31 lines
1.5 KiB
Python
31 lines
1.5 KiB
Python
# #region Test.ReleaseTemplates [C:2] [TYPE Module] [SEMANTICS test,release,docker,secrets]
|
|
# @BRIEF Verify generated release compose templates require every service secret.
|
|
# @RELATION BINDS_TO -> [Tooling.Build]
|
|
# @TEST_EDGE: missing_service_jwt -> generated backend compose rejects an unset service token
|
|
|
|
from pathlib import Path
|
|
|
|
PROJECT_ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def test_generated_enterprise_backend_requires_service_jwt() -> None:
|
|
"""The generated backend must receive the same mandatory service token as agent."""
|
|
text = (PROJECT_ROOT / "build.sh").read_text(encoding="utf-8")
|
|
backend_block = text.split(" backend:", 1)[1].split("\n\n frontend:", 1)[0]
|
|
|
|
assert "SERVICE_JWT: \\${SERVICE_JWT:?Set SERVICE_JWT in .env}" in backend_block
|
|
assert "RESET_DATABASE_SCHEMA: \\${RESET_DATABASE_SCHEMA:-true}" in backend_block
|
|
assert '"env_template": ".env.example"' in text
|
|
assert '${DIST_ROOT}/.env.example' in text
|
|
|
|
|
|
def test_generated_light_compose_requires_all_runtime_secrets() -> None:
|
|
"""The standalone image cannot start with public or omitted security secrets."""
|
|
text = (PROJECT_ROOT / "build.sh").read_text(encoding="utf-8")
|
|
light_block = text.split(" app:", 1)[1].split("\n\nvolumes:", 1)[0]
|
|
|
|
assert "AUTH_SECRET_KEY: ${AUTH_SECRET_KEY:?Set AUTH_SECRET_KEY}" in light_block
|
|
assert "ENCRYPTION_KEY: ${ENCRYPTION_KEY:?Set ENCRYPTION_KEY}" in light_block
|
|
assert "SERVICE_JWT: ${SERVICE_JWT:?Set SERVICE_JWT}" in light_block
|
|
# #endregion Test.ReleaseTemplates
|