stack/hw/test/cloudflare.bats

#!/usr/bin/env bats
# Tests for Cloudflare configuration enrollment

load test_helper

setup() {
    setup_test_work
    source_nanny_functions
}

teardown() {
    teardown_test_work
}

# ─── cloudflare.conf format ───

@test "tunnel token is stored correctly" {
    echo "CF_TUNNEL_TOKEN=eyJhIjoiNDhmMzA1ZjQ3YmY5N2I4OGFiNjg0YzY1NWIzMTVhNmUi" >> "$CFCONF"
    run grep "^CF_TUNNEL_TOKEN=" "$CFCONF"
    assert_success
    assert_output --partial "eyJ"
}

@test "placeholder token is used when skipped" {
    echo "CF_TUNNEL_TOKEN=PASTE_YOUR_TOKEN_HERE" >> "$CFCONF"
    local token
    token=$(grep "^CF_TUNNEL_TOKEN=" "$CFCONF" | cut -d= -f2-)
    assert_equal "$token" "PASTE_YOUR_TOKEN_HERE"
}

@test "service token credentials stored separately" {
    echo "CF_SVC_CLIENT_ID=abc123.access" >> "$CFCONF"
    echo "CF_SVC_CLIENT_SECRET=secretvalue" >> "$CFCONF"
    run grep "^CF_SVC_CLIENT_ID=" "$CFCONF"
    assert_success
    run grep "^CF_SVC_CLIENT_SECRET=" "$CFCONF"
    assert_success
}

@test "access configured flag is set" {
    echo "CF_ACCESS_CONFIGURED=true" >> "$CFCONF"
    run grep "^CF_ACCESS_CONFIGURED=true" "$CFCONF"
    assert_success
}

# ─── RustFS credentials ───

@test "rustfs credentials are stored" {
    echo "RUSTFS_ROOT_USER=admin" >> "$CFCONF"
    echo "RUSTFS_ROOT_PASSWORD=supersecretpass123" >> "$CFCONF"
    local user pass
    user=$(grep "^RUSTFS_ROOT_USER=" "$CFCONF" | cut -d= -f2)
    pass=$(grep "^RUSTFS_ROOT_PASSWORD=" "$CFCONF" | cut -d= -f2)
    assert_equal "$user" "admin"
    assert_equal "$pass" "supersecretpass123"
}

@test "auto-generated password is at least 20 chars" {
    local pass
    pass=$(head -c 32 /dev/urandom | base64 | tr -d '/+=' | head -c 24)
    assert [ ${#pass} -ge 20 ]
}

# ─── Network config ───

@test "static IP config stored with CIDR" {
    echo "NET_STATIC_IP=192.168.1.100/24" >> "$CFCONF"
    echo "NET_GATEWAY=192.168.1.1" >> "$CFCONF"
    echo "NET_DNS=1.1.1.1" >> "$CFCONF"
    local ip
    ip=$(grep "^NET_STATIC_IP=" "$CFCONF" | cut -d= -f2)
    assert_equal "$ip" "192.168.1.100/24"
}

@test "gateway is stored" {
    echo "NET_GATEWAY=192.168.1.1" >> "$CFCONF"
    local gw
    gw=$(grep "^NET_GATEWAY=" "$CFCONF" | cut -d= -f2)
    assert_equal "$gw" "192.168.1.1"
}

@test "dns defaults to 1.1.1.1 when empty" {
    local dns=""
    dns="${dns:-1.1.1.1}"
    assert_equal "$dns" "1.1.1.1"
}

# ─── WARP config ───

@test "warp enabled flag stored" {
    echo "CF_WARP_ENABLED=true" >> "$CFCONF"
    run grep "^CF_WARP_ENABLED=true" "$CFCONF"
    assert_success
}

@test "warp disabled flag stored" {
    echo "CF_WARP_ENABLED=false" >> "$CFCONF"
    run grep "^CF_WARP_ENABLED=false" "$CFCONF"
    assert_success
}

# ─── Certificate config ───

@test "cert type none when skipped" {
    echo "CF_CERT_TYPE=none" >> "$CFCONF"
    local cert_type
    cert_type=$(grep "^CF_CERT_TYPE=" "$CFCONF" | cut -d= -f2)
    assert_equal "$cert_type" "none"
}

@test "cert type origin-ca when cloudflare origin cert" {
    echo "CF_CERT_TYPE=origin-ca" >> "$CFCONF"
    local cert_type
    cert_type=$(grep "^CF_CERT_TYPE=" "$CFCONF" | cut -d= -f2)
    assert_equal "$cert_type" "origin-ca"
}

@test "cert type letsencrypt when LE selected" {
    echo "CF_CERT_TYPE=letsencrypt" >> "$CFCONF"
    local cert_type
    cert_type=$(grep "^CF_CERT_TYPE=" "$CFCONF" | cut -d= -f2)
    assert_equal "$cert_type" "letsencrypt"
}

@test "API token stored for certbot" {
    echo "CF_API_TOKEN=v1.0-abc123def456" >> "$CFCONF"
    run grep "^CF_API_TOKEN=" "$CFCONF"
    assert_success
}

@test "certbot credentials file has correct format" {
    mkdir -p "${TEST_WORK}/certs"
    echo "dns_cloudflare_api_token = testtoken123" > "${TEST_WORK}/certs/cf-credentials.ini"
    run grep "dns_cloudflare_api_token" "${TEST_WORK}/certs/cf-credentials.ini"
    assert_success
}

# ─── Cloudflare state tracking ───

@test "all cloudflare steps track independently" {
    local steps=(cf_account cf_tunnel cf_routes cf_access cf_ssl cf_api_token cf_cert cf_warp cf_rustfs_creds cf_network)
    for step in "${steps[@]}"; do
        run state_done "$step"
        assert_failure
    done

    state_mark "cf_account"
    state_mark "cf_tunnel"

    run state_done "cf_account"
    assert_success
    run state_done "cf_tunnel"
    assert_success
    run state_done "cf_routes"
    assert_failure
}

@test "cloudflare state survives re-source" {
    state_mark "cf_tunnel"
    state_mark "cf_access"
    source_nanny_functions
    run state_done "cf_tunnel"
    assert_success
    run state_done "cf_access"
    assert_success
    run state_done "cf_network"
    assert_failure
}