75 lines
2.1 KiB
Go
75 lines
2.1 KiB
Go
|
package config
|
||
|
|
|
||
|
|
import (
|
||
|
|
"os"
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestValidateRejectsPlaceholderSecrets(t *testing.T) {
|
||
|
|
t.Setenv("DEV_MODE", "false")
|
||
|
|
t.Setenv("JWT_SECRET", "change-me-to-at-least-32-characters-long")
|
||
|
|
t.Setenv("ADMIN_PASSWORD", "change-me-strong-admin-password")
|
||
|
|
t.Setenv("STORAGE_ACCESS_KEY", "ak")
|
||
|
|
t.Setenv("STORAGE_SECRET_KEY", "change-me-long-rustfs-secret")
|
||
|
|
|
||
|
|
cfg := Load()
|
||
|
|
cfg.DevMode = false
|
||
|
|
cfg.StorageDriver = "s3"
|
||
|
|
cfg.StorageAccess = "ak"
|
||
|
|
cfg.StorageSecret = "change-me-long-rustfs-secret"
|
||
|
|
if err := cfg.Validate(); err == nil {
|
||
|
|
t.Fatal("expected Validate to reject placeholder JWT")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestValidateAcceptsStrongSecrets(t *testing.T) {
|
||
|
|
t.Setenv("DEV_MODE", "false")
|
||
|
|
jwt := strings.Repeat("a1B2c3D4", 6) // 48 chars, no placeholder markers
|
||
|
|
t.Setenv("JWT_SECRET", jwt)
|
||
|
|
t.Setenv("ADMIN_PASSWORD", "Tr0ub4dor&3-not-default")
|
||
|
|
cfg := Load()
|
||
|
|
cfg.DevMode = false
|
||
|
|
cfg.StorageDriver = "s3"
|
||
|
|
cfg.StorageAccess = "AKIAEXAMPLE"
|
||
|
|
cfg.StorageSecret = "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY"
|
||
|
|
if err := cfg.Validate(); err != nil {
|
||
|
|
t.Fatalf("Validate: %v", err)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestResolveDatabaseURLEncodesPassword(t *testing.T) {
|
||
|
|
os.Unsetenv("DATABASE_URL")
|
||
|
|
t.Setenv("POSTGRES_USER", "pargar")
|
||
|
|
t.Setenv("POSTGRES_PASSWORD", "p@ss:word/with%chars")
|
||
|
|
t.Setenv("POSTGRES_HOST", "db.internal")
|
||
|
|
t.Setenv("POSTGRES_DB", "pargar")
|
||
|
|
t.Setenv("POSTGRES_SSLMODE", "disable")
|
||
|
|
u := resolveDatabaseURL()
|
||
|
|
if !strings.Contains(u, "p%40ss%3Aword%2Fwith%25chars") {
|
||
|
|
t.Fatalf("password not encoded in URL: %s", u)
|
||
|
|
}
|
||
|
|
if !strings.Contains(u, "@db.internal:") {
|
||
|
|
t.Fatalf("host missing: %s", u)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestResolveRedisURLEncodesPassword(t *testing.T) {
|
||
|
|
os.Unsetenv("REDIS_URL")
|
||
|
|
t.Setenv("REDIS_HOST", "redis.internal")
|
||
|
|
t.Setenv("REDIS_PASSWORD", "r@dis:pass")
|
||
|
|
u := resolveRedisURL()
|
||
|
|
if !strings.Contains(u, "%40") || !strings.Contains(u, "%3A") {
|
||
|
|
t.Fatalf("redis password not encoded: %s", u)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestIsInsecureSecret(t *testing.T) {
|
||
|
|
if !isInsecureSecret("change-me-postgres") {
|
||
|
|
t.Fatal("expected change-me to be insecure")
|
||
|
|
}
|
||
|
|
if isInsecureSecret(strings.Repeat("xY9k", 12)) {
|
||
|
|
t.Fatal("random-looking secret should be ok")
|
||
|
|
}
|
||
|
|
}
|