mrcharles
31de03d401
Founder ruling 2026-09-03: cover HA-down / network-down / power recovery. DOORMAN_BREAKGLASS_IDS badges fire the relay LOCALLY (no HA dependency), then best-effort POST flagged local_unlock:true so HA logs without re-dispatching. --check-breakglass decision mode; 7/7 breakglass tests, full suites green. https://projects.knownelement.com/issues/345
51 lines
1.9 KiB
Bash
Executable File
51 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# tests/test-breakglass.sh — break-glass decision tests (offline).
|
|
#
|
|
# The break-glass list (DOORMAN_BREAKGLASS_IDS) unlocks LOCALLY with no
|
|
# HA involvement — the disaster path (HA down / network down / power
|
|
# recovery). `doorman.sh --check-breakglass <id>` is the decision
|
|
# function: exit 0 = break-glass badge, exit 1 = not.
|
|
#
|
|
set -uo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
BIN="$ROOT/bin/doorman.sh"
|
|
|
|
pass=0
|
|
fail=0
|
|
ok() { printf 'ok - %s\n' "$1"; pass=$((pass + 1)); }
|
|
no() { printf 'FAIL - %s\n' "$1"; fail=$((fail + 1)); }
|
|
|
|
check() { # check <id> <list> -> exit 0 if breakglass
|
|
DOORMAN_BREAKGLASS_IDS="$2" "$BIN" --check-breakglass "$1" >/dev/null 2>&1
|
|
}
|
|
|
|
# T1: listed badge -> breakglass.
|
|
if check 0000000001 "0000000001"; then ok "T1 listed badge matches"; else no "T1 listed badge did not match"; fi
|
|
|
|
# T2: multiple entries, whitespace-separated, partial match must not hit.
|
|
if check 0000000001 "0000000002 0000000001"; then ok "T2 second list entry matches"; else no "T2 second entry failed"; fi
|
|
|
|
# T3: unlisted badge -> not breakglass.
|
|
if check 9999999999 "0000000001"; then no "T3 unlisted badge matched!"; else ok "T3 unlisted badge rejected"; fi
|
|
|
|
# T4: prefix of a listed badge must NOT match (word boundary check).
|
|
if check 000000000 "0000000001"; then no "T4 prefix matched!"; else ok "T4 prefix rejected"; fi
|
|
|
|
# T5: suffix likewise.
|
|
if check "000000001" "0000000001"; then no "T5 suffix matched!"; else ok "T5 suffix rejected"; fi
|
|
|
|
# T6: empty list -> nothing is breakglass.
|
|
if check 0000000001 ""; then no "T6 empty list matched!"; else ok "T6 empty list rejects all"; fi
|
|
|
|
# T7: unset list (env not set at all) -> nothing is breakglass.
|
|
if DOORMAN_BREAKGLASS_IDS='' "$BIN" --check-breakglass 0000000001 >/dev/null 2>&1; then
|
|
no "T7 unset list matched!"
|
|
else
|
|
ok "T7 unset list rejects all"
|
|
fi
|
|
|
|
printf '\n%d passed, %d failed\n' "$pass" "$fail"
|
|
[ "$fail" -eq 0 ]
|