mirror of
https://github.com/dokku/dokku.git
synced 2026-08-29 10:08:53 +02:00
81a929d768
The dynamic `dns-provider-*` properties were reported as `--traefik-dns-provider-<env_var>`, outside the `global`/`computed` namespace every other traefik property uses, so a consumer reading the json report could not tell which of the two a key represented. They are now reported as `--traefik-global-dns-provider-<env_var>`. The `basic-auth-password` property is a credential as well and is now masked in the default report output on the same terms as the dns provider values, meaning the raw value is returned only for `--format json` or when the flag is queried by name.
135 lines
4.1 KiB
Bash
135 lines
4.1 KiB
Bash
#!/usr/bin/env bats
|
|
|
|
load test_helper
|
|
|
|
setup() {
|
|
dokku traefik:set --global basic-auth-password
|
|
dokku traefik:set --global dns-provider-test_key
|
|
create_app
|
|
}
|
|
|
|
teardown() {
|
|
destroy_app
|
|
dokku traefik:set --global basic-auth-password >/dev/null 2>&1 || true
|
|
dokku traefik:set --global challenge-mode >/dev/null 2>&1 || true
|
|
dokku traefik:set --global dns-provider-test_key >/dev/null 2>&1 || true
|
|
}
|
|
|
|
@test "(traefik:report) info-flag works before deploy" {
|
|
run /bin/bash -c "dokku traefik:set --global challenge-mode"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-computed-challenge-mode"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "tls"
|
|
|
|
run /bin/bash -c "dokku traefik:report $TEST_APP --traefik-invalid-flag"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_failure
|
|
assert_output_contains "Invalid flag passed"
|
|
}
|
|
|
|
@test "(traefik:report) --format json" {
|
|
run /bin/bash -c "dokku traefik:report --global --format json | jq -e ."
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"computed-api-enabled\"'"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "false"
|
|
|
|
run /bin/bash -c "dokku traefik:report --global"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_contains "global traefik information"
|
|
}
|
|
|
|
@test "(traefik:report) dns-provider values are masked unless queried" {
|
|
run /bin/bash -c "dokku traefik:set --global dns-provider-test_key secretvalue"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku traefik:report --global | grep test_key"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_contains "*******"
|
|
|
|
run /bin/bash -c "dokku traefik:report --global --traefik-global-dns-provider-test_key"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "secretvalue"
|
|
|
|
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-dns-provider-test_key\"'"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "secretvalue"
|
|
}
|
|
|
|
@test "(traefik:report) basic-auth-password is masked unless queried" {
|
|
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-basic-auth-password\"'"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output ""
|
|
|
|
run /bin/bash -c "dokku traefik:report --global | grep 'basic auth password'"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_not_contains "*******"
|
|
|
|
run /bin/bash -c "dokku traefik:set --global basic-auth-password secretpassword"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku traefik:report --global | grep 'basic auth password'"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_contains "*******" 2
|
|
assert_output_not_contains "secretpassword"
|
|
|
|
run /bin/bash -c "dokku traefik:report --global --traefik-global-basic-auth-password"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "secretpassword"
|
|
|
|
run /bin/bash -c "dokku traefik:report --global --traefik-computed-basic-auth-password"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "secretpassword"
|
|
|
|
run /bin/bash -c "dokku traefik:report --global --format json | jq -r '.\"global-basic-auth-password\"'"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output "secretpassword"
|
|
}
|
|
|
|
@test "(traefik:report) credentials are masked in the aggregate report" {
|
|
run /bin/bash -c "dokku traefik:set --global dns-provider-test_key secretvalue"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku traefik:set --global basic-auth-password secretpassword"
|
|
assert_success
|
|
|
|
run /bin/bash -c "dokku report $TEST_APP"
|
|
echo "output: $output"
|
|
echo "status: $status"
|
|
assert_success
|
|
assert_output_contains "global dns provider test_key"
|
|
assert_output_contains "*******" -1
|
|
assert_output_not_contains "secretvalue"
|
|
assert_output_not_contains "secretpassword"
|
|
}
|