Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

2026-09-30 09:23:17 +00:00
1 parent 7082ab955a
commit 848f0d8f8a
@@ -0,0 +1,109 @@
+#!/usr/bin/env sh
+set -eu
+
+ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
+HELPER="$ROOT/scripts/modelforge_scheduled_backup.sh"
+TEMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TEMP_DIR"' EXIT HUP INT TERM
+mkdir -p "$TEMP_DIR/bin"
+
+cat >"$TEMP_DIR/bin/curl" <<'CURL'
+#!/usr/bin/env sh
+set -eu
+expected="${MODELFORGE_TEST_EXPECTED_KEY:?test did not provide an expected credential}"
+found=false
+for argument do
+  if [ "$argument" = "X-ModelForge-Admin-Token: $expected" ]; then
+    found=true
+  fi
+done
+if [ "$found" != true ]; then
+  printf '%s\n' 'scheduled backup sent the wrong admin credential' >&2
+  exit 97
+fi
+
+case " $* " in
+  *"/verify "*)
+    printf '%s\n' verify >>"$MODELFORGE_TEST_CURL_CALLS"
+    printf '%s' '{"state":"VERIFIED"}'
+    ;;
+  *"/retention/run "*)
+    printf '%s\n' retention >>"$MODELFORGE_TEST_CURL_CALLS"
+    ;;
+  *"/recovery/backups "*)
+    printf '%s\n' create >>"$MODELFORGE_TEST_CURL_CALLS"
+    printf '%s' '{"id":"00000000-0000-0000-0000-000000000001","state":"CREATED"}'
+    ;;
+  *)
+    printf '%s\n' 'scheduled backup sent an unexpected request' >&2
+    exit 98
+    ;;
+esac
+CURL
+chmod +x "$TEMP_DIR/bin/curl"
+
+assert_calls() {
+  expected_calls="$1"
+  actual_calls="$(cat "$TEMP_DIR/calls")"
+  if [ "$actual_calls" != "$expected_calls" ]; then
+    printf 'expected API calls:\n%s\nactual API calls:\n%s\n' "$expected_calls" "$actual_calls" >&2
+    return 1
+  fi
+}
+
+assert_secret_not_logged() {
+  secret="$1"
+  if grep -F "$secret" "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >/dev/null 2>&1; then
+    printf '%s\n' 'scheduled backup printed a credential to its output' >&2
+    return 1
+  fi
+}
+
+: >"$TEMP_DIR/calls"
+if ! MODELFORGE_BACKUP_ADMIN_API_KEY=dedicated-named-admin-secret \
+  MODELFORGE_OPERATOR_API_KEY=legacy-global-secret \
+  MODELFORGE_TEST_EXPECTED_KEY=dedicated-named-admin-secret \
+  MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" \
+  PATH="$TEMP_DIR/bin:$PATH" sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"; then
+  cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
+  printf '%s\n' 'scheduled backup rejected its dedicated named administrator key' >&2
+  exit 1
+fi
+assert_calls 'create
+verify
+retention'
+assert_secret_not_logged dedicated-named-admin-secret
+
+: >"$TEMP_DIR/calls"
+if ! MODELFORGE_OPERATOR_API_KEY=legacy-global-secret \
+  MODELFORGE_TEST_EXPECTED_KEY=legacy-global-secret \
+  MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" \
+  PATH="$TEMP_DIR/bin:$PATH" sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"; then
+  cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
+  printf '%s\n' 'scheduled backup no longer accepts the legacy administrator key' >&2
+  exit 1
+fi
+assert_calls 'create
+verify
+retention'
+assert_secret_not_logged legacy-global-secret
+
+: >"$TEMP_DIR/calls"
+set +e
+env -u MODELFORGE_BACKUP_ADMIN_API_KEY -u MODELFORGE_OPERATOR_API_KEY \
+  MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" PATH="$TEMP_DIR/bin:$PATH" \
+  sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"
+missing_key_status=$?
+set -e
+if [ "$missing_key_status" -eq 0 ] || [ -s "$TEMP_DIR/calls" ]; then
+  printf '%s\n' 'scheduled backup did not fail closed before making an API call' >&2
+  cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
+  exit 1
+fi
+if ! grep -F 'MODELFORGE_BACKUP_ADMIN_API_KEY' "$TEMP_DIR/stderr" >/dev/null 2>&1; then
+  printf '%s\n' 'missing-key diagnostic did not name the dedicated setting' >&2
+  cat "$TEMP_DIR/stderr" >&2
+  exit 1
+fi
+
+printf '%s\n' 'scheduled backup authentication tests passed'