stack/hw/test/build_validation.bats

#!/usr/bin/env bats
# Tests for build-iso.sh validation logic (pre-build checks)

load test_helper

setup() {
    setup_test_work
    source_nanny_functions
    mkdir -p "${TEST_WORK}/ssh-keys"
}

teardown() {
    teardown_test_work
}

# Helper: create a complete valid enrollment
create_full_enrollment() {
    # drives.conf — 8 drives
    cat > "$CONF" << 'DRIVES'
#
# Drive enrollment manifest
#
DRIVE_SATA_1=WD-S001|WD Blue SA510 2TB|0x5001|2000398934016|sata|enrolled_via=usb
DRIVE_SATA_2=WD-S002|WD Blue SA510 2TB|0x5002|2000398934016|sata|enrolled_via=usb
DRIVE_SATA_3=WD-S003|WD Blue SA510 2TB|0x5003|2000398934016|sata|enrolled_via=usb
DRIVE_SATA_4=WD-S004|WD Blue SA510 2TB|0x5004|2000398934016|sata|enrolled_via=usb
DRIVE_SATA_5=WD-S005|WD Blue SA510 2TB|0x5005|2000398934016|sata|enrolled_via=usb
DRIVE_SATA_6=WD-S006|WD Blue SA510 2TB|0x5006|2000398934016|sata|enrolled_via=usb
DRIVE_NVME_DOCKER=NVM-D001|WD SN770 2TB|none|2000398934016|nvme|enrolled_via=usb
DRIVE_HDD_BACKUP=HDD-B001|WD Red Plus 4TB|none|4000787030016|sata|enrolled_via=usb
DRIVES

    # yubikeys.conf — 2 keys
    create_enrolled_yubikeys

    # SSH keys
    echo "sk-ssh-ed25519 AAAA yubikey-1-storagenode-12345678" > "${TEST_WORK}/ssh-keys/yubikey1_storagenode.pub"
    echo "sk-ssh-ed25519 BBBB yubikey-2-storagenode-87654321" > "${TEST_WORK}/ssh-keys/yubikey2_storagenode.pub"

    # authorized_keys
    cat "${TEST_WORK}"/ssh-keys/*.pub > "${TEST_WORK}/authorized_keys"

    # drive-resolver.sh
    echo "#!/bin/sh" > "${TEST_WORK}/drive-resolver.sh"
    chmod +x "${TEST_WORK}/drive-resolver.sh"

    # cloudflare.conf
    cat > "$CFCONF" << 'CF'
CF_TUNNEL_TOKEN=eyJhIjoiNDhmMzA1ZjQ3YmY5N2I4OGFiNjg0YzY1NWIzMTVhNmUi
CF_ACCESS_CONFIGURED=true
CF_CERT_TYPE=none
CF_WARP_ENABLED=true
RUSTFS_ROOT_USER=admin
RUSTFS_ROOT_PASSWORD=autogenpass123456789
NET_STATIC_IP=192.168.1.100/24
NET_GATEWAY=192.168.1.1
NET_DNS=1.1.1.1
CF
}

# ─── Validation: all files present ───

@test "build validation passes with complete enrollment" {
    create_full_enrollment
    for f in drives.conf drive-resolver.sh yubikeys.conf authorized_keys cloudflare.conf; do
        assert [ -f "${TEST_WORK}/${f}" ]
    done
}

@test "build validation: drives.conf has 6 SATA" {
    create_full_enrollment
    local count
    count=$(grep -c "^DRIVE_SATA_" "$CONF")
    assert_equal "$count" "6"
}

@test "build validation: drives.conf has 1 NVMe" {
    create_full_enrollment
    local count
    count=$(grep -c "^DRIVE_NVME_" "$CONF")
    assert_equal "$count" "1"
}

@test "build validation: drives.conf has 1 HDD" {
    create_full_enrollment
    local count
    count=$(grep -c "^DRIVE_HDD_" "$CONF")
    assert_equal "$count" "1"
}

@test "build validation: yubikeys.conf has 2 keys" {
    create_full_enrollment
    local count
    count=$(grep -c "^YUBIKEY_" "$YKCONF")
    assert_equal "$count" "2"
}

@test "build validation: at least 2 SSH public keys" {
    create_full_enrollment
    local count
    count=$(ls "${TEST_WORK}"/ssh-keys/*.pub 2>/dev/null | wc -l)
    assert [ "$count" -ge 2 ]
}

@test "build validation: cloudflare.conf has tunnel token" {
    create_full_enrollment
    run grep "^CF_TUNNEL_TOKEN=" "$CFCONF"
    assert_success
}

# ─── Validation: missing files ───

@test "build fails without drives.conf" {
    create_full_enrollment
    rm -f "$CONF"
    assert [ ! -f "$CONF" ]
}

@test "build fails without yubikeys.conf" {
    create_full_enrollment
    rm -f "$YKCONF"
    assert [ ! -f "$YKCONF" ]
}

@test "build fails without authorized_keys" {
    create_full_enrollment
    rm -f "${TEST_WORK}/authorized_keys"
    assert [ ! -f "${TEST_WORK}/authorized_keys" ]
}

@test "build fails without cloudflare.conf" {
    create_full_enrollment
    rm -f "$CFCONF"
    assert [ ! -f "$CFCONF" ]
}

# ─── Validation: incomplete enrollment ───

@test "build fails with only 5 SATA drives" {
    create_full_enrollment
    # Remove SATA_6
    sed -i '/^DRIVE_SATA_6=/d' "$CONF"
    local count
    count=$(grep -c "^DRIVE_SATA_" "$CONF")
    assert_equal "$count" "5"
}

@test "build fails with no NVMe drive" {
    create_full_enrollment
    sed -i '/^DRIVE_NVME/d' "$CONF"
    local count
    count=$(grep -c "^DRIVE_NVME_" "$CONF" 2>/dev/null || true)
    assert_equal "${count:-0}" "0"
}

@test "build fails with no HDD backup" {
    create_full_enrollment
    sed -i '/^DRIVE_HDD/d' "$CONF"
    local count
    count=$(grep -c "^DRIVE_HDD_" "$CONF" 2>/dev/null || true)
    assert_equal "${count:-0}" "0"
}

@test "build fails with only 1 YubiKey" {
    create_full_enrollment
    sed -i '/^YUBIKEY_2=/d' "$YKCONF"
    local count
    count=$(grep -c "^YUBIKEY_" "$YKCONF")
    assert_equal "$count" "1"
}

# ─── Cross-validation ───

@test "all drive serials are unique" {
    create_full_enrollment
    local serials
    serials=$(grep "^DRIVE_" "$CONF" | cut -d= -f2 | cut -d'|' -f1 | sort)
    local unique_serials
    unique_serials=$(echo "$serials" | sort -u)
    assert_equal "$serials" "$unique_serials"
}

@test "yubikey serials are different from each other" {
    create_full_enrollment
    local s1 s2
    s1=$(grep "^YUBIKEY_1=" "$YKCONF" | cut -d= -f2 | cut -d'|' -f1)
    s2=$(grep "^YUBIKEY_2=" "$YKCONF" | cut -d= -f2 | cut -d'|' -f1)
    assert [ "$s1" != "$s2" ]
}

@test "authorized_keys matches number of SSH key files" {
    create_full_enrollment
    local key_files key_lines
    key_files=$(ls "${TEST_WORK}"/ssh-keys/*.pub | wc -l)
    key_lines=$(grep -c "^sk-ssh-\|^ssh-ed25519\|^ecdsa-" "${TEST_WORK}/authorized_keys")
    assert_equal "$key_files" "$key_lines"
}