6c4a459773
`checks.script-test-nats-render-config` runs the queue server's `ExecStartPre` render against a scratch runtime directory: a fetched key lands in `auth_callout.xkey` and the wrapper includes the fragment, and a missing or malformed key file fails the start and writes no config. module-eval only sees the render as a store path, so dropping `xkey` from the template, or its substitution, passed every check while the server would have run unsealed.
60 lines
1.9 KiB
Shell
60 lines
1.9 KiB
Shell
# Cases for ./nats-render-config.nix. Each case gets a fresh runtime directory,
|
|
# runs the rendered script against it, and asserts on the exit code and the
|
|
# config files left behind.
|
|
set -uo pipefail
|
|
|
|
failures=0
|
|
count=0
|
|
|
|
fail() {
|
|
echo "FAILED: $case: $*" >&2
|
|
failures=$((failures + 1))
|
|
}
|
|
|
|
# The shape the script checks for, X and 55 base32 characters.
|
|
key=XAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
|
|
|
|
setup() {
|
|
case=$1
|
|
dir=$(mktemp -d)
|
|
rt=$dir/rt
|
|
mkdir "$rt"
|
|
if ! sed "s|^d=.*|d=$rt|" "$RENDER" >"$dir/render"; then
|
|
echo "cannot read the rendered script $RENDER" >&2
|
|
exit 1
|
|
fi
|
|
chmod +x "$dir/render"
|
|
if ! grep -qxF "d=$rt" "$dir/render"; then fail "the rewrite did not reach the script's runtime directory"; fi
|
|
}
|
|
|
|
go() {
|
|
count=$((count + 1))
|
|
"$dir/render" >"$dir/out" 2>"$dir/err"
|
|
rc=$?
|
|
}
|
|
|
|
setup "a fetched key is rendered into auth_callout.xkey, and the server's config includes it"
|
|
printf '%s' "$key" >"$rt/callout-xkey.pub"
|
|
go
|
|
if [ "$rc" -ne 0 ]; then fail "exit $rc: $(cat "$dir/err")"; fi
|
|
if ! jq -e --arg k "$key" '.authorization.auth_callout.xkey == $k' "$rt/callout.conf" >/dev/null; then
|
|
fail "callout.conf does not carry the key as auth_callout.xkey"
|
|
fi
|
|
if ! grep -qxF 'include "callout.conf"' "$rt/nats.conf"; then fail "nats.conf does not include callout.conf"; fi
|
|
|
|
setup "with no key file the start fails and writes no config"
|
|
go
|
|
if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
|
|
if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
|
|
|
|
setup "a file that is not a public xkey fails the start and writes no config"
|
|
printf '%s' "not-a-key" >"$rt/callout-xkey.pub"
|
|
go
|
|
if [ "$rc" -eq 0 ]; then fail "exited 0"; fi
|
|
if [ -e "$rt/callout.conf" ] || [ -e "$rt/nats.conf" ]; then fail "a config was written"; fi
|
|
|
|
if [ "$failures" -ne 0 ]; then
|
|
echo "script-test-nats-render-config: $failures of $count cases broke" >&2
|
|
exit 1
|
|
fi
|
|
echo "$count cases hold in script-test-nats-render-config"
|