seed's key"
|
|
printf 'seed-key\n' >"$seed"
|
|
expect 0 seed-key seed-key
|
|
grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG" || fail "no create-only write"
|
|
[ -e "$seed" ] || fail "the seed file was removed"
|
|
|
|
setup "a store that holds a key wins over the seed, and is not written"
|
|
printf 'seed-key\n' >"$seed"
|
|
printf 'store-key' >"$stored"
|
|
expect 0 store-key store-key
|
|
! grep -q '^kv put' "$FAKE_BAO_LOG" || fail "wrote to the store"
|
|
|
|
setup "with no seed and an empty store, a key is minted and stored"
|
|
expect 0 minted-key minted-key
|
|
|
|
setup "a store that refuses the login mints nothing, with or without a seed"
|
|
export FAKE_BAO_LOGIN_RC=1
|
|
expect 1 "" ""
|
|
printf 'seed-key\n' >"$seed"
|
|
expect 1 "" ""
|
|
|
|
setup "a store that refuses the read stores and hands over nothing"
|
|
printf 'seed-key\n' >"$seed"
|
|
export FAKE_BAO_DENY_READ=1
|
|
expect 1 "" seed-key
|
|
|
|
setup "a store that refuses the write hands over nothing"
|
|
export FAKE_BAO_DENY_WRITE=1
|
|
expect 1 "" ""
|
|
|
|
setup "a store that holds an empty value hands over nothing"
|
|
: >"$stored"
|
|
expect 1 "" ""
|
|
|
|
setup "a lost race takes the winner's key"
|
|
printf 'seed-key\n' >"$seed"
|
|
export FAKE_BAO_RACE=other-key
|
|
expect 0 other-key other-key
|
|
|
|
echo "$failures failures"
|
|
[ "$failures" = 0 ]
|