63 lines
2.9 KiB
Go
63 lines
2.9 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
const mockOSSDeployment = `{"dispatcher_id":"c046b893-8628-4589-ae50-619d049248a6","oss":{"endpoint":"https://127.0.0.1:19445","region":"cn-mock","bucket":"mock-bucket","object_prefix":"approved","access_key_id_env":"MOCK_OSS_KEY_ID","access_key_secret_env":"MOCK_OSS_KEY_SECRET","max_asset_bytes":1048576}}`
|
|
|
|
func writeMockOSSDeployment(t *testing.T, body string) string {
|
|
t.Helper()
|
|
path := filepath.Join(t.TempDir(), "oss.json")
|
|
if err := os.WriteFile(path, []byte(body), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return path
|
|
}
|
|
|
|
func TestLoadCurrentOSSConfigRequiresBoundLocalHTTPSAndExplicitCredentials(t *testing.T) {
|
|
t.Setenv("MOCK_OSS_KEY_ID", "isolated-id")
|
|
t.Setenv("MOCK_OSS_KEY_SECRET", "isolated-secret")
|
|
configuration, err := LoadCurrentOSSConfig(writeMockOSSDeployment(t, mockOSSDeployment), dispatcherFixtureID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if configuration.Endpoint != "https://127.0.0.1:19445" || configuration.Bucket != "mock-bucket" ||
|
|
configuration.KeyPrefix != "approved" || configuration.MaxAssetBytes != 1048576 || configuration.GrantTTL != 15*time.Minute ||
|
|
configuration.AccessKeyID != "isolated-id" || configuration.AccessKeySecret != "isolated-secret" {
|
|
t.Fatal("approved deployment settings were rewritten")
|
|
}
|
|
}
|
|
|
|
func TestLoadCurrentOSSConfigRejectsUnapprovedDeploymentWithoutLeakingCredentials(t *testing.T) {
|
|
t.Setenv("MOCK_OSS_KEY_ID", "isolated-id")
|
|
t.Setenv("MOCK_OSS_KEY_SECRET", "isolated-secret")
|
|
for _, tc := range []struct {
|
|
name string
|
|
body string
|
|
}{
|
|
{"wrong Dispatcher", strings.Replace(mockOSSDeployment, dispatcherFixtureID, "22222222-2222-4222-8222-222222222222", 1)},
|
|
{"legacy generation", strings.Replace(mockOSSDeployment, `{"dispatcher_id":`, `{"schema_version":"v3","dispatcher_id":`, 1)},
|
|
{"insecure endpoint", strings.Replace(mockOSSDeployment, "https://127.0.0.1:19445", "http://127.0.0.1:19445", 1)},
|
|
{"external endpoint", strings.Replace(mockOSSDeployment, "https://127.0.0.1:19445", "https://oss.example.invalid:443", 1)},
|
|
{"duplicate key", strings.Replace(mockOSSDeployment, `"bucket":"mock-bucket"`, `"bucket":"mock-bucket","bucket":"other"`, 1)},
|
|
{"missing size", strings.Replace(mockOSSDeployment, `"max_asset_bytes":1048576`, `"max_asset_bytes":0`, 1)},
|
|
{"extra document", mockOSSDeployment + ` {}`},
|
|
{"oversized", strings.Repeat(" ", 65<<10) + mockOSSDeployment},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
if _, err := LoadCurrentOSSConfig(writeMockOSSDeployment(t, tc.body), dispatcherFixtureID); err == nil || strings.Contains(err.Error(), "isolated-secret") {
|
|
t.Fatalf("unapproved deployment admitted or exposed credential: %v", err)
|
|
}
|
|
})
|
|
}
|
|
t.Setenv("MOCK_OSS_KEY_SECRET", "")
|
|
if _, err := LoadCurrentOSSConfig(writeMockOSSDeployment(t, mockOSSDeployment), dispatcherFixtureID); err == nil || strings.Contains(err.Error(), "isolated-id") {
|
|
t.Fatalf("unavailable credential was defaulted or exposed: %v", err)
|
|
}
|
|
}
|