26 lines
1.3 KiB
Python
26 lines
1.3 KiB
Python
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
|
|
def test_edge_hsts_ownership_is_explicit_and_verified():
|
|
settings = (ROOT / "backend/config/settings.py").read_text(encoding="utf-8")
|
|
deploy = (ROOT / "scripts/deploy_production.sh").read_text(encoding="utf-8")
|
|
workflow = (ROOT / ".gitea/workflows/deploy.yml").read_text(encoding="utf-8")
|
|
example = (ROOT / ".env.production.example").read_text(encoding="utf-8")
|
|
|
|
assert 'os.getenv("DJANGO_HSTS_AT_EDGE", "false")' in settings
|
|
assert '["security.W004"]' in settings
|
|
assert "DJANGO_HSTS_AT_EDGE=true" in workflow
|
|
assert "SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt" in workflow
|
|
assert 'DEPLOY_HEALTH_HOST="math.jacky0987.xyz"' in workflow
|
|
assert 'DEPLOY_SMOKE_BASE_URL="https://math.jacky0987.xyz"' in workflow
|
|
assert 'DEPLOY_SMOKE_WS_URL="wss://math.jacky0987.xyz/ws/health/"' in workflow
|
|
assert '"https://math.jacky0987.xyz/health/"' in workflow
|
|
assert "127.0.0.1:4321" not in workflow
|
|
assert "curl --silent --show-error --head" in deploy
|
|
assert "curl --fail --silent --show-error --head" not in deploy
|
|
assert "strict-transport-security:.*max-age=[1-9][0-9]*" in deploy
|
|
assert "unverified" not in deploy.lower()
|
|
assert "DJANGO_HSTS_AT_EDGE=false" in example
|