From e5e0e6631600ce7ba730791d6a00befca783f952 Mon Sep 17 00:00:00 2001 From: "kubestellar-hive[bot]" Date: Fri, 28 Aug 2026 06:03:40 -0400 Subject: [PATCH] [quality] test: add BATS coverage for shared.just powerwash/toggle-tpm2 system_files/shared/usr/share/ublue-os/just/shared.just had zero test coverage. Its powerwash recipe performs an irreversible factory reset (sudo bootc install reset --experimental) behind two gum confirmations, with a bctl fast path that must bypass those prompts. tests/test_shared_just.bats extracts the powerwash shebang recipe body and executes it against stubbed bctl/gum/sudo binaries, asserting: bctl delegation short-circuits gum and sudo; declining either confirmation cancels without wiping; non-affirmative and empty answers decline; two prompts are always required; and the reset runs exactly once only after both confirmations. toggle-tpm2 is checked for its absolute luks-tpm2-autounlock path. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: kubestellar-hive[bot] --- tests/test_shared_just.bats | 209 ++++++++++++++++++++++++++++++++++++ 1 file changed, 209 insertions(+) create mode 100644 tests/test_shared_just.bats diff --git a/tests/test_shared_just.bats b/tests/test_shared_just.bats new file mode 100644 index 00000000..bf34841a --- /dev/null +++ b/tests/test_shared_just.bats @@ -0,0 +1,209 @@ +#!/usr/bin/env bats +# Tests for system_files/shared/usr/share/ublue-os/just/shared.just +# +# Covers the two recipes defined there: +# - powerwash (destructive factory reset, double-confirmation gated) +# - toggle-tpm2 (LUKS TPM2 auto-unlock toggle) +# +# The powerwash recipe body is a `#!/usr/bin/bash` shebang recipe with no just +# interpolation, so it can be extracted verbatim and executed against stubbed +# bctl/gum/sudo binaries. That exercises the real control flow instead of +# grepping the recipe text. + +SHARED_JUST="${BATS_TEST_DIRNAME}/../system_files/shared/usr/share/ublue-os/just/shared.just" +WORKDIR="" + +# Extract a shebang recipe body from shared.just and dedent it by four spaces. +_extract_recipe() { + awk -v name="$1" ' + $0 == name ":" { in_recipe = 1; next } + in_recipe && $0 ~ /^[^[:space:]]/ { exit } + in_recipe && $0 ~ /^ / { sub(/^ /, ""); print } + in_recipe && $0 == "" { print } + ' "${SHARED_JUST}" +} + +setup() { + WORKDIR="$(mktemp -d)" + mkdir -p "${WORKDIR}/bin" + : > "${WORKDIR}/calls.log" + : > "${WORKDIR}/gum-answers" + + _extract_recipe powerwash > "${WORKDIR}/powerwash.sh" + chmod +x "${WORKDIR}/powerwash.sh" + + # gum stub: pops one answer per invocation from GUM_ANSWERS. + cat > "${WORKDIR}/bin/gum" <<'EOF' +#!/usr/bin/bash +printf 'gum %s\n' "$*" >> "${CALLS}" +answer="$(/usr/bin/head -n1 "${GUM_ANSWERS}")" +/usr/bin/tail -n +2 "${GUM_ANSWERS}" > "${GUM_ANSWERS}.tmp" +/bin/mv "${GUM_ANSWERS}.tmp" "${GUM_ANSWERS}" +printf '%s\n' "${answer}" +EOF + + cat > "${WORKDIR}/bin/sudo" <<'EOF' +#!/usr/bin/bash +printf 'sudo %s\n' "$*" >> "${CALLS}" +EOF + + cat > "${WORKDIR}/bin/bctl" <<'EOF' +#!/usr/bin/bash +printf 'bctl %s\n' "$*" >> "${CALLS}" +EOF + + chmod +x "${WORKDIR}/bin/gum" "${WORKDIR}/bin/sudo" "${WORKDIR}/bin/bctl" +} + +teardown() { + rm -rf "${WORKDIR}" +} + +_queue_answers() { + printf '%s\n' "$@" > "${WORKDIR}/gum-answers" +} + +# Run the extracted powerwash recipe. Pass "with-bctl" to keep the bctl stub on +# PATH; anything else removes it so the gum confirmation path is taken. +_run_powerwash() { + if [ "${1:-}" != "with-bctl" ]; then + rm -f "${WORKDIR}/bin/bctl" + fi + run /usr/bin/env -i \ + PATH="${WORKDIR}/bin:/usr/bin:/bin" \ + CALLS="${WORKDIR}/calls.log" \ + GUM_ANSWERS="${WORKDIR}/gum-answers" \ + /usr/bin/bash "${WORKDIR}/powerwash.sh" +} + +_calls() { + cat "${WORKDIR}/calls.log" +} + +@test "shared.just: powerwash recipe body is extractable and non-empty" { + [ -s "${WORKDIR}/powerwash.sh" ] + run head -n1 "${WORKDIR}/powerwash.sh" + [ "${output}" = "#!/usr/bin/bash" ] +} + +@test "powerwash: delegates to bctl when bctl is available" { + _queue_answers "Yes - wipe this machine" "Yes - wipe this machine" + + _run_powerwash with-bctl + + [ "${status}" -eq 0 ] + run grep -Fq "bctl powerwash" <<< "$(_calls)" + [ "${status}" -eq 0 ] +} + +@test "powerwash: bctl delegation skips gum prompts and sudo entirely" { + _queue_answers "Yes - wipe this machine" "Yes - wipe this machine" + + _run_powerwash with-bctl + + run grep -q "^gum " <<< "$(_calls)" + [ "${status}" -ne 0 ] + run grep -q "^sudo " <<< "$(_calls)" + [ "${status}" -ne 0 ] +} + +@test "powerwash: declining the first confirmation cancels without wiping" { + _queue_answers "No" "Yes - wipe this machine" + + _run_powerwash + + [ "${status}" -eq 0 ] + [[ "${output}" == *"Powerwash cancelled."* ]] + run grep -q "^sudo " <<< "$(_calls)" + [ "${status}" -ne 0 ] +} + +@test "powerwash: declining the first confirmation asks only once" { + _queue_answers "No" "Yes - wipe this machine" + + _run_powerwash + + [ "$(grep -c "^gum " <<< "$(_calls)")" -eq 1 ] +} + +@test "powerwash: declining the second confirmation cancels without wiping" { + _queue_answers "Yes - wipe this machine" "No" + + _run_powerwash + + [ "${status}" -eq 0 ] + [[ "${output}" == *"Powerwash cancelled."* ]] + run grep -q "^sudo " <<< "$(_calls)" + [ "${status}" -ne 0 ] +} + +@test "powerwash: a single confirmation is never enough — two prompts are required" { + _queue_answers "Yes - wipe this machine" "No" + + _run_powerwash + + [ "$(grep -c "^gum " <<< "$(_calls)")" -eq 2 ] +} + +@test "powerwash: an unrelated gum answer is treated as a decline" { + _queue_answers "maybe" "Yes - wipe this machine" + + _run_powerwash + + [ "${status}" -eq 0 ] + [[ "${output}" == *"Powerwash cancelled."* ]] + run grep -q "^sudo " <<< "$(_calls)" + [ "${status}" -ne 0 ] +} + +@test "powerwash: empty gum output is treated as a decline" { + _queue_answers "" "Yes - wipe this machine" + + _run_powerwash + + [ "${status}" -eq 0 ] + [[ "${output}" == *"Powerwash cancelled."* ]] + run grep -q "^sudo " <<< "$(_calls)" + [ "${status}" -ne 0 ] +} + +@test "powerwash: both confirmations run the experimental bootc reset" { + _queue_answers "Yes - wipe this machine" "Yes - wipe this machine" + + _run_powerwash + + [ "${status}" -eq 0 ] + run grep -Fq "sudo bootc install reset --experimental" <<< "$(_calls)" + [ "${status}" -eq 0 ] +} + +@test "powerwash: the reset is issued exactly once" { + _queue_answers "Yes - wipe this machine" "Yes - wipe this machine" + + _run_powerwash + + [ "$(grep -c "^sudo " <<< "$(_calls)")" -eq 1 ] +} + +@test "powerwash: both prompts warn the user before wiping" { + _queue_answers "Yes - wipe this machine" "Yes - wipe this machine" + + _run_powerwash + + local calls + calls="$(_calls)" + run grep -Fq "experimental feature that will reset this device" <<< "${calls}" + [ "${status}" -eq 0 ] + run grep -Fq "Are you sure?" <<< "${calls}" + [ "${status}" -eq 0 ] +} + +@test "toggle-tpm2: invokes the absolute luks-tpm2-autounlock path" { + run grep -A2 '^toggle-tpm2:' "${SHARED_JUST}" + [ "${status}" -eq 0 ] + [[ "${output}" == *"/usr/bin/luks-tpm2-autounlock"* ]] +} + +@test "shared.just: recipes are grouped under System" { + [ "$(grep -c "^\[group('System')\]" "${SHARED_JUST}")" -eq 2 ] +}