Initial commit.

2026-07-15 07:49:11 -04:00
commit a3f0f8a1be
37 changed files with 2825 additions and 0 deletions
@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# Exercises the plugin's nginx config generation against a fake dokku layout,
+# asserts the important directives are present, and (if docker is available)
+# validates the result with a real nginx binary.
+set -eo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+# Fake dokku host layout.
+export DOKKU_ROOT="$WORK/dokku-root"
+export DOKKU_LIB_ROOT="$WORK/dokku-lib"
+export PLUGIN_CORE_AVAILABLE_PATH="$WORK/nonexistent" # force built-in fallbacks
+APP="myapp"
+mkdir -p "$DOKKU_ROOT/$APP" "$DOKKU_LIB_ROOT/data/google-auth/global"
+
+# A minimal nginx.conf as dokku's template would generate it.
+cat >"$DOKKU_ROOT/$APP/nginx.conf" <<'EOF'
+upstream myapp-5000 {
+  server 172.17.0.3:5000;
+}
+server {
+  listen 80;
+  server_name myapp.example.com;
+}
+EOF
+
+# shellcheck disable=SC1091
+source "$ROOT/functions"
+
+fail() {
+  echo "FAIL: $*" 1>&2
+  exit 1
+}
+
+# --- pattern validation ---
+fn-ga-validate-pattern "/api/webhooks" || fail "prefix pattern should be valid"
+fn-ga-validate-pattern "re:^/v[0-9]+/public/" || fail "regex pattern should be valid"
+fn-ga-validate-pattern "api/webhooks" && fail "pattern without leading / should be invalid"
+fn-ga-validate-pattern "/x; }" && fail "pattern with injection chars should be invalid"
+fn-ga-validate-pattern '/x{2}' && fail "pattern with braces should be invalid"
+fn-ga-validate-pattern "" && fail "empty pattern should be invalid"
+echo "ok: pattern validation"
+
+# --- conf generation ---
+fn-ga-app-set-enabled "$APP" true
+fn-ga-exclude-add "$APP" "/api/webhooks"
+fn-ga-exclude-add "$APP" "re:^/healthz$"
+
+CONF="$WORK/google-auth.conf"
+fn-ga-generate-conf "$APP" >"$CONF" || fail "conf generation failed"
+
+grep -q 'proxy_pass http://myapp-5000;' "$CONF" || fail "conf should proxy to the app upstream"
+grep -q 'auth_request /_google-auth/verify;' "$CONF" || fail "conf should gate with auth_request"
+grep -q 'location ^~ /api/webhooks {' "$CONF" || fail "conf should contain prefix exclusion"
+grep -q 'location ~ ^/healthz$ {' "$CONF" || fail "conf should contain regex exclusion"
+grep -q 'error_page 401 = @google_auth_signin;' "$CONF" || fail "conf should redirect 401s to signin"
+grep -q 'proxy_set_header X-Forwarded-Email \$google_auth_email;' "$CONF" || fail "conf should forward the email header"
+grep -q 'proxy_set_header X-Forwarded-Email "";' "$CONF" || fail "excluded paths should strip identity headers"
+echo "ok: conf contents"
+
+# --- write/remove behavior ---
+[[ "$(fn-ga-write-conf "$APP")" == "changed" ]] || fail "first write should report changed"
+[[ "$(fn-ga-write-conf "$APP")" == "unchanged" ]] || fail "second write should report unchanged"
+[[ -f "$DOKKU_ROOT/$APP/nginx.conf.d/google-auth.conf" ]] || fail "conf file should exist"
+fn-ga-app-set-enabled "$APP" false
+[[ "$(fn-ga-write-conf "$APP")" == "changed" ]] || fail "disable should remove the conf"
+[[ ! -f "$DOKKU_ROOT/$APP/nginx.conf.d/google-auth.conf" ]] || fail "conf file should be gone"
+fn-ga-app-set-enabled "$APP" true
+fn-ga-write-conf "$APP" >/dev/null
+echo "ok: write/remove behavior"
+
+# --- undeployed app is skipped ---
+mkdir -p "$DOKKU_ROOT/fresh-app"
+fn-ga-app-set-enabled "fresh-app" true
+[[ "$(fn-ga-write-conf "fresh-app")" == "skipped" ]] || fail "app without nginx.conf should be skipped"
+echo "ok: undeployed app skipped"
+
+# --- validate with real nginx if docker is around ---
+if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
+  cat >"$WORK/nginx-test.conf" <<EOF
+events {}
+http {
+  upstream myapp-5000 {
+    server 127.0.0.1:65000;
+  }
+  server {
+    listen 8080;
+    server_name myapp.example.com;
+    location / {
+      proxy_pass http://myapp-5000;
+    }
+    include /work/google-auth.conf;
+  }
+}
+EOF
+  if docker run --rm -v "$WORK:/work:ro" nginx:alpine nginx -t -c /work/nginx-test.conf; then
+    echo "ok: real nginx accepted the generated config"
+  else
+    fail "nginx -t rejected the generated config"
+  fi
+else
+  echo "skip: docker unavailable, skipped real nginx validation"
+fi
+
+echo "ALL NGINX CONF TESTS PASSED"