mirror of
https://github.com/fabro-sh/fabro.git
synced 2026-09-05 08:10:39 +00:00
1ef10b46ce
- Capture webhook secret at route mount time via Arc<[u8]> router state so the handler drops its per-request server_secret lookup and the dead NOT_FOUND fallback. - Extract WEBHOOK_ROUTE and WEBHOOK_SECRET_ENV constants; apply across serve.rs, server.rs, and TailscaleFunnelManager so the mounted route and the URLs pushed to GitHub cannot drift. - Flatten the seven-level nested webhook startup match in serve.rs into a single start_webhook_strategy helper with early returns, short-circuiting when the secret is absent and replacing the server.api.url .expect with a propagated error. - Share compute_signature and a new read_repo_file helper across tests; delete the duplicated webhook_signature, TestHmacSha256, and read_doc/repo_root copies. - Replace the nested for-loops in the new webhook auth tests with five flat #[tokio::test] cases per CLAUDE.md. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
66 lines
2.4 KiB
Rust
66 lines
2.4 KiB
Rust
use crate::helpers::read_repo_file as read_doc;
|
|
|
|
#[test]
|
|
fn active_server_docs_describe_the_unix_socket_default() {
|
|
let architecture = read_doc("docs/reference/architecture.mdx");
|
|
assert!(
|
|
architecture.contains("~/.fabro/fabro.sock"),
|
|
"architecture doc should mention the default Unix socket bind"
|
|
);
|
|
|
|
let api_overview = read_doc("docs/api-reference/overview.mdx");
|
|
assert!(
|
|
api_overview.contains("~/.fabro/fabro.sock"),
|
|
"API overview should mention the default Unix socket bind"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn security_doc_does_not_require_jwt_keys_for_the_current_web_flow() {
|
|
let security = read_doc("docs/administration/security.mdx");
|
|
assert!(
|
|
security.contains("SESSION_SECRET"),
|
|
"security doc should still mention the session secret"
|
|
);
|
|
assert!(
|
|
!security.contains("`FABRO_JWT_PRIVATE_KEY`, `FABRO_JWT_PUBLIC_KEY`, and `SESSION_SECRET`"),
|
|
"security doc should not describe JWT keys as required for the current web flow"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn deploy_server_doc_links_to_the_cli_target_section_slug() {
|
|
let deploy_server = read_doc("docs/administration/deploy-server.mdx");
|
|
assert!(
|
|
deploy_server.contains("/reference/user-configuration#cli-target-section"),
|
|
"deploy-server doc should link to the Mintlify slug for the [cli.target] section"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn changelog_marks_removed_mutual_tls_as_historical() {
|
|
let changelog = read_doc("docs/changelog/2026-03-03.mdx");
|
|
assert!(
|
|
changelog.contains("removed inbound mutual TLS listener support"),
|
|
"historical changelog should clarify that inbound mutual TLS is no longer supported"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn github_docs_describe_webhooks_as_strategy_dependent() {
|
|
let github = read_doc("docs/integrations/github.mdx");
|
|
assert!(
|
|
!github.contains("enables browser OAuth and webhooks"),
|
|
"GitHub integration docs should not imply app auth alone enables webhook delivery"
|
|
);
|
|
assert!(
|
|
!github.contains("| Webhooks | No | Yes |"),
|
|
"GitHub strategy matrix should describe webhook delivery as strategy-dependent"
|
|
);
|
|
|
|
let server_configuration = read_doc("docs/administration/server-configuration.mdx");
|
|
assert!(
|
|
!server_configuration.contains("enables the GitHub App flow, browser OAuth, and webhooks"),
|
|
"server configuration docs should not imply app auth alone enables webhook delivery"
|
|
);
|
|
}
|