姚章浩
72 lines
1.9 KiB
Go
72 lines
1.9 KiB
Go
package scripts
|
|
|
|
import (
|
|
"os"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestDobotAIDingTalkContainerAssetsProvideSafeShortOperatorCommands(t *testing.T) {
|
|
compose, err := os.ReadFile("../deploy/dobotai-dingtalk/compose.yaml")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, required := range []string{
|
|
"dobotai-dingtalk:",
|
|
"container_name: dobotai-dingtalk",
|
|
"network_mode: host",
|
|
"env_file:",
|
|
"read_only: true",
|
|
"/var/lib/dobotai/secrets",
|
|
} {
|
|
if !strings.Contains(string(compose), required) {
|
|
t.Errorf("compose missing %q", required)
|
|
}
|
|
}
|
|
|
|
configure, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-configure")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, required := range []string{
|
|
"configure_env.py",
|
|
"/etc/dobotai-test/dobotai.env",
|
|
"dobotai-dingtalk-start",
|
|
} {
|
|
if !strings.Contains(string(configure), required) {
|
|
t.Errorf("configure command missing %q", required)
|
|
}
|
|
}
|
|
|
|
bind, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-bind-admin")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, required := range []string{
|
|
"docker exec -it dobotai-dingtalk",
|
|
"/usr/local/bin/dobotai bootstrap-admin",
|
|
} {
|
|
if !strings.Contains(string(bind), required) {
|
|
t.Errorf("bind command missing %q", required)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDobotAIDingTalkCredentialConfigurationNeverPassesSecretsOnCommandLine(t *testing.T) {
|
|
data, err := os.ReadFile("../deploy/dobotai-dingtalk/configure_env.py")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
source := string(data)
|
|
for _, required := range []string{"getpass.getpass", "os.replace", "0o600", "DINGTALK_CLIENT_SECRET"} {
|
|
if !strings.Contains(source, required) {
|
|
t.Errorf("credential configurator missing %q", required)
|
|
}
|
|
}
|
|
for _, forbidden := range []string{"subprocess.run([", "-v", "DINGTALK_CLIENT_SECRET="} {
|
|
if strings.Contains(source, forbidden) {
|
|
t.Errorf("credential configurator must not expose secret through process arguments: %q", forbidden)
|
|
}
|
|
}
|
|
}
|