108 lines
4.0 KiB
Bash
Executable File
108 lines
4.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Exercises the plugin's nginx config generation against a fake dokku layout,
|
|
# asserts the important directives are present, and (if docker is available)
|
|
# validates the result with a real nginx binary.
|
|
set -eo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
WORK="$(mktemp -d)"
|
|
trap 'rm -rf "$WORK"' EXIT
|
|
|
|
# Fake dokku host layout.
|
|
export DOKKU_ROOT="$WORK/dokku-root"
|
|
export DOKKU_LIB_ROOT="$WORK/dokku-lib"
|
|
export PLUGIN_CORE_AVAILABLE_PATH="$WORK/nonexistent" # force built-in fallbacks
|
|
APP="myapp"
|
|
mkdir -p "$DOKKU_ROOT/$APP" "$DOKKU_LIB_ROOT/data/google-auth/global"
|
|
|
|
# A minimal nginx.conf as dokku's template would generate it.
|
|
cat >"$DOKKU_ROOT/$APP/nginx.conf" <<'EOF'
|
|
upstream myapp-5000 {
|
|
server 172.17.0.3:5000;
|
|
}
|
|
server {
|
|
listen 80;
|
|
server_name myapp.example.com;
|
|
}
|
|
EOF
|
|
|
|
# shellcheck disable=SC1091
|
|
source "$ROOT/functions"
|
|
|
|
fail() {
|
|
echo "FAIL: $*" 1>&2
|
|
exit 1
|
|
}
|
|
|
|
# --- pattern validation ---
|
|
fn-ga-validate-pattern "/api/webhooks" || fail "prefix pattern should be valid"
|
|
fn-ga-validate-pattern "re:^/v[0-9]+/public/" || fail "regex pattern should be valid"
|
|
fn-ga-validate-pattern "api/webhooks" && fail "pattern without leading / should be invalid"
|
|
fn-ga-validate-pattern "/x; }" && fail "pattern with injection chars should be invalid"
|
|
fn-ga-validate-pattern '/x{2}' && fail "pattern with braces should be invalid"
|
|
fn-ga-validate-pattern "" && fail "empty pattern should be invalid"
|
|
echo "ok: pattern validation"
|
|
|
|
# --- conf generation ---
|
|
fn-ga-app-set-enabled "$APP" true
|
|
fn-ga-exclude-add "$APP" "/api/webhooks"
|
|
fn-ga-exclude-add "$APP" "re:^/healthz$"
|
|
|
|
CONF="$WORK/google-auth.conf"
|
|
fn-ga-generate-conf "$APP" >"$CONF" || fail "conf generation failed"
|
|
|
|
grep -q 'proxy_pass http://myapp-5000;' "$CONF" || fail "conf should proxy to the app upstream"
|
|
grep -q 'auth_request /_google-auth/verify;' "$CONF" || fail "conf should gate with auth_request"
|
|
grep -q 'location ^~ /api/webhooks {' "$CONF" || fail "conf should contain prefix exclusion"
|
|
grep -q 'location ~ ^/healthz$ {' "$CONF" || fail "conf should contain regex exclusion"
|
|
grep -q 'error_page 401 = @google_auth_signin;' "$CONF" || fail "conf should redirect 401s to signin"
|
|
grep -q 'proxy_set_header X-Forwarded-Email \$google_auth_email;' "$CONF" || fail "conf should forward the email header"
|
|
grep -q 'proxy_set_header X-Forwarded-Email "";' "$CONF" || fail "excluded paths should strip identity headers"
|
|
echo "ok: conf contents"
|
|
|
|
# --- write/remove behavior ---
|
|
[[ "$(fn-ga-write-conf "$APP")" == "changed" ]] || fail "first write should report changed"
|
|
[[ "$(fn-ga-write-conf "$APP")" == "unchanged" ]] || fail "second write should report unchanged"
|
|
[[ -f "$DOKKU_ROOT/$APP/nginx.conf.d/google-auth.conf" ]] || fail "conf file should exist"
|
|
fn-ga-app-set-enabled "$APP" false
|
|
[[ "$(fn-ga-write-conf "$APP")" == "changed" ]] || fail "disable should remove the conf"
|
|
[[ ! -f "$DOKKU_ROOT/$APP/nginx.conf.d/google-auth.conf" ]] || fail "conf file should be gone"
|
|
fn-ga-app-set-enabled "$APP" true
|
|
fn-ga-write-conf "$APP" >/dev/null
|
|
echo "ok: write/remove behavior"
|
|
|
|
# --- undeployed app is skipped ---
|
|
mkdir -p "$DOKKU_ROOT/fresh-app"
|
|
fn-ga-app-set-enabled "fresh-app" true
|
|
[[ "$(fn-ga-write-conf "fresh-app")" == "skipped" ]] || fail "app without nginx.conf should be skipped"
|
|
echo "ok: undeployed app skipped"
|
|
|
|
# --- validate with real nginx if docker is around ---
|
|
if command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
|
|
cat >"$WORK/nginx-test.conf" <<EOF
|
|
events {}
|
|
http {
|
|
upstream myapp-5000 {
|
|
server 127.0.0.1:65000;
|
|
}
|
|
server {
|
|
listen 8080;
|
|
server_name myapp.example.com;
|
|
location / {
|
|
proxy_pass http://myapp-5000;
|
|
}
|
|
include /work/google-auth.conf;
|
|
}
|
|
}
|
|
EOF
|
|
if docker run --rm -v "$WORK:/work:ro" nginx:alpine nginx -t -c /work/nginx-test.conf; then
|
|
echo "ok: real nginx accepted the generated config"
|
|
else
|
|
fail "nginx -t rejected the generated config"
|
|
fi
|
|
else
|
|
echo "skip: docker unavailable, skipped real nginx validation"
|
|
fi
|
|
|
|
echo "ALL NGINX CONF TESTS PASSED"
|