forked from wangziqi/gongxue-base
69 lines
2.9 KiB
JavaScript
69 lines
2.9 KiB
JavaScript
import assert from 'node:assert/strict';
|
|
import fs from 'node:fs';
|
|
import {
|
|
parseBackendRuntimeRoleBootstrapOptions,
|
|
} from './bootstrap-backend-runtime-roles.js';
|
|
|
|
const sql = fs.readFileSync('scripts/deploy/sql/bootstrap-backend-runtime-roles.sql', 'utf8');
|
|
const migration = fs.readFileSync('supabase/migrations/202607120013_backend_runtime_roles.sql', 'utf8');
|
|
|
|
assert.deepEqual(
|
|
parseBackendRuntimeRoleBootstrapOptions([], {}),
|
|
{ apply: false, adminUrl: '', confirmation: '', json: false },
|
|
);
|
|
assert.throws(
|
|
() => parseBackendRuntimeRoleBootstrapOptions(['--apply'], {}),
|
|
/DATABASE_ADMIN_URL is required/,
|
|
);
|
|
assert.throws(
|
|
() => parseBackendRuntimeRoleBootstrapOptions(['--apply'], {
|
|
DATABASE_ADMIN_URL: ['postgresql:', '//admin:secret@db.test/postgres'].join(''),
|
|
}),
|
|
/BOOTSTRAP_BACKEND_RUNTIME_ROLES/,
|
|
);
|
|
assert.match(sql, /alter role tiku_api[\s\S]*bypassrls/i);
|
|
assert.match(sql, /alter role tiku_worker[\s\S]*bypassrls/i);
|
|
for (const extensionName of ['pgcrypto', 'citext', 'ltree', 'pg_trgm']) {
|
|
assert.ok(sql.includes(`'${extensionName}'::name`), `${extensionName} must be managed by the privileged bootstrap`);
|
|
}
|
|
assert.match(
|
|
sql,
|
|
/if not found then[\s\S]*create extension %I with schema extensions/i,
|
|
'privileged bootstrap must install extensions before normal migrations can create them with unsafe defaults',
|
|
);
|
|
assert.match(sql, /alter extension %I set schema extensions/i);
|
|
assert.match(sql, /grant usage on schema extensions to tiku_api, tiku_worker/i);
|
|
assert.match(sql, /search_path = pg_catalog, public, extensions/i);
|
|
assert.match(sql, /pg_auth_members[\s\S]*revoke %I from %I/i);
|
|
assert.match(
|
|
sql,
|
|
/revoke execute on all functions in schema public[\s\S]*from public, anon, authenticated, tiku_api, tiku_worker/i,
|
|
);
|
|
assert.match(
|
|
sql,
|
|
/revoke execute on all functions in schema extensions[\s\S]*from public, anon, authenticated, tiku_api, tiku_worker/i,
|
|
);
|
|
for (const trustedRole of [
|
|
'postgres',
|
|
'service_role',
|
|
'dashboard_user',
|
|
'supabase_auth_admin',
|
|
'supabase_storage_admin',
|
|
'supabase_realtime_admin',
|
|
'supabase_functions_admin',
|
|
]) {
|
|
assert.ok(sql.includes(`'${trustedRole}'::name`), `${trustedRole} must retain extension execution when present`);
|
|
}
|
|
assert.match(
|
|
sql,
|
|
/alter default privileges for role %I revoke execute on functions from public, anon, authenticated, tiku_api, tiku_worker/i,
|
|
);
|
|
assert.match(sql, /extension\.extname in \('citext', 'ltree', 'pg_trgm'\)[\s\S]*grant execute on function %s to tiku_api, tiku_worker/i);
|
|
assert.doesNotMatch(sql, /password\s+['"]/i, 'bootstrap must preserve externally managed passwords');
|
|
|
|
assert.doesNotMatch(migration, /create role tiku_api|alter role tiku_api/i);
|
|
assert.match(migration, /Runtime role % is missing[\s\S]*bootstrap-backend-runtime-roles\.js/i);
|
|
assert.match(migration, /not role_state\.rolbypassrls/i);
|
|
|
|
console.log('[PASS] privileged backend runtime role bootstrap contract');
|