v0.13.7

scripts/smoke.sh

@@ -48,6 +48,35 @@ grep -qi 'swagger-ui' "$TMP/swagger.html"
 
 curl -fsS "http://127.0.0.1:$PORT/api/bootstrap" >"$TMP/bootstrap.json"
 grep -q 'sim-salon' "$TMP/bootstrap.json"
+python3 - "$TMP/bootstrap.json" "$PORT" <<'PYBOOTSTRAP'
+import json, sys, urllib.request
+
+bootstrap = json.load(open(sys.argv[1], encoding="utf-8"))
+port = sys.argv[2]
+settings = bootstrap.get("settings")
+assert isinstance(settings, dict), "bootstrap.settings missing"
+paths = {
+    "application": "/api/settings/application",
+    "gree": "/api/settings/gree",
+    "history": "/api/settings/history",
+    "influxdb": "/api/settings/influxdb",
+    "notifications": "/api/settings/notifications",
+    "night": "/api/settings/night",
+    "home_assistant": "/api/settings/home-assistant",
+    "debug": "/api/settings/debug",
+}
+assert set(paths) <= set(settings), f"bootstrap settings sections missing: {set(paths) - set(settings)}"
+for section, path in paths.items():
+    with urllib.request.urlopen(f"http://127.0.0.1:{port}{path}") as response:
+        standalone = json.load(response)
+    assert settings[section] == standalone, f"bootstrap settings mismatch for {section}"
+
+assert "password" not in settings["influxdb"]
+assert "token" not in settings["influxdb"]
+assert "token" not in settings["home_assistant"]
+for secret in ("pushover_app_token", "pushover_user_key", "slack_webhook_url", "discord_webhook_url"):
+    assert secret not in settings["notifications"], f"secret field leaked: {secret}"
+PYBOOTSTRAP
 
 curl -fsS -X POST -H 'Content-Type: application/json' \
   -d '{"power":true,"mode":"cool","target_temperature":22}' \