31 lines
1.8 KiB
TypeScript
Executable File
31 lines
1.8 KiB
TypeScript
Executable File
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { readFile } from 'node:fs/promises';
|
|
|
|
const read = (path: string) => readFile(new URL(`../${path}`, import.meta.url), 'utf8');
|
|
test('persistent custody deployment remains separate, sandbox-only and password authenticated without a database host port', async () => {
|
|
const compose = (await read('compose.custody.yaml')).replaceAll('\r\n', '\n');
|
|
assert.match(compose, /WIKIDECK_CUSTODY_MODE: sandbox/);
|
|
assert.match(compose, /WIKIDECK_CUSTODY_STORAGE: postgres/);
|
|
assert.match(compose, /WIKIDECK_PAYMENT_MODE: mock/);
|
|
assert.match(compose, /financial: \{internal: true\}/);
|
|
assert.match(compose, /POSTGRES_PASSWORD_FILE:/);
|
|
assert.doesNotMatch(compose, /POSTGRES_HOST_AUTH_METHOD|LOCAL_TEST|5432:5432|tmpfs:.*postgresql/);
|
|
const database = compose.split(' database:')[1].split(' migrate:')[0];
|
|
assert.doesNotMatch(database, /ports:/);
|
|
assert.match(database, /pg-data:\/var\/lib\/postgresql\/data/);
|
|
const application = compose.split(' wikideck:')[1].split('networks:\n financial:')[0];
|
|
assert.match(application, /pg-runtime:\/secrets\/runtime:ro/);
|
|
assert.doesNotMatch(application, /pg-admin:|pg-owner:|pg-tls:/);
|
|
});
|
|
test('database HBA requires TLS+SCRAM over TCP and provisioning refuses partial credential replacement', async () => {
|
|
const hba = await read('deploy/postgres/pg_hba.conf'), setup = await read('deploy/postgres/setup.mjs');
|
|
assert.match(hba, /hostnossl all all all reject/);
|
|
assert.match(hba, /hostssl wikideck_custody custody_runtime all scram-sha-256/);
|
|
assert.doesNotMatch(hba, /^host.*trust/m);
|
|
assert.match(setup, /randomBytes\(32\)/);
|
|
assert.match(setup, /Partial secret initialization/);
|
|
assert.match(setup, /subjectAltName=DNS:database/);
|
|
assert.match(setup, /-checkend/);
|
|
});
|