27 lines
901 B
Python
27 lines
901 B
Python
from pathlib import Path
|
|
import re
|
|
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_vault_cache_is_a_persistent_named_volume():
|
|
compose = (ROOT / "compose.yaml").read_text()
|
|
assert "vault-cache:/data/vault-cache" in compose
|
|
assert "volumes:\n vault-cache:" in compose
|
|
|
|
|
|
def test_vault_sync_uses_protected_environment_instead_of_embedded_password():
|
|
script = (ROOT / "vault-sync.sh").read_text()
|
|
assert '.vault-sync.env' in script
|
|
assert not re.search(r'export BW_PASSWORD=["\'](?!\$)', script)
|
|
assert 'BW_CLIENTID' in script
|
|
assert 'BW_CLIENTSECRET' in script
|
|
assert 'bw login --apikey' in script
|
|
assert 'bw unlock --passwordenv BW_PASSWORD' in script
|
|
|
|
|
|
def test_vault_sync_runtime_files_are_not_tracked():
|
|
gitignore = (ROOT / ".gitignore").read_text().splitlines()
|
|
assert ".vault-sync.env" in gitignore
|
|
assert "vault-sync.log" in gitignore
|