feat: add Go migration compatibility foundation

2026-08-13 10:35:52 +08:00
1 parent 7de3300034
commit 716a8031b1
@@ -0,0 +1,152 @@
+package postgres
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/pem"
+	"math/big"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func TestParseConfigDefaultsToLocalOutsideProduction(t *testing.T) {
+	cfg, err := ParseConfig(env(map[string]string{"NODE_ENV": "development"}), os.ReadFile)
+	if err != nil {
+		t.Fatalf("ParseConfig() error = %v", err)
+	}
+	if cfg.Backend != BackendLocal {
+		t.Fatalf("Backend = %q, want %q", cfg.Backend, BackendLocal)
+	}
+}
+
+func TestParseConfigRequiresExplicitBackendInProduction(t *testing.T) {
+	_, err := ParseConfig(env(map[string]string{"NODE_ENV": "production"}), os.ReadFile)
+	if err == nil || !strings.Contains(err.Error(), "ZHINIAN_DATA_BACKEND") {
+		t.Fatalf("ParseConfig() error = %v, want backend validation error", err)
+	}
+}
+
+func TestParseConfigRequiresPostgresURL(t *testing.T) {
+	_, err := ParseConfig(env(map[string]string{"ZHINIAN_DATA_BACKEND": "postgres"}), os.ReadFile)
+	if err == nil || !strings.Contains(err.Error(), "DATABASE_URL") {
+		t.Fatalf("ParseConfig() error = %v, want DATABASE_URL error", err)
+	}
+}
+
+func TestParseConfigAcceptsOnlyPostgresSchemesAndRejectsSSLQueryParameters(t *testing.T) {
+	tests := []struct {
+		name string
+		url  string
+	}{
+		{name: "wrong scheme", url: "https://db.example/app"},
+		{name: "sslmode", url: "postgres://db.example/app?sslmode=require"},
+		{name: "mixed case ssl parameter", url: "postgresql://db.example/app?SSLcert=x"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			_, err := ParseConfig(env(map[string]string{
+				"ZHINIAN_DATA_BACKEND": "postgres",
+				"DATABASE_URL":         tt.url,
+			}), os.ReadFile)
+			if err == nil {
+				t.Fatal("ParseConfig() error = nil, want validation error")
+			}
+		})
+	}
+}
+
+func TestParseConfigBuildsVerifyFullTLSFromCA(t *testing.T) {
+	dir := t.TempDir()
+	caPath := filepath.Join(dir, "ca.pem")
+	const ca = "-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n"
+	read := func(path string) ([]byte, error) {
+		if path != caPath {
+			t.Fatalf("read path = %q, want %q", path, caPath)
+		}
+		return []byte(ca), nil
+	}
+	_, err := ParseConfig(env(map[string]string{
+		"ZHINIAN_DATA_BACKEND":  "postgres",
+		"DATABASE_URL":          "postgresql://db.example/app",
+		"DATABASE_SSL_MODE":     "verify-full",
+		"DATABASE_CA_CERT_PATH": caPath,
+	}), read)
+	if err == nil || !strings.Contains(err.Error(), "CA certificate") {
+		t.Fatalf("ParseConfig() error = %v, want invalid CA certificate error", err)
+	}
+}
+
+func TestParseConfigVerifyFullBuildsRootsWithoutDisablingVerification(t *testing.T) {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatal(err)
+	}
+	template := &x509.Certificate{
+		SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "test CA"},
+		NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(time.Hour),
+		IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, template, template, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ca := pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der})
+	cfg, err := ParseConfig(env(map[string]string{
+		"ZHINIAN_DATA_BACKEND":  "postgres",
+		"DATABASE_URL":          "postgresql://db.example/app",
+		"DATABASE_SSL_MODE":     "verify-full",
+		"DATABASE_CA_CERT_PATH": "/ca.pem",
+	}), func(string) ([]byte, error) { return ca, nil })
+	if err != nil {
+		t.Fatalf("ParseConfig() error = %v", err)
+	}
+	if cfg.TLSConfig == nil || cfg.TLSConfig.RootCAs == nil {
+		t.Fatal("TLSConfig.RootCAs is nil")
+	}
+	if cfg.TLSConfig.InsecureSkipVerify {
+		t.Fatal("TLSConfig.InsecureSkipVerify = true, want full certificate and hostname verification")
+	}
+}
+
+func TestParseConfigDefaultsAndNumericValidation(t *testing.T) {
+	cfg, err := ParseConfig(env(map[string]string{
+		"ZHINIAN_DATA_BACKEND": "postgres",
+		"DATABASE_URL":         "postgres://db.example/app",
+	}), os.ReadFile)
+	if err != nil {
+		t.Fatalf("ParseConfig() error = %v", err)
+	}
+	if cfg.PoolMax != 10 || cfg.IdleTimeout != 30*time.Second || cfg.ConnectionTimeout != 10*time.Second || cfg.StatementTimeout != 30*time.Second {
+		t.Fatalf("unexpected defaults: %+v", cfg)
+	}
+	if cfg.ApplicationName != "zhinian-go" || cfg.SSLMode != SSLDisable {
+		t.Fatalf("unexpected identity/TLS defaults: %+v", cfg)
+	}
+
+	for name, value := range map[string]string{
+		"DATABASE_POOL_MAX":              "0",
+		"DATABASE_IDLE_TIMEOUT_MS":       "-1",
+		"DATABASE_CONNECTION_TIMEOUT_MS": "0",
+		"DATABASE_STATEMENT_TIMEOUT_MS":  "nope",
+	} {
+		t.Run(name, func(t *testing.T) {
+			_, err := ParseConfig(env(map[string]string{
+				"ZHINIAN_DATA_BACKEND": "postgres",
+				"DATABASE_URL":         "postgres://db.example/app",
+				name:                   value,
+			}), os.ReadFile)
+			if err == nil || !strings.Contains(err.Error(), name) {
+				t.Fatalf("ParseConfig() error = %v, want %s validation error", err, name)
+			}
+		})
+	}
+}
+
+func env(values map[string]string) Getenv {
+	return func(name string) string { return values[name] }
+}