Graham McIntie
1590f78bdc
- LIKE wildcard injection: sanitize %, _ in search queries (devices, sites, gaiia) - Jason.decode! → Jason.decode with error handling for untrusted input - inspect() leak: replace with generic error messages, log details server-side - SSRF protection: URL validator blocks private IPs, localhost, non-HTTP schemes - SSRF validation added to HTTP monitoring executor and integration credentials - GraphQL complexity limits: always applied, not just in prod - GraphQL introspection: also check GET query params, not just body - Stripe webhook: explicit nil/empty checks for signature and body - Cookie security: secure flag for session (prod), http_only+secure for remember_me - Honeybadger API key: read from env var with fallback - String.to_integer → Integer.parse with fallback for URL params - String.to_atom → whitelist map for HTTP methods - Gaiia webhook: remove secret_len and expected signature from log - Admin API: add rate limiting pipeline - to_atom_keys: per-key fallback instead of all-or-nothing rescue
86 lines
2.3 KiB
Bash
Executable file
86 lines
2.3 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# TowerOps Test Environment Bootstrap
|
|
# Ensures PostgreSQL is running, test DB exists, and migrations are current.
|
|
# Run inside or outside of `nix develop` — it works either way.
|
|
set -e
|
|
|
|
export PATH="/nix/var/nix/profiles/default/bin:$PATH"
|
|
|
|
PROJ_DIR="$(cd "$(dirname "$0")/.." && pwd)"
|
|
cd "$PROJ_DIR"
|
|
|
|
NIX_CMD="nix develop .#default --command"
|
|
|
|
GREEN='\033[0;32m'
|
|
RED='\033[0;31m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m'
|
|
|
|
ok() { echo -e "${GREEN}✓${NC} $1"; }
|
|
fail() { echo -e "${RED}✗${NC} $1"; }
|
|
info() { echo -e "${YELLOW}→${NC} $1"; }
|
|
|
|
echo "=== TowerOps Test Bootstrap ==="
|
|
echo ""
|
|
|
|
# --- 1. Check/start PostgreSQL ---
|
|
info "Checking PostgreSQL..."
|
|
if pg_isready -h localhost -p 5432 > /dev/null 2>&1; then
|
|
ok "PostgreSQL is running"
|
|
else
|
|
info "PostgreSQL not running — starting services..."
|
|
$NIX_CMD start-services
|
|
sleep 2
|
|
if pg_isready -h localhost -p 5432 > /dev/null 2>&1; then
|
|
ok "PostgreSQL started successfully"
|
|
else
|
|
fail "Could not start PostgreSQL"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
# --- 2. Create test database if it doesn't exist ---
|
|
info "Checking test database..."
|
|
|
|
# Unset DATABASE_URL to avoid the unexpanded $USER issue from nix shell
|
|
DB_EXISTS=$($NIX_CMD env -u DATABASE_URL bash -c \
|
|
"MIX_ENV=test mix ecto.create 2>&1" || true)
|
|
|
|
if echo "$DB_EXISTS" | grep -q "already created"; then
|
|
ok "Test database already exists"
|
|
elif echo "$DB_EXISTS" | grep -q "has been created"; then
|
|
ok "Test database created"
|
|
else
|
|
# If it failed for another reason, show the output
|
|
if echo "$DB_EXISTS" | grep -qi "error"; then
|
|
fail "Problem with test database:"
|
|
echo "$DB_EXISTS"
|
|
exit 1
|
|
else
|
|
ok "Test database ready"
|
|
fi
|
|
fi
|
|
|
|
# --- 3. Run pending migrations ---
|
|
info "Running test migrations..."
|
|
MIGRATE_OUT=$($NIX_CMD env -u DATABASE_URL bash -c \
|
|
"MIX_ENV=test mix ecto.migrate 2>&1" || true)
|
|
|
|
if echo "$MIGRATE_OUT" | grep -q "already up"; then
|
|
ok "All migrations already applied"
|
|
elif echo "$MIGRATE_OUT" | grep -qi "migrat"; then
|
|
ok "Migrations applied"
|
|
echo "$MIGRATE_OUT" | grep -i "migrat" | head -5
|
|
else
|
|
ok "Migrations up to date"
|
|
fi
|
|
|
|
# --- 4. Summary ---
|
|
echo ""
|
|
echo "=== Status ==="
|
|
ok "PostgreSQL: running on localhost:5432"
|
|
ok "Test DB: ready"
|
|
ok "Migrations: current"
|
|
echo ""
|
|
echo "Run tests with: ./tools/dev.sh test"
|
|
echo " or directly: nix develop --command env -u DATABASE_URL MIX_ENV=test mix test"
|