vrr/Pulse
2
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-07-10 00:14:38 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 8

Harden integration bootstrap token seed
Some checks are pending
Build and Test / Secret Scan (push) Waiting to run
Details
Build and Test / Frontend & Backend (push) Waiting to run
Details

Browse source
This commit is contained in:
rcourtman 2026-06-14 23:32:38 +01:00
parent fe0074c372
commit 54b7e9933d
2 changed files with 38 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

29
tests/integration/docker-compose.test.yml
View file

@ -10,13 +10,28 @@ services:
- PGID=${PGID:-1000}
volumes:
- test-data:/data
command: >
sh -c "set -e;
umask 077;
printf '%s\n' \"$$PULSE_E2E_BOOTSTRAP_TOKEN\" > /data/.bootstrap_token;
chown \"$${PUID:-1000}:$${PGID:-1000}\" /data /data/.bootstrap_token;
chmod 700 /data;
chmod 600 /data/.bootstrap_token"
command:
- sh
- -c
- |
set -e
umask 077
: "$${PULSE_E2E_BOOTSTRAP_TOKEN:?PULSE_E2E_BOOTSTRAP_TOKEN is required}"
token="$${PULSE_E2E_BOOTSTRAP_TOKEN}"
if [ "$${#token}" -ne 48 ]; then
echo "PULSE_E2E_BOOTSTRAP_TOKEN must be a 48-character hex token" >&2
exit 1
fi
case "$${token}" in
*[!0123456789abcdefABCDEF]*)
echo "PULSE_E2E_BOOTSTRAP_TOKEN must be a 48-character hex token" >&2
exit 1
;;
esac
printf '%s\n' "$${token}" > /data/.bootstrap_token
chown "$${PUID:-1000}:$${PGID:-1000}" /data /data/.bootstrap_token
chmod 700 /data
chmod 600 /data/.bootstrap_token
networks:
- test-network

16
tests/integration/scripts/pretest.test.mjs
View file

@ -1,4 +1,5 @@
import assert from 'node:assert/strict';
import { readFileSync } from 'node:fs';
import test from 'node:test';
import {
@ -142,3 +143,18 @@ test('validateBootstrapTokenForFirstRun validates the seed token before first-ru
assert.equal(calls[1].url, 'http://localhost:7655/api/security/validate-bootstrap-token');
assert.equal(calls[1].options.body, JSON.stringify({ token: 'token-123' }));
});
test('docker compose bootstrap seed expands the token inside the seed container shell', () => {
const compose = readFileSync(new URL('../docker-compose.test.yml', import.meta.url), 'utf8');
assert.match(compose, /command:\n\s+- sh\n\s+- -c\n\s+- \|/);
assert.ok(
compose.includes(': "$${PULSE_E2E_BOOTSTRAP_TOKEN:?PULSE_E2E_BOOTSTRAP_TOKEN is required}"'),
);
assert.ok(compose.includes('token="$${PULSE_E2E_BOOTSTRAP_TOKEN}"'));
assert.ok(compose.includes('if [ "$${#token}" -ne 48 ]; then'));
assert.ok(
compose.includes('printf \'%s\\n\' "$${token}" > /data/.bootstrap_token'),
);
assert.doesNotMatch(compose, /"\$\$PULSE_E2E_BOOTSTRAP_TOKEN"/);
});