Configuration hardening

2026-05-07 21:33:53 +02:00
parent bba0d2fb45
commit d1b20684f5
14 changed files with 1335 additions and 176 deletions
@@ -2769,4 +2769,153 @@ func TestBuildHAKsConvertsMusicSourcesAndWritesCreditsArtifacts(t *testing.T) {
 	}
 }

+func TestBuildHAKsUsesExplicitMusicDatasetOutsideLegacyRoot(t *testing.T) {
+	root := t.TempDir()
+	mustMkdir(t, filepath.Join(root, "assets", "audio", "westgate"))
+	mustMkdir(t, filepath.Join(root, "build"))

+	ffprobePath := filepath.Join(root, "tools", "ffprobe")
+	ffmpegPath := filepath.Join(root, "tools", "ffmpeg")
+	mustMkdir(t, filepath.Dir(ffprobePath))
+	mustWriteFile(t, ffprobePath, "#!/bin/sh\nprintf '%s\\n' '{\"format\":{\"tags\":{\"artist\":\"Dataset Artist\",\"title\":\"Dataset Title\"}}}'\n")
+	mustWriteFile(t, ffmpegPath, "#!/bin/sh\nfor last; do :; done\nprintf 'dataset-bmu' > \"$last\"\n")
+	if err := os.Chmod(ffprobePath, 0o755); err != nil {
+		t.Fatalf("chmod ffprobe: %v", err)
+	}
+	if err := os.Chmod(ffmpegPath, 0o755); err != nil {
+		t.Fatalf("chmod ffmpeg: %v", err)
+	}
+
+	mustWriteFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Assets
+  resref: testassets
+paths:
+  assets: assets
+  build: build
+music:
+  tools:
+    ffmpeg: tools/ffmpeg
+    ffprobe: tools/ffprobe
+  defaults:
+    credits_root: custom-credits
+  datasets:
+    westgate_audio:
+      source: audio/westgate
+      output: generated/music
+      prefix: wg_
+haks:
+  - name: music
+    priority: 1
+    max_bytes: 1048576
+    split: false
+    include:
+      - generated/music/**
+`)
+	mustWriteFile(t, filepath.Join(root, "assets", "audio", "westgate", "Theme Song.mp3"), "source-mp3")
+
+	p, err := project.Load(root)
+	if err != nil {
+		t.Fatalf("load project: %v", err)
+	}
+	if err := p.ValidateLayout(); err != nil {
+		t.Fatalf("validate layout: %v", err)
+	}
+	if err := p.Scan(); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+
+	result, err := BuildHAKs(p)
+	if err != nil {
+		t.Fatalf("build haks: %v", err)
+	}
+	if result.CreditsSummary.TrackCount != 1 {
+		t.Fatalf("expected one music track, got %#v", result.CreditsSummary)
+	}
+	manifestRaw, err := os.ReadFile(filepath.Join(root, "build", "haks.json"))
+	if err != nil {
+		t.Fatalf("read manifest: %v", err)
+	}
+	manifestText := string(manifestRaw)
+	if !strings.Contains(manifestText, "generated/music/wg_theme.bmu") {
+		t.Fatalf("expected dataset output resource in manifest, got:\n%s", manifestText)
+	}
+	if strings.Contains(manifestText, "audio/westgate/Theme Song.mp3") {
+		t.Fatalf("did not expect source mp3 in manifest, got:\n%s", manifestText)
+	}
+	creditsRaw, err := os.ReadFile(filepath.Join(root, "custom-credits", "audio", "westgate", "CREDITS.md"))
+	if err != nil {
+		t.Fatalf("read generated dataset credits: %v", err)
+	}
+	if !strings.Contains(string(creditsRaw), "Dataset Artist") || !strings.Contains(string(creditsRaw), "wg_theme.bmu") {
+		t.Fatalf("unexpected generated credits:\n%s", string(creditsRaw))
+	}
+}
+
+func TestPlanHAKsDoesNotTranscodeMusicSources(t *testing.T) {
+	root := t.TempDir()
+	mustMkdir(t, filepath.Join(root, "assets", "audio", "westgate"))
+	mustMkdir(t, filepath.Join(root, "build"))
+
+	ffmpegPath := filepath.Join(root, "tools", "ffmpeg")
+	mustMkdir(t, filepath.Dir(ffmpegPath))
+	mustWriteFile(t, ffmpegPath, "#!/bin/sh\necho should-not-run >&2\nexit 42\n")
+	if err := os.Chmod(ffmpegPath, 0o755); err != nil {
+		t.Fatalf("chmod ffmpeg: %v", err)
+	}
+
+	mustWriteFile(t, filepath.Join(root, "nwn-tool.yaml"), `
+module:
+  name: Test Assets
+  resref: testassets
+paths:
+  assets: assets
+  build: build
+music:
+  tools:
+    ffmpeg: tools/ffmpeg
+    ffprobe: tools/ffprobe
+  datasets:
+    westgate_audio:
+      source: audio/westgate
+      output: generated/music
+      prefix: wg_
+haks:
+  - name: music
+    priority: 1
+    max_bytes: 1048576
+    split: false
+    include:
+      - generated/music/**
+`)
+	mustWriteFile(t, filepath.Join(root, "assets", "audio", "westgate", "Theme Song.mp3"), "source-mp3")
+
+	p, err := project.Load(root)
+	if err != nil {
+		t.Fatalf("load project: %v", err)
+	}
+	if err := p.ValidateLayout(); err != nil {
+		t.Fatalf("validate layout: %v", err)
+	}
+	if err := p.Scan(); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+
+	result, err := PlanHAKs(p)
+	if err != nil {
+		t.Fatalf("plan haks: %v", err)
+	}
+	if result.CreditsSummary.TrackCount != 1 {
+		t.Fatalf("expected one planned music track, got %#v", result.CreditsSummary)
+	}
+	manifestRaw, err := os.ReadFile(filepath.Join(root, "build", "haks.json"))
+	if err != nil {
+		t.Fatalf("read manifest: %v", err)
+	}
+	if !strings.Contains(string(manifestRaw), "generated/music/wg_theme.bmu") {
+		t.Fatalf("expected planned generated music in manifest, got:\n%s", string(manifestRaw))
+	}
+	if _, err := os.Stat(filepath.Join(root, ".cache", "music")); !os.IsNotExist(err) {
+		t.Fatalf("plan-only should not stage music, stat err=%v", err)
+	}
+}