dobotai-platform/scripts/containerized_deployment_test.go

package scripts

import (
	"os"
	"strings"
	"testing"
)

func TestDobotAIDingTalkComposeOwnsApplicationAndPostgres(t *testing.T) {
	compose, err := os.ReadFile("../deploy/dobotai-dingtalk/compose.yaml")
	if err != nil {
		t.Fatal(err)
	}
	for _, required := range []string{
		"dobotai-dingtalk:",
		"container_name: dobotai-dingtalk",
		"dobotai-postgres:",
		"container_name: dobotai-postgres",
		"dobotai-postgres-data:",
		"depends_on:",
		"condition: service_healthy",
		"host.docker.internal:host-gateway",
		"127.0.0.1:8090:8090",
		"env_file:",
		"read_only: true",
		"/var/lib/dobotai/secrets",
	} {
		if !strings.Contains(string(compose), required) {
			t.Errorf("compose missing %q", required)
		}
	}

	configure, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-configure")
	if err != nil {
		t.Fatal(err)
	}
	for _, required := range []string{
		"configure_env.py",
		"dobotai-dingtalk-start",
	} {
		if !strings.Contains(string(configure), required) {
			t.Errorf("configure command missing %q", required)
		}
	}

	bind, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-bind-admin")
	if err != nil {
		t.Fatal(err)
	}
	for _, required := range []string{
		"docker exec -it dobotai-dingtalk",
		"/usr/local/bin/dobotai bootstrap-admin",
	} {
		if !strings.Contains(string(bind), required) {
			t.Errorf("bind command missing %q", required)
		}
	}
}

func TestDobotAIDingTalkCredentialConfigurationNeverPassesSecretsOnCommandLine(t *testing.T) {
	data, err := os.ReadFile("../deploy/dobotai-dingtalk/configure_env.py")
	if err != nil {
		t.Fatal(err)
	}
	source := string(data)
	for _, required := range []string{"getpass.getpass", "os.replace", "0o600", "DINGTALK_CLIENT_SECRET"} {
		if !strings.Contains(source, required) {
			t.Errorf("credential configurator missing %q", required)
		}
	}
	for _, forbidden := range []string{"subprocess.run([", "-v", "DINGTALK_CLIENT_SECRET="} {
		if strings.Contains(source, forbidden) {
			t.Errorf("credential configurator must not expose secret through process arguments: %q", forbidden)
		}
	}
}

func TestDobotAIDingTalkCredentialConfigurationExplainsEveryInputWithRedactedExamples(t *testing.T) {
	configurator, err := os.ReadFile("../deploy/dobotai-dingtalk/configure_env.py")
	if err != nil {
		t.Fatal(err)
	}
	documentation, err := os.ReadFile("../deploy/dobotai-dingtalk/README.md")
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(configurator), "格式示例：{example}") || !strings.Contains(string(documentation), "格式示例") {
		t.Fatal("configuration guidance must label every example")
	}
	for _, example := range []string{
		"http://host.docker.internal:8080",
		`{"dingtalk:*":"你的Agent ID"}`,
		"DINGTALK_CLIENT_SECRET",
	} {
		if !strings.Contains(string(configurator), example) {
			t.Errorf("configurator missing redacted example %q", example)
		}
		if !strings.Contains(string(documentation), example) {
			t.Errorf("documentation missing redacted example %q", example)
		}
	}
	if strings.Contains(string(configurator), "DATABASE_URL") {
		t.Fatal("database URL must be deployment-managed, not requested interactively")
	}
	if !strings.Contains(string(documentation), "dobotai-postgres") {
		t.Fatal("documentation must explain the Compose-managed database")
	}
}

func TestDobotAIDingTalkStartRollsBackToPreviousContainerImage(t *testing.T) {
	data, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-start")
	if err != nil {
		t.Fatal(err)
	}
	source := string(data)
	for _, required := range []string{
		"previous_image=",
		"set_runtime_image",
		"docker inspect --format",
		"set_runtime_image \"$previous_image\"",
		"\"${compose[@]}\" up -d --no-build --force-recreate dobotai-dingtalk",
	} {
		if !strings.Contains(source, required) {
			t.Errorf("start script missing container upgrade rollback %q", required)
		}
	}
}

func TestDobotAIDingTalkDockerInstallerPreparesDirectoriesDatabaseAndMigrations(t *testing.T) {
	data, err := os.ReadFile("../deploy/dobotai-dingtalk/install-docker.sh")
	if err != nil {
		t.Fatal(err)
	}
	source := string(data)
	for _, required := range []string{
		"container",
		"secrets",
		"backups",
		"migrations",
		"postgres.env",
		"dobotai-postgres",
		"apply-migrations.sh",
		"docker compose",
		"umask 077",
	} {
		if !strings.Contains(source, required) {
			t.Errorf("docker installer missing %q", required)
		}
	}
	if strings.Contains(source, "dobotai-dingtalk up -d") {
		t.Fatal("installer must prepare database but must not start the unconfigured application")
	}
}

func TestDobotAIDingTalkExistingDatabaseMigrationHasBackupAndRollbackBoundary(t *testing.T) {
	data, err := os.ReadFile("../deploy/dobotai-dingtalk/migrate-existing-database.sh")
	if err != nil {
		t.Fatal(err)
	}
	source := string(data)
	for _, required := range []string{
		"pg_dump -Fc",
		"pg_restore --list",
		"dobotai-postgres-data",
		"dobotai-dingtalk",
		"rollback",
		"apply-migrations.sh",
	} {
		if !strings.Contains(source, required) {
			t.Errorf("database adoption script missing %q", required)
		}
	}
}