63 lines
2.3 KiB
Shell
Executable file
63 lines
2.3 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
|
|
rg -F 'qualified Env' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
|
|
rg -F 'qualified Text.URI' "$ROOT/src/Nuthatch/Config.hs" >/dev/null
|
|
rg -F 'newtype Secret value = Secret value' \
|
|
"$ROOT/src/Nuthatch/Config.hs" >/dev/null
|
|
if rg -n 'lookupEnv|parseURI|splitOn.*://' \
|
|
"$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
|
|
printf 'configuration bypasses maintained parsers\n' >&2
|
|
exit 1
|
|
fi
|
|
for secret_group in \
|
|
Secret Config HttpConfig OidcConfig PostgresConfig S3Config; do
|
|
if sed -n "/^\\(data\\|newtype\\) $secret_group /,/^$/p" \
|
|
"$ROOT/src/Nuthatch/Config.hs" |
|
|
rg '\bShow\b' >/dev/null; then
|
|
printf 'secret-bearing configuration has a revealing Show instance\n' >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
config_fields="$(
|
|
sed -n '/^data Config /,/^$/p' "$ROOT/src/Nuthatch/Config.hs" |
|
|
sed -nE \
|
|
's/^[[:space:]]*[\{,][[:space:]]*(cfg[A-Za-z0-9_]+).*/\1/p'
|
|
)"
|
|
expected_config_fields='cfgRuntime
|
|
cfgHttp
|
|
cfgOidc
|
|
cfgPostgres
|
|
cfgRedis
|
|
cfgS3
|
|
cfgProduct
|
|
cfgRecovery'
|
|
if [[ "$config_fields" != "$expected_config_fields" ]]; then
|
|
printf 'top-level configuration does not contain exactly eight groups\n' >&2
|
|
exit 1
|
|
fi
|
|
if rg -F 'Nuthatch.Streaming' "$ROOT/src/Nuthatch/Config.hs" >/dev/null; then
|
|
printf 'configuration depends on streaming implementation details\n' >&2
|
|
exit 1
|
|
fi
|
|
rg -F 'withDb :: PostgresConfig' "$ROOT/src/Nuthatch/Db.hs" >/dev/null
|
|
rg -F 'withRedis :: RedisConfig' "$ROOT/src/Nuthatch/Redis.hs" >/dev/null
|
|
rg -F 'throttleCheck :: Redis -> RedisConfig' \
|
|
"$ROOT/src/Nuthatch/Redis.hs" >/dev/null
|
|
rg -F 'newS3 :: S3Config' "$ROOT/src/Nuthatch/S3.hs" >/dev/null
|
|
rg -F 'mintSession :: HttpConfig' "$ROOT/src/Nuthatch/Session.hs" >/dev/null
|
|
rg -F 'verifySession :: HttpConfig' "$ROOT/src/Nuthatch/Session.hs" >/dev/null
|
|
rg -F 'beginAuthorization :: OidcConfig' "$ROOT/src/Nuthatch/Oidc.hs" >/dev/null
|
|
for secret_type in \
|
|
SessionToken CsrfToken AuthorizationRequest TransactionClaims IdTokenClaims; do
|
|
if sed -n \
|
|
"/^\\(newtype\\|data\\) $secret_type /,/^$/p" \
|
|
"$ROOT/src/Nuthatch/Types.hs" "$ROOT/src/Nuthatch/Oidc.hs" |
|
|
rg 'deriving stock .*Show' >/dev/null; then
|
|
printf 'secret-bearing application value has a Show instance\n' >&2
|
|
exit 1
|
|
fi
|
|
done
|
|
printf 'Runtime configuration structure passed\n'
|