30 lines
1.1 KiB
Shell
Executable file
30 lines
1.1 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
rg -F 'qualified Env' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
|
|
rg -F 'qualified Text.URI' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
|
|
rg -F 'newtype Secret value = Secret value' \
|
|
"$ROOT/src/Nuthatch/Config.hs" >/dev/null
|
|
if rg -n 'lookupEnv|parseURI|splitOn.*://' \
|
|
"$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
|
|
printf 'configuration bypasses maintained parsers\n' >&2
|
|
exit 1
|
|
fi
|
|
if rg -n 'Secret.*deriving.*Show|data Config.*deriving.*Show' \
|
|
"$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
|
|
printf 'secret-bearing configuration has a revealing Show instance\n' >&2
|
|
exit 1
|
|
fi
|
|
for secret_type in \
|
|
SessionToken CsrfToken AuthorizationRequest TransactionClaims IdTokenClaims; do
|
|
if sed -n \
|
|
"/^\\(newtype\\|data\\) $secret_type /,/^$/p" \
|
|
"$ROOT/src/Nuthatch/Types.hs" "$ROOT/src/Nuthatch/Oidc.hs" |
|
|
rg 'deriving stock .*Show' >/dev/null; then
|
|
printf 'secret-bearing application value has a Show instance\n' >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
printf 'Runtime configuration structure passed\n'
|