feat(dns): git SoR + drift-check for pihole/dhcpd; serial-restart rule [#469][#420]

2026-09-01 17:07:23 -05:00
parent e2d6e5c52f
commit adfdcafeab
6 changed files with 3664 additions and 0 deletions
@@ -0,0 +1,67 @@
+#!/bin/bash
+# Unit tests for netinfra/dns/drift-check.sh [#420][#469]
+# Tests the redaction and normalization functions without touching hosts.
+set -euo pipefail
+
+PROJECT_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SCRIPT="$PROJECT_ROOT/netinfra/dns/drift-check.sh"
+
+failed=0
+
+if [[ -f "$SCRIPT" ]] && (source "$SCRIPT"); then
+    echo "✅ script exists + sources cleanly"
+else
+    echo "❌ script missing or fails to source: $SCRIPT"
+    exit 1
+fi
+# shellcheck disable=SC1091
+source "$SCRIPT"
+
+test_redact_strips_secrets() {
+    local out
+    out=$(printf '  pwhash = "SECRETBALLOONHASH"\n  totp_secret = "ABC234"\n  password = "hunter2"\n  port = 53\n' | redact_config)
+    if grep -qE "SECRETBALLOON|ABC234|hunter2" <<<"$out"; then
+        echo "❌ redact_config leaked a secret"
+        ((++failed))
+    elif grep -q '"REDACTED"' <<<"$out" && grep -q "port = 53" <<<"$out"; then
+        echo "✅ redact_config strips secrets, keeps config"
+    else
+        echo "❌ redact_config mangled output"
+        ((++failed))
+    fi
+}
+
+test_normalize_drops_timestamp() {
+    local out
+    out=$(printf '# Last updated on 2026-09-01 17:01:15 CDT\n  dnsmasq_lines = []\n' | normalize_toml)
+    if grep -q "Last updated" <<<"$out"; then
+        echo "❌ normalize_toml kept the timestamp churn line"
+        ((++failed))
+    elif grep -q "dnsmasq_lines" <<<"$out"; then
+        echo "✅ normalize_toml drops timestamp, keeps config"
+    else
+        echo "❌ normalize_toml dropped config lines"
+        ((++failed))
+    fi
+}
+
+test_normalize_implies_redaction() {
+    local out
+    out=$(printf '  totp_secret = "XYZ789"\n  a = 1\n' | normalize_toml)
+    if grep -q XYZ789 <<<"$out"; then
+        echo "❌ normalize_toml leaked a secret"
+        ((++failed))
+    else
+        echo "✅ normalize_toml redacts secrets"
+    fi
+}
+
+test_redact_strips_secrets
+test_normalize_drops_timestamp
+test_normalize_implies_redaction
+
+if ((failed > 0)); then
+    echo "❌ $failed drift-check test(s) failed"
+    exit 1
+fi
+echo "✅ all drift-check tests passed"