tegwick
4143f7c004
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 37s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834
39 lines
1.4 KiB
Python
39 lines
1.4 KiB
Python
from __future__ import annotations
|
|
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from sbom_nexus.config import database_target, migration_role
|
|
|
|
|
|
def test_database_target_prefers_secret_file(monkeypatch, tmp_path: Path) -> None:
|
|
secret = tmp_path / "url"
|
|
secret.write_text("postgresql://mounted-secret\n", encoding="utf-8")
|
|
monkeypatch.setenv("SBOM_NEXUS_DATABASE_URL_FILE", str(secret))
|
|
monkeypatch.setenv("SBOM_NEXUS_DATABASE_URL", "postgresql://environment")
|
|
|
|
assert database_target() == "postgresql://mounted-secret"
|
|
|
|
|
|
def test_database_target_rejects_empty_secret_file(monkeypatch, tmp_path: Path) -> None:
|
|
secret = tmp_path / "url"
|
|
secret.write_text("\n", encoding="utf-8")
|
|
monkeypatch.setenv("SBOM_NEXUS_DATABASE_URL_FILE", str(secret))
|
|
|
|
with pytest.raises(RuntimeError, match="is empty"):
|
|
database_target()
|
|
|
|
|
|
def test_migration_role_accepts_a_postgres_identifier(monkeypatch) -> None:
|
|
monkeypatch.setenv("SBOM_NEXUS_MIGRATION_ROLE", "sbom_nexus_owner")
|
|
|
|
assert migration_role() == "sbom_nexus_owner"
|
|
|
|
|
|
@pytest.mark.parametrize("role", ["owner; DROP DATABASE postgres", "UpperCase", 'bad"role'])
|
|
def test_migration_role_rejects_unsafe_identifiers(monkeypatch, role: str) -> None:
|
|
monkeypatch.setenv("SBOM_NEXUS_MIGRATION_ROLE", role)
|
|
|
|
with pytest.raises(RuntimeError, match="PostgreSQL identifier"):
|
|
migration_role()
|