254 lines
9.1 KiB
Go
254 lines
9.1 KiB
Go
package api
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"git.misaka.ren/m1saka/dsh-web/internal/docker"
|
|
"git.misaka.ren/m1saka/dsh-web/internal/store"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"strings"
|
|
"sync/atomic"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func imageTestAPI(t *testing.T, h http.HandlerFunc) (*API, string) {
|
|
t.Helper()
|
|
oldDiskAvailable := buildDiskAvailable
|
|
buildDiskAvailable = func(string) (uint64, error) { return minimumBuildDiskBytes, nil }
|
|
t.Cleanup(func() { buildDiskAvailable = oldDiskAvailable })
|
|
root := t.TempDir()
|
|
t.Setenv("DSH_DOCKER_ROOT_VISIBLE", root)
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path == "/v1.47/info" {
|
|
writeJSON(w, map[string]string{"DockerRootDir": root})
|
|
return
|
|
}
|
|
h(w, r)
|
|
}))
|
|
t.Cleanup(srv.Close)
|
|
s, err := store.Open(filepath.Join(t.TempDir(), "test.db"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
s.DB.SetMaxOpenConns(1)
|
|
a := New(s, t.TempDir())
|
|
a.docker = docker.New(srv.URL)
|
|
t.Cleanup(func() {
|
|
deadline := time.Now().Add(5 * time.Second)
|
|
for {
|
|
buildQueue.Lock()
|
|
active := buildQueue.active[s.DB]
|
|
buildQueue.Unlock()
|
|
if !active {
|
|
break
|
|
}
|
|
if time.Now().After(deadline) {
|
|
t.Error("worker did not finish")
|
|
break
|
|
}
|
|
time.Sleep(time.Millisecond)
|
|
}
|
|
s.Close()
|
|
})
|
|
if err = s.CreateUser(store.User{ID: "u", Username: "user"}, "unused"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
sid, _, err := s.Session("u")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
registerTestAccess(t, a, sid)
|
|
return a, sid
|
|
}
|
|
func imageRequest(h http.HandlerFunc, sid, method, body string) *httptest.ResponseRecorder {
|
|
r := httptest.NewRequest(method, "/", strings.NewReader(body))
|
|
if sid != "" {
|
|
r.AddCookie(&http.Cookie{Name: "dsh_session", Value: sid})
|
|
addTestAccess(r, sid)
|
|
}
|
|
w := httptest.NewRecorder()
|
|
h(w, r)
|
|
return w
|
|
}
|
|
func TestImageListContract(t *testing.T) {
|
|
a, sid := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path == "/v1.47/images/unverified/json" {
|
|
writeImageInspect(w, "unverified", "0.2.0-rc.1")
|
|
return
|
|
}
|
|
if r.URL.Path == "/v1.47/images/sha256:abc/json" {
|
|
writeImageInspect(w, "sha256:abc", "0.2.0-rc.1")
|
|
return
|
|
}
|
|
if !strings.Contains(r.URL.Query().Get("filters"), "dsh-mgr.role=runtime") {
|
|
t.Error("missing label filter")
|
|
}
|
|
io.WriteString(w, `[{"Id":"sha256:abc","Labels":{"dsh-mgr.role":"runtime","dsh-mgr.version":"0.2.0-rc.1","dsh-mgr.recipe":"`+imageRecipeRev+`"},"RepoTags":["runtime:0.2.0-rc.1"]},{"Id":"other","Labels":{}},{"Id":"unverified","Labels":{"dsh-mgr.role":"runtime","dsh-mgr.version":"0.2.0-rc.1","dsh-mgr.recipe":"`+imageRecipeRev+`"}},{"Id":"sha256:abc","Labels":{"dsh-mgr.role":"runtime","dsh-mgr.version":"9.9.9"}}]`)
|
|
})
|
|
seedVerifiedImage(t, a, "sha256:abc", "0.2.0-rc.1")
|
|
if w := imageRequest(a.images, "", "GET", ""); w.Code != 401 {
|
|
t.Fatal(w.Code)
|
|
}
|
|
w := imageRequest(a.images, sid, "GET", "")
|
|
var images []imageRecord
|
|
if err := json.Unmarshal(w.Body.Bytes(), &images); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(images) != 2 || images[0].ID != "sha256:abc" || images[0].ImageID != images[0].ID || images[0].Status != "available" || images[1].Status != "unverified" {
|
|
t.Fatal(w.Body.String())
|
|
}
|
|
if w = imageRequest(a.images, sid, "POST", ""); w.Code != 405 {
|
|
t.Fatal(w.Code)
|
|
}
|
|
}
|
|
|
|
func seedVerifiedImage(t *testing.T, a *API, id, version string) {
|
|
t.Helper()
|
|
buildQueue.Lock()
|
|
defer buildQueue.Unlock()
|
|
if err := a.ensureBuilds(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := a.s.DB.Exec("INSERT INTO image_builds(id,version,status,image_id,created_at,recipe_rev,platform) VALUES(?,?,'success',?,'now',?,?)", store.ID(), version, id, imageRecipeRev, imagePlatform); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := a.s.DB.Exec("INSERT OR REPLACE INTO image_admissions(image_id,version,recipe_rev,platform,state,evidence,admitted_by,admitted_at) VALUES(?,?,?,?,'compatible','test fixture explicit acceptance','test','now')", id, version, imageRecipeRev, imagePlatform); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
func TestImageSanitizing(t *testing.T) {
|
|
s := sanitizeBuildLog("token=topsecret Authorization: Bearer hidden password=private https://user:[email protected]/")
|
|
for _, secret := range []string{"topsecret", "hidden", "private", "user:pass"} {
|
|
if strings.Contains(s, secret) {
|
|
t.Fatal(s)
|
|
}
|
|
}
|
|
if len(sanitizeBuildLog(strings.Repeat("x", 2*buildLogLimit))) > buildLogLimit {
|
|
t.Fatal("unbounded")
|
|
}
|
|
for _, v := range []string{"latest", "*", "^0.2.0-rc.1", "1.2", "0.2.0-rc.1;id", "https://example.com", ""} {
|
|
if validBuildVersion(v) {
|
|
t.Fatal(v)
|
|
}
|
|
}
|
|
if !validBuildVersion("0.2.0-rc.1-beta.1") {
|
|
t.Fatal("fixed prerelease rejected")
|
|
}
|
|
}
|
|
|
|
func TestVerificationFailureCleansUp(t *testing.T) {
|
|
var deleted atomic.Bool
|
|
a, _ := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) {
|
|
switch {
|
|
case strings.HasSuffix(r.URL.Path, "/create"):
|
|
io.WriteString(w, `{"Id":"bad"}`)
|
|
case r.Method == "DELETE":
|
|
deleted.Store(true)
|
|
w.WriteHeader(204)
|
|
default:
|
|
w.WriteHeader(500)
|
|
io.WriteString(w, `{"message":"cannot start"}`)
|
|
}
|
|
})
|
|
if err := a.verifyBuiltImage(context.Background(), "bad", "0.2.0-rc.1"); err == nil {
|
|
t.Fatal("accepted failed start")
|
|
}
|
|
if !deleted.Load() {
|
|
t.Fatal("container leaked")
|
|
}
|
|
}
|
|
|
|
func TestBuildRestartRecovery(t *testing.T) {
|
|
a, _ := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(500) })
|
|
buildQueue.Lock()
|
|
defer buildQueue.Unlock()
|
|
if err := a.ensureBuilds(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := a.s.DB.Exec("INSERT INTO image_builds(id,version,status,created_at) VALUES('old','0.2.0-rc.1','running','now')"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
delete(buildQueue.initialized, a.s.DB)
|
|
if err := a.ensureBuilds(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var status, detail string
|
|
if err := a.s.DB.QueryRow("SELECT status,error FROM image_builds WHERE id='old'").Scan(&status, &detail); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if status != "failed" || !strings.Contains(detail, "restart") {
|
|
t.Fatalf("%s %s", status, detail)
|
|
}
|
|
}
|
|
|
|
func TestFailedVerificationNeverAvailable(t *testing.T) {
|
|
var deleted atomic.Bool
|
|
imageID := "sha256:" + strings.Repeat("c", 64)
|
|
info := releaseFixture()
|
|
a, sid := imageTestAPI(t, func(w http.ResponseWriter, r *http.Request) {
|
|
switch r.URL.Path {
|
|
case "/v1.47/images/sha256:abc/json", "/v1.47/images/sha256:reuse/json":
|
|
writeImageInspect(w, strings.TrimSuffix(strings.TrimPrefix(r.URL.Path, "/v1.47/images/"), "/json"), "0.2.0-rc.1")
|
|
case "/v1.47/images/json":
|
|
writeJSON(w, []any{map[string]any{"Id": imageID, "Labels": map[string]string{"dsh-mgr.role": "runtime", "dsh-mgr.version": "0.2.0-rc.1", "dsh-mgr.recipe": imageRecipeRev}}})
|
|
case "/v1.47/containers/create":
|
|
io.WriteString(w, `{"Id":"check"}`)
|
|
case "/v1.47/containers/check/start", "/v1.47/exec/probe/start":
|
|
w.WriteHeader(204)
|
|
case "/v1.47/containers/check/exec":
|
|
io.WriteString(w, `{"Id":"probe"}`)
|
|
case "/v1.47/exec/probe/json":
|
|
io.WriteString(w, `{"Running":false,"ExitCode":1}`)
|
|
case "/v1.47/containers/check":
|
|
deleted.Store(true)
|
|
w.WriteHeader(204)
|
|
case "/v1.47/build":
|
|
writeJSON(w, map[string]any{"aux": map[string]string{"ID": imageID}})
|
|
case "/v1.47/images/" + imageID + "/json":
|
|
parts := strings.Split(imagePlatform, "/")
|
|
writeJSON(w, map[string]any{"Id": imageID, "Os": parts[0], "Architecture": parts[1], "Config": map[string]any{"Labels": map[string]string{"dsh-mgr.role": "runtime", "dsh-mgr.version": info.Version, "dsh-mgr.recipe": imageRecipeRev, "dsh-mgr.release": info.ReleaseID, "dsh-mgr.source": info.Repository, "dsh-mgr.commit": info.Commit}}})
|
|
default:
|
|
t.Errorf("unexpected Docker call %s", r.URL)
|
|
w.WriteHeader(500)
|
|
}
|
|
})
|
|
if _, err := a.s.DB.Exec("UPDATE users SET admin=1 WHERE id='u'"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
old := fetchRelease
|
|
t.Cleanup(func() { fetchRelease = old })
|
|
fetchRelease = func(context.Context, string, string) (releaseInfo, io.Reader, error) {
|
|
return info, strings.NewReader("context"), nil
|
|
}
|
|
b, err := a.enqueueRelease("u", info)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
a.runImageBuild(b)
|
|
if err := scanBuildSummary(a.s.DB.QueryRow("SELECT "+buildSummaryColumns+" FROM image_builds WHERE id=?", b.ID), &b); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if b.Status != "failed" || b.ImageID != imageID || !strings.Contains(b.Error, "verification failed") || !deleted.Load() {
|
|
t.Fatalf("%+v cleanup=%v", b, deleted.Load())
|
|
}
|
|
w := imageRequest(a.images, sid, "GET", "")
|
|
var images []imageRecord
|
|
if err := json.Unmarshal(w.Body.Bytes(), &images); err != nil || w.Code != 200 || len(images) != 1 || images[0].Status != "unverified" {
|
|
t.Fatal("failed image advertised", w.Body.String())
|
|
}
|
|
w = imageRequest(a.instances, sid, "POST", fmt.Sprintf(`{"name":"rejected","image_id":%q}`, imageID))
|
|
if w.Code != 400 {
|
|
t.Fatal("unverified image accepted", w.Code, w.Body.String())
|
|
}
|
|
}
|
|
|
|
func writeImageInspect(w http.ResponseWriter, id, version string) {
|
|
parts := strings.Split(imagePlatform, "/")
|
|
writeJSON(w, map[string]any{"Id": id, "Os": parts[0], "Architecture": parts[1], "Config": map[string]any{"Labels": map[string]string{"dsh-mgr.role": "runtime", "dsh-mgr.version": version, "dsh-mgr.recipe": imageRecipeRev}}})
|
|
}
|