WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

Bounded test succeeded; native RandomX miner accepted one block

Browse Source
This commit is contained in:
eric
2026-10-22 21:25:39 -04:00
parent 176d1927a8
commit bd3d36a7e1
12 changed files with 607 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/postgres-transport.test.ts
+20
View File
@@ -3,6 +3,7 @@ import assert from 'node:assert/strict';
import { mkdtemp, writeFile, chmod, rm } from 'node:fs/promises';
import { join } from 'node:path';
import { tmpdir } from 'node:os';
import { execFileSync } from 'node:child_process';
import { postgresConfig } from '../server/market/postgres-config.ts';
test('PostgreSQL verified TLS remains the default and cannot be downgraded through URL options', async t => {
@@ -27,6 +28,25 @@ test('PostgreSQL verified TLS remains the default and cannot be downgraded throu
await assert.rejects(postgresConfig(env), /configuration/);
});
test('PostgreSQL public CA is validated separately from owner-only credential URL files', async t => {
if (process.platform === 'win32') return;
const dir = await mkdtemp(join(tmpdir(), 'wikideck-ca-'));
t.after(() => rm(dir, { recursive: true, force: true }));
const urlFile = join(dir, 'connection'), caFile = join(dir, 'ca.crt'), keyFile = join(dir, 'ca.key');
await writeFile(urlFile, 'postgresql://fixture:fixture-only@database/custody', { mode: 0o600 });
execFileSync('openssl', ['req', '-x509', '-newkey', 'rsa:2048', '-sha256', '-nodes', '-days', '2',
'-subj', '/CN=fixture CA', '-keyout', keyFile, '-out', caFile], { stdio: 'ignore' });
await chmod(urlFile, 0o600); await chmod(caFile, 0o644); await chmod(keyFile, 0o600);
const config = await postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: urlFile, WIKIDECK_CUSTODY_PG_CA_FILE: caFile });
assert.equal((config.ssl as { rejectUnauthorized: boolean }).rejectUnauthorized, true);
assert.ok((config.ssl as { ca: string }).ca.includes('BEGIN CERTIFICATE'));
await chmod(urlFile, 0o644);
await assert.rejects(postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: urlFile, WIKIDECK_CUSTODY_PG_CA_FILE: caFile }), /configuration/);
await chmod(urlFile, 0o600);
await writeFile(caFile, 'not a certificate', { mode: 0o644 }); await chmod(caFile, 0o644);
await assert.rejects(postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: urlFile, WIKIDECK_CUSTODY_PG_CA_FILE: caFile }), /configuration/);
});
test('infrastructure-managed transport requires exact opt-in and rejects mixed TLS/test configuration', async t => {
const dir = await mkdtemp(join(tmpdir(), 'wikideck-infrastructure-'));
t.after(() => rm(dir, { recursive: true, force: true }));