claude-hdb
a10349d835
Public tool, private state. cast holds no hostnames, no bindings, no secrets: it joins a product repo's .infra/ manifest with a state directory you point it at, and makes Coolify match. Extracted from heavy-duty/infra, which was half tool and half state — the inconsistency that made it impossible to say whether "infra" named a CLI or a runbook. rig builds the boxes; cast fills them; infra is what they are filled with. Two changes were required to make it genuinely stateless and publishable: - The implicit cwd contract (environments.yaml / secrets/ / .coolify.env resolved against the working directory, silently reading the wrong file from the wrong place) is now an explicit --state <dir> / $CAST_STATE. - BANNED_IN_PROD — a hardcoded list of one product's ALLOW_* flags, the only product knowledge in the executor — becomes the generic, operator- owned environments.<env>.forbidden_var_patterns. The guard now lives in private state, so a product-side change cannot lower its own guard, and it is a pattern rather than a list, so it catches unforeseen siblings. Age identities resolve as $CAST_AGE_KEY_FILE_<ENV> then ~/.config/cast/age-<env>.key — which is the entire attended-vs-unattended apply mechanism, with no environment names known to the tool. Instance identity (org names, the GitHub App name, founder domains) is out of the fixtures and out of register-github-app.sh, which took APP_NAME and ORG as arguments rather than baking them in. 69 tests green; bin/cast + curl installer mirror rig's shape. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
55 lines
1.9 KiB
TypeScript
55 lines
1.9 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { assertEnvVarPolicy, resolveTemplate } from "../src/envtemplate.js";
|
|
|
|
describe("resolveTemplate", () => {
|
|
it("classifies literals as non-secret and ${…} as secret", () => {
|
|
const r = resolveTemplate(
|
|
"PORT=3000\nMAILGUN_KEY=${MAILGUN_KEY}\n# comment\n\n",
|
|
{
|
|
MAILGUN_KEY: "mk-123",
|
|
},
|
|
);
|
|
expect(r.vars.PORT).toEqual({ value: "3000", secret: false });
|
|
expect(r.vars.MAILGUN_KEY).toEqual({ value: "mk-123", secret: true });
|
|
});
|
|
it("throws on a missing secret, naming key and placeholder", () => {
|
|
expect(() => resolveTemplate("API_KEY=${NOPE}", {})).toThrow(
|
|
/NOPE.*API_KEY|API_KEY.*NOPE/,
|
|
);
|
|
});
|
|
it("throws on malformed lines with the line number", () => {
|
|
expect(() => resolveTemplate("PORT=3000\nnot a line", {})).toThrow(
|
|
/line 2/,
|
|
);
|
|
});
|
|
});
|
|
|
|
describe("assertEnvVarPolicy", () => {
|
|
const withFlag = { vars: { ALLOW_SEED: { value: "false", secret: false } } };
|
|
const banAllow = ["^ALLOW_"];
|
|
|
|
it("refuses when a forbidden var is PRESENT, even set false", () => {
|
|
expect(() =>
|
|
assertEnvVarPolicy("prod", { "core-api": withFlag }, banAllow),
|
|
).toThrow(/ALLOW_SEED.*core-api.*off.*absent/s);
|
|
});
|
|
it("allows the same env where the policy is not declared", () => {
|
|
expect(() =>
|
|
assertEnvVarPolicy("staging", { "core-api": withFlag }, undefined),
|
|
).not.toThrow();
|
|
});
|
|
it("is a pattern, not a fixed list — it catches unforeseen siblings", () => {
|
|
const future = {
|
|
vars: { ALLOW_WIPE_EVERYTHING: { value: "true", secret: false } },
|
|
};
|
|
expect(() =>
|
|
assertEnvVarPolicy("prod", { worker: future }, banAllow),
|
|
).toThrow(/ALLOW_WIPE_EVERYTHING/);
|
|
});
|
|
it("leaves vars that do not match the pattern alone", () => {
|
|
const ok = { vars: { PORT: { value: "3000", secret: false } } };
|
|
expect(() =>
|
|
assertEnvVarPolicy("prod", { "core-api": ok }, banAllow),
|
|
).not.toThrow();
|
|
});
|
|
});
|