96 lines
3.7 KiB
TypeScript
96 lines
3.7 KiB
TypeScript
import {
|
|
chmodSync,
|
|
mkdtempSync,
|
|
rmSync,
|
|
writeFileSync,
|
|
existsSync,
|
|
readdirSync,
|
|
readFileSync,
|
|
} from "node:fs";
|
|
import { tmpdir } from "node:os";
|
|
import { join, resolve } from "node:path";
|
|
import { spawnSync } from "node:child_process";
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
function runScript(scriptPath: string, env: Record<string, string>) {
|
|
const tmpScriptDir = mkdtempSync(join(tmpdir(), "skymoney-a08-script-"));
|
|
const normalizedScript = join(tmpScriptDir, "script.sh");
|
|
writeFileSync(normalizedScript, readFileSync(scriptPath, "utf8").replace(/\r/g, ""));
|
|
chmodSync(normalizedScript, 0o755);
|
|
const result = spawnSync("bash", [normalizedScript], {
|
|
env: { ...process.env, ...env },
|
|
encoding: "utf8",
|
|
});
|
|
rmSync(tmpScriptDir, { recursive: true, force: true });
|
|
return result;
|
|
}
|
|
|
|
describe("A08 Software and Data Integrity Failures", () => {
|
|
it("creates checksum artifacts during backup execution", () => {
|
|
const repoRoot = resolve(__dirname, "..", "..");
|
|
const backupScriptPath = resolve(repoRoot, "scripts/backup.sh");
|
|
const tmpRoot = mkdtempSync(join(tmpdir(), "skymoney-a08-backup-"));
|
|
const fakeBin = join(tmpRoot, "bin");
|
|
const outDir = join(tmpRoot, "backups");
|
|
const fakePgDump = join(fakeBin, "pg_dump");
|
|
|
|
try {
|
|
spawnSync("mkdir", ["-p", fakeBin], { encoding: "utf8" });
|
|
writeFileSync(
|
|
fakePgDump,
|
|
"#!/usr/bin/env bash\nset -euo pipefail\nout=''\nwhile [[ $# -gt 0 ]]; do\n if [[ \"$1\" == '-f' ]]; then out=\"$2\"; shift 2; continue; fi\n shift\ndone\nprintf 'fake-dump-data' > \"$out\"\n"
|
|
);
|
|
chmodSync(fakePgDump, 0o755);
|
|
|
|
const res = runScript(backupScriptPath, {
|
|
PATH: `${fakeBin}:${process.env.PATH ?? ""}`,
|
|
BACKUP_DATABASE_URL: "postgres://app:app@127.0.0.1:5432/skymoney",
|
|
BACKUP_DIR: outDir,
|
|
});
|
|
|
|
expect(res.status).toBe(0);
|
|
const names = readdirSync(outDir);
|
|
expect(names.some((n) => n.endsWith(".dump"))).toBe(true);
|
|
expect(names.some((n) => n.endsWith(".sha256"))).toBe(true);
|
|
} finally {
|
|
rmSync(tmpRoot, { recursive: true, force: true });
|
|
}
|
|
});
|
|
|
|
it("blocks restore on checksum mismatch before DB commands execute", () => {
|
|
const repoRoot = resolve(__dirname, "..", "..");
|
|
const restoreScriptPath = resolve(repoRoot, "scripts/restore.sh");
|
|
const tmpRoot = mkdtempSync(join(tmpdir(), "skymoney-a08-restore-"));
|
|
const fakeBin = join(tmpRoot, "bin");
|
|
const backupFile = join(tmpRoot, "sample.dump");
|
|
const checksumFile = `${backupFile}.sha256`;
|
|
const markerFile = join(tmpRoot, "db_called.marker");
|
|
|
|
try {
|
|
spawnSync("mkdir", ["-p", fakeBin], { encoding: "utf8" });
|
|
writeFileSync(backupFile, "tampered-content");
|
|
writeFileSync(checksumFile, `${"0".repeat(64)} sample.dump\n`);
|
|
|
|
const fakePsql = join(fakeBin, "psql");
|
|
const fakePgRestore = join(fakeBin, "pg_restore");
|
|
writeFileSync(fakePsql, `#!/usr/bin/env bash\nset -euo pipefail\ntouch "${markerFile}"\n`);
|
|
writeFileSync(fakePgRestore, `#!/usr/bin/env bash\nset -euo pipefail\ntouch "${markerFile}"\n`);
|
|
chmodSync(fakePsql, 0o755);
|
|
chmodSync(fakePgRestore, 0o755);
|
|
|
|
const res = runScript(restoreScriptPath, {
|
|
PATH: `${fakeBin}:${process.env.PATH ?? ""}`,
|
|
BACKUP_FILE: backupFile,
|
|
DATABASE_URL: "postgres://app:app@127.0.0.1:5432/skymoney",
|
|
RESTORE_DATABASE_URL: "postgres://app:app@127.0.0.1:5432/skymoney_restore_test",
|
|
});
|
|
|
|
expect(res.status).not.toBe(0);
|
|
expect(`${res.stdout}${res.stderr}`).toContain("checksum verification failed");
|
|
expect(existsSync(markerFile)).toBe(false);
|
|
} finally {
|
|
rmSync(tmpRoot, { recursive: true, force: true });
|
|
}
|
|
});
|
|
});
|