inspec/test/unit/config_test.rb
Clinton Wolfe f7202c229b Add caching to Inspec::Config
Signed-off-by: Clinton Wolfe <clintoncwolfe@gmail.com>
2019-03-06 14:59:06 -05:00

611 lines
22 KiB
Ruby

require 'helper'
require 'stringio'
require 'inspec/config'
describe 'Inspec::Config' do
# ========================================================================== #
# Constructor
# ========================================================================== #
describe 'the constructor' do
describe 'when no args are provided' do
it 'should initialize properly' do
cfg = Inspec::Config.new
cfg.must_respond_to :final_options
end
end
describe 'when CLI args are provided' do
it 'should initialize properly' do
cfg = Inspec::Config.new({color: true, log_level: 'warn'})
cfg.must_respond_to :final_options
end
end
# TODO: add test for reading from default config path
end
# ========================================================================== #
# Global Caching
# ========================================================================== #
describe 'caching' do
# Note that since unit tests are randomized, we have no idea what is in
# the cache. We just want to validate that we get the same thing.
it 'should cache the config object' do
cfg_1 = Inspec::Config.new # in the unlikely event we are the first unit test
# Type check
cfg_cached = Inspec::Config.cached
cfg_cached.must_be_kind_of Inspec::Config
# Multiple calls to cached should return the same thing
cfg_2 = Inspec::Config.cached
cfg_2.must_equal cfg_cached
# Cached value unaffected by later instance creation
cfg_3 = Inspec::Config.new(shoe_size: 9)
cfg_4 = Inspec::Config.cached
cfg_4.must_equal cfg_cached
end
end
# ========================================================================== #
# File Validation
# ========================================================================== #
describe 'when validating a file' do
let(:cfg) { Inspec::Config.new({}, cfg_io) }
let(:cfg_io) { StringIO.new(ConfigTestHelper.fixture(fixture_name)) }
let(:seen_fields) { cfg.final_options.keys.sort }
describe 'when the file is a legacy file' do
let(:fixture_name) { 'legacy' }
it 'should read the file successfully' do
expected = ['color', 'reporter', 'target_id', 'type'].sort
seen_fields.must_equal expected
end
end
describe 'when the file is a valid v1.1 file' do
let(:fixture_name) { 'basic' }
it 'should read the file successfully' do
expected = ['create_lockfile', 'reporter', 'type'].sort
seen_fields.must_equal expected
end
end
describe 'when the file is minimal' do
let(:fixture_name) { 'minimal' }
it 'should read the file successfully' do
expected = ['reporter', 'type'].sort
seen_fields.must_equal expected
end
end
describe 'when the file has malformed json' do
let(:fixture_name) { 'malformed_json' }
it 'should throw an exception' do
ex = proc { cfg }.must_raise(Inspec::ConfigError::MalformedJson)
# Failed to load JSON configuration: 765: unexpected token at '{ "hot_garbage": "a", "version": "1.1",
# '
# Config was: "{ \"hot_garbage\": \"a\", \"version\": \"1.1\", \n"
ex.message.must_include 'Failed to load JSON config' # The message
ex.message.must_include 'unexpected token' # The specific parser error
ex.message.must_include 'hot_garbage' # A sample of the unacceptable contents
end
end
describe 'when the file has a bad file version' do
let(:fixture_name) { 'bad_version' }
it 'should throw an exception' do
ex = proc { cfg }.must_raise(Inspec::ConfigError::Invalid)
ex.message.must_include 'Unsupported config file version'
ex.message.must_include '99.99'
ex.message.must_include '1.1'
end
end
describe 'when a 1.1 file has an invalid top-level entry' do
let(:fixture_name) { 'bad_top_level' }
it 'should throw an exception' do
ex = proc { cfg }.must_raise(Inspec::ConfigError::Invalid)
ex.message.must_include 'Unrecognized top-level'
ex.message.must_include 'unsupported_field'
ex.message.must_include 'compliance'
end
end
end
# ========================================================================== #
# Defaults
# ========================================================================== #
describe 'reading defaults' do
let(:cfg) { Inspec::Config.new({}, nil, command) }
let(:final_options) { cfg.final_options }
let(:seen_fields) { cfg.final_options.keys.sort }
describe 'when the exec command is used' do
let(:command) { :exec }
it 'should have the correct defaults' do
expected = ['color', 'create_lockfile', 'backend_cache', 'reporter', 'show_progress', 'type'].sort
seen_fields.must_equal expected
final_options['reporter'].must_be_kind_of Hash
final_options['reporter'].count.must_equal 1
final_options['reporter'].keys.must_include 'cli'
final_options['show_progress'].must_equal false
final_options['color'].must_equal true
final_options['create_lockfile'].must_equal true
final_options['backend_cache'].must_equal true
end
end
describe 'when the shell command is used' do
let(:command) { :shell }
it 'should have the correct defaults' do
expected = ['reporter', 'type'].sort
seen_fields.must_equal expected
final_options['reporter'].must_be_kind_of Hash
final_options['reporter'].count.must_equal 1
final_options['reporter'].keys.must_include 'cli'
end
end
end
# ========================================================================== #
# Reading CLI Options
# ========================================================================== #
# The config facility supports passing in CLI options in the constructor, so
# that it can handle merging internally. That is tested here.
#
# This is different than storing options
# in the config file with the same name as the CLI options, which is
# tested under 'CLI Options Stored in File'
describe 'reading CLI options' do
let(:cfg) { Inspec::Config.new(cli_opts) }
let(:final_options) { cfg.final_options }
let(:seen_fields) { cfg.final_options.keys.sort }
describe 'when the CLI opts are present' do
let(:cli_opts) do
{
color: true,
'string_key' => 'string_value',
array_value: [1,2,3],
}
end
it 'should transparently round-trip the options' do
expected = ['color', 'array_value', 'reporter', 'string_key', 'type'].sort
seen_fields.must_equal expected
final_options[:color].must_equal true
final_options['color'].must_equal true
final_options['string_key'].must_equal 'string_value'
final_options[:string_key].must_equal 'string_value'
final_options['array_value'].must_equal [1,2,3]
final_options[:array_value].must_equal [1,2,3]
end
end
end
# ========================================================================== #
# CLI Options Stored in File
# ========================================================================== #
describe 'reading CLI options stored in the config file' do
let(:cfg) { Inspec::Config.new({}, cfg_io) }
let(:final_options) { cfg.final_options }
let(:cfg_io) { StringIO.new(ConfigTestHelper.fixture(fixture_name)) }
let(:seen_fields) { cfg.final_options.keys.sort }
# These two test cases have the same options but in different file versions.
describe 'when the CLI opts are present in a 1.1 file' do
let(:fixture_name) { :like_legacy }
it 'should read the options' do
expected = ['color', 'reporter', 'target_id', 'type'].sort
seen_fields.must_equal expected
final_options['color'].must_equal "true" # Dubious - should this be String or TrueClass?
final_options['target_id'].must_equal 'mynode'
end
end
describe 'when the CLI opts are present in a legacy file' do
let(:fixture_name) { :legacy }
it 'should read the options' do
expected = ['color', 'reporter', 'target_id', 'type'].sort
seen_fields.must_equal expected
final_options['color'].must_equal "true" # Dubious - should this be String or TrueClass?
final_options['target_id'].must_equal 'mynode'
end
end
end
# ========================================================================== #
# Parsing and Validating Reporters
# ========================================================================== #
# TODO: this should be moved into plugins for the reporters
describe 'when parsing reporters' do
let(:cfg) { Inspec::Config.new(cli_opts) }
let(:seen_reporters) { cfg['reporter'] }
describe 'when paring CLI reporter' do
let(:cli_opts) { { 'reporter' => ['cli'] } }
it 'parse cli reporters' do
expected_value = { 'cli' => { 'stdout' => true }}
seen_reporters.must_equal expected_value
end
end
describe 'when paring CLI reporter' do
let(:cli_opts) { { 'reporter' => ['cli'], 'target_id' => '1d3e399f-4d71-4863-ac54-84d437fbc444' } }
it 'parses cli report and attaches target_id' do
expected_value = {"cli"=>{"stdout"=>true, "target_id"=>"1d3e399f-4d71-4863-ac54-84d437fbc444"}}
seen_reporters.must_equal expected_value
end
end
end
describe 'when validating reporters' do
# validate_reporters is private, so we use .send
let(:cfg) { Inspec::Config.new }
it 'valid reporter' do
reporters = { 'json' => { 'stdout' => true } }
cfg.send(:validate_reporters!, reporters)
end
it 'invalid reporter type' do
reporters = ['json', 'magenta']
proc { cfg.send(:validate_reporters!, reporters) }.must_raise NotImplementedError
end
it 'two reporters outputting to stdout' do
stdout = { 'stdout' => true }
reporters = { 'json' => stdout, 'cli' => stdout }
proc { cfg.send(:validate_reporters!, reporters) }.must_raise ArgumentError
end
end
# ========================================================================== #
# Miscellaneous Option Finalization
# ========================================================================== #
describe 'option finalization' do
it 'raises if `--password/--sudo-password` are used without value' do
# When you invoke `inspec shell --password` (with no value for password,
# though it is setup to expect a string) Thor will set the key with value -1
ex = proc { Inspec::Config.new({'sudo_password' => -1}) }.must_raise(ArgumentError)
ex.message.must_match(/Please provide a value for --sudo-password/)
end
it 'assumes `--sudo` if `--sudo-password` is used without it' do
@mock_logger = Minitest::Mock.new
@mock_logger.expect(:warn, nil, [/Adding `--sudo`./])
Inspec::Log.stub :warn, proc { |message| @mock_logger.warn(message) } do
cfg = Inspec::Config.new('sudo_password' => 'somepass')
cfg.key?('sudo').must_equal true
end
@mock_logger.verify
end
it 'calls `Compliance::API.login` if `opts[:compliance] is passed`' do
InspecPlugins::Compliance::API.expects(:login)
cfg_io = StringIO.new(ConfigTestHelper.fixture('with_compliance'))
Inspec::Config.new({ backend: 'mock' }, cfg_io)
end
end
# ========================================================================== #
# Fetching Credentials
# ========================================================================== #
describe 'when fetching creds' do
let(:cfg) { Inspec::Config.new(cli_opts, cfg_io) }
let(:cfg_io) { StringIO.new(ConfigTestHelper.fixture(file_fixture_name)) }
let(:seen_fields) { creds.keys.sort }
let(:creds) { cfg.unpack_train_credentials }
describe 'when generic creds are present on the cli' do
let(:cfg_io) { nil }
let(:cli_opts) { { sudo: true, 'shell_command': 'ksh' } }
it 'should pass the credentials as-is' do
expected = [:backend, :sudo, :shell_command].sort
seen_fields.must_equal expected
creds[:sudo].must_equal true
creds[:shell_command].must_equal 'ksh'
creds[:backend].must_equal 'local' # Checking for default
end
end
describe 'when creds are specified on the CLI with a backend and transport prefixes' do
let(:cfg_io) { nil }
let(:cli_opts) { { backend: 'ssh', ssh_host: 'example.com', ssh_key_files: 'mykey' } }
it 'should read the backend and strip prefixes' do
expected = [:backend, :host, :key_files].sort
seen_fields.must_equal expected
creds[:backend].must_equal 'ssh'
creds[:host].must_equal 'example.com'
creds[:key_files].must_equal 'mykey'
end
end
describe 'when creds are specified with a credset target_uri in a 1.1 file without transport prefixes' do
let(:file_fixture_name) { :basic }
let(:cli_opts) { { target: 'ssh://set1' }}
it 'should use the credset to lookup the creds in the file' do
expected = [:backend, :host, :user].sort
seen_fields.must_equal expected
creds[:backend].must_equal 'ssh'
creds[:host].must_equal 'some.host'
creds[:user].must_equal 'some_user'
end
end
describe 'when creds are specified with a credset that contains odd characters' do
let(:file_fixture_name) { :match_checks_in_credset_names }
[
'ssh://TitleCase',
'ssh://snake_case',
'ssh://conta1nsnumeral5',
].each do |target_uri|
it "should be able to unpack #{target_uri}" do
# let() caching breaks things here
cfg_io = StringIO.new(ConfigTestHelper.fixture(file_fixture_name))
cli_opts = { target: target_uri }
cfg = Inspec::Config.new({ target: target_uri }, cfg_io)
creds = cfg.unpack_train_credentials
creds.count.must_equal 2
creds[:backend].must_equal 'ssh'
creds[:found].must_equal 'yes'
end
end
[
'ssh://contains.dots',
].each do |target_uri|
it "should handoff unpacking #{target_uri} to train" do
# let() caching breaks things here
cfg_io = StringIO.new(ConfigTestHelper.fixture(file_fixture_name))
cfg = Inspec::Config.new({ target: target_uri }, cfg_io)
creds = cfg.unpack_train_credentials
creds.count.must_equal 2
creds[:backend].must_equal 'ssh'
creds[:host].must_equal 'contains.dots'
end
end
[
'ssh://contains spaces',
].each do |target_uri|
it "should be not able to unpack #{target_uri}" do
# let() caching breaks things here
cfg_io = StringIO.new(ConfigTestHelper.fixture(file_fixture_name))
cfg = Inspec::Config.new({ target: target_uri }, cfg_io)
assert_raises(Train::UserError) { creds = cfg.unpack_train_credentials }
end
end
end
describe 'when creds are specified with a credset target_uri in a 1.1 file and a prefixed override on the CLI' do
let(:file_fixture_name) { :basic }
let(:cli_opts) { { target: 'ssh://set1', ssh_user: 'bob' } }
it 'should use the credset to lookup the creds in the file then override the single value' do
expected = [:backend, :host, :user].sort
seen_fields.must_equal expected
creds[:backend].must_equal 'ssh'
creds[:host].must_equal 'some.host'
creds[:user].must_equal 'bob'
end
end
describe 'when creds are specified with a non-credset target_uri' do
let(:cfg_io) { nil }
let(:cli_opts) { { target: 'ssh://bob@somehost' } }
it 'should unpack the options using the URI parser' do
expected = [:backend, :host, :user].sort
seen_fields.must_equal expected
creds[:backend].must_equal 'ssh'
creds[:host].must_equal 'somehost'
creds[:user].must_equal 'bob'
end
end
describe 'when backcompat creds are specified on the CLI without a transport prefix' do
let(:cfg_io) { nil }
let(:cli_opts) { { target: 'ssh://some.host', user: 'bob' } }
it 'should assign the options correctly' do
expected = [:backend, :host, :user].sort
seen_fields.must_equal expected
creds[:backend].must_equal 'ssh'
creds[:host].must_equal 'some.host'
creds[:user].must_equal 'bob'
end
end
end
# ========================================================================== #
# Merging Options
# ========================================================================== #
describe 'when merging options' do
let(:cfg) { Inspec::Config.new(cli_opts, cfg_io, command) }
let(:cfg_io) { StringIO.new(ConfigTestHelper.fixture(file_fixture_name)) }
let(:seen_fields) { cfg.final_options.keys.sort }
let(:command) { nil }
describe 'when there is both a default and a config file setting' do
let(:file_fixture_name) { :override_check }
let(:cli_opts) { {} }
it 'the config file setting should prevail' do
Inspec::Config::Defaults.stubs(:default_for_command).returns('target_id'=> 'value_from_default')
expected = ['reporter', 'target_id', 'type'].sort
seen_fields.must_equal expected
cfg.final_options['target_id'].must_equal 'value_from_config_file'
cfg.final_options[:target_id].must_equal 'value_from_config_file'
end
end
describe 'when there is both a default and a CLI option' do
let(:cli_opts) { { target_id: 'value_from_cli_opts' } }
let(:cfg_io) { nil }
it 'the CLI option should prevail' do
Inspec::Config::Defaults.stubs(:default_for_command).returns('target_id'=> 'value_from_default')
expected = ['reporter', 'target_id', 'type'].sort
seen_fields.must_equal expected
cfg.final_options['target_id'].must_equal 'value_from_cli_opts'
cfg.final_options[:target_id].must_equal 'value_from_cli_opts'
end
end
describe 'when there is both a config file setting and a CLI option' do
let(:file_fixture_name) { :override_check }
let(:cli_opts) { { target_id: 'value_from_cli_opts' } }
it 'the CLI option should prevail' do
expected = ['reporter', 'target_id', 'type'].sort
seen_fields.must_equal expected
cfg.final_options['target_id'].must_equal 'value_from_cli_opts'
cfg.final_options[:target_id].must_equal 'value_from_cli_opts'
end
end
describe 'specifically check default vs config file override for "reporter" setting' do
let(:cli_opts) { {} }
let(:command) { :shell } # shell default is [ :cli ]
let(:file_fixture_name) { :override_check } # This fixture sets the cfg file contents to request a json reporter
it 'the config file setting should prevail' do
expected = ['reporter', 'target_id', 'type'].sort
seen_fields.must_equal expected
cfg.final_options['reporter'].must_be_kind_of Hash
cfg.final_options['reporter'].keys.must_equal ['json']
cfg.final_options['reporter']['json']['path'].must_equal 'path/from/config/file'
cfg.final_options[:reporter].must_be_kind_of Hash
cfg.final_options[:reporter].keys.must_equal ['json']
cfg.final_options[:reporter]['json']['path'].must_equal 'path/from/config/file'
end
end
end
end
# ========================================================================== #
# Test Fixtures
# ========================================================================== #
module ConfigTestHelper
def fixture(fixture_name)
case fixture_name.to_sym
when :legacy
# TODO - this is dubious, but based on https://www.inspec.io/docs/reference/reporters/#automate-reporter
# Things that have 'compliance' as a toplevel have also been seen
<<~EOJ1
{
"color": "true",
"target_id": "mynode",
"reporter": {
"automate" : {
"url" : "https://YOUR_A2_URL/data-collector/v0/",
"token" : "YOUR_A2_ADMIN_TOKEN"
}
}
}
EOJ1
when :basic
<<~EOJ2
{
"version": "1.1",
"cli_options": {
"create_lockfile": "false"
},
"reporter": {
"automate" : {
"url": "http://some.where",
"token" : "YOUR_A2_ADMIN_TOKEN"
}
},
"credentials": {
"ssh": {
"set1": {
"host": "some.host",
"user": "some_user"
}
}
}
}
EOJ2
when :like_legacy
<<~EOJ3
{
"version": "1.1",
"cli_options": {
"color": "true",
"target_id": "mynode"
},
"reporter": {
"automate" : {
"url" : "https://YOUR_A2_URL/data-collector/v0/",
"token" : "YOUR_A2_ADMIN_TOKEN"
}
}
}
EOJ3
when :override_check
<<~EOJ4
{
"version": "1.1",
"cli_options": {
"target_id": "value_from_config_file"
},
"reporter": {
"json": {
"path": "path/from/config/file"
}
}
}
EOJ4
when :minimal
'{ "version": "1.1" }'
when :bad_version
'{ "version": "99.99" }'
when :bad_top_level
'{ "version": "1.1", "unsupported_field": "some_value" }'
when :malformed_json
'{ "hot_garbage": "a", "version": "1.1", '
when :with_compliance
# TODO - this is dubious, need to verify
<<~EOJ5
{
"compliance": {
"server":"https://some.host",
"user":"someuser"
}
}
EOJ5
when :match_checks_in_credset_names
<<~EOJ6
{
"version": "1.1",
"credentials": {
"ssh": {
"TitleCase": {
"found": "yes"
},
"snake_case": {
"found": "yes"
},
"conta1nsnumeral5": {
"found": "yes"
},
"contains.dots": {
"found": "no"
},
"contains spaces": {
"found": "no"
}
}
}
}
EOJ6
end
end
module_function :fixture
end