feat(test): support scoped Firstleg read-only receiver evidence

2026-10-03 21:24:00 +08:00
parent 18b39b4378
commit 3987562890
2 changed files with 15 additions and 1 deletions
@@ -58,3 +58,17 @@ test('transport frames valid empty rows and suppresses raw remote and connection
  const script=buildEvidenceRemoteScript('order',buildCompletionEvidenceSql(completion()),'java-test-agent')
  assert.equal(script.includes(env().JENKINS_API_TOKEN),false)
 })
+
+test('Firstleg receiver evidence stays on its exact TEST container and rejects writes', () => {
+  const sql = buildCompletionEvidenceSql(completion())
+  const decode = value => Buffer.from([...value.matchAll(/'([A-Za-z0-9+/=]{40,})'/g)].map(m => m[1]).join(''), 'base64').toString('utf8')
+  const python = decode(decode(buildEvidenceRemoteScript('firstleg', sql, 'java-test-agent')))
+  assert.match(python, /docker','inspect','firstleg-test-firstleg'/)
+  assert.match(python, /get\('Name'\)!='\/firstleg-test-firstleg'/)
+  assert.match(python, /com\.docker\.compose\.project'\)!='firstleg-test'/)
+  assert.match(python, /e\['FIRSTLEG_DB_URL'\]/)
+  assert.match(python, /e\['FIRSTLEG_DB_USERNAME'\]/)
+  assert.match(python, /MYSQL_PWD=e\['FIRSTLEG_DB_PASSWORD'\]/)
+  assert.throws(() => buildEvidenceRemoteScript('firstleg', sql.replace('COMMIT;', 'DELETE FROM fl_inbound_order;\nCOMMIT;'), 'java-test-agent'))
+  assert.throws(() => buildEvidenceRemoteScript('firstleg-prod', sql, 'java-test-agent'))
+})