Frank
c58dab0a89
The homepage user page + shared data now use a dedicated CADDY_HOMEPAGE_HASH (username dankuser), separate from the shared family password (CADDY_BASICAUTH_HASH, username dank, still used by the other vhosts) and the operator password (CADDY_ADMIN_HASH, username frank, the /admin/ page). This lets the homepage be re-logged independently without touching the other sites. deploy.sh renders the new placeholder; the .env.example documents all three hashes.
48 lines
2.0 KiB
Bash
48 lines
2.0 KiB
Bash
#!/usr/bin/env bats
|
|
# Seam: the homepage site block in dankclaw/Caddyfile. It must carry a root
|
|
# basicauth hash and a distinct /admin/-scoped admin hash (Q18/Q19), and serve
|
|
# /srv/homepage. caddy is not on the dev box, so the tests assert the
|
|
# structure statically; the deploy renders the two real hashes from the .env.
|
|
|
|
load helpers
|
|
|
|
setup() {
|
|
CADDY="$REPO_ROOT/dankclaw/Caddyfile"
|
|
}
|
|
|
|
@test "the homepage has its own hash and a distinct admin hash" {
|
|
grep -q "REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
|
|
grep -q "REPLACE_WITH_ADMIN_HASH" "$CADDY"
|
|
}
|
|
|
|
@test "the admin basicauth is scoped to /admin/ (Q19)" {
|
|
# The admin page is a 'handle /admin*' block with the operator (frank)
|
|
# credential. Caddy sorts a top-level 'rewrite' before 'basicauth', which
|
|
# would change the path and break the path-based auth matcher; 'handle'
|
|
# preserves order, so the auth is checked on the original path.
|
|
grep -qE "handle[[:space:]]+/admin\*" "$CADDY"
|
|
grep -qE "frank[[:space:]]+REPLACE_WITH_ADMIN_HASH" "$CADDY"
|
|
}
|
|
|
|
@test "the homepage serves /srv/homepage" {
|
|
grep -q "root \* /srv/homepage" "$CADDY"
|
|
grep -q "file_server" "$CADDY"
|
|
}
|
|
|
|
@test "the /admin/ page serves admin.html and / serves index.html" {
|
|
# Each page is served by its own 'handle' block via 'try_files' (which
|
|
# serves the named file without a top-level 'rewrite' that Caddy would
|
|
# sort before the basicauth).
|
|
grep -qE "try_files[[:space:]]+/admin.html" "$CADDY"
|
|
grep -qE "try_files[[:space:]]+/index.html" "$CADDY"
|
|
}
|
|
|
|
@test "the shared data + assets accept both the family and the operator" {
|
|
# The admin page (frank) and the user page (dank) both fetch the shared
|
|
# data (services.json, status.json) and assets. The browser reuses the
|
|
# page's credential for these, so the block must accept both users.
|
|
grep -qE "@data[[:space:]]+path[[:space:]]+/services\.json[[:space:]]+/status\.json" "$CADDY"
|
|
grep -qE "handle[[:space:]]+@data" "$CADDY"
|
|
grep -qE "dankuser[[:space:]]+REPLACE_WITH_HOMEPAGE_HASH" "$CADDY"
|
|
}
|