79 lines
2.3 KiB
Python
79 lines
2.3 KiB
Python
"""Prod env checker: failures block deploys, warnings don't."""
|
|
|
|
import sys
|
|
from pathlib import Path
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parent.parent.parent
|
|
sys.path.insert(0, str(REPO_ROOT / "backend" / "scripts"))
|
|
|
|
from check_prod import check
|
|
|
|
|
|
def _good() -> dict:
|
|
return {
|
|
"CALLBACK_TOKEN": "t" * 40,
|
|
"LANGFLOW_API_KEY": "k" * 24,
|
|
"LFX_API_KEY": "x" * 24,
|
|
"LANGFLOW_SUPERUSER_PASSWORD": "p" * 20,
|
|
"LANGFLOW_SECRET_KEY": "s" * 40,
|
|
"FRONTEND_MODE": "preview",
|
|
"ADMIN_EMAILS": "admin@example.com",
|
|
"SMTP_HOST": "smtp.example.com",
|
|
"SMTP_PASSWORD": "secret",
|
|
"CONTACT_TO": "team@example.com",
|
|
"FRONTEND_URL": "https://example.com",
|
|
}
|
|
|
|
|
|
def test_good_env_passes_without_warnings():
|
|
failures, warnings = check(_good())
|
|
assert failures == []
|
|
assert warnings == []
|
|
|
|
|
|
def test_empty_and_short_secrets_fail():
|
|
values = _good()
|
|
values["CALLBACK_TOKEN"] = ""
|
|
values["LANGFLOW_SUPERUSER_PASSWORD"] = "short"
|
|
failures, _ = check(values)
|
|
assert any("CALLBACK_TOKEN" in f for f in failures)
|
|
assert any("LANGFLOW_SUPERUSER_PASSWORD" in f for f in failures)
|
|
|
|
|
|
def test_placeholders_fail():
|
|
values = _good()
|
|
values["LANGFLOW_API_KEY"] = "sk-"
|
|
values["LFX_API_KEY"] = "lfx-abc"
|
|
failures, _ = check(values)
|
|
assert any("LANGFLOW_API_KEY" in f for f in failures)
|
|
assert any("LFX_API_KEY" in f for f in failures)
|
|
|
|
|
|
def test_insecure_modes_fail():
|
|
values = _good()
|
|
values["FRONTEND_MODE"] = "dev"
|
|
values["APP_ENV"] = "dev"
|
|
values["LANGFLOW_AUTO_LOGIN"] = "true"
|
|
failures, _ = check(values)
|
|
assert len([f for f in failures if "FRONTEND_MODE" in f]) == 1
|
|
assert len([f for f in failures if "APP_ENV" in f]) == 1
|
|
assert len([f for f in failures if "AUTO_LOGIN" in f]) == 1
|
|
|
|
|
|
def test_soft_misconfigurations_warn_only():
|
|
values = _good()
|
|
values["ADMIN_EMAILS"] = ""
|
|
values["SMTP_PASSWORD"] = ""
|
|
values["CONTACT_TO"] = ""
|
|
values["FRONTEND_URL"] = "http://example.com"
|
|
failures, warnings = check(values)
|
|
assert failures == []
|
|
assert len(warnings) == 4
|
|
|
|
|
|
def test_example_file_would_not_pass():
|
|
from check_prod import parse_env
|
|
|
|
values = parse_env(REPO_ROOT / ".env.example")
|
|
failures, _ = check(values)
|
|
assert failures, "placeholders must be detectable"
|