Mercurial

annotate mrjunejune/test/production_bundle_exclusion_test.sh @ 271:13d61401c57d

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
redirect Copilot cache to service state Set XDG_CACHE_HOME from the configured inference state so the systemd service can extract Copilot outside its protected home directory. Co-authored-by: Copilot <[email protected]>
author MrJuneJune <me@mrjunejune.com>
date Fri, 07 Aug 2026 13:24:05 -0700
parents 04fee26ecce0
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
259
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
1 #!/usr/bin/env bash
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
2 set -euo pipefail
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
3
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
4 bundle="$1"
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
5
264
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
6 # Dereference symlinks so we scan the actual file tree.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
7 # Assert at least one regular file exists to catch an empty/broken bundle.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
8 file_count=$(find -L "$bundle" -type f | wc -l)
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
9 if [[ "$file_count" -eq 0 ]]; then
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
10 echo "Production bundle appears empty — no regular files found under $bundle" >&2
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
11 exit 1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
12 fi
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
13
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
14 # ── No .env file (contains real AWS credentials in developer environment) ─────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
15 if find -L "$bundle" -type f -name ".env" | grep -q .; then
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
16 echo "Production bundle contains .env (credential file)" >&2
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
17 exit 1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
18 fi
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
19
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
20 # ── No .config file (contains real secrets in developer environment) ──────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
21 if find -L "$bundle" -type f -name ".config" | grep -q .; then
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
22 echo "Production bundle contains .config (secret file)" >&2
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
23 exit 1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
24 fi
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
25
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
26 # ── No SQLite database, WAL, or SHM files ─────────────────────────────────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
27 if find -L "$bundle" -type f \( -name "*.db" -o -name "*.db-wal" -o -name "*.db-shm" \) | grep -q .; then
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
28 echo "Production bundle contains a database or WAL/SHM file" >&2
259
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
29 exit 1
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
30 fi
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
31
264
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
32 # ── No AUTH_COOKIE_SECRET values (non-hex-chars after = are false positive safe) ─
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
33 # Match a line that looks like AUTH_COOKIE_SECRET=<hex-looking value> (≥64 chars)
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
34 if grep -R -a -l -E 'AUTH_COOKIE_SECRET=[0-9a-fA-F]{64}' "$bundle"; then
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
35 echo "Production bundle contains an AUTH_COOKIE_SECRET assignment with a secret value" >&2
259
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
36 exit 1
667156fcd3e3 Add dev-only cyberpunk JRPG page
MrJuneJune <me@mrjunejune.com>
parents:
diff changeset
37 fi
264
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
38
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
39 # ── No zenbu-scrypt hashes (bootstrap password hashes) ────────────────────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
40 # The literal prefix "zenbu-scrypt$" followed by a v= parameter is the real hash
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
41 # format; safe references are only in comments or test-fixture strings in binaries.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
42 # We scan text files only (config, scripts, yaml) — not compiled binaries.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
43 if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
44 -exec grep -l 'zenbu-scrypt\$v=' {} \; | grep -q .; then
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
45 echo "Production bundle contains a zenbu-scrypt password hash in a config/script" >&2
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
46 exit 1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
47 fi
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
48
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
49 # ── No mjj_session or mjj_guest raw token values in config/scripts ─────────────
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
50 # Cookie *names* appear safely in source code; we check only config/script files.
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
51 if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
52 -exec grep -lE 'mjj_session=[A-Za-z0-9_-]{20,}|mjj_guest=[A-Za-z0-9_-]{20,}' {} \; | grep -q .; then
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
53 echo "Production bundle contains raw mjj_session/mjj_guest token values" >&2
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
54 exit 1
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
55 fi
04fee26ecce0 add authenticated JRPG conversation platform
MrJuneJune <me@mrjunejune.com>
parents: 259
diff changeset
56