feat(safety): add atomic WireGuard mutation and rollback engine

2026-10-12 23:04:22 +03:00
parent e5e3064885
commit 4e3c5347f2
10 changed files with 1122 additions and 6 deletions
@@ -6,6 +6,14 @@ allow_empty=${MOCK_ALLOW_EMPTY_INVOCATION:-}
 printf '%q' "$command_name" >>"$TEST_MOCK_LOG"
 for argument in "$@"; do printf ' %q' "$argument" >>"$TEST_MOCK_LOG"; done
 printf '\n' >>"$TEST_MOCK_LOG"
+if [[ $# == 2 && $1 == strip ]]; then
+  [[ -f $2 && ! -L $2 && $(stat -c '%a' -- "$2") == 600 && -n ${TEST_ROOT:-} && $2 == "${TEST_ROOT}"/* ]] || { printf 'Mock wg-quick strip failure\n' >&2; exit 97; }
+  case ${WG_QUICK_STRIP_FAIL:-0}:${2##*/} in
+    1:*|staged:*.stage.*|live:wg0.conf) printf 'Mock wg-quick strip failure\n' >&2; exit 97 ;;
+  esac
+  if [[ -n ${WG_QUICK_STRIP_OUTPUT:-} && -f $WG_QUICK_STRIP_OUTPUT ]]; then cat -- "$WG_QUICK_STRIP_OUTPUT"; fi
+  exit 0
+fi
 if [[ -n "$allow_empty" && "$allow_empty" != "$command_name" ]]; then
  printf 'Unexpected mock invocation: %s does not allow empty calls for %s\n' "$command_name" "$allow_empty" >&2
  exit 99