40 lines
1.5 KiB
Python
40 lines
1.5 KiB
Python
from __future__ import annotations
|
||
|
||
import re
|
||
from pathlib import Path
|
||
|
||
ROOT = Path(__file__).resolve().parents[3]
|
||
SCRIPT = ROOT / "scripts" / "backup" / "backup-awoooi.sh"
|
||
|
||
|
||
def test_daily_backup_has_no_hardcoded_database_password() -> None:
|
||
text = SCRIPT.read_text(encoding="utf-8")
|
||
assignment = re.search(r"^AWOOOI_DB_PASS=(.+)$", text, re.MULTILINE)
|
||
|
||
assert assignment is not None
|
||
assert assignment.group(1) == '"${AWOOOI_DB_PASS:-}"'
|
||
assert "PGPASSWORD='${AWOOOI_DB_PASS}'" not in text
|
||
assert 'PGPASSFILE="$pgpass"' in text
|
||
assert "pg_dump --no-password" in text
|
||
|
||
|
||
def test_daily_backup_resolves_runtime_database_url_and_fails_closed() -> None:
|
||
text = SCRIPT.read_text(encoding="utf-8")
|
||
|
||
assert "resolve_database_url()" in text
|
||
assert "load_database_config()" in text
|
||
assert "AWOOOI_BACKUP_DATABASE_URL BACKUP_DATABASE_URL DATABASE_URL" in text
|
||
assert "無法解析 AWOOOI DATABASE_URL；拒絕使用舊硬編密碼" in text
|
||
assert "base64 -d" in text
|
||
assert 'printf \'%s\\n\' "${decoded}"' in text
|
||
|
||
|
||
def test_daily_backup_uses_same_rls_safe_pg_dump_contract_as_frequent_lane() -> None:
|
||
text = SCRIPT.read_text(encoding="utf-8")
|
||
|
||
assert "dump_database_with_rls_guard()" in text
|
||
assert 'PGOPTIONS="-c statement_timeout=0 -c max_parallel_workers_per_gather=0"' in text
|
||
assert "ALTER TABLE %I.%I ${mode} ROW LEVEL SECURITY" in text
|
||
assert "trap restore_force_rls EXIT" in text
|
||
assert 'dump_database_with_rls_guard \\\n "awoooi_prod"' in text
|