EngineScript/scripts/ci/test-sql-credentials.sh at master · EngineScript/EngineScript

History

381 lines (316 loc) · 14.1 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

294

295

296

297

298

299

300

301

302

303

304

305

306

307

308

309

310

311

312

313

314

315

316

317

318

319

320

321

322

323

324

325

326

327

328

329

330

331

332

333

334

335

336

337

338

339

340

341

342

343

344

345

346

347

348

349

350

351

352

353

354

355

356

357

358

359

360

361

362

363

364

365

366

367

368

369

370

371

372

373

374

375

376

377

378

379

380

381

#!/usr/bin/env bash

#----------------------------------------------------------------------------------

# EngineScript - A High-Performance WordPress Server Built on Ubuntu and Cloudflare

#----------------------------------------------------------------------------------

# Website: https://EngineScript.com

# GitHub: https://github.com/Enginescript/EngineScript

# License: GPL v3.0

#----------------------------------------------------------------------------------

# CI Test: SQL Credential Creation

# Tests the database credential generation, validation, and SQL execution

# functions used by vhost-install.sh and vhost-import.sh. It also checks the

# vhost import/export source for the canonical single-archive format contract.

# This script sources the shared enginescript-db-credentials.sh library and

# calls the exact same functions that production uses, so any change to

# the credential logic is automatically tested. Archive contract checks are

# intentionally source-level because vhost-import.sh and vhost-export.sh are

# interactive production scripts that require a real WordPress site.

#----------------------------------------------------------------------------------

set -euo pipefail

# CI safety net: if running inside GitHub Actions, re-exec under a timeout so a

# future stall cannot reach the runner's default 6-hour limit.

if [[ "${CI:-}" == "true" && "${_CI_TIMEOUT_GUARD:-}" != "1" ]]; then

export _CI_TIMEOUT_GUARD=1

exec timeout 600 "$0" "$@"

# Resolve the repo root relative to this script's location (scripts/ci/)

REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"

# Source the shared database credential functions from the repo checkout

source "${REPO_ROOT}/scripts/functions/shared/enginescript-db-credentials.sh" || {

echo "Error: Failed to source enginescript-db-credentials.sh" >&2

exit 1

}

TESTS_PASSED=0

TESTS_FAILED=0

pass() {

echo " PASSED: $1"

TESTS_PASSED=$((TESTS_PASSED + 1))

}

fail() {

echo " FAILED: $1" >&2

TESTS_FAILED=$((TESTS_FAILED + 1))

}

assert_file_contains() {

local file_path="$1"

local pattern="$2"

local description="$3"

if grep -Eq -- "${pattern}" "${file_path}"; then

pass "${description}"

else

fail "${description}"

}

#----------------------------------------------------------------------------------

# Test 1: vhost-install credential creation methods

#----------------------------------------------------------------------------------

echo ""

echo "======================================================="

echo " Test 1: vhost-install.sh credential methods"

echo "======================================================="

echo ""

# --- Step 1: Generate random characters ---

echo "Step 1: Source enginescript-variables.txt for random credentials"

source "${REPO_ROOT}/enginescript-variables.txt"

if [[ ${#RAND_CHAR2} -eq 2 ]]; then

pass "RAND_CHAR2 length is 2 (got '${RAND_CHAR2}')"

else

fail "RAND_CHAR2 length should be 2, got ${#RAND_CHAR2} ('${RAND_CHAR2}')"

if [[ ${#RAND_CHAR4} -eq 4 && "${RAND_CHAR4}" =~ ^[a-zA-Z0-9]+$ ]]; then

pass "RAND_CHAR4 length is 4, charset valid (got '${RAND_CHAR4}')"

else

fail "RAND_CHAR4 invalid: length=${#RAND_CHAR4}, value='${RAND_CHAR4}'"

if [[ ${#RAND_CHAR16} -eq 16 && "${RAND_CHAR16}" =~ ^[a-zA-Z0-9]+$ ]]; then

pass "RAND_CHAR16 length is 16, charset valid"

else

fail "RAND_CHAR16 invalid: length=${#RAND_CHAR16}"

if [[ ${#RAND_CHAR32} -eq 32 && "${RAND_CHAR32}" =~ ^[a-zA-Z0-9_]+$ ]]; then

pass "RAND_CHAR32 length is 32, charset valid"

else

fail "RAND_CHAR32 invalid: length=${#RAND_CHAR32}"

# --- Step 2: Generate install DB name ---

echo ""

echo "Step 2: generate_install_db_name"

INSTALL_DOMAIN="wordpresstesting.com"

generate_install_db_name "${INSTALL_DOMAIN}" || { fail "generate_install_db_name returned non-zero"; }

if [[ -n "${ES_DB_NAME:-}" ]]; then

pass "ES_DB_NAME is set: '${ES_DB_NAME}'"

else

fail "ES_DB_NAME is empty after generate_install_db_name"

if [[ ${#ES_DB_NAME} -le 64 ]]; then

pass "ES_DB_NAME length (${#ES_DB_NAME}) <= 64 char limit"

else

fail "ES_DB_NAME length (${#ES_DB_NAME}) exceeds 64 char limit"

# --- Step 3: Validate install credentials ---

echo ""

echo "Step 3: validate_install_credentials"

database_name="${ES_DB_NAME}"

database_user="${RAND_CHAR16}"

database_password="${RAND_CHAR32}"

if validate_install_credentials "${database_user}" "${database_password}" "${INSTALL_DOMAIN}"; then

pass "validate_install_credentials accepted generated credentials"

else

fail "validate_install_credentials rejected generated credentials"

# --- Step 4: Write credentials file ---

echo ""

echo "Step 4: write_credentials_file"

INSTALL_CREDS_DIR="$(mktemp -d)"

write_credentials_file "${INSTALL_CREDS_DIR}" "${INSTALL_DOMAIN}" "${database_name}" "${database_user}" "${database_password}"

if [[ -f "${INSTALL_CREDS_DIR}/${INSTALL_DOMAIN}.txt" ]]; then

pass "Credentials file created at ${INSTALL_CREDS_DIR}/${INSTALL_DOMAIN}.txt"

else

fail "Credentials file not found"

if [[ -n "${DB:-}" && -n "${USR:-}" && -n "${PSWD:-}" ]]; then

pass "DB, USR, PSWD variables set after sourcing credentials file"

else

fail "DB, USR, or PSWD not set after sourcing credentials file"

if [[ "${DB}" == "${database_name}" && "${USR}" == "${database_user}" && "${PSWD}" == "${database_password}" ]]; then

pass "Sourced values match written values"

else

fail "Sourced values do not match written values"

# --- Step 5: Execute SQL ---

echo ""

echo "Step 5: execute_install_sql"

if execute_install_sql "${DB}" "${USR}" "${PSWD}" "${INSTALL_DOMAIN}"; then

pass "execute_install_sql completed successfully"

else

fail "execute_install_sql returned non-zero"

# --- Step 6: Verify in MariaDB ---

echo ""

echo "Step 6: Verify database and user in MariaDB"

if sudo mariadb -e "SHOW DATABASES LIKE '${DB}';" | grep -q "${DB}"; then

pass "Database '${DB}' exists in MariaDB"

else

fail "Database '${DB}' not found in MariaDB"

if sudo mariadb -e "SELECT User FROM mysql.user WHERE User='${USR}';" | grep -q "${USR}"; then

pass "User '${USR}' exists in MariaDB"

else

fail "User '${USR}' not found in MariaDB"

# Clean up temp dir

rm -rf "${INSTALL_CREDS_DIR}"

echo ""

echo " vhost-install test complete."

#----------------------------------------------------------------------------------

# Test 2: vhost-import credential creation methods

#----------------------------------------------------------------------------------

echo ""

echo "======================================================="

echo " Test 2: vhost-import.sh credential methods"

echo "======================================================="

echo ""

# --- Step 1: Generate random characters (fresh set) ---

echo "Step 1: Source enginescript-variables.txt for random credentials (fresh)"

source "${REPO_ROOT}/enginescript-variables.txt"

if [[ ${#RAND_CHAR4} -eq 4 && ${#RAND_CHAR16} -eq 16 && ${#RAND_CHAR32} -eq 32 ]]; then

pass "Fresh RAND_CHAR4/16/32 generated with correct lengths"

else

fail "Fresh random credentials have incorrect lengths"

# --- Step 2: Domain name construction (import method) ---

echo ""

echo "Step 2: generate_import_db_name"

IMPORT_DOMAIN="importtest.com"

DB_CHARSET="utf8mb4"

generate_import_db_name "${IMPORT_DOMAIN}" || { fail "generate_import_db_name returned non-zero"; }

DB="${ES_DB_NAME}"

USR="${RAND_CHAR16}"

PSWD="${RAND_CHAR32}"

GENERATED_IMPORT_DB="${DB}"

GENERATED_IMPORT_USR="${USR}"

GENERATED_IMPORT_PSWD="${PSWD}"

if [[ -n "${DB}" && "${DB}" == "importtest_${RAND_CHAR4}" ]]; then

pass "Import DB constructed and assigned like vhost-import.sh: '${DB}'"

else

fail "Import DB construction unexpected: '${DB}'"

if [[ -n "${USR}" && -n "${PSWD}" ]]; then

pass "Import USR and PSWD assigned like vhost-import.sh"

else

fail "Import USR or PSWD was not assigned"

# --- Step 3: Write credentials file ---

echo ""

echo "Step 3: write_credentials_file"

IMPORT_CREDS_DIR="$(mktemp -d)"

write_credentials_file "${IMPORT_CREDS_DIR}" "${IMPORT_DOMAIN}" "${DB}" "${USR}" "${PSWD}"

if [[ -f "${IMPORT_CREDS_DIR}/${IMPORT_DOMAIN}.txt" ]]; then

pass "Credentials file created"

else

fail "Credentials file not found"

if [[ "${DB}" == "${GENERATED_IMPORT_DB}" && "${USR}" == "${GENERATED_IMPORT_USR}" && "${PSWD}" == "${GENERATED_IMPORT_PSWD}" ]]; then

pass "Sourced values preserve generated import credentials"

else

fail "Sourced values do not preserve generated import credentials"

# --- Step 4: Validate import credentials ---

echo ""

echo "Step 4: validate_import_credentials"

if validate_import_credentials "${DB}" "${USR}" "${PSWD}" "${DB_CHARSET}"; then

pass "validate_import_credentials accepted generated credentials"

else

fail "validate_import_credentials rejected generated credentials"

if [[ "${ES_DB_CHARSET_VALIDATED}" == "utf8mb4" ]]; then

pass "ES_DB_CHARSET_VALIDATED = '${ES_DB_CHARSET_VALIDATED}'"

else

fail "ES_DB_CHARSET_VALIDATED unexpected: '${ES_DB_CHARSET_VALIDATED}'"

if [[ "${ES_DB_COLLATION}" == "utf8mb4_unicode_ci" ]]; then

pass "ES_DB_COLLATION = '${ES_DB_COLLATION}'"

else

fail "ES_DB_COLLATION unexpected: '${ES_DB_COLLATION}'"

# --- Step 5: Execute SQL ---

echo ""

echo "Step 5: execute_import_sql"

if execute_import_sql "${DB}" "${USR}" "${PSWD}" "${ES_DB_CHARSET_VALIDATED}" "${ES_DB_COLLATION}"; then

pass "execute_import_sql completed successfully"

else

fail "execute_import_sql returned non-zero"

# --- Step 6: Verify in MariaDB ---

echo ""

echo "Step 6: Verify database and user in MariaDB"

if sudo mariadb -e "SHOW DATABASES LIKE '${DB}';" | grep -q "${DB}"; then

pass "Database '${DB}' exists in MariaDB"

else

fail "Database '${DB}' not found in MariaDB"

if sudo mariadb -e "SELECT User FROM mysql.user WHERE User='${USR}';" | grep -q "${USR}"; then

pass "User '${USR}' exists in MariaDB"

else

fail "User '${USR}' not found in MariaDB"

# Clean up temp dir

rm -rf "${IMPORT_CREDS_DIR}"

echo ""

echo " vhost-import test complete."

#----------------------------------------------------------------------------------

# Test 3: vhost import/export single-archive contract

#----------------------------------------------------------------------------------

echo ""

echo "======================================================="

echo " Test 3: vhost import/export archive contract"

echo "======================================================="

echo ""

IMPORT_SCRIPT="${REPO_ROOT}/scripts/functions/vhost/vhost-import.sh"

EXPORT_SCRIPT="${REPO_ROOT}/scripts/functions/vhost/vhost-export.sh"

assert_file_contains "${EXPORT_SCRIPT}" 'manifest\.txt' "vhost-export documents manifest.txt in the bundle"

assert_file_contains "${EXPORT_SCRIPT}" 'database/<site>_db_<timestamp>\.sql\.gz' "vhost-export documents database/<site>_db_<timestamp>.sql.gz"

assert_file_contains "${EXPORT_SCRIPT}" 'files/<site>_files_<timestamp>\.tar\.gz' "vhost-export documents files/<site>_files_<timestamp>.tar.gz"

assert_file_contains "${EXPORT_SCRIPT}" 'zip -0 -r -q "\$\{COMBINED_EXPORT_PATH\}" \.' "vhost-export stores the already-compressed payloads in the outer ZIP"

assert_file_contains "${EXPORT_SCRIPT}" 'format=enginescript-site-archive' "vhost-export writes the EngineScript archive format marker"

assert_file_contains "${EXPORT_SCRIPT}" 'version=1' "vhost-export writes archive version 1"

assert_file_contains "${EXPORT_SCRIPT}" 'database_path=database/\$\{DB_EXPORT_FILENAME\}\.gz' "vhost-export writes the canonical database manifest path"

assert_file_contains "${EXPORT_SCRIPT}" 'files_archive_path=files/\$\{FILES_EXPORT_FILENAME\}' "vhost-export writes the canonical files manifest path"

assert_file_contains "${IMPORT_SCRIPT}" 'MANIFEST_PATH="\$\{WP_EXTRACTED_PATH\}/manifest\.txt"' "vhost-import requires manifest.txt at the archive root"

assert_file_contains "${IMPORT_SCRIPT}" 'format=enginescript-site-archive' "vhost-import validates the EngineScript archive format marker"

assert_file_contains "${IMPORT_SCRIPT}" 'version=1' "vhost-import validates archive version 1"

assert_file_contains "${IMPORT_SCRIPT}" 'find "\$\{WP_EXTRACTED_PATH\}/database" -maxdepth 1 -type f -name "\*\.sql\.gz"' "vhost-import requires exactly one database/*.sql.gz file"

assert_file_contains "${IMPORT_SCRIPT}" 'find "\$\{WP_EXTRACTED_PATH\}/files" -maxdepth 1 -type f -name "\*\.tar\.gz"' "vhost-import requires exactly one files/*.tar.gz archive"

if grep -Eq 'two_file|SINGLE_ZIP_FILE|WP_ARCHIVE_DIR|DB_IMPORT_DIR|root-directory|database-file' "${IMPORT_SCRIPT}"; then

fail "vhost-import still contains legacy separate-file import markers"

else

pass "vhost-import no longer contains legacy separate-file import markers"

echo ""

echo " vhost import/export archive contract test complete."

#----------------------------------------------------------------------------------

# Test 4: MariaDB install root authentication contract

#----------------------------------------------------------------------------------

echo ""

echo "======================================================="

echo " Test 4: MariaDB install root authentication"

echo "======================================================="

echo ""

MARIADB_INSTALL_SCRIPT="${REPO_ROOT}/scripts/install/mariadb/mariadb-install.sh"

assert_file_contains \

"${MARIADB_INSTALL_SCRIPT}" \

"ALTER USER 'root'@'localhost' IDENTIFIED VIA unix_socket OR mysql_native_password USING PASSWORD" \

"MariaDB install keeps socket auth and enables mysql_native_password"

assert_file_contains \

"${MARIADB_INSTALL_SCRIPT}" \

'mariadb --protocol=socket' \

"MariaDB install uses the local socket for root bootstrap SQL"

if grep -Eq 'ed25519|UPDATE mysql\.global_priv SET priv=.*root' "${MARIADB_INSTALL_SCRIPT}"; then

fail "MariaDB install still contains unsupported ed25519 root auth or direct root global_priv rewrites"

else

pass "MariaDB install avoids unsupported ed25519 root auth and direct root global_priv rewrites"

echo ""

echo " MariaDB install root authentication test complete."

#----------------------------------------------------------------------------------

# Summary

#----------------------------------------------------------------------------------

echo ""

echo "======================================================="

echo " RESULTS: ${TESTS_PASSED} passed, ${TESTS_FAILED} failed"

echo "======================================================="

echo ""

if [[ ${TESTS_FAILED} -gt 0 ]]; then

exit 1

Navigation Menu

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FilesExpand file tree

test-sql-credentials.sh

Latest commit

History

test-sql-credentials.sh

File metadata and controls