31 lines
1.2 KiB
TypeScript
31 lines
1.2 KiB
TypeScript
import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs'
|
|
import { tmpdir } from 'node:os'
|
|
import { join } from 'node:path'
|
|
import { afterEach, describe, expect, it } from 'vitest'
|
|
import { collectConfigSourceOwnershipViolations } from './verify-config-source-ownership.ts'
|
|
|
|
const roots: string[] = []
|
|
|
|
afterEach(() => {
|
|
for (const root of roots.splice(0)) rmSync(root, { recursive: true, force: true })
|
|
})
|
|
|
|
describe('configuration source ownership gate', () => {
|
|
it('rejects inline endpoints in shipped bundle patches', () => {
|
|
const root = mkdtempSync(join(tmpdir(), 'dsh-config-source-ownership-'))
|
|
roots.push(root)
|
|
const directory = join(root, 'packages/bundle/base')
|
|
mkdirSync(directory, { recursive: true })
|
|
writeFileSync(
|
|
join(directory, 'cordis.patch.yml'),
|
|
'config:\n baseURL: !!js process.env.DEEPSEEK_SEARCH_BASE_URL\n',
|
|
)
|
|
|
|
expect(collectConfigSourceOwnershipViolations(root)).toEqual([
|
|
'packages/bundle/base/cordis.patch.yml:2: inlines a credential or endpoint from the environment.'
|
|
+ ' The adapter resolves apiKeyEnv through ctx.credentials and the endpoint through the'
|
|
+ ' environment snapshot; inlining here bypasses both ladders.',
|
|
])
|
|
})
|
|
})
|