49 lines
2.4 KiB
TypeScript
49 lines
2.4 KiB
TypeScript
// Guards the Ory Postgres config: each Ory service keeps its own database (the
|
|
// image pin is covered by compose.test.ts's global scan). Real container behaviour is
|
|
// verified by booting postgres in CI/e2e; this catches edits.
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { readdirSync, readFileSync } from "node:fs";
|
|
|
|
const read = (p: string) => readFileSync(new URL(`../${p}`, import.meta.url), "utf8");
|
|
const ORY_DATABASES = ["hydra", "keto", "kratos"]; // one DB per Ory service
|
|
|
|
function sourceFiles(dir = "src"): string[] {
|
|
const out: string[] = [];
|
|
for (const entry of readdirSync(new URL(`../${dir}/`, import.meta.url), { withFileTypes: true })) {
|
|
if (entry.isDirectory()) out.push(...sourceFiles(`${dir}/${entry.name}`));
|
|
else if (entry.name.endsWith(".ts")) out.push(`${dir}/${entry.name}`);
|
|
}
|
|
return out.sort();
|
|
}
|
|
|
|
test("init SQL gives each Ory service its own database, and leaves plugin databases to bootstrap", () => {
|
|
const sql = read("ory/postgres/init/init.sql");
|
|
for (const db of ORY_DATABASES) {
|
|
assert.match(sql, new RegExp(`CREATE DATABASE ${db}\\b`, "i"), `creates ${db}`);
|
|
}
|
|
// This file runs once, on an empty data dir — a plugin database added here would never appear for
|
|
// a plugin dropped in later. bootstrap provisions them on every boot instead.
|
|
assert.doesNotMatch(sql, /plugin_/i, "no plugin database is seeded here");
|
|
// PUBLIC keeps CONNECT unless it is revoked, which would put every plugin role on the auth plane.
|
|
for (const db of ORY_DATABASES) {
|
|
assert.match(sql, new RegExp(`REVOKE CONNECT ON DATABASE ${db} FROM PUBLIC`, "i"), `${db} is closed to PUBLIC`);
|
|
}
|
|
});
|
|
|
|
// AGENTS.md records that the driver runs the provisioning DDL in bootstrap and nothing else. A
|
|
// single value imported from the wrong module puts it in web's graph without changing behaviour,
|
|
// so nothing but this would notice.
|
|
test("the Postgres driver reaches bootstrap only, never web's import graph", () => {
|
|
const files = sourceFiles();
|
|
assert.ok(files.length > 40, "walks the source tree");
|
|
assert.deepEqual(
|
|
files.filter((f) => /^import .*"postgres"/m.test(read(f))), // an import line, not a mention of one
|
|
["src/plugin-host/storage-provisioning.ts", "src/plugin-host/storage.test.ts"],
|
|
);
|
|
assert.deepEqual(
|
|
files.filter((f) => !f.endsWith(".test.ts") && /from "[^"]*storage-provisioning\.ts"/.test(read(f))),
|
|
["src/auth/bootstrap.ts"],
|
|
);
|
|
});
|