44 lines
2.0 KiB
Python
44 lines
2.0 KiB
Python
import json
|
|
from pathlib import Path
|
|
import pytest
|
|
from aios_baseline.cli import initialize_validation, load_configuration, build_service
|
|
|
|
|
|
def test_generated_validation_configuration_is_usable_and_not_production(tmp_path):
|
|
root=tmp_path/'validation'
|
|
initialize_validation(root,unit='sample.service')
|
|
config,tokens=load_configuration(root/'server.json')
|
|
assert config['profile']=='isolated-validation'
|
|
assert len(tokens)==2
|
|
assert not (root/'state').exists() # preflight is read only
|
|
service=build_service(config)
|
|
assert service.jobs.store is not None
|
|
assert (root/'owner-private.pem').stat().st_mode & 0o077 == 0
|
|
raw=json.loads((root/'server.json').read_text())
|
|
raw['profile']='production'
|
|
(root/'server.json').write_text(json.dumps(raw))
|
|
with pytest.raises(ValueError,match='PROFILE'): load_configuration(root/'server.json')
|
|
|
|
|
|
def test_config_cannot_register_duplicate_tokens_or_expand_secret_variables(tmp_path,monkeypatch):
|
|
root=tmp_path/'validation'
|
|
initialize_validation(root,unit='sample.service')
|
|
raw=json.loads((root/'server.json').read_text())
|
|
raw['identities'][1]['token_file']=raw['identities'][0]['token_file']
|
|
(root/'server.json').write_text(json.dumps(raw))
|
|
with pytest.raises(ValueError,match='TOKEN'): load_configuration(root/'server.json')
|
|
raw['identities'][1]['token_file']='$HOME/token'
|
|
(root/'server.json').write_text(json.dumps(raw))
|
|
with pytest.raises(ValueError,match='PATH'): load_configuration(root/'server.json')
|
|
|
|
|
|
def test_config_rejects_symlink_public_config_and_untrusted_state_marker(tmp_path):
|
|
root=tmp_path/'validation'
|
|
initialize_validation(root,unit='sample.service')
|
|
alias=tmp_path/'alias.json';alias.symlink_to(root/'server.json')
|
|
with pytest.raises(OSError): load_configuration(alias)
|
|
config,_=load_configuration(root/'server.json')
|
|
state=root/'state';state.mkdir(mode=0o700)
|
|
(state/'ISOLATED_VALIDATION_AUTHORITY').write_text('different-authority\n')
|
|
with pytest.raises(ValueError,match='MARKER'): build_service(config)
|