root/Jyotisha
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: reject ambiguous database env values

Browse Source
This commit is contained in:
Jesse_Chen
2026-07-20 21:45:45 +08:00
parent 9ff5e6266c
commit ac9277a7a8
2 changed files with 64 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
frontend/tests/database-env-validator.test.ts
+55 -1
View File
@@ -25,7 +25,7 @@ const validEnvironment = [
"MIGRATION_RUNNER_PASSWORD=migration-runner-test-password",
"BACKUP_READER_PASSWORD=backup-reader-test-password",
"STAGING_BACKUP_ENCRYPTION_KEY=staging-backup-test-password",
"SCHEMA_DATABASE_URL=postgresql://schema_owner:schema-owner-test-password@postgres:5432/jyotisha",
"SCHEMA_DATABASE_URL=postgresql://schema_owner:schema-owner%2Dtest-password@postgres:5432/jyotisha",
];
test("database env validator rejects Compose-compatible duplicate selectors without printing values", () => {
@@ -83,6 +83,60 @@ test("database env validator rejects Compose-compatible duplicate selectors with
}
});
test("database env validator rejects bare Compose-compatible duplicate definitions", () => {
const root = mkdtempSync(join(tmpdir(), "jyotisha-database-env-"));
const envFile = join(root, ".env.staging.database");
try {
writeFileSync(
envFile,
`${[...validEnvironment, " POSTGRES_DB"].join("\n")}\n`,
{ mode: 0o600 },
);
chmodSync(envFile, 0o600);
const result = spawnSync("bash", [validator, envFile], { encoding: "utf8" });
assert.notEqual(result.status, 0);
assert.doesNotMatch(
`${result.stdout}${result.stderr}`,
/postgres-test-password|schema-owner-test-password|staging-backup-test-password/,
);
} finally {
rmSync(root, { recursive: true, force: true });
}
});
test("database env validator rejects quoted and interpolated required secrets", () => {
const root = mkdtempSync(join(tmpdir(), "jyotisha-database-env-"));
const envFile = join(root, ".env.staging.database");
try {
for (const password of ['""', "''", "${UNSET}"]) {
writeFileSync(
envFile,
`${validEnvironment
.map((line) =>
line.startsWith("POSTGRES_PASSWORD=")
? `POSTGRES_PASSWORD=${password}`
: line,
)
.join("\n")}\n`,
{ mode: 0o600 },
);
chmodSync(envFile, 0o600);
const result = spawnSync("bash", [validator, envFile], { encoding: "utf8" });
assert.notEqual(result.status, 0, password);
assert.doesNotMatch(
`${result.stdout}${result.stderr}`,
/postgres-test-password|schema-owner-test-password|staging-backup-test-password/,
);
}
} finally {
rmSync(root, { recursive: true, force: true });
}
});
test("database env validator rejects symlinks and unsafe modes", () => {
const root = mkdtempSync(join(tmpdir(), "jyotisha-database-env-"));
const envFile = join(root, ".env.staging.database");