32 lines
1.7 KiB
JavaScript
32 lines
1.7 KiB
JavaScript
import { readFileSync } from "node:fs";
|
|
import path from "node:path";
|
|
import { fileURLToPath } from "node:url";
|
|
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
const scriptDirectory = path.dirname(fileURLToPath(import.meta.url));
|
|
const source = readFileSync(path.join(scriptDirectory, "verify-migrations-schema-parity.sh"), "utf8");
|
|
|
|
describe("migration/schema parity RLS prerequisites", () => {
|
|
it("provisions every restricted login before replaying migrations", () => {
|
|
expect(source).toContain('HIVEGRID_RLS_PROVISION_DATABASE_URL="$SHADOW_ADMIN_URL"');
|
|
expect(source).toContain('HIVEGRID_RLS_MIGRATOR_PASSWORD="$PARITY_MIGRATOR_PASSWORD"');
|
|
expect(source).toContain('HIVEGRID_RLS_APP_PASSWORD="$PARITY_APP_PASSWORD"');
|
|
expect(source).toContain('HIVEGRID_RLS_PORTAL_PASSWORD="$PARITY_PORTAL_PASSWORD"');
|
|
expect(source).toContain('HIVEGRID_RLS_WORKER_PASSWORD="$PARITY_WORKER_PASSWORD"');
|
|
expect(source).toContain('HIVEGRID_RLS_AUTHENTIK_JIT_PASSWORD="$PARITY_AUTHENTIK_JIT_PASSWORD"');
|
|
expect(source).toContain("node scripts/provision-rls-roles.mjs");
|
|
});
|
|
|
|
it("replays the migration chain as the non-superuser migrator", () => {
|
|
expect(source).toContain('SHADOW_MIGRATOR_URL="postgresql://hivegrid_migrator:');
|
|
expect(source).toContain('DATABASE_URL="$SHADOW_MIGRATOR_URL" DIRECT_URL="$SHADOW_MIGRATOR_URL" SHADOW_DATABASE_URL="$SHADOW_MIGRATOR_URL"');
|
|
expect(source.indexOf("node scripts/provision-rls-roles.mjs")).toBeLessThan(source.indexOf("pnpm exec prisma migrate diff"));
|
|
});
|
|
|
|
it("never falls back to the bootstrap superuser for Prisma migration replay", () => {
|
|
expect(source).not.toMatch(/^DATABASE_URL="\$SHADOW_ADMIN_URL"/mu);
|
|
expect(source).not.toMatch(/^SHADOW_DATABASE_URL="\$SHADOW_ADMIN_URL"/mu);
|
|
});
|
|
});
|