Test in docker, simplify sig parity

Author: kvz

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.gitignore
+.docker-cache
+.bundle
+coverage
+pkg
+node_modules
+vendor/bundle
+.env

.gitignore

@@ -15,3 +15,4 @@ transloadit-*.gem
 env.sh
 .env
 vendor/bundle/
+.docker-cache/

Dockerfile

@@ -0,0 +1,19 @@
+# syntax=docker/dockerfile:1
+
+FROM ruby:3.3 AS base
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+       build-essential \
+       git \
+       curl \
+       ca-certificates \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install Node.js for parity checks
+RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
+    && apt-get install -y --no-install-recommends nodejs \
+    && npm install -g npm@latest \
+    && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /workspace

README.md

@@ -476,18 +476,45 @@ bundle install
 bundle exec rake test
 ```
 
-To also test parity against the Node.js reference implementation, run:
+To also test parity against the Node.js reference implementation, ensure you can run `npx transloadit smart_sig` and `npx transloadit sig` (the CLI downloads on demand), then run:
 
 ```bash
 TEST_NODE_PARITY=1 bundle exec rake test
 ```
 
+You can warm the CLI cache ahead of time with:
+
+```bash
+TRANSLOADIT_KEY=... TRANSLOADIT_SECRET=... \
+  npx --yes transloadit smart_sig --help
+TRANSLOADIT_KEY=... TRANSLOADIT_SECRET=... \
+  npx --yes transloadit sig --algorithm sha384 --help
+```
+
 To disable coverage reporting, run:
 
 ```bash
 COVERAGE=0 bundle exec rake test
 ```
 
+#### Run tests in Docker
+
+```bash
+./scripts/test-in-docker.sh
+```
+
+This builds a local image, runs `bundle install`, and executes `bundle exec rake test`. Pass a custom command to run something else (Bundler still installs first):
+
+```bash
+./scripts/test-in-docker.sh bundle exec ruby -Itest test/unit/transloadit/test_request.rb
+```
+
+The script forwards environment variables such as `TEST_NODE_PARITY` or credentials defined in `.env`, so you can combine parity checks and integration tests inside Docker:
+
+```bash
+TEST_NODE_PARITY=1 ./scripts/test-in-docker.sh
+```
+
 ### Releasing on RubyGems
 
 Let's say you wanted to release version `3.1.0`, here are the steps:

scripts/test-in-docker.sh

@@ -0,0 +1,76 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+IMAGE_NAME=${IMAGE_NAME:-transloadit-ruby-sdk-dev}
+CACHE_DIR=.docker-cache
+
+ensure_docker() {
+  if ! command -v docker >/dev/null 2>&1; then
+    echo "Docker is required to run this script." >&2
+    exit 1
+  fi
+
+  if ! docker info >/dev/null 2>&1; then
+    if [[ -z "${DOCKER_HOST:-}" && -S "$HOME/.colima/default/docker.sock" ]]; then
+      export DOCKER_HOST="unix://$HOME/.colima/default/docker.sock"
+    fi
+  fi
+
+  if ! docker info >/dev/null 2>&1; then
+    echo "Docker daemon is not reachable. Start Docker (or Colima) and retry." >&2
+    exit 1
+  fi
+}
+
+configure_platform() {
+  if [[ -z "${DOCKER_PLATFORM:-}" ]]; then
+    local arch
+    arch=$(uname -m)
+    if [[ "$arch" == "arm64" || "$arch" == "aarch64" ]]; then
+      DOCKER_PLATFORM=linux/amd64
+    fi
+  fi
+}
+
+ensure_docker
+configure_platform
+
+if [[ $# -eq 0 ]]; then
+  RUN_CMD='set -e; bundle install --jobs 4 --retry 3; bundle exec rake test'
+else
+  printf -v USER_CMD '%q ' "$@"
+  RUN_CMD="set -e; bundle install --jobs 4 --retry 3; ${USER_CMD}"
+fi
+
+mkdir -p "$CACHE_DIR/bundle" "$CACHE_DIR/npm-cache"
+
+BUILD_ARGS=()
+if [[ -n "${DOCKER_PLATFORM:-}" ]]; then
+  BUILD_ARGS+=(--platform "$DOCKER_PLATFORM")
+fi
+BUILD_ARGS+=(-t "$IMAGE_NAME" -f Dockerfile .)
+
+docker build "${BUILD_ARGS[@]}"
+
+DOCKER_ARGS=(
+  --rm
+  --user "$(id -u):$(id -g)"
+  -e HOME=/workspace
+  -e BUNDLE_PATH=/workspace/$CACHE_DIR/bundle
+  -e BUNDLE_APP_CONFIG=/workspace/$CACHE_DIR/bundle-config
+  -e BUNDLE_CACHE_PATH=/workspace/$CACHE_DIR/bundle-cache
+  -e npm_config_cache=/workspace/$CACHE_DIR/npm-cache
+  -e TEST_NODE_PARITY="${TEST_NODE_PARITY:-0}"
+  -v "$PWD":/workspace
+  -w /workspace
+)
+
+if [[ -n "${DOCKER_PLATFORM:-}" ]]; then
+  DOCKER_ARGS+=(--platform "$DOCKER_PLATFORM")
+fi
+
+if [[ -f .env ]]; then
+  DOCKER_ARGS+=(--env-file "$PWD/.env")
+fi
+
+exec docker run "${DOCKER_ARGS[@]}" "$IMAGE_NAME" bash -lc "$RUN_CMD"

test/test_helper.rb

@@ -15,6 +15,8 @@
 require "minitest/autorun"
 require "transloadit"
 require "vcr"
+require "open3"
+require "json"
 
 VCR.configure do |c|
   c.cassette_library_dir = "test/fixtures/cassettes"
@@ -25,3 +27,49 @@
 def values_from_post_body(body)
   Addressable::URI.parse("?" + CGI.unescape(body)).query_values
 end
+
+module TransloaditCliHelpers
+  TRANSLOADIT_CLI_PACKAGE = ENV.fetch("TRANSLOADIT_CLI_PACKAGE", "[email protected]")
+
+  def run_transloadit_cli(command, payload, key:, secret:, algorithm: nil)
+    return nil unless ENV["TEST_NODE_PARITY"] == "1"
+
+    env = {
+      "TRANSLOADIT_KEY" => key,
+      "TRANSLOADIT_SECRET" => secret,
+      "TRANSLOADIT_AUTH_KEY" => key,
+      "TRANSLOADIT_AUTH_SECRET" => secret
+    }
+
+    args = [
+      "npm", "exec", "--yes", "--package", TRANSLOADIT_CLI_PACKAGE, "--",
+      "transloadit", command
+    ]
+    args += ["--algorithm", algorithm] if algorithm
+
+    stdout, stderr, status = Open3.capture3(env, *args, stdin_data: JSON.dump(payload))
+    raise "transloadit CLI #{command} failed: #{stderr}" unless status.success?
+
+    stdout.strip
+  end
+
+  def run_transloadit_smart_sig(payload, key:, secret:)
+    cli_payload = {
+      workspace: payload.fetch(:workspace),
+      template: payload.fetch(:template),
+      input: payload.fetch(:input)
+    }
+    cli_payload[:url_params] = payload[:url_params] if payload.key?(:url_params)
+    cli_payload[:expire_at_ms] = payload[:expire_at_ms] if payload.key?(:expire_at_ms)
+
+    run_transloadit_cli("smart_sig", cli_payload, key: key, secret: secret)
+  end
+
+  def run_transloadit_sig(payload, key:, secret:, algorithm: nil)
+    output = run_transloadit_cli("sig", payload, key: key, secret: secret, algorithm: algorithm)
+    output && JSON.parse(output)
+  end
+end
+
+Minitest::Test.include(TransloaditCliHelpers)
+

test/unit/transloadit/node-smartcdn-sig.ts

@@ -1,4 +1,5 @@
 require "test_helper"
+require "multi_json"
 
 describe Transloadit::Request do
   it "must allow initialization" do
@@ -76,3 +77,30 @@
     end
   end
 end
+
+  describe "signature parity" do
+    it "matches transloadit CLI sig output" do
+      skip "Parity testing not enabled" unless ENV["TEST_NODE_PARITY"] == "1"
+
+      expires = "2025-01-02T00:00:00.000Z"
+      params = {
+        auth: {key: "cli-key", expires: expires},
+        steps: {encode: {robot: "/video/encode"}}
+      }
+
+      cli_result = run_transloadit_sig(params, key: "cli-key", secret: "cli-secret", algorithm: "sha384")
+      refute_nil cli_result
+
+      cli_params_json = cli_result["params"]
+      request = Transloadit::Request.new("/", "cli-secret")
+      ruby_signature = request.send(:signature, cli_params_json)
+
+      assert_equal cli_result["signature"], ruby_signature
+
+      cli_params = JSON.parse(cli_params_json)
+      assert_equal "cli-key", cli_params.dig("auth", "key")
+      assert_equal expires, cli_params.dig("auth", "expires")
+      assert_equal "/video/encode", cli_params.dig("steps", "encode", "robot")
+    end
+  end
+