47 lines
1.9 KiB
JavaScript
47 lines
1.9 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { execFile } from 'node:child_process';
|
|
import fs from 'node:fs/promises';
|
|
import os from 'node:os';
|
|
import path from 'node:path';
|
|
import { promisify } from 'node:util';
|
|
|
|
const execFileAsync = promisify(execFile);
|
|
|
|
test('Git askpass reads HTTPS credentials from protected files instead of process env', async () => {
|
|
const authDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-git-auth-'));
|
|
try {
|
|
await fs.writeFile(path.join(authDir, 'https-username'), 'deploy-user', { mode: 0o600 });
|
|
await fs.writeFile(path.join(authDir, 'https-token'), 'deploy-token', { mode: 0o600 });
|
|
|
|
const username = await execFileAsync('./runtime/git-askpass.sh', ['Username'], {
|
|
env: { SAMMO_GIT_AUTH_DIR: authDir },
|
|
});
|
|
const token = await execFileAsync('./runtime/git-askpass.sh', ['Password'], {
|
|
env: { SAMMO_GIT_AUTH_DIR: authDir },
|
|
});
|
|
|
|
assert.equal(username.stdout, 'deploy-user');
|
|
assert.equal(token.stdout, 'deploy-token');
|
|
} finally {
|
|
await fs.rm(authDir, { recursive: true });
|
|
}
|
|
});
|
|
|
|
test('runtime entrypoint removes raw repository secrets before launching PM2', async () => {
|
|
const entrypoint = await fs.readFile(new URL('../runtime/entrypoint.sh', import.meta.url), 'utf8');
|
|
const pm2Start = entrypoint.indexOf('"$pm2_bin" start');
|
|
const httpsUnset = entrypoint.indexOf('unset CORE_REPOSITORY_USERNAME CORE_REPOSITORY_TOKEN');
|
|
const sshUnset = entrypoint.indexOf('unset CORE_SSH_PRIVATE_KEY_BASE64 CORE_SSH_KNOWN_HOSTS_BASE64');
|
|
|
|
assert.ok(pm2Start > 0);
|
|
assert.ok(httpsUnset > 0 && httpsUnset < pm2Start);
|
|
assert.ok(sshUnset > 0 && sshUnset < pm2Start);
|
|
});
|
|
|
|
test('Caddy runtime logs remove the custom Gateway session header', async () => {
|
|
const caddyfile = await fs.readFile(new URL('../caddy/Caddyfile', import.meta.url), 'utf8');
|
|
|
|
assert.match(caddyfile, /log\s*\{[\s\S]*format filter\s*\{[\s\S]*request>headers>X-Session-Token delete/);
|
|
});
|