mirror of
https://github.com/Sea-Haven-Industries/meal-order-manager.git
synced 2026-09-30 06:33:12 +00:00
12f1eb881f
Some checks failed
Build Lambda Layer / build (push) Has been cancelled
* fix(auth): accept federated portal Cognito tokens for meals admin Google Workspace federation stores email_verified=false, which 403'd the portal Admin probe while the public menu still loaded. * fix(iam): grant plan role CloudFront DescribeFunction
55 lines
2.1 KiB
Python
55 lines
2.1 KiB
Python
"""Structural checks for portal Cognito ID-token configuration."""
|
|
|
|
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
TERRAFORM = ROOT / "terraform"
|
|
|
|
|
|
def _read(name: str) -> str:
|
|
return (TERRAFORM / name).read_text()
|
|
|
|
|
|
def test_portal_cognito_parameters_are_managed():
|
|
locals_tf = _read("locals.tf")
|
|
ssm_tf = _read("ssm.tf")
|
|
variables_tf = _read("variables.tf")
|
|
|
|
assert (
|
|
'portal_cognito_issuer_param = "${local.ssm_prefix}/portal-cognito-issuer"'
|
|
in locals_tf
|
|
)
|
|
assert (
|
|
'portal_cognito_audience_param = "${local.ssm_prefix}/portal-cognito-audience"'
|
|
in locals_tf
|
|
)
|
|
assert (
|
|
'portal_cognito_trust_param = "${local.ssm_prefix}/portal-cognito-trust"'
|
|
in locals_tf
|
|
)
|
|
assert 'resource "aws_ssm_parameter" "portal_cognito_issuer"' in ssm_tf
|
|
assert 'resource "aws_ssm_parameter" "portal_cognito_audience"' in ssm_tf
|
|
assert 'resource "aws_ssm_parameter" "portal_cognito_trust"' in ssm_tf
|
|
assert 'variable "portal_cognito_issuer"' in variables_tf
|
|
assert 'variable "portal_cognito_audience"' in variables_tf
|
|
assert 'variable "portal_cognito_extra_trust"' in variables_tf
|
|
|
|
|
|
def test_both_api_lambdas_receive_parameter_names():
|
|
lambda_tf = _read("lambda.tf")
|
|
|
|
assert lambda_tf.count("PORTAL_COGNITO_ISSUER_PARAM") == 2
|
|
assert lambda_tf.count("PORTAL_COGNITO_AUDIENCE_PARAM") == 2
|
|
assert lambda_tf.count("PORTAL_COGNITO_TRUST_PARAM") == 2
|
|
assert lambda_tf.count("aws_ssm_parameter.portal_cognito_issuer.name") == 2
|
|
assert lambda_tf.count("aws_ssm_parameter.portal_cognito_audience.name") == 2
|
|
assert lambda_tf.count("aws_ssm_parameter.portal_cognito_trust.name") == 2
|
|
|
|
|
|
def test_submit_route_remains_public_for_google_compatibility():
|
|
locals_tf = _read("locals.tf")
|
|
submit_route = locals_tf.split("submit_order = {", 1)[1].split("}", 1)[0]
|
|
|
|
assert 'route_key = "POST /api/submit-order"' in submit_route
|
|
assert 'authorizer = "NONE"' in submit_route
|
|
assert 'authorizer_type = "JWT"' not in _read("apigateway.tf")
|