wehub-resource-sync
42 lines
1.6 KiB
TypeScript
42 lines
1.6 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import fs from 'fs';
|
|
import path from 'path';
|
|
import { fileURLToPath } from 'url';
|
|
|
|
const currentDir = path.dirname(fileURLToPath(import.meta.url));
|
|
const migrationDir = path.resolve(currentDir, '../../src/infra/database/migrations');
|
|
const migrationFile = '048_project-admin-database-create-privilege.sql';
|
|
const migrationPath = path.resolve(migrationDir, migrationFile);
|
|
|
|
function readMigration(): string {
|
|
return fs.readFileSync(migrationPath, 'utf8');
|
|
}
|
|
|
|
describe('project admin database create privilege migration', () => {
|
|
it('migration file exists and runs after internal runtime defaults hardening', () => {
|
|
expect(fs.existsSync(migrationPath)).toBe(true);
|
|
|
|
const migrations = fs
|
|
.readdirSync(migrationDir)
|
|
.filter((file) => file.endsWith('.sql'))
|
|
.sort();
|
|
|
|
const migrationIndex = migrations.indexOf(migrationFile);
|
|
const predecessorIndex = migrations.indexOf('047_harden-internal-runtime-defaults.sql');
|
|
|
|
expect(predecessorIndex).not.toBe(-1);
|
|
expect(migrationIndex).not.toBe(-1);
|
|
expect(migrationIndex).toBeGreaterThan(predecessorIndex);
|
|
});
|
|
|
|
it('grants database CREATE to project_admin without assuming the role or database name', () => {
|
|
const sql = readMigration();
|
|
|
|
expect(sql).toMatch(/IF EXISTS \(SELECT 1 FROM pg_roles WHERE rolname = 'project_admin'\)/i);
|
|
expect(sql).toMatch(
|
|
/EXECUTE format\('GRANT CREATE ON DATABASE %I TO project_admin', current_database\(\)\)/i
|
|
);
|
|
expect(sql).not.toMatch(/GRANT CREATE ON DATABASE\s+(?!%I)/i);
|
|
});
|
|
});
|