forked from lunanting/cangku
60 lines
2.9 KiB
JavaScript
60 lines
2.9 KiB
JavaScript
'use strict';
|
|
|
|
const fs = require('fs');
|
|
const os = require('os');
|
|
const path = require('path');
|
|
const test = require('node:test');
|
|
const assert = require('node:assert/strict');
|
|
|
|
const {
|
|
getSecretBackupCandidatePaths,
|
|
getSecretBackupPath,
|
|
readSecretBackup,
|
|
writeSecretBackup,
|
|
} = require('../src/services/resilientSecretStore');
|
|
|
|
test('secret backup survives outside the repository with owner-only permissions', async (context) => {
|
|
const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'shujuku3-secret-test-'));
|
|
const filePath = path.join(directory, 'secrets.json');
|
|
const previousPath = process.env.SHUJUKU3_SECRET_STORE_PATH;
|
|
const previousLegacyPath = process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
|
|
process.env.SHUJUKU3_SECRET_STORE_PATH = filePath;
|
|
process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = path.join(directory, 'legacy.json');
|
|
context.after(() => {
|
|
if (previousPath === undefined) delete process.env.SHUJUKU3_SECRET_STORE_PATH;
|
|
else process.env.SHUJUKU3_SECRET_STORE_PATH = previousPath;
|
|
if (previousLegacyPath === undefined) delete process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
|
|
else process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = previousLegacyPath;
|
|
fs.rmSync(directory, { recursive: true, force: true });
|
|
});
|
|
|
|
await writeSecretBackup('selection_similar_products_api_key', 'durable-test-secret');
|
|
|
|
assert.equal(getSecretBackupPath(), filePath);
|
|
assert.deepEqual(getSecretBackupCandidatePaths(), [filePath, path.join(directory, 'legacy.json')]);
|
|
assert.equal(readSecretBackup('selection_similar_products_api_key'), 'durable-test-secret');
|
|
assert.equal(fs.statSync(filePath).mode & 0o777, 0o600);
|
|
});
|
|
|
|
test('secret reader recovers from the legacy home backup when the shared file is absent', async (context) => {
|
|
const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'shujuku3-secret-legacy-test-'));
|
|
const primaryPath = path.join(directory, 'shared', 'secrets.json');
|
|
const legacyPath = path.join(directory, 'legacy', 'secrets.json');
|
|
const previousPath = process.env.SHUJUKU3_SECRET_STORE_PATH;
|
|
const previousLegacyPath = process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
|
|
context.after(() => {
|
|
if (previousPath === undefined) delete process.env.SHUJUKU3_SECRET_STORE_PATH;
|
|
else process.env.SHUJUKU3_SECRET_STORE_PATH = previousPath;
|
|
if (previousLegacyPath === undefined) delete process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
|
|
else process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = previousLegacyPath;
|
|
fs.rmSync(directory, { recursive: true, force: true });
|
|
});
|
|
|
|
process.env.SHUJUKU3_SECRET_STORE_PATH = legacyPath;
|
|
process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = legacyPath;
|
|
await writeSecretBackup('selection_similar_products_api_key', 'legacy-durable-secret');
|
|
|
|
process.env.SHUJUKU3_SECRET_STORE_PATH = primaryPath;
|
|
assert.equal(readSecretBackup('selection_similar_products_api_key'), 'legacy-durable-secret');
|
|
});
|