|
| 1 | +//! Build output validation tests |
| 2 | +//! |
| 3 | +//! Validates that build variants contain/exclude the expected components. |
| 4 | +//! These tests run against the built SQL files, not the database. |
| 5 | +
|
| 6 | +use std::fs; |
| 7 | +use std::path::Path; |
| 8 | + |
| 9 | +/// Helper to read a release SQL file |
| 10 | +fn read_release_sql(filename: &str) -> String { |
| 11 | + let path = format!("../../release/{}", filename); |
| 12 | + fs::read_to_string(&path).unwrap_or_else(|_| panic!("Failed to read {}", path)) |
| 13 | +} |
| 14 | + |
| 15 | +// ============================================================================= |
| 16 | +// Protect Variant Tests |
| 17 | +// ============================================================================= |
| 18 | + |
| 19 | +#[test] |
| 20 | +fn protect_variant_file_exists() { |
| 21 | + assert!( |
| 22 | + Path::new("../../release/cipherstash-encrypt-protect.sql").exists(), |
| 23 | + "protect variant installer should exist" |
| 24 | + ); |
| 25 | +} |
| 26 | + |
| 27 | +#[test] |
| 28 | +fn protect_uninstaller_exists() { |
| 29 | + assert!( |
| 30 | + Path::new("../../release/cipherstash-encrypt-protect-uninstall.sql").exists(), |
| 31 | + "protect variant uninstaller should exist" |
| 32 | + ); |
| 33 | +} |
| 34 | + |
| 35 | +#[test] |
| 36 | +fn protect_variant_excludes_config_table() { |
| 37 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 38 | + assert!( |
| 39 | + !sql.contains("CREATE TABLE") || !sql.contains("eql_v2_configuration"), |
| 40 | + "protect variant should not contain eql_v2_configuration table" |
| 41 | + ); |
| 42 | +} |
| 43 | + |
| 44 | +#[test] |
| 45 | +fn protect_variant_excludes_config_state_type() { |
| 46 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 47 | + assert!( |
| 48 | + !sql.contains("eql_v2_configuration_state"), |
| 49 | + "protect variant should not contain eql_v2_configuration_state enum" |
| 50 | + ); |
| 51 | +} |
| 52 | + |
| 53 | +#[test] |
| 54 | +fn protect_variant_excludes_add_search_config() { |
| 55 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 56 | + assert!( |
| 57 | + !sql.contains("CREATE FUNCTION eql_v2.add_search_config") |
| 58 | + && !sql.contains("CREATE OR REPLACE FUNCTION eql_v2.add_search_config"), |
| 59 | + "protect variant should not contain add_search_config function" |
| 60 | + ); |
| 61 | +} |
| 62 | + |
| 63 | +#[test] |
| 64 | +fn protect_variant_excludes_add_column() { |
| 65 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 66 | + assert!( |
| 67 | + !sql.contains("CREATE FUNCTION eql_v2.add_column") |
| 68 | + && !sql.contains("CREATE OR REPLACE FUNCTION eql_v2.add_column"), |
| 69 | + "protect variant should not contain add_column function" |
| 70 | + ); |
| 71 | +} |
| 72 | + |
| 73 | +#[test] |
| 74 | +fn protect_variant_excludes_migrate_config() { |
| 75 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 76 | + assert!( |
| 77 | + !sql.contains("CREATE FUNCTION eql_v2.migrate_config") |
| 78 | + && !sql.contains("CREATE OR REPLACE FUNCTION eql_v2.migrate_config"), |
| 79 | + "protect variant should not contain migrate_config function" |
| 80 | + ); |
| 81 | +} |
| 82 | + |
| 83 | +#[test] |
| 84 | +fn protect_variant_excludes_create_encrypted_columns() { |
| 85 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 86 | + assert!( |
| 87 | + !sql.contains("CREATE FUNCTION eql_v2.create_encrypted_columns") |
| 88 | + && !sql.contains("CREATE OR REPLACE FUNCTION eql_v2.create_encrypted_columns"), |
| 89 | + "protect variant should not contain create_encrypted_columns function" |
| 90 | + ); |
| 91 | +} |
| 92 | + |
| 93 | +#[test] |
| 94 | +fn protect_variant_excludes_diff_config() { |
| 95 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 96 | + assert!( |
| 97 | + !sql.contains("CREATE FUNCTION eql_v2.diff_config") |
| 98 | + && !sql.contains("CREATE OR REPLACE FUNCTION eql_v2.diff_config"), |
| 99 | + "protect variant should not contain diff_config function" |
| 100 | + ); |
| 101 | +} |
| 102 | + |
| 103 | +#[test] |
| 104 | +fn protect_variant_includes_core_encrypted_type() { |
| 105 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 106 | + assert!( |
| 107 | + sql.contains("eql_v2_encrypted"), |
| 108 | + "protect variant should contain eql_v2_encrypted type" |
| 109 | + ); |
| 110 | +} |
| 111 | + |
| 112 | +#[test] |
| 113 | +fn protect_variant_includes_operators() { |
| 114 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 115 | + assert!( |
| 116 | + sql.contains("CREATE OPERATOR"), |
| 117 | + "protect variant should contain operators" |
| 118 | + ); |
| 119 | +} |
| 120 | + |
| 121 | +#[test] |
| 122 | +fn protect_variant_includes_blake3() { |
| 123 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 124 | + assert!( |
| 125 | + sql.contains("eql_v2.blake3"), |
| 126 | + "protect variant should contain blake3 index type" |
| 127 | + ); |
| 128 | +} |
| 129 | + |
| 130 | +#[test] |
| 131 | +fn protect_variant_includes_hmac_256() { |
| 132 | + let sql = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 133 | + assert!( |
| 134 | + sql.contains("eql_v2.hmac_256"), |
| 135 | + "protect variant should contain hmac_256 index type" |
| 136 | + ); |
| 137 | +} |
| 138 | + |
| 139 | +#[test] |
| 140 | +fn protect_variant_is_smaller_than_full() { |
| 141 | + let protect = read_release_sql("cipherstash-encrypt-protect.sql"); |
| 142 | + let full = read_release_sql("cipherstash-encrypt.sql"); |
| 143 | + assert!( |
| 144 | + protect.len() < full.len(), |
| 145 | + "protect variant ({} bytes) should be smaller than full variant ({} bytes)", |
| 146 | + protect.len(), |
| 147 | + full.len() |
| 148 | + ); |
| 149 | +} |
0 commit comments