bsodfather/crank
1
0
Fork 0
Code Issues Pull Requests 3 Actions Packages Projects Releases Wiki Activity

feat: complete Epic 1 production foundation

Browse Source
This commit is contained in:
bsodfather
2026-08-25 01:24:11 +03:00
parent 767428436d
commit 182bde8ac0
298 changed files with 35719 additions and 5299 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/crank-config/tests/contract.rs
+30 -7
View File
@@ -5,9 +5,11 @@ use crank_config::{
parse_migrator, parse_process,
};
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
fn required_admin() -> BTreeMap<String, String> {
[
("CRANK_MASTER_KEY", "master"),
("CRANK_MASTER_KEY", TEST_MASTER_KEY),
("CRANK_SESSION_SECRET", "session"),
("CRANK_PASSWORD_PEPPER", "pepper"),
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
@@ -19,7 +21,7 @@ fn required_admin() -> BTreeMap<String, String> {
}
fn required_mcp() -> BTreeMap<String, String> {
[("CRANK_MASTER_KEY", "master")]
[("CRANK_MASTER_KEY", TEST_MASTER_KEY)]
.into_iter()
.map(|(key, value)| (key.to_owned(), value.to_owned()))
.collect()
@@ -106,9 +108,9 @@ fn source_for(
}
#[test]
fn registry_covers_exactly_the_57_observed_runtime_names() {
fn registry_covers_exactly_the_59_observed_runtime_names() {
let registry = field_registry();
assert_eq!(registry.len(), 57);
assert_eq!(registry.len(), 59);
let unique = registry
.iter()
.map(|field| field.env_name)
@@ -148,9 +150,10 @@ fn defaults_are_preserved_and_invalid_values_never_fall_back() {
for (name, value) in [
("POSTGRES_PORT", "bad"),
("CRANK_MASTER_KEY", "too-short"),
("CRANK_SESSION_TTL_HOURS", "bad"),
("CRANK_ADMIN_RATE_LIMIT_RPS", "bad"),
("CRANK_TRUST_FORWARDED_HEADERS", "tru"),
("CRANK_TRUSTED_PROXY_IPS", "not-an-ip"),
] {
let mut vars = required_admin();
vars.insert(name.to_owned(), value.to_owned());
@@ -309,6 +312,24 @@ fn process_specific_fields_and_zero_ports_fail_closed() {
}
}
#[test]
fn production_admin_non_loopback_requires_https_base_url() {
let mut vars = required_admin();
vars.insert("CRANK_ENVIRONMENT".into(), "production".into());
vars.insert("CRANK_ADMIN_BIND".into(), "0.0.0.0:3001".into());
vars.insert("CRANK_BASE_URL".into(), "http://crank.example.test".into());
let error = parse_process(ProcessKind::AdminApi, ConfigSource::from_utf8(vars)).unwrap_err();
assert!(error.diagnostics().iter().any(|item| {
item.code == DiagnosticCode::UnsafeCombination && item.field == "admin.exposure.tls"
}));
let mut safe = required_admin();
safe.insert("CRANK_ENVIRONMENT".into(), "production".into());
safe.insert("CRANK_ADMIN_BIND".into(), "0.0.0.0:3001".into());
safe.insert("CRANK_BASE_URL".into(), "https://crank.example.test".into());
parse_process(ProcessKind::AdminApi, ConfigSource::from_utf8(safe)).unwrap();
}
#[test]
fn whitespace_secrets_and_consumer_invalid_values_fail_in_the_leaf_parser() {
for name in [
@@ -355,6 +376,7 @@ fn cross_field_and_typed_boundaries_fail_closed() {
("POSTGRES_MAX_CONNECTIONS", "1025"),
("CRANK_ADMIN_RATE_LIMIT_RPS", "100001"),
("CRANK_ADMIN_RATE_LIMIT_BURST", "0"),
("CRANK_OUTBOUND_MAX_REQUEST_BYTES", "67108865"),
("CRANK_OUTBOUND_MAX_RESPONSE_BYTES", "67108865"),
("OTEL_BSP_SCHEDULE_DELAY", "bad"),
("OTEL_BSP_EXPORT_TIMEOUT", "300001"),
@@ -406,11 +428,12 @@ fn inclusive_edges_and_legacy_boolean_spellings_are_explicit() {
("POSTGRES_MAX_CONNECTIONS".into(), "1024".into()),
("POSTGRES_MIN_CONNECTIONS".into(), "0".into()),
("CRANK_RUNTIME_MAX_CONCURRENT_UNARY".into(), "1".into()),
("CRANK_OUTBOUND_MAX_REQUEST_BYTES".into(), "67108864".into()),
(
"CRANK_OUTBOUND_MAX_RESPONSE_BYTES".into(),
"67108864".into(),
),
("CRANK_TRUST_FORWARDED_HEADERS".into(), "yes".into()),
("CRANK_TRUSTED_PROXY_IPS".into(), "127.0.0.1,::1".into()),
("CRANK_DEMO_SEED".into(), "off".into()),
]);
let config = parse_process(ProcessKind::AdminApi, ConfigSource::from_utf8(vars)).unwrap();
@@ -419,7 +442,7 @@ fn inclusive_edges_and_legacy_boolean_spellings_are_explicit() {
assert_eq!(admin.database.pool.max_connections, 1024);
assert_eq!(admin.database.pool.min_connections, 0);
assert_eq!(admin.runtime.max_concurrent_unary, 1);
assert!(admin.trust_forwarded_headers);
assert_eq!(admin.trusted_proxy_ips.len(), 2);
assert!(!admin.demo_seed);
}
crates/crank-config/tests/generation.rs
+1 -1
View File
@@ -21,7 +21,7 @@ fn generated_reference_distinguishes_required_and_optional_fields() {
let reference = render::reference_section();
assert!(reference.contains(
"| `CRANK_MASTER_KEY` | `runtime.master_key` | `Shared` | `secret/-` | `required/blank` |"
"| `CRANK_MASTER_KEY` | `runtime.master_key` | `Shared` | `secret/-` | `required/blank` | `>=32` |"
));
assert!(
reference
crates/crank-config/tests/redaction.rs
+13 -9
View File
@@ -2,6 +2,10 @@ use std::collections::BTreeMap;
use crank_config::{ConfigSource, ProcessKind, parse_process};
const TEST_MASTER_KEY: &str = "test-master-key-00000000000000000000000000000000";
const CANARY_ONE_MASTER_KEY: &str = "CANARY_ONE-000000000000000000000000000000000";
const CANARY_TWO_MASTER_KEY: &str = "CANARY_TWO-000000000000000000000000000000000";
fn config(secret: &str) -> crank_config::EffectiveConfig {
let vars = [
("CRANK_MASTER_KEY", secret),
@@ -18,8 +22,8 @@ fn config(secret: &str) -> crank_config::EffectiveConfig {
#[test]
fn secrets_are_absent_from_debug_display_and_fingerprint() {
let first = config("CANARY_ONE");
let second = config("CANARY_TWO");
let first = config(CANARY_ONE_MASTER_KEY);
let second = config(CANARY_TWO_MASTER_KEY);
let rendered = format!("{first:?}");
assert!(!rendered.contains("CANARY_ONE"));
assert_eq!(first.fingerprint(), second.fingerprint());
@@ -35,18 +39,18 @@ fn secrets_are_absent_from_debug_display_and_fingerprint() {
#[test]
fn effective_semantics_not_input_spelling_drive_fingerprint() {
let mut canonical = [
("CRANK_MASTER_KEY", "master"),
("CRANK_MASTER_KEY", TEST_MASTER_KEY),
("CRANK_SESSION_SECRET", "session"),
("CRANK_PASSWORD_PEPPER", "pepper"),
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
("CRANK_BOOTSTRAP_ADMIN_PASSWORD", "password"),
("CRANK_TRUST_FORWARDED_HEADERS", "true"),
("CRANK_DEMO_SEED", "true"),
]
.into_iter()
.map(|(key, value)| (key.to_owned(), value.to_owned()))
.collect::<BTreeMap<_, _>>();
let mut compatibility = canonical.clone();
compatibility.insert("CRANK_TRUST_FORWARDED_HEADERS".into(), "yes".into());
compatibility.insert("CRANK_DEMO_SEED".into(), "yes".into());
let canonical_config = parse_process(
ProcessKind::AdminApi,
@@ -71,7 +75,7 @@ fn effective_semantics_not_input_spelling_drive_fingerprint() {
#[test]
fn diagnostics_are_bounded_json_and_never_echo_secret_canaries() {
let canary = "CANARY_SECRET_VALUE";
let canary = "CANARY_SECRET_VALUE-0000000000000000000000";
let vars = [
("CRANK_MASTER_KEY", canary),
("CRANK_SESSION_SECRET", canary),
@@ -111,7 +115,7 @@ fn diagnostics_are_bounded_json_and_never_echo_secret_canaries() {
#[test]
fn public_projection_debug_omits_urls_hosts_paths_and_identity_values() {
let mut vars = [
("CRANK_MASTER_KEY", "master"),
("CRANK_MASTER_KEY", TEST_MASTER_KEY),
("CRANK_SESSION_SECRET", "session"),
("CRANK_PASSWORD_PEPPER", "pepper"),
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@CANARY.test"),
@@ -135,7 +139,7 @@ fn public_projection_debug_omits_urls_hosts_paths_and_identity_values() {
#[test]
fn normalized_database_and_admin_default_urls_drive_fingerprint() {
let base = [
("CRANK_MASTER_KEY", "master"),
("CRANK_MASTER_KEY", TEST_MASTER_KEY),
("CRANK_SESSION_SECRET", "session"),
("CRANK_PASSWORD_PEPPER", "pepper"),
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),
@@ -160,7 +164,7 @@ fn normalized_database_and_admin_default_urls_drive_fingerprint() {
assert_eq!(implicit.fingerprint(), url.fingerprint());
let tls = [
("CRANK_MASTER_KEY", "master"),
("CRANK_MASTER_KEY", TEST_MASTER_KEY),
("CRANK_SESSION_SECRET", "session"),
("CRANK_PASSWORD_PEPPER", "pepper"),
("CRANK_BOOTSTRAP_ADMIN_EMAIL", "owner@example.test"),