114 lines
6.3 KiB
JavaScript
114 lines
6.3 KiB
JavaScript
import assert from "node:assert/strict";
|
|
import { generateKeyPairSync } from "node:crypto";
|
|
import { mkdtemp, rm, writeFile } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { readConfig } from "../src/config.mjs";
|
|
|
|
const base = {
|
|
EXTERNAL_DATA_PLANE_DATABASE_URL: "postgresql://user:pass@example.invalid/data_plane",
|
|
NODEDC_INTERNAL_ACCESS_TOKEN: "legacy-internal-token",
|
|
};
|
|
|
|
const directory = await mkdtemp(join(tmpdir(), "nodedc-edp-config-"));
|
|
const secretPath = join(directory, "provisioner-token");
|
|
const publicKeyPath = join(directory, "engine-public-key.pem");
|
|
const secret = "provisioner_secret_is_separate_from_legacy_internal_token_123456";
|
|
try {
|
|
await writeFile(secretPath, `${secret}\n`, { encoding: "utf8", mode: 0o600 });
|
|
const { publicKey } = generateKeyPairSync("ed25519");
|
|
await writeFile(publicKeyPath, publicKey.export({ type: "spki", format: "pem" }), { mode: 0o600 });
|
|
const config = readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "true",
|
|
EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: secretPath,
|
|
EXTERNAL_DATA_PLANE_MAX_FUTURE_SKEW_SECONDS: "120",
|
|
EXTERNAL_DATA_PLANE_RETENTION_SWEEP_MS: "60000",
|
|
});
|
|
assert.equal(config.provisionerAccessToken, secret);
|
|
assert.equal(config.provisionerApiEnabled, true);
|
|
assert.equal(config.managedProvisionerApiEnabled, false);
|
|
assert.equal(config.maxFutureSkewSeconds, 120);
|
|
assert.equal(config.retentionSweepMs, 60000);
|
|
assert.equal(config.maxPatchBytes, 262144);
|
|
assert.equal(config.receiptRetentionMs, 604800000);
|
|
assert.equal(config.legacyIntakeEnabled, false);
|
|
assert.equal(readConfig({ ...base, EXTERNAL_DATA_PLANE_LEGACY_INTAKE_ENABLED: "true" }).legacyIntakeEnabled, true);
|
|
assert.throws(() => readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "true",
|
|
EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: secretPath,
|
|
NODEDC_INTERNAL_ACCESS_TOKEN: secret,
|
|
}), /provisioner_token_must_differ_from_internal_token/);
|
|
assert.throws(() => readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "true",
|
|
EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: join(directory, "missing"),
|
|
}), /external_data_plane_provisioner_token_file_unreadable/);
|
|
const managedConfig = readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "false",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "true",
|
|
EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: join(directory, "missing-token-is-ignored"),
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: publicKeyPath,
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID: "nodedc-engine",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID: "engine-edp-managed-provisioner-v1",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE: "nodedc-external-data-plane.managed-provisioning.v1",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_MAX_SKEW_SECONDS: "45",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_REPLAY_CACHE_MAX_ENTRIES: "500",
|
|
});
|
|
assert.equal(managedConfig.provisionerApiEnabled, false);
|
|
assert.equal(managedConfig.managedProvisionerApiEnabled, true);
|
|
assert.equal(managedConfig.provisionerAccessToken, "");
|
|
assert.equal(managedConfig.managedProvisionerPublicKey.asymmetricKeyType, "ed25519");
|
|
assert.equal(managedConfig.managedProvisionerServiceId, "nodedc-engine");
|
|
assert.equal(managedConfig.managedProvisionerKeyId, "engine-edp-managed-provisioner-v1");
|
|
assert.equal(managedConfig.managedProvisionerAudience, "nodedc-external-data-plane.managed-provisioning.v1");
|
|
assert.equal(managedConfig.managedProvisionerMaxSkewMs, 45_000);
|
|
assert.equal(managedConfig.managedProvisionerReplayCacheMaxEntries, 500);
|
|
const foundryConfig = readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONING_ENABLED: "true",
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_PUBLIC_KEY_FILE: publicKeyPath,
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_SERVICE_ID: "nodedc-module-foundry",
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_KEY_ID: "foundry-edp-managed-provisioner-v1",
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_AUDIENCE: "nodedc-external-data-plane.managed-provisioning.v1",
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_MAX_SKEW_SECONDS: "30",
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_REPLAY_CACHE_MAX_ENTRIES: "600",
|
|
});
|
|
assert.equal(foundryConfig.foundryProvisionerApiEnabled, true);
|
|
assert.equal(foundryConfig.foundryProvisionerPublicKey.asymmetricKeyType, "ed25519");
|
|
assert.equal(foundryConfig.foundryProvisionerServiceId, "nodedc-module-foundry");
|
|
assert.equal(foundryConfig.foundryProvisionerKeyId, "foundry-edp-managed-provisioner-v1");
|
|
assert.equal(foundryConfig.foundryProvisionerMaxSkewMs, 30_000);
|
|
assert.equal(foundryConfig.foundryProvisionerReplayCacheMaxEntries, 600);
|
|
assert.throws(() => readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "true",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: join(directory, "missing"),
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID: "nodedc-engine",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID: "engine-edp-managed-provisioner-v1",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE: "nodedc-external-data-plane.managed-provisioning.v1",
|
|
}), /external_data_plane_managed_provisioner_public_key_file_unreadable/);
|
|
assert.throws(() => readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "true",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: publicKeyPath,
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID: "invalid service id",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID: "engine-edp-managed-provisioner-v1",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE: "nodedc-external-data-plane.managed-provisioning.v1",
|
|
}), /external_data_plane_managed_provisioner_service_id_invalid/);
|
|
assert.equal(readConfig({
|
|
...base,
|
|
EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "false",
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "false",
|
|
EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: join(directory, "missing"),
|
|
EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: join(directory, "missing"),
|
|
EXTERNAL_DATA_PLANE_FOUNDRY_PROVISIONER_PUBLIC_KEY_FILE: join(directory, "missing"),
|
|
}).provisionerAccessToken, "");
|
|
} finally {
|
|
await rm(directory, { recursive: true, force: true });
|
|
}
|
|
|
|
console.log("external-data-plane config: ok");
|