Mercurial

comparison mrjunejune/test/production_bundle_exclusion_test.sh @ 264:04fee26ecce0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
add authenticated JRPG conversation platform Add reusable auth/session storage, owned conversation recovery, guest quotas, admin workflows, URL-routed conversation UI, mobile frame support, and parallel browser acceptance. Co-authored-by: Copilot <[email protected]>
author MrJuneJune <me@mrjunejune.com>
date Fri, 07 Aug 2026 07:34:12 -0700
parents 667156fcd3e3
children
comparison
equal deleted inserted replaced
263:ee04e4e69fed 264:04fee26ecce0
1 #!/usr/bin/env bash 1 #!/usr/bin/env bash
2 set -euo pipefail 2 set -euo pipefail
3 3
4 bundle="$1" 4 bundle="$1"
5 5
6 if find "$bundle" -type f | grep -E '/jrpg/|pixel-mplus-12-regular'; then 6 # Dereference symlinks so we scan the actual file tree.
7 echo "Production bundle contains development-only JRPG files" >&2 7 # Assert at least one regular file exists to catch an empty/broken bundle.
8 file_count=$(find -L "$bundle" -type f | wc -l)
9 if [[ "$file_count" -eq 0 ]]; then
10 echo "Production bundle appears empty — no regular files found under $bundle" >&2
8 exit 1 11 exit 1
9 fi 12 fi
10 13
11 if grep -R -a -l -E '"/jrpg"|/jrpg/index\.html' "$bundle"; then 14 # ── No .env file (contains real AWS credentials in developer environment) ─────
12 echo "Production bundle contains a development-only JRPG route" >&2 15 if find -L "$bundle" -type f -name ".env" | grep -q .; then
16 echo "Production bundle contains .env (credential file)" >&2
13 exit 1 17 exit 1
14 fi 18 fi
19
20 # ── No .config file (contains real secrets in developer environment) ──────────
21 if find -L "$bundle" -type f -name ".config" | grep -q .; then
22 echo "Production bundle contains .config (secret file)" >&2
23 exit 1
24 fi
25
26 # ── No SQLite database, WAL, or SHM files ─────────────────────────────────────
27 if find -L "$bundle" -type f \( -name "*.db" -o -name "*.db-wal" -o -name "*.db-shm" \) | grep -q .; then
28 echo "Production bundle contains a database or WAL/SHM file" >&2
29 exit 1
30 fi
31
32 # ── No AUTH_COOKIE_SECRET values (non-hex-chars after = are false positive safe) ─
33 # Match a line that looks like AUTH_COOKIE_SECRET=<hex-looking value> (≥64 chars)
34 if grep -R -a -l -E 'AUTH_COOKIE_SECRET=[0-9a-fA-F]{64}' "$bundle"; then
35 echo "Production bundle contains an AUTH_COOKIE_SECRET assignment with a secret value" >&2
36 exit 1
37 fi
38
39 # ── No zenbu-scrypt hashes (bootstrap password hashes) ────────────────────────
40 # The literal prefix "zenbu-scrypt$" followed by a v= parameter is the real hash
41 # format; safe references are only in comments or test-fixture strings in binaries.
42 # We scan text files only (config, scripts, yaml) — not compiled binaries.
43 if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
44 -exec grep -l 'zenbu-scrypt\$v=' {} \; | grep -q .; then
45 echo "Production bundle contains a zenbu-scrypt password hash in a config/script" >&2
46 exit 1
47 fi
48
49 # ── No mjj_session or mjj_guest raw token values in config/scripts ─────────────
50 # Cookie *names* appear safely in source code; we check only config/script files.
51 if find -L "$bundle" -type f \( -name "*.sh" -o -name "*.yaml" -o -name "*.json" -o -name ".config*" \) \
52 -exec grep -lE 'mjj_session=[A-Za-z0-9_-]{20,}|mjj_guest=[A-Za-z0-9_-]{20,}' {} \; | grep -q .; then
53 echo "Production bundle contains raw mjj_session/mjj_guest token values" >&2
54 exit 1
55 fi
56