path: root/tests/unit/test_archangel.bats

#!/usr/bin/env bats
# Unit tests for the installer/archangel monolith.
#
# Coverage scope: gather_input() in unattended mode — defaulting of
# optional values, preservation of explicit ones, and the
# filesystem-specific encryption checks. Required-field, disk, and
# timezone validation moved to validate_config (called from main
# before gather_input); its coverage lives in test_config.bats.
# The interactive branch (everything reachable via
# `if [[ "$UNATTENDED" != true ]]`) is not unit-tested per the
# project's testing-strategy.org policy on fzf / arch-chroot /
# mkfs / cryptsetup wrappers.
#
# Sourcing archangel relies on the source-guard at the bottom of
# the script: when sourced, function definitions load but main is
# not called, init_logging is not run (so /tmp/archangel-*.log is
# not created), and the banner is not printed.

setup() {
    # shellcheck disable=SC1091
    source "${BATS_TEST_DIRNAME}/../../installer/archangel"
    UNATTENDED=true
}

#############################
# Optional-field defaults
#############################
# Default values themselves are pinned in test_config.bats (config.sh
# is the single source of truth). The remaining test here covers the
# adjacent guarantee: gather_input doesn't clobber values the user set.

@test "gather_input unattended preserves explicit non-default values" {
    HOSTNAME=h
    TIMEZONE=UTC
    ROOT_PASSWORD=x
    SELECTED_DISKS=(/dev/sda)
    FILESYSTEM=btrfs
    NO_ENCRYPT=yes
    LOCALE="en_GB.UTF-8"
    KEYMAP="dvorak"
    ENABLE_SSH="no"
    gather_input >/dev/null
    [ "$FILESYSTEM" = "btrfs" ]
    [ "$LOCALE" = "en_GB.UTF-8" ]
    [ "$KEYMAP" = "dvorak" ]
    [ "$ENABLE_SSH" = "no" ]
}

#############################
# Filesystem-specific encryption validation
#############################

@test "gather_input unattended errors when ZFS without ZFS_PASSPHRASE and encryption on" {
    HOSTNAME=h
    TIMEZONE=UTC
    ROOT_PASSWORD=x
    SELECTED_DISKS=(/dev/sda)
    FILESYSTEM=zfs
    NO_ENCRYPT=no
    ZFS_PASSPHRASE=""
    run gather_input
    [ "$status" -eq 1 ]
    [[ "$output" == *"ZFS_PASSPHRASE"* ]]
}

@test "gather_input unattended errors when Btrfs without LUKS_PASSPHRASE and encryption on" {
    HOSTNAME=h
    TIMEZONE=UTC
    ROOT_PASSWORD=x
    SELECTED_DISKS=(/dev/sda)
    FILESYSTEM=btrfs
    NO_ENCRYPT=no
    LUKS_PASSPHRASE=""
    run gather_input
    [ "$status" -eq 1 ]
    [[ "$output" == *"LUKS_PASSPHRASE"* ]]
}

@test "gather_input unattended accepts ZFS with NO_ENCRYPT=yes and no passphrase" {
    HOSTNAME=h
    TIMEZONE=UTC
    ROOT_PASSWORD=x
    SELECTED_DISKS=(/dev/sda)
    FILESYSTEM=zfs
    NO_ENCRYPT=yes
    ZFS_PASSPHRASE=""
    run gather_input
    [ "$status" -eq 0 ]
}

#############################
# Filesystem validity
#############################
# Validation moved to validate_filesystem in lib/config.sh — covered
# by test_config.bats. main() calls it between check_config and
# gather_input so a bad FILESYSTEM= never reaches install time.

#############################
# RAID-level defaulting
#############################

@test "gather_input unattended defaults RAID_LEVEL to mirror for multi-disk install" {
    HOSTNAME=h
    TIMEZONE=UTC
    ROOT_PASSWORD=x
    SELECTED_DISKS=(/dev/sda /dev/sdb)
    FILESYSTEM=zfs
    NO_ENCRYPT=yes
    RAID_LEVEL=""
    gather_input >/dev/null
    [ "$RAID_LEVEL" = "mirror" ]
}

@test "gather_input unattended preserves an explicit RAID_LEVEL on multi-disk install" {
    HOSTNAME=h
    TIMEZONE=UTC
    ROOT_PASSWORD=x
    SELECTED_DISKS=(/dev/sda /dev/sdb /dev/sdc)
    FILESYSTEM=zfs
    NO_ENCRYPT=yes
    RAID_LEVEL="raidz1"
    gather_input >/dev/null
    [ "$RAID_LEVEL" = "raidz1" ]
}

@test "gather_input unattended leaves RAID_LEVEL empty for single-disk install" {
    HOSTNAME=h
    TIMEZONE=UTC
    ROOT_PASSWORD=x
    SELECTED_DISKS=(/dev/sda)
    FILESYSTEM=zfs
    NO_ENCRYPT=yes
    RAID_LEVEL=""
    gather_input >/dev/null
    [ -z "$RAID_LEVEL" ]
}

#############################
# install_failure_cleanup
#############################
# install_failure_cleanup is the trap target for ERR / INT / TERM
# during install_zfs and install_btrfs. It clears sensitive vars,
# dispatches on FILESYSTEM, and exits non-zero. Tests use function
# overrides to capture which system tools the cleanup invokes; the
# tools themselves (umount, zpool, btrfs_cleanup,
# btrfs_close_encryption) are deliberately VM-tested per
# testing-strategy.org.

@test "install_failure_cleanup clears sensitive variables before exiting" {
    FILESYSTEM=zfs
    POOL_NAME=zroot
    ROOT_PASSWORD="topsecret"
    ZFS_PASSPHRASE="anothersecret"
    LUKS_PASSPHRASE="thirdsecret"

    # Mocks: silent no-ops for system tools; error returns non-zero
    # so the function returns instead of exiting the test process.
    umount() { :; }
    zpool() { return 1; }
    btrfs_cleanup() { :; }
    btrfs_close_encryption() { :; }
    warn() { :; }
    error() { return 1; }

    install_failure_cleanup || true

    [ -z "$ROOT_PASSWORD" ]
    [ -z "$ZFS_PASSPHRASE" ]
    [ -z "$LUKS_PASSPHRASE" ]
}

@test "install_failure_cleanup dispatches to ZFS path when FILESYSTEM=zfs" {
    FILESYSTEM=zfs
    POOL_NAME=zroot
    CALLS=()

    # Mocks track invocations via CALLS array. Array assignment is not
    # affected by the production code's >/dev/null 2>&1 redirects on
    # the zpool list check, so we capture the call regardless of where
    # the mock's stdout would have gone.
    umount() { CALLS+=("umount $*"); return 0; }
    zpool() {
        CALLS+=("zpool $*")
        [[ "$1" == "list" ]] && return 0
        return 0
    }
    btrfs_cleanup() { CALLS+=("btrfs_cleanup"); }
    btrfs_close_encryption() { CALLS+=("btrfs_close_encryption"); }
    warn() { :; }
    error() { CALLS+=("error"); return 1; }

    install_failure_cleanup || true

    [[ " ${CALLS[*]} " == *" umount /mnt/efi "* ]]
    [[ " ${CALLS[*]} " == *" umount -R /mnt "* ]]
    [[ " ${CALLS[*]} " == *" zpool list zroot "* ]]
    [[ " ${CALLS[*]} " == *" zpool export zroot "* ]]
    [[ " ${CALLS[*]} " != *" btrfs_cleanup "* ]]
    [[ " ${CALLS[*]} " != *" btrfs_close_encryption "* ]]
}

@test "install_failure_cleanup dispatches to Btrfs path when FILESYSTEM=btrfs" {
    FILESYSTEM=btrfs
    CALLS=()

    umount() { CALLS+=("umount $*"); return 0; }
    zpool() { CALLS+=("zpool $*"); return 0; }
    btrfs_cleanup() { CALLS+=("btrfs_cleanup"); }
    btrfs_close_encryption() { CALLS+=("btrfs_close_encryption"); }
    warn() { :; }
    error() { CALLS+=("error"); return 1; }

    install_failure_cleanup || true

    [[ " ${CALLS[*]} " == *" umount /mnt/efi "* ]]
    [[ " ${CALLS[*]} " == *" btrfs_cleanup "* ]]
    [[ " ${CALLS[*]} " == *" btrfs_close_encryption "* ]]
    [[ " ${CALLS[*]} " != *" zpool"* ]]
}

@test "install_failure_cleanup ZFS path skips zpool export when pool not imported" {
    FILESYSTEM=zfs
    POOL_NAME=zroot
    CALLS=()

    umount() { CALLS+=("umount $*"); return 0; }
    zpool() {
        CALLS+=("zpool $*")
        [[ "$1" == "list" ]] && return 1  # pool NOT imported
        return 0
    }
    btrfs_cleanup() { :; }
    btrfs_close_encryption() { :; }
    warn() { :; }
    error() { return 1; }

    install_failure_cleanup || true

    [[ " ${CALLS[*]} " == *" zpool list zroot "* ]]
    [[ " ${CALLS[*]} " != *" zpool export"* ]]
}

@test "install_failure_cleanup ZFS path falls back to lazy unmount when a mount is busy" {
    FILESYSTEM=zfs
    POOL_NAME=zroot
    CALLS=()

    # A pacstrap-interrupted target can leave busy mounts that a plain
    # umount can't release; cleanup must retry lazily so the retry sees a
    # clean disk. Non-lazy umount fails here; the -l fallback succeeds.
    umount() {
        CALLS+=("umount $*")
        [[ "$*" == *"-l"* ]] && return 0
        return 1
    }
    zpool() { CALLS+=("zpool $*"); return 0; }
    warn() { :; }
    error() { return 1; }

    install_failure_cleanup || true

    [[ " ${CALLS[*]} " == *" umount -l /mnt/efi "* ]]
    [[ " ${CALLS[*]} " == *" umount -R -l /mnt "* ]]
    # The pool still gets exported after the lazy unmount.
    [[ " ${CALLS[*]} " == *" zpool export zroot "* ]]
}

@test "install_failure_cleanup Btrfs path falls back to lazy unmount when EFI is busy" {
    FILESYSTEM=btrfs
    CALLS=()

    umount() {
        CALLS+=("umount $*")
        [[ "$*" == *"-l"* ]] && return 0
        return 1
    }
    btrfs_cleanup() { CALLS+=("btrfs_cleanup"); }
    btrfs_close_encryption() { CALLS+=("btrfs_close_encryption"); }
    warn() { :; }
    error() { return 1; }

    install_failure_cleanup || true

    [[ " ${CALLS[*]} " == *" umount -l /mnt/efi "* ]]
}

#############################
# validate_environment
#############################
# Boundary wrappers (is_uefi_boot, required_commands) are stubbed so the
# composition's fail-fast wiring is exercised without depending on the
# host's firmware mode or installed tools. The real command list lives in
# test_common.bats; the real UEFI/network probes run in the VM harness.

@test "validate_environment errors when not booted in UEFI mode" {
    is_uefi_boot() { return 1; }
    required_commands() { return 0; }
    FILESYSTEM=zfs
    run validate_environment
    [ "$status" -eq 1 ]
    [[ "$output" == *"UEFI"* ]]
}

@test "validate_environment errors when a required command is missing" {
    is_uefi_boot() { return 0; }
    required_commands() { echo "definitely-not-a-real-cmd-xyz"; }
    FILESYSTEM=zfs
    run validate_environment
    [ "$status" -eq 1 ]
    [[ "$output" == *"definitely-not-a-real-cmd-xyz"* ]]
}

@test "validate_environment passes when UEFI present and commands resolve" {
    is_uefi_boot() { return 0; }
    required_commands() { echo "bash"; }
    FILESYSTEM=zfs
    run validate_environment
    [ "$status" -eq 0 ]
}

#############################
# validate_install_targets
#############################
# disk_in_use / disk_size_bytes / network_available are the system-boundary
# wrappers; stubbing them drives the real composition + real
# disk_meets_min_size. Live probes run in the VM harness on the happy path.

@test "validate_install_targets errors when a disk is in use" {
    SELECTED_DISKS=(/dev/sda)
    disk_in_use() { return 0; }
    disk_size_bytes() { echo 500107862016; }
    network_available() { return 0; }
    run validate_install_targets
    [ "$status" -eq 1 ]
    [[ "$output" == *"in use"* ]]
}

@test "validate_install_targets errors when a disk is too small" {
    SELECTED_DISKS=(/dev/sda)
    disk_in_use() { return 1; }
    disk_size_bytes() { echo 1000000; }
    network_available() { return 0; }
    run validate_install_targets
    [ "$status" -eq 1 ]
    [[ "$output" == *"too small"* ]]
}

@test "validate_install_targets errors when disk size is unreadable" {
    SELECTED_DISKS=(/dev/sda)
    disk_in_use() { return 1; }
    disk_size_bytes() { echo ""; }
    network_available() { return 0; }
    run validate_install_targets
    [ "$status" -eq 1 ]
}

@test "validate_install_targets errors when the network is unreachable" {
    SELECTED_DISKS=(/dev/sda)
    disk_in_use() { return 1; }
    disk_size_bytes() { echo 500107862016; }
    network_available() { return 1; }
    run validate_install_targets
    [ "$status" -eq 1 ]
    [[ "$output" == *"network"* || "$output" == *"connectivity"* ]]
}

@test "validate_install_targets passes when disks idle, large enough, network up" {
    SELECTED_DISKS=(/dev/sda /dev/sdb)
    disk_in_use() { return 1; }
    disk_size_bytes() { echo 500107862016; }
    network_available() { return 0; }
    run validate_install_targets
    [ "$status" -eq 0 ]
}

#############################
# network_available
#############################
# The two probes it composes — DNS via getent and a TCP-443 open via
# timeout+bash /dev/tcp — are the system boundary; mocking them drives the
# fail-fast wiring without a live network. The real probe runs in the VM
# harness. These pin the "network failure before pacstrap" error path that
# validate_install_targets surfaces.

@test "network_available returns 1 when DNS resolution fails" {
    getent() { return 1; }
    run network_available
    [ "$status" -eq 1 ]
}

@test "network_available returns 1 when DNS resolves but the TCP connect fails" {
    getent() { return 0; }
    timeout() { return 1; }
    run network_available
    [ "$status" -eq 1 ]
}

@test "network_available returns 0 when DNS resolves and the TCP connect opens" {
    getent() { return 0; }
    timeout() { return 0; }
    run network_available
    [ "$status" -eq 0 ]
}

#############################
# configure_zfs_keyfile
#############################
# Encrypted ZFS installs prompt for the same passphrase twice:
# ZFSBootMenu unlocks the pool to read the kernel and initramfs, then
# kexecs, and the key doesn't survive kexec — so the booted initramfs
# re-imports the pool, finds keylocation=prompt, and asks again.
#
# configure_zfs_keyfile closes the second prompt the same way the Btrfs
# path already closes its LUKS equivalent: write the passphrase to a
# keyfile inside the encrypted root, point the encryption root at it,
# and bake it into the initramfs via FILES=. ZFSBootMenu can't read a
# file inside a dataset it hasn't unlocked yet, so it still prompts
# once — that surviving prompt is the intended behavior, not a bug.
#
# zfs is the stubbed system boundary. The keyfile write, its
# permissions, and the FILES= wiring are exercised for real.

zfs_keyfile_fixture() {
    TEST_ROOT=$(mktemp -d)
    MNTPOINT="$TEST_ROOT"
    ZFS_ARGS_LOG="$TEST_ROOT/zfs-args"
    mkdir -p "$MNTPOINT/etc"
    printf '%s\n' 'FILES=()' > "$MNTPOINT/etc/mkinitcpio.conf"
    zfs() { echo "$*" >> "$ZFS_ARGS_LOG"; return 0; }
}

@test "configure_zfs_keyfile writes the passphrase with no trailing newline" {
    zfs_keyfile_fixture
    configure_zfs_keyfile "correct horse" zroot
    # The keyfile lands mode 000, which locks out the owner too — only root
    # bypasses that, and these tests don't run as root. Restore read access to
    # inspect the content; the mode itself is asserted separately below.
    chmod u+r "$MNTPOINT/etc/zfs/zroot.key"
    # A trailing newline would become part of the passphrase ZFS reads back,
    # so the key would never match what's typed at the ZBM prompt. 13 bytes,
    # not 14: no terminator.
    [ "$(wc -c < "$MNTPOINT/etc/zfs/zroot.key")" -eq 13 ]
    [ "$(cat "$MNTPOINT/etc/zfs/zroot.key")" = "correct horse" ]
    rm -rf "$TEST_ROOT"
}

@test "configure_zfs_keyfile points the encryption root at the keyfile" {
    zfs_keyfile_fixture
    configure_zfs_keyfile testpass zroot
    grep -qE '^set +keylocation=file:///etc/zfs/zroot\.key +zroot$' "$ZFS_ARGS_LOG"
    rm -rf "$TEST_ROOT"
}

@test "configure_zfs_keyfile changes the location without rekeying the pool" {
    zfs_keyfile_fixture
    configure_zfs_keyfile testpass zroot
    # keylocation is settable with plain `zfs set` (zfsprops(7)), and
    # keyformat is already passphrase from pool creation. Reaching for
    # `zfs change-key` here would rekey the pool and prompt for new key
    # material mid-install — and losing keyformat=passphrase would leave
    # ZFSBootMenu with no way to accept a typed passphrase at all.
    ! grep -qF 'change-key' "$ZFS_ARGS_LOG"
    rm -rf "$TEST_ROOT"
}

@test "configure_zfs_keyfile bakes the keyfile into the initramfs" {
    zfs_keyfile_fixture
    configure_zfs_keyfile testpass zroot
    grep -qF 'FILES=(/etc/zfs/zroot.key)' "$MNTPOINT/etc/mkinitcpio.conf"
    rm -rf "$TEST_ROOT"
}

@test "configure_zfs_keyfile leaves the keyfile unreadable to other users" {
    zfs_keyfile_fixture
    configure_zfs_keyfile testpass zroot
    # Protected at rest by the encrypted dataset, but a stray mode 644
    # would expose it to any local user on the running system.
    [ "$(stat -c '%a' "$MNTPOINT/etc/zfs/zroot.key")" -eq 0 ]
    rm -rf "$TEST_ROOT"
}

@test "configure_zfs_keyfile preserves a passphrase containing shell metacharacters" {
    zfs_keyfile_fixture
    configure_zfs_keyfile 'a$b "c" \d*' zroot
    chmod u+r "$MNTPOINT/etc/zfs/zroot.key"
    [ "$(cat "$MNTPOINT/etc/zfs/zroot.key")" = 'a$b "c" \d*' ]
    rm -rf "$TEST_ROOT"
}

@test "configure_zfs_keyfile aborts when the key change fails" {
    zfs_keyfile_fixture
    zfs() { return 1; }
    run configure_zfs_keyfile testpass zroot
    # Silently continuing would ship an initramfs whose keyfile doesn't
    # match the pool, turning one prompt into an unbootable system.
    [ "$status" -eq 1 ]
    rm -rf "$TEST_ROOT"
}