47 lines
1.8 KiB
TypeScript
47 lines
1.8 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import {
|
|
parseTenantRehomeArgs,
|
|
validateBackupEvidenceObject,
|
|
} from '../../scripts/rehome-tenant.mjs';
|
|
|
|
const source = '01J00000000000000000000001';
|
|
const target = '01J00000000000000000000002';
|
|
const actor = '01J00000000000000000000003';
|
|
const sha256 = 'a'.repeat(64);
|
|
|
|
describe('tenant rehome argument and evidence validation', () => {
|
|
it('requires explicit apply mode and a backup evidence path', () => {
|
|
expect(() => parseTenantRehomeArgs(['--source', source, '--target', target])).toThrow('--dry-run or --apply');
|
|
expect(() => parseTenantRehomeArgs(['--apply', '--source', source, '--target', target, '--actor', actor]))
|
|
.toThrow('--backup-evidence is required');
|
|
});
|
|
|
|
it('accepts only evidence with encrypted off-host backup and a matching successful restore', () => {
|
|
const fullEvidence = {
|
|
backup: {
|
|
format: 'pg_dump -Fc' as const,
|
|
encrypted: true as const,
|
|
offHost: true as const,
|
|
sha256,
|
|
createdAt: '2026-09-26T08:00:00Z',
|
|
},
|
|
restoreDrill: {
|
|
status: 'passed' as const,
|
|
backupSha256: sha256,
|
|
restoredAt: '2026-09-26T08:30:00Z',
|
|
verifiedAt: '2026-09-26T08:45:00Z',
|
|
isolatedDatabase: 'krona_staff_restore_check',
|
|
},
|
|
};
|
|
expect(validateBackupEvidenceObject(fullEvidence)).toEqual(fullEvidence);
|
|
expect(() => validateBackupEvidenceObject({
|
|
backupSha256: sha256,
|
|
backupCreatedAt: '2026-09-26T08:00:00Z',
|
|
restoreVerifiedAt: '2026-09-26T08:45:00Z',
|
|
})).toThrow('does not attest an encrypted off-host custom dump');
|
|
expect(() => validateBackupEvidenceObject({
|
|
...fullEvidence,
|
|
restoreDrill: { ...fullEvidence.restoreDrill, backupSha256: 'b'.repeat(64) },
|
|
})).toThrow('does not attest an encrypted off-host custom dump');
|
|
});
|
|
});
|