Rogeeandrogee
f719529d66
* fix(security): harden auth and credential handling (HH-444) * fix(security): address HH-444 review blockers * fix(security): close remaining HH-444 review blockers --------- Co-authored-by: Rogee <rogee@ipao.vip>
67 lines
3.1 KiB
Go
67 lines
3.1 KiB
Go
package config
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func validReleaseConfig() *Config {
|
|
return &Config{
|
|
Server: ServerConfig{Port: 3000, Mode: "release", CORS: CORSConfig{AllowedOrigins: []string{"https://chat.acme.test"}, AllowCredentials: true}},
|
|
Database: DatabaseConfig{DSN: "postgres://user:pass@db.acme.test/gochat?sslmode=verify-full"},
|
|
Redis: RedisConfig{DSN: "rediss://:redis-secret@redis.acme.test:6379"},
|
|
JWT: JWTConfig{Secret: "production-secret-at-least-32-bytes", AccessExpiryMinutes: 15, RefreshExpiryHours: 168},
|
|
Encryption: EncryptionConfig{Enabled: true, CurrentKeyVersion: 1, AESKey: base64.StdEncoding.EncodeToString(make([]byte, 32))},
|
|
Log: LogConfig{Level: "info"},
|
|
Worker: WorkerConfig{Concurrency: 1, BlockTimeoutS: 5, SweepIntervalS: 30},
|
|
Search: SearchConfig{Engine: "meilisearch", Host: "https://search.acme.test", APIKey: "search-secret-123", TimeoutSeconds: 5},
|
|
}
|
|
}
|
|
|
|
func TestReleaseTransportAndCORSValidationFailsClosed(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
mutate func(*Config)
|
|
message string
|
|
}{
|
|
{"database certificate not verified", func(c *Config) { c.Database.DSN = "postgres://user:pass@db.acme.test/gochat?sslmode=require" }, "verify-full or verify-ca"},
|
|
{"plain redis", func(c *Config) { c.Redis.DSN = "redis://:redis-secret@redis.acme.test:6379" }, "must use rediss"},
|
|
{"redis certificate not verified", func(c *Config) { c.Redis.DSN = "rediss://:redis-secret@redis.acme.test:6379?insecure_skip_verify=true" }, "cannot be disabled"},
|
|
{"placeholder origin", func(c *Config) { c.Server.CORS.AllowedOrigins = []string{"https://example.com"} }, "not deployable"},
|
|
{"non HTTPS origin", func(c *Config) { c.Server.CORS.AllowedOrigins = []string{"http://chat.acme.test"} }, "exact HTTPS origin"},
|
|
{"wildcard origin", func(c *Config) { c.Server.CORS.AllowedOrigins = []string{"*.acme.test"} }, "exact HTTPS origin"},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
cfg := validReleaseConfig()
|
|
tt.mutate(cfg)
|
|
err := Validate(cfg)
|
|
require.ErrorContains(t, err, tt.message)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestSecuritySettingsLoadFromEnvironment(t *testing.T) {
|
|
workingDir, err := os.Getwd()
|
|
require.NoError(t, err)
|
|
require.NoError(t, os.Chdir(filepath.Join(workingDir, "..", "..")))
|
|
t.Cleanup(func() { _ = os.Chdir(workingDir) })
|
|
t.Setenv("GOCHAT_SERVER_TRUSTED_PROXIES", "10.0.0.0/8,192.0.2.10")
|
|
t.Setenv("GOCHAT_SERVER_CORS_ALLOWED_ORIGINS", "https://chat.acme.test,https://admin.acme.test")
|
|
t.Setenv("GOCHAT_JWT_WS_TICKET_TTL_SECONDS", "20")
|
|
t.Setenv("GOCHAT_ENCRYPTION_ENABLED", "true")
|
|
t.Setenv("GOCHAT_RATE_LIMIT_LOGIN_REQUESTS", "7")
|
|
|
|
cfg, err := LoadWithEnv("default")
|
|
require.NoError(t, err)
|
|
require.Equal(t, []string{"10.0.0.0/8", "192.0.2.10"}, cfg.Server.TrustedProxies)
|
|
require.Equal(t, []string{"https://chat.acme.test", "https://admin.acme.test"}, cfg.Server.CORS.AllowedOrigins)
|
|
require.Equal(t, 20, cfg.JWT.WSTicketTTLSeconds)
|
|
require.True(t, cfg.Encryption.Enabled)
|
|
require.Equal(t, 7, cfg.RateLimit.Login.Requests)
|
|
}
|