mirror of
https://github.com/cozystack/cozystack.git
synced 2026-10-23 03:27:50 +09:00
Myasnikov Daniil
cc942fed68
The shell translator rewrites test bodies and loses Bats reporting. The unit lane needs complete TAP results and JUnit reports without changing how live-cluster suites run. Sourced production helpers still need a dash pass, and unit test bodies need nounset without exporting shell options into subprocesses. Assisted-by: LLM Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>
53 lines
2.4 KiB
Bash
53 lines
2.4 KiB
Bash
#!/usr/bin/env bats
|
|
# Unit test: the template-side allowlist for postgresql.sharedPreloadLibraries
|
|
# in packages/apps/postgres/templates/db.yaml.
|
|
#
|
|
# The enum in values.schema.json rejects a bad name before rendering starts, and
|
|
# helm-unittest always validates the schema, so the chart's own suite never
|
|
# reaches the template check behind it. Rendering with --skip-schema-validation
|
|
# is the only way to exercise that backstop, and it is the case the backstop
|
|
# exists for.
|
|
|
|
load test_helper
|
|
|
|
REPO_ROOT="$(cd "$(dirname "${BATS_TEST_FILENAME:-$0}")/.." && pwd)"
|
|
CHART="$REPO_ROOT/packages/apps/postgres"
|
|
|
|
render_without_schema() {
|
|
helm template pg "$CHART" --namespace tenant-test --skip-schema-validation \
|
|
--set _cluster.cluster-domain=cozy.local \
|
|
--set "postgresql.sharedPreloadLibraries[0]=$1" 2>&1
|
|
}
|
|
|
|
@test "an allowed name renders when the schema is skipped" {
|
|
# Without this, the rejections below could pass on an unrelated render error.
|
|
out=$(render_without_schema pg_stat_statements) || { echo "$out" >&2; return 1; }
|
|
printf '%s\n' "$out" | grep -q 'shared_preload_libraries:'
|
|
}
|
|
|
|
@test "the template rejects a name outside the allowlist when the schema is skipped" {
|
|
if out=$(render_without_schema pg_cron); then
|
|
echo "render succeeded with pg_cron preloaded" >&2
|
|
return 1
|
|
fi
|
|
printf '%s\n' "$out" | grep -qF 'SECURITY: shared preload library "pg_cron" is not allowed.'
|
|
}
|
|
|
|
@test "the template rejects a library path when the schema is skipped" {
|
|
if out=$(render_without_schema /var/lib/postgresql/data/pgdata/evil.so); then
|
|
echo "render succeeded with a library path preloaded" >&2
|
|
return 1
|
|
fi
|
|
printf '%s\n' "$out" | grep -qF 'SECURITY: shared preload library "/var/lib/postgresql/data/pgdata/evil.so" is not allowed.'
|
|
}
|
|
|
|
@test "the template allowlist matches the schema enum" {
|
|
# The template names its list in the rejection message; the two lists drifting
|
|
# apart would leave one guard accepting what the other refuses.
|
|
out=$(render_without_schema pg_cron) && return 1
|
|
template=$(printf '%s\n' "$out" | sed -n 's/.* Allowed: \([^.]*\)\..*/\1/p' | tr -d ' ' | tr ',' '\n' | sort)
|
|
schema=$(jq -r '.properties.postgresql.properties.sharedPreloadLibraries.items.enum[]' "$CHART/values.schema.json" | sort)
|
|
[ -n "$template" ] || { echo "no allowlist found in: $out" >&2; return 1; }
|
|
[ "$template" = "$schema" ] || { printf 'template:\n%s\nschema:\n%s\n' "$template" "$schema" >&2; return 1; }
|
|
}
|