110 lines
3.4 KiB
Bash
110 lines
3.4 KiB
Bash
#!/usr/bin/env sh
|
|
set -eu
|
|
|
|
ROOT="$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)"
|
|
HELPER="$ROOT/scripts/modelforge_scheduled_backup.sh"
|
|
TEMP_DIR="$(mktemp -d)"
|
|
trap 'rm -rf "$TEMP_DIR"' EXIT HUP INT TERM
|
|
mkdir -p "$TEMP_DIR/bin"
|
|
|
|
cat >"$TEMP_DIR/bin/curl" <<'CURL'
|
|
#!/usr/bin/env sh
|
|
set -eu
|
|
expected="${MODELFORGE_TEST_EXPECTED_KEY:?test did not provide an expected credential}"
|
|
found=false
|
|
for argument do
|
|
if [ "$argument" = "X-ModelForge-Admin-Token: $expected" ]; then
|
|
found=true
|
|
fi
|
|
done
|
|
if [ "$found" != true ]; then
|
|
printf '%s\n' 'scheduled backup sent the wrong admin credential' >&2
|
|
exit 97
|
|
fi
|
|
|
|
case " $* " in
|
|
*"/verify "*)
|
|
printf '%s\n' verify >>"$MODELFORGE_TEST_CURL_CALLS"
|
|
printf '%s' '{"state":"VERIFIED"}'
|
|
;;
|
|
*"/retention/run "*)
|
|
printf '%s\n' retention >>"$MODELFORGE_TEST_CURL_CALLS"
|
|
;;
|
|
*"/recovery/backups "*)
|
|
printf '%s\n' create >>"$MODELFORGE_TEST_CURL_CALLS"
|
|
printf '%s' '{"id":"00000000-0000-0000-0000-000000000001","state":"CREATED"}'
|
|
;;
|
|
*)
|
|
printf '%s\n' 'scheduled backup sent an unexpected request' >&2
|
|
exit 98
|
|
;;
|
|
esac
|
|
CURL
|
|
chmod +x "$TEMP_DIR/bin/curl"
|
|
|
|
assert_calls() {
|
|
expected_calls="$1"
|
|
actual_calls="$(cat "$TEMP_DIR/calls")"
|
|
if [ "$actual_calls" != "$expected_calls" ]; then
|
|
printf 'expected API calls:\n%s\nactual API calls:\n%s\n' "$expected_calls" "$actual_calls" >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
assert_secret_not_logged() {
|
|
secret="$1"
|
|
if grep -F "$secret" "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >/dev/null 2>&1; then
|
|
printf '%s\n' 'scheduled backup printed a credential to its output' >&2
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
: >"$TEMP_DIR/calls"
|
|
if ! MODELFORGE_BACKUP_ADMIN_API_KEY=dedicated-named-admin-secret \
|
|
MODELFORGE_OPERATOR_API_KEY=legacy-global-secret \
|
|
MODELFORGE_TEST_EXPECTED_KEY=dedicated-named-admin-secret \
|
|
MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" \
|
|
PATH="$TEMP_DIR/bin:$PATH" sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"; then
|
|
cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
|
|
printf '%s\n' 'scheduled backup rejected its dedicated named administrator key' >&2
|
|
exit 1
|
|
fi
|
|
assert_calls 'create
|
|
verify
|
|
retention'
|
|
assert_secret_not_logged dedicated-named-admin-secret
|
|
|
|
: >"$TEMP_DIR/calls"
|
|
if ! MODELFORGE_OPERATOR_API_KEY=legacy-global-secret \
|
|
MODELFORGE_TEST_EXPECTED_KEY=legacy-global-secret \
|
|
MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" \
|
|
PATH="$TEMP_DIR/bin:$PATH" sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"; then
|
|
cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
|
|
printf '%s\n' 'scheduled backup no longer accepts the legacy administrator key' >&2
|
|
exit 1
|
|
fi
|
|
assert_calls 'create
|
|
verify
|
|
retention'
|
|
assert_secret_not_logged legacy-global-secret
|
|
|
|
: >"$TEMP_DIR/calls"
|
|
set +e
|
|
env -u MODELFORGE_BACKUP_ADMIN_API_KEY -u MODELFORGE_OPERATOR_API_KEY \
|
|
MODELFORGE_TEST_CURL_CALLS="$TEMP_DIR/calls" PATH="$TEMP_DIR/bin:$PATH" \
|
|
sh "$HELPER" >"$TEMP_DIR/stdout" 2>"$TEMP_DIR/stderr"
|
|
missing_key_status=$?
|
|
set -e
|
|
if [ "$missing_key_status" -eq 0 ] || [ -s "$TEMP_DIR/calls" ]; then
|
|
printf '%s\n' 'scheduled backup did not fail closed before making an API call' >&2
|
|
cat "$TEMP_DIR/stdout" "$TEMP_DIR/stderr" >&2
|
|
exit 1
|
|
fi
|
|
if ! grep -F 'MODELFORGE_BACKUP_ADMIN_API_KEY' "$TEMP_DIR/stderr" >/dev/null 2>&1; then
|
|
printf '%s\n' 'missing-key diagnostic did not name the dedicated setting' >&2
|
|
cat "$TEMP_DIR/stderr" >&2
|
|
exit 1
|
|
fi
|
|
|
|
printf '%s\n' 'scheduled backup authentication tests passed'
|