55 lines
2.2 KiB
TypeScript
55 lines
2.2 KiB
TypeScript
import { describe, expect, it } from 'vitest';
|
|
import {
|
|
parseTenantRehomeArgs,
|
|
validateBackupEvidenceObject,
|
|
} from '../../scripts/rehome-tenant.mjs';
|
|
|
|
const source = '01J00000000000000000000001';
|
|
const target = '01J00000000000000000000002';
|
|
const actor = '01J00000000000000000000003';
|
|
const sha256 = 'a'.repeat(64);
|
|
|
|
describe('tenant rehome argument and evidence validation', () => {
|
|
it('defaults to read-only dry-run and accepts the published CLI aliases', () => {
|
|
expect(parseTenantRehomeArgs(['--from', source, '--to', target, '--json'])).toEqual({
|
|
mode: 'dry-run', source, target, json: true,
|
|
});
|
|
expect(parseTenantRehomeArgs(['--dry-run', '--source', source, '--target', target]).mode).toBe('dry-run');
|
|
});
|
|
|
|
it('requires backup evidence for every apply invocation', () => {
|
|
expect(() => parseTenantRehomeArgs(['--apply', '--from', source, '--to', target, '--actor', actor]))
|
|
.toThrow('--backup-evidence is required');
|
|
expect(() => parseTenantRehomeArgs(['--from', source, '--source', source, '--to', target]))
|
|
.toThrow('Duplicate option for source.');
|
|
});
|
|
|
|
it('accepts only evidence with encrypted off-host backup and a matching successful restore', () => {
|
|
const fullEvidence = {
|
|
backup: {
|
|
format: 'pg_dump -Fc' as const,
|
|
encrypted: true as const,
|
|
offHost: true as const,
|
|
sha256,
|
|
createdAt: '2026-09-26T08:00:00Z',
|
|
},
|
|
restoreDrill: {
|
|
status: 'passed' as const,
|
|
backupSha256: sha256,
|
|
restoredAt: '2026-09-26T08:30:00Z',
|
|
verifiedAt: '2026-09-26T08:45:00Z',
|
|
isolatedDatabase: 'krona_staff_restore_check',
|
|
},
|
|
};
|
|
expect(validateBackupEvidenceObject(fullEvidence)).toEqual(fullEvidence);
|
|
expect(() => validateBackupEvidenceObject({
|
|
backupSha256: sha256,
|
|
backupCreatedAt: '2026-09-26T08:00:00Z',
|
|
restoreVerifiedAt: '2026-09-26T08:45:00Z',
|
|
})).toThrow('does not attest an encrypted off-host custom dump');
|
|
expect(() => validateBackupEvidenceObject({
|
|
...fullEvidence,
|
|
restoreDrill: { ...fullEvidence.restoreDrill, backupSha256: 'b'.repeat(64) },
|
|
})).toThrow('does not attest an encrypted off-host custom dump');
|
|
});
|
|
});
|