5f4f1ab865
Some checks failed
CD Pipeline / workflow-shape (push) Successful in 1s
CD Pipeline / cancel-stale-cd (push) Has been skipped
CD Pipeline / build-and-deploy (push) Has been cancelled
CD Pipeline / post-deploy-checks (push) Has been cancelled
CD Pipeline / tests (push) Has been cancelled
26 lines
846 B
Python
26 lines
846 B
Python
from __future__ import annotations
|
|
|
|
import re
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[3]
|
|
SCRIPT = ROOT / "scripts" / "backup" / "backup-awoooi.sh"
|
|
|
|
|
|
def test_daily_backup_has_no_hardcoded_database_password() -> None:
|
|
text = SCRIPT.read_text(encoding="utf-8")
|
|
assignment = re.search(r"^AWOOOI_DB_PASS=(.+)$", text, re.MULTILINE)
|
|
|
|
assert assignment is not None
|
|
assert assignment.group(1) == '"${AWOOOI_DB_PASS:-}"'
|
|
assert "PGPASSWORD='${AWOOOI_DB_PASS}'" not in text
|
|
assert 'PGPASSFILE="$pgpass"' in text
|
|
assert "pg_dump --no-password" in text
|
|
|
|
|
|
def test_daily_backup_fails_closed_without_runtime_credential() -> None:
|
|
text = SCRIPT.read_text(encoding="utf-8")
|
|
|
|
assert 'if [ -z "${AWOOOI_DB_PASS}" ]; then' in text
|
|
assert "refusing an unauthenticated or hardcoded fallback" in text
|