hinterland/hearth
2
2
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: db-tool: +secrets load

Browse Source
This commit is contained in:
yukkop
2026-06-09 23:55:05 +00:00
parent a20381e343
commit 7c25e3b46d
14 changed files with 439 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/package/db-tool/default.nix
+4 -3
View File
@@ -31,7 +31,8 @@
) (lib.filterAttrs (_: v: v != null)
(lib.mapAttrs (n: t: mkTestDrv folder n t) (testDir folder)));
database = self.packages.${system}."db-tool";
database = self.packages.${system}."db-dev";
dbOps = self.packages.${system}."db-ops";
postgresInit = self.packages.${system}."postgres-init";
postgresCleanup = self.packages.${system}."postgres-cleanup";
@@ -48,7 +49,7 @@
mkNonPgTest = testName: testDrv: pkgs.runCommand "db-tool-${testName}"
{
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ database postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash ];
buildInputs = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
test=${testDrv}
@@ -64,7 +65,7 @@
mkPgTest = testName: testDrv: pkgs.runCommand "db-tool-${testName}"
{
nativeBuildInputs = [ pkgs.coreutils pkgs.gnugrep pkgs.gnused ];
buildInputs = [ database postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash pkgs.netcat-openbsd ];
buildInputs = [ database dbOps postgresInit postgresCleanup pkgs.postgresql_17 pkgs.dash pkgs.netcat-openbsd ];
} ''
${builtins.readFile self.legacyPackages.${system}.helpers.posix-shell.log}
test=${testDrv}
test/package/db-tool/test/db-ops-help.sh
+19
View File
@@ -0,0 +1,19 @@
# shellcheck shell=dash
export HECTIC_NAMESPACE=test-db-ops-help
log notice "test case: db-ops --help exits 0"
if ! db-ops --help > /tmp/db-ops-help-out.txt 2>&1; then
log error "test failed: db-ops --help exited non-zero"
exit 1
fi
for tok in secrets load HECTIC_DOTENV_FILE PGURL DB_URL; do
if ! grep -qF "$tok" /tmp/db-ops-help-out.txt; then
log error "test failed: db-ops --help output missing token: $tok"
cat /tmp/db-ops-help-out.txt >&2
exit 1
fi
done
log notice "test passed"
test/package/db-tool/test/db-ops-missing-dotenv.sh
+24
View File
@@ -0,0 +1,24 @@
# shellcheck shell=dash
export HECTIC_NAMESPACE=test-db-ops-missing-dotenv
if db-ops --url 'postgresql://example.invalid/test' secrets load > /tmp/db-ops-missing-dotenv.out 2>&1; then
log error "expected db-ops secrets load to fail without dotenv source"
exit 1
else
exit_code=$?
fi
[ "$exit_code" -eq 3 ] || {
log error "expected exit code 3 without dotenv source, got: $exit_code"
cat /tmp/db-ops-missing-dotenv.out >&2
exit 1
}
if ! grep -qF 'dotenv source is required' /tmp/db-ops-missing-dotenv.out; then
log error "missing dotenv source error message"
cat /tmp/db-ops-missing-dotenv.out >&2
exit 1
fi
log notice "test passed"
test/package/db-tool/test/db-ops-missing-pgurl.sh
+28
View File
@@ -0,0 +1,28 @@
# shellcheck shell=dash
export HECTIC_NAMESPACE=test-db-ops-missing-pgurl
dotenv_file=$(mktemp)
trap 'rm -f "$dotenv_file"' EXIT INT TERM
printf 'TEST_SECRET=hello-world\n' > "$dotenv_file"
if db-ops secrets load --dotenv-file "$dotenv_file" > /tmp/db-ops-missing-pgurl.out 2>&1; then
log error "expected db-ops secrets load to fail without PGURL"
exit 1
else
exit_code=$?
fi
[ "$exit_code" -eq 3 ] || {
log error "expected exit code 3 without PGURL, got: $exit_code"
cat /tmp/db-ops-missing-pgurl.out >&2
exit 1
}
if ! grep -qF 'PGURL or DB_URL is required' /tmp/db-ops-missing-pgurl.out; then
log error "missing PGURL error message"
cat /tmp/db-ops-missing-pgurl.out >&2
exit 1
fi
log notice "test passed"
test/package/db-tool/test/db-ops-unreadable-dotenv.sh
+28
View File
@@ -0,0 +1,28 @@
# shellcheck shell=dash
export HECTIC_NAMESPACE=test-db-ops-unreadable-dotenv
dotenv_dir=$(mktemp -d)
dotenv_file="$dotenv_dir/missing.env"
trap 'rm -rf "$dotenv_dir"' EXIT INT TERM
if db-ops --url 'postgresql://example.invalid/test' secrets load --dotenv-file "$dotenv_file" > /tmp/db-ops-unreadable-dotenv.out 2>&1; then
log error "expected db-ops secrets load to fail for unreadable explicit dotenv path"
exit 1
else
exit_code=$?
fi
[ "$exit_code" -eq 3 ] || {
log error "expected exit code 3 for unreadable explicit dotenv path, got: $exit_code"
cat /tmp/db-ops-unreadable-dotenv.out >&2
exit 1
}
if ! grep -qF 'dotenv file is not readable' /tmp/db-ops-unreadable-dotenv.out; then
log error "missing unreadable dotenv file error message"
cat /tmp/db-ops-unreadable-dotenv.out >&2
exit 1
fi
log notice "test passed"
test/package/db-tool/test/postgresql/db-ops-secrets-load/run.sh
+56
View File
@@ -0,0 +1,56 @@
# shellcheck shell=dash
HECTIC_NAMESPACE=test-db-ops-secrets-load
PG_WORKING_DIR=$(mktemp -d)
export PG_WORKING_DIR PG_DATABASE=testdb PG_PORT=5432 PG_SHARED_PRELOAD_LIBRARIES=''
cleanup() {
postgres-cleanup >/dev/null 2>&1 || :
rm -rf "$PG_WORKING_DIR"
}
trap 'cleanup' EXIT INT TERM
if ! postgres-init; then
log error "postgres-init failed"
exit 1
fi
PGURL="postgresql://$(id -un)@/testdb?host=${PG_WORKING_DIR}/sock&port=5432"
export PGURL
dotenv_file=$(mktemp)
printf 'TEST_SECRET=hello-world\nQUOTED_SECRET="quoted value"\nDELIMITER_SECRET=before$ps_env$after\n' > "$dotenv_file"
if ! db-ops secrets load --dotenv-file "$dotenv_file"; then
log error "db-ops secrets load failed"
rm -f "$dotenv_file"
exit 1
fi
rm -f "$dotenv_file"
secret_value=$(psql "$PGURL" -v ON_ERROR_STOP=1 -tAc "SELECT value FROM hectic.secret WHERE key = 'TEST_SECRET';") || exit 1
[ "$secret_value" = "hello-world" ] || {
log error "expected TEST_SECRET to be loaded, got: $secret_value"
exit 1
}
quoted_value=$(psql "$PGURL" -v ON_ERROR_STOP=1 -tAc "SELECT value FROM hectic.secret WHERE key = 'QUOTED_SECRET';") || exit 1
[ "$quoted_value" = "quoted value" ] || {
log error "expected QUOTED_SECRET to strip outer quotes, got: $quoted_value"
exit 1
}
delimiter_value=$(psql "$PGURL" -v ON_ERROR_STOP=1 -tAc "SELECT value FROM hectic.secret WHERE key = 'DELIMITER_SECRET';") || exit 1
[ "$delimiter_value" = 'before$ps_env$after' ] || {
log error "expected DELIMITER_SECRET to preserve dollar-quote delimiter text, got: $delimiter_value"
exit 1
}
hectic_schema=$(psql "$PGURL" -v ON_ERROR_STOP=1 -tAc "SELECT count(*) FROM pg_namespace WHERE nspname='hectic';") || exit 1
[ "$hectic_schema" = 1 ] || {
log error "expected hectic schema to exist, got: $hectic_schema"
exit 1
}
log notice "test passed"