263 lines
10 KiB
Bash
Executable File
263 lines
10 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
repository_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)
|
|
guard="$repository_root/tools/require-base-config.sh"
|
|
terminal_url=https://terminal.invalid/rpc
|
|
public_url=https://public.invalid/rpc
|
|
account=demo-account
|
|
sender=0x1111111111111111111111111111111111111111
|
|
recipient=0x2222222222222222222222222222222222222222
|
|
|
|
run_guard() {
|
|
local mode=${1-deploy}
|
|
shift || true
|
|
env -i PATH="$PATH" \
|
|
BASE_SEPOLIA_RPC_URL="$terminal_url" \
|
|
BASE_SEPOLIA_PUBLIC_RPC_URL="$public_url" \
|
|
BASE_SEPOLIA_ACCOUNT="$account" \
|
|
BASE_SEPOLIA_SENDER="$sender" \
|
|
BASE_SEPOLIA_RECIPIENT="$recipient" \
|
|
"$@" bash "$guard" "$mode"
|
|
}
|
|
|
|
assert_no_config_values() {
|
|
local output=$1
|
|
shift
|
|
local value
|
|
for value in "$terminal_url" "$public_url" "$account" "$sender" "$recipient" "$@"; do
|
|
[[ -n $value ]] || continue
|
|
if [[ $output == *"$value"* ]]; then
|
|
echo "configuration guard leaked a configured value" >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
}
|
|
|
|
expect_rejected() {
|
|
local assignment=$1
|
|
local output
|
|
if output=$(run_guard deploy "$assignment" 2>&1); then
|
|
echo "configuration guard accepted invalid fixture: ${assignment%%=*}" >&2
|
|
exit 1
|
|
fi
|
|
assert_no_config_values "$output" "${assignment#*=}"
|
|
}
|
|
|
|
for mode in deploy upgrade transfer; do
|
|
output=$(run_guard "$mode" 2>&1)
|
|
[[ -z $output ]] || { echo "configuration guard produced output for valid fixtures" >&2; exit 1; }
|
|
done
|
|
|
|
for assignment in \
|
|
BASE_SEPOLIA_RPC_URL= \
|
|
BASE_SEPOLIA_PUBLIC_RPC_URL= \
|
|
BASE_SEPOLIA_ACCOUNT= \
|
|
BASE_SEPOLIA_SENDER= \
|
|
BASE_SEPOLIA_RECIPIENT= \
|
|
BASE_SEPOLIA_ACCOUNT='bad account' \
|
|
BASE_SEPOLIA_SENDER=0x1234 \
|
|
BASE_SEPOLIA_RECIPIENT=0x0000000000000000000000000000000000000000 \
|
|
BASE_SEPOLIA_RECIPIENT="$sender" \
|
|
BASE_SEPOLIA_RPC_URL=http://terminal.invalid \
|
|
BASE_SEPOLIA_PUBLIC_RPC_URL=http://public.invalid \
|
|
BASE_SEPOLIA_PUBLIC_RPC_URL=https://user@public.invalid \
|
|
BASE_SEPOLIA_PUBLIC_RPC_URL='https://public.invalid/?api_key=fixture' \
|
|
BASE_SEPOLIA_PUBLIC_RPC_URL='https://public.invalid/?token=fixture'; do
|
|
expect_rejected "$assignment"
|
|
done
|
|
|
|
private_key_name=PRIVATE_$(printf KEY)
|
|
mnemonic_name=MNEM$(printf ONIC)
|
|
fake_key=0x$(printf 'a%.0s' {1..64})
|
|
output=$(
|
|
env -i PATH="$PATH" "$private_key_name=$fake_key" "$mnemonic_name=fixture words only" \
|
|
bash "$guard" deploy 2>&1 || true
|
|
)
|
|
if [[ $output != *BASE_SEPOLIA_RPC_URL* ]]; then
|
|
echo "configuration guard unexpectedly accepted a raw-key or mnemonic fallback" >&2
|
|
exit 1
|
|
fi
|
|
assert_no_config_values "$output"
|
|
|
|
dry_run=$(
|
|
make -n -C "$repository_root" deploy-base-sepolia \
|
|
BASE_SEPOLIA_RPC_URL=https://terminal.invalid \
|
|
BASE_SEPOLIA_PUBLIC_RPC_URL=https://public.invalid \
|
|
BASE_SEPOLIA_ACCOUNT=demo \
|
|
BASE_SEPOLIA_SENDER=0x1111111111111111111111111111111111111111 \
|
|
BASE_SEPOLIA_RECIPIENT=0x2222222222222222222222222222222222222222
|
|
)
|
|
[[ $dry_run == *'--account "demo"'* ]] || { echo "Base dry run omitted --account" >&2; exit 1; }
|
|
[[ $dry_run == *'--sender "0x1111111111111111111111111111111111111111"'* ]] || \
|
|
{ echo "Base dry run omitted --sender" >&2; exit 1; }
|
|
[[ $dry_run == *'--slow'* ]] || { echo "Base dry run omitted --slow" >&2; exit 1; }
|
|
if [[ ${dry_run,,} == *private-key* || ${dry_run,,} == *mnemonic* ]]; then
|
|
echo "Base dry run exposed a raw signing option" >&2
|
|
exit 1
|
|
fi
|
|
|
|
node --input-type=module - "$repository_root" <<'NODE'
|
|
import assert from "node:assert/strict";
|
|
import { access, mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
|
|
import { tmpdir } from "node:os";
|
|
import { join } from "node:path";
|
|
import { pathToFileURL } from "node:url";
|
|
|
|
const repositoryRoot = process.argv[2];
|
|
const { archiveManifest, selectManifest } = await import(pathToFileURL(join(repositoryRoot, "tools/select-manifest.mjs")));
|
|
const { validateManifest } = await import(pathToFileURL(join(repositoryRoot, "tools/finalize-manifest.mjs")));
|
|
const { publishManifest, validatePublicManifest } = await import(pathToFileURL(join(repositoryRoot, "tools/publish-web-manifest.mjs")));
|
|
const root = await mkdtemp(join(tmpdir(), "uups-base-config-"));
|
|
const deployments = join(root, "deployments");
|
|
const webManifest = join(root, "web/public/deployment.json");
|
|
const owner = "0x1111111111111111111111111111111111111111";
|
|
const recipient = "0x2222222222222222222222222222222222222222";
|
|
const base = {
|
|
schemaVersion: 1,
|
|
network: "baseSepolia",
|
|
chainId: 84532,
|
|
deploymentBlock: 99,
|
|
rpcUrl: "https://public.invalid/rpc",
|
|
explorerBaseUrl: "https://sepolia.basescan.org",
|
|
token: "0x3333333333333333333333333333333333333333",
|
|
proxy: "0x4444444444444444444444444444444444444444",
|
|
implementation: "0x5555555555555555555555555555555555555555",
|
|
owner,
|
|
actors: [
|
|
{ label: "Presenter", address: owner },
|
|
{ label: "Recipient", address: recipient },
|
|
],
|
|
};
|
|
const anvil = {
|
|
...base,
|
|
network: "anvil",
|
|
chainId: 31337,
|
|
rpcUrl: "http://127.0.0.1:8545",
|
|
explorerBaseUrl: undefined,
|
|
actors: [
|
|
{ label: "owner", address: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266" },
|
|
{ label: "Alice", address: "0x70997970C51812dc3A010C7d01b50e0d17dc79C8" },
|
|
{ label: "Bob", address: "0x3C44CdDdB6a900fa2b585dd299e03d12FA4293BC" },
|
|
],
|
|
owner: "0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266",
|
|
};
|
|
delete anvil.explorerBaseUrl;
|
|
|
|
try {
|
|
await mkdir(deployments, { recursive: true });
|
|
await writeFile(join(deployments, "base-sepolia.json"), `${JSON.stringify(base)}\n`);
|
|
await writeFile(join(deployments, "anvil.json"), `${JSON.stringify(anvil)}\n`);
|
|
await selectManifest({ root, network: "baseSepolia" });
|
|
const activeBefore = await readFile(join(deployments, "active.json"));
|
|
const anvilBefore = await readFile(join(deployments, "anvil.json"));
|
|
const published = await publishManifest({
|
|
activePath: join(deployments, "active.json"),
|
|
outputPath: webManifest,
|
|
});
|
|
assert.equal(published.rpcUrl, "https://public.invalid/rpc");
|
|
assert.equal(published.explorerBaseUrl, "https://sepolia.basescan.org");
|
|
assert.equal((await readFile(webManifest, "utf8")).includes("terminal.invalid"), false);
|
|
const without = (field) => {
|
|
const manifest = { ...base };
|
|
delete manifest[field];
|
|
return manifest;
|
|
};
|
|
const invalidCases = [
|
|
["missing rpcUrl", without("rpcUrl"), /rpcUrl/],
|
|
["missing explorerBaseUrl", without("explorerBaseUrl"), /explorerBaseUrl/],
|
|
["wrong actor count", { ...base, actors: [base.actors[0]] }, /exactly Presenter and Recipient|actor configuration/],
|
|
["wrong actor labels", { ...base, actors: [{ ...base.actors[0], label: "Owner" }, base.actors[1]] }, /Presenter and Recipient|actor configuration/],
|
|
["owner is not Presenter", { ...base, owner: recipient }, /owner.*Presenter|first actor/],
|
|
["HTTP public RPC", { ...base, rpcUrl: "http://public.invalid/rpc" }, /HTTPS/],
|
|
["credential-bearing public RPC", { ...base, rpcUrl: "https://user@public.invalid/rpc" }, /credentials|prohibited secret/],
|
|
["wrong BaseScan root", { ...base, explorerBaseUrl: "https://example.invalid" }, /BaseScan/],
|
|
];
|
|
for (const [label, invalid, rejection] of invalidCases) {
|
|
assert.throws(() => validateManifest(invalid), rejection, `confirmation accepted ${label}`);
|
|
assert.throws(() => validatePublicManifest(invalid), rejection, `publication validation accepted ${label}`);
|
|
await writeFile(join(deployments, "active.json"), `${JSON.stringify(invalid)}\n`);
|
|
await assert.rejects(
|
|
() => publishManifest({ activePath: join(deployments, "active.json"), outputPath: webManifest }),
|
|
rejection,
|
|
`publication accepted ${label}`,
|
|
);
|
|
}
|
|
await writeFile(join(deployments, "active.json"), activeBefore);
|
|
|
|
const archived = await archiveManifest({
|
|
root,
|
|
network: "baseSepolia",
|
|
now: new Date("2026-08-21T12:34:56.789Z"),
|
|
});
|
|
assert.equal(archived.path, join(deployments, "base-sepolia.20260821T123456789Z.json"));
|
|
await access(archived.path);
|
|
await assert.rejects(() => access(join(deployments, "base-sepolia.json")));
|
|
assert.deepEqual(await readFile(join(deployments, "active.json")), activeBefore);
|
|
assert.deepEqual(await readFile(join(deployments, "anvil.json")), anvilBefore);
|
|
|
|
const canonicalPath = join(deployments, "base-sepolia.json");
|
|
const canonicalBytes = Buffer.from(`${JSON.stringify(base)}\n`);
|
|
const existingBytes = Buffer.from("existing archive bytes\n");
|
|
const collisionDate = new Date("2026-08-21T12:35:56.789Z");
|
|
const collisionPath = join(deployments, "base-sepolia.20260821T123556789Z.json");
|
|
await writeFile(canonicalPath, canonicalBytes);
|
|
await writeFile(collisionPath, existingBytes);
|
|
await assert.rejects(
|
|
() => archiveManifest({ root, network: "baseSepolia", now: collisionDate }),
|
|
/existing Base Sepolia archive/,
|
|
);
|
|
assert.deepEqual(await readFile(canonicalPath), canonicalBytes);
|
|
assert.deepEqual(await readFile(collisionPath), existingBytes);
|
|
|
|
const boundaryDate = new Date("2026-08-21T12:36:56.789Z");
|
|
const boundaryPath = join(deployments, "base-sepolia.20260821T123656789Z.json");
|
|
const boundaryBytes = Buffer.from("archive created by racing process\n");
|
|
await assert.rejects(
|
|
() => archiveManifest({
|
|
root,
|
|
network: "baseSepolia",
|
|
now: boundaryDate,
|
|
io: {
|
|
link: async (_source, target) => {
|
|
await writeFile(target, boundaryBytes);
|
|
const error = new Error("collision at link boundary");
|
|
error.code = "EEXIST";
|
|
throw error;
|
|
},
|
|
},
|
|
}),
|
|
/existing Base Sepolia archive/,
|
|
);
|
|
assert.deepEqual(await readFile(canonicalPath), canonicalBytes);
|
|
assert.deepEqual(await readFile(boundaryPath), boundaryBytes);
|
|
|
|
const unlinkFailureDate = new Date("2026-08-21T12:37:56.789Z");
|
|
const unlinkFailurePath = join(deployments, "base-sepolia.20260821T123756789Z.json");
|
|
await assert.rejects(
|
|
() => archiveManifest({
|
|
root,
|
|
network: "baseSepolia",
|
|
now: unlinkFailureDate,
|
|
io: {
|
|
rm: async (path, options) => {
|
|
if (path === canonicalPath) {
|
|
assert.deepEqual(await readFile(unlinkFailurePath), canonicalBytes);
|
|
throw new Error("source unlink failed");
|
|
}
|
|
return rm(path, options);
|
|
},
|
|
},
|
|
}),
|
|
/source unlink failed/,
|
|
);
|
|
assert.deepEqual(await readFile(canonicalPath), canonicalBytes);
|
|
assert.deepEqual(await readFile(unlinkFailurePath), canonicalBytes);
|
|
await assert.rejects(() => archiveManifest({ root, network: "anvil" }), /baseSepolia/);
|
|
} finally {
|
|
await rm(root, { recursive: true, force: true });
|
|
}
|
|
NODE
|
|
|
|
echo "Base configuration and manifest filesystem tests passed"
|