- S3BlobStore (object_store, path-style) behind the same BlobStore trait, tested against a REAL MinIO container (round trip, overwrite, NotFound on get and delete, nested keys); [storage] backend=local|s3 config with validation + server-side selection (S3 creds via env overlay) - Helm chart: server pod with the secret broker as a SIDECAR sharing a private emptyDir unix socket (no network hop carries credentials), frontend, optional local PVC vs S3, OIDC/oauth values, unbuffered-SSE ingress annotations, NetworkPolicies (frontend->server only), hardened securityContexts; ci/check-helm.sh lints AND asserts the rendered topology properties - deploy/airgapped/install.sh: offline signature+checksum verification via the bundled teamclaw-bundler BEFORE any docker load; --verify-only mode; ci/test-install.sh rehearses clean/tampered/wrong-key paths with the real binary - CI: helm gate + installer rehearsal wired in 149 Rust tests; helm lint + rendered assertions green; installer verify-path rehearsal green. Co-Authored-By: Claude Fable 5 <[email protected]>
154 lines
5.1 KiB
Rust
154 lines
5.1 KiB
Rust
// figment::Jail::expect_with dictates closures returning figment's own
|
|
// (large) error type; the lint has nothing actionable here.
|
|
#![allow(clippy::result_large_err)]
|
|
|
|
use tc_config::{AppConfig, AuthMode, ConfigError, DeployTarget, LlmProviderKind};
|
|
|
|
const AIR_GAPPED_TOML: &str = r#"
|
|
deploy_target = "air_gapped"
|
|
listen_addr = "0.0.0.0:8080"
|
|
|
|
[database]
|
|
url = "postgres://teamclaw:pw@db:5432/teamclaw"
|
|
|
|
[llm]
|
|
provider = "openai_compat"
|
|
base_url = "http://local-llm:8000/v1"
|
|
model = "qwen2.5-72b-instruct"
|
|
|
|
[auth]
|
|
mode = "local"
|
|
"#;
|
|
|
|
const CLOUD_TOML: &str = r#"
|
|
deploy_target = "cloud"
|
|
listen_addr = "0.0.0.0:8080"
|
|
|
|
[database]
|
|
url = "postgres://teamclaw:pw@db:5432/teamclaw"
|
|
max_connections = 32
|
|
|
|
[llm]
|
|
provider = "anthropic"
|
|
model = "claude-sonnet-4-5"
|
|
|
|
[auth]
|
|
mode = "oidc"
|
|
issuer_url = "https://idp.example.com"
|
|
client_id = "teamclaw"
|
|
"#;
|
|
|
|
#[test]
|
|
fn loads_air_gapped_config_from_toml() {
|
|
figment::Jail::expect_with(|jail| {
|
|
jail.create_file("teamclaw.toml", AIR_GAPPED_TOML)?;
|
|
let cfg = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap();
|
|
assert_eq!(cfg.deploy_target, DeployTarget::AirGapped);
|
|
assert_eq!(cfg.listen_addr.port(), 8080);
|
|
assert_eq!(cfg.database.url, "postgres://teamclaw:pw@db:5432/teamclaw");
|
|
assert_eq!(cfg.llm.provider, LlmProviderKind::OpenAiCompat);
|
|
assert_eq!(
|
|
cfg.llm.base_url.as_deref(),
|
|
Some("http://local-llm:8000/v1")
|
|
);
|
|
assert_eq!(cfg.auth.mode, AuthMode::Local);
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn loads_cloud_config_with_oidc() {
|
|
figment::Jail::expect_with(|jail| {
|
|
jail.create_file("teamclaw.toml", CLOUD_TOML)?;
|
|
let cfg = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap();
|
|
assert_eq!(cfg.deploy_target, DeployTarget::Cloud);
|
|
assert_eq!(cfg.database.max_connections, 32);
|
|
assert_eq!(cfg.llm.provider, LlmProviderKind::Anthropic);
|
|
assert_eq!(cfg.auth.mode, AuthMode::Oidc);
|
|
assert_eq!(
|
|
cfg.auth.issuer_url.as_deref(),
|
|
Some("https://idp.example.com")
|
|
);
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn env_overrides_toml_values() {
|
|
figment::Jail::expect_with(|jail| {
|
|
jail.create_file("teamclaw.toml", AIR_GAPPED_TOML)?;
|
|
jail.set_env("TEAMCLAW_DATABASE__URL", "postgres://other:pw@x:5432/y");
|
|
jail.set_env("TEAMCLAW_LLM__MODEL", "llama-3.1-8b-instruct");
|
|
let cfg = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap();
|
|
assert_eq!(cfg.database.url, "postgres://other:pw@x:5432/y");
|
|
assert_eq!(cfg.llm.model, "llama-3.1-8b-instruct");
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn database_max_connections_defaults_to_ten() {
|
|
figment::Jail::expect_with(|jail| {
|
|
jail.create_file("teamclaw.toml", AIR_GAPPED_TOML)?;
|
|
let cfg = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap();
|
|
assert_eq!(cfg.database.max_connections, 10);
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn openai_compat_without_base_url_is_rejected() {
|
|
figment::Jail::expect_with(|jail| {
|
|
let toml = AIR_GAPPED_TOML.replace("base_url = \"http://local-llm:8000/v1\"\n", "");
|
|
jail.create_file("teamclaw.toml", &toml)?;
|
|
let err = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap_err();
|
|
assert!(matches!(err, ConfigError::Invalid(msg) if msg.contains("base_url")));
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn scripted_provider_requires_scenario_path() {
|
|
figment::Jail::expect_with(|jail| {
|
|
let toml = AIR_GAPPED_TOML
|
|
.replace("provider = \"openai_compat\"", "provider = \"scripted\"")
|
|
.replace("base_url = \"http://local-llm:8000/v1\"\n", "");
|
|
jail.create_file("teamclaw.toml", &toml)?;
|
|
let err = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap_err();
|
|
assert!(matches!(err, ConfigError::Invalid(msg) if msg.contains("scenario_path")));
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn oidc_mode_requires_issuer_and_client_id() {
|
|
figment::Jail::expect_with(|jail| {
|
|
let toml = CLOUD_TOML.replace("issuer_url = \"https://idp.example.com\"\n", "");
|
|
jail.create_file("teamclaw.toml", &toml)?;
|
|
let err = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap_err();
|
|
assert!(matches!(err, ConfigError::Invalid(msg) if msg.contains("issuer_url")));
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn missing_file_is_a_clear_error() {
|
|
figment::Jail::expect_with(|jail| {
|
|
let err = AppConfig::load_from(&jail.directory().join("absent.toml")).unwrap_err();
|
|
assert!(matches!(err, ConfigError::Load(_)));
|
|
Ok(())
|
|
});
|
|
}
|
|
|
|
#[test]
|
|
fn s3_backend_requires_endpoint_and_bucket() {
|
|
figment::Jail::expect_with(|jail| {
|
|
let toml =
|
|
format!("{AIR_GAPPED_TOML}\n[storage]\ndata_dir = \"./data\"\nbackend = \"s3\"\n");
|
|
jail.create_file("teamclaw.toml", &toml)?;
|
|
let err = AppConfig::load_from(&jail.directory().join("teamclaw.toml")).unwrap_err();
|
|
assert!(matches!(err, ConfigError::Invalid(msg) if msg.contains("s3_endpoint")));
|
|
Ok(())
|
|
});
|
|
}
|