13 lines
1.2 KiB
JavaScript
13 lines
1.2 KiB
JavaScript
import test from 'node:test';import assert from 'node:assert/strict';
|
|
import {mkdtempSync,rmSync} from 'node:fs';import {tmpdir} from 'node:os';import {join,resolve} from 'node:path';
|
|
import {protectCollectorDirectory} from '../scripts/debug-collector-acl.mjs';
|
|
|
|
test('ACL proof rejects process failures and unverified or malformed success without exposing errors',()=>{
|
|
for(const result of [{status:1,stdout:'{"verified":true,"changed":false}',stderr:'private path/account'},{status:0,stdout:'{"verified":false,"changed":false}'},{status:0,stdout:'{}'},{status:0,stdout:'private error'}])assert.throws(()=>protectCollectorDirectory('unused',{run:()=>result}),error=>error.message.startsWith('Collector directory protection')&&!error.message.includes('private'));
|
|
});
|
|
test('actual Windows exact private ACL is verified without being reapplied on restart',{skip:process.platform!=='win32'},t=>{
|
|
const directory=mkdtempSync(join(tmpdir(),'safetynet-collector-acl-'));t.after(()=>{assert.ok(resolve(directory).startsWith(resolve(tmpdir())));rmSync(directory,{recursive:true,force:true});});
|
|
const initial=protectCollectorDirectory(directory);assert.equal(initial.verified,true);
|
|
assert.deepEqual(protectCollectorDirectory(directory),{verified:true,changed:false});
|
|
});
|