Initial commit

2026-07-12 15:53:24 +08:00
commit 68d61700d5
252 changed files with 23291 additions and 0 deletions
--- a/server/internal/config/config_test.go
+++ b/server/internal/config/config_test.go
@@ -0,0 +1,76 @@
+package config
+
+import (
+	"encoding/base64"
+	"strings"
+	"testing"
+)
+
+func TestLoadAcceptsExactly32ByteKeys(t *testing.T) {
+	values := map[string]string{
+		"DATABASE_URL":               "postgres://localhost/test",
+		"DATA_ENCRYPTION_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("a", 32))),
+		"PHONE_HMAC_KEY_BASE64":      base64.StdEncoding.EncodeToString([]byte(strings.Repeat("b", 32))),
+		"SESSION_COOKIE_SECURE":      "false",
+	}
+	cfg, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
+	if err != nil {
+		t.Fatalf("load returned error: %v", err)
+	}
+	if len(cfg.EncryptionKey) != 32 || len(cfg.PhoneHMACKey) != 32 {
+		t.Fatalf("unexpected key lengths: %d, %d", len(cfg.EncryptionKey), len(cfg.PhoneHMACKey))
+	}
+}
+
+func TestLoadRejectsWrongKeyLength(t *testing.T) {
+	values := map[string]string{
+		"DATABASE_URL":               "postgres://localhost/test",
+		"DATA_ENCRYPTION_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("a", 31))),
+		"PHONE_HMAC_KEY_BASE64":      base64.StdEncoding.EncodeToString([]byte(strings.Repeat("b", 32))),
+	}
+	_, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
+	if err == nil || !strings.Contains(err.Error(), "exactly 32 bytes") {
+		t.Fatalf("expected exact length error, got %v", err)
+	}
+}
+
+func TestLoadRequiresSecureCookieInProduction(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("x", 32)))
+	values := map[string]string{
+		"APP_ENV":                    "production",
+		"DATABASE_URL":               "postgres://localhost/test",
+		"DATA_ENCRYPTION_KEY_BASE64": key,
+		"PHONE_HMAC_KEY_BASE64":      key,
+		"SESSION_COOKIE_SECURE":      "false",
+	}
+	_, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
+	if err == nil || !strings.Contains(err.Error(), "must be true") {
+		t.Fatalf("expected production cookie error, got %v", err)
+	}
+}
+
+func TestLoadRequiresTLSAndReleaseMigrationsInProduction(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("x", 32)))
+	values := map[string]string{
+		"APP_ENV":                    "production",
+		"DATABASE_URL":               "postgres://queue:secret@pg.internal/queue?sslmode=verify-full",
+		"DATA_ENCRYPTION_KEY_BASE64": key,
+		"PHONE_HMAC_KEY_BASE64":      key,
+		"SESSION_COOKIE_SECURE":      "true",
+		"MIGRATE_ON_START":           "false",
+	}
+	if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err != nil {
+		t.Fatalf("secure production configuration rejected: %v", err)
+	}
+
+	values["DATABASE_URL"] = "postgres://queue:secret@pg.internal/queue?sslmode=disable"
+	if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err == nil || !strings.Contains(err.Error(), "TLS") {
+		t.Fatalf("expected production database TLS error, got %v", err)
+	}
+
+	values["DATABASE_URL"] = "postgres://queue:secret@pg.internal/queue?sslmode=verify-full"
+	values["MIGRATE_ON_START"] = "true"
+	if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err == nil || !strings.Contains(err.Error(), "MIGRATE_ON_START") {
+		t.Fatalf("expected production migration mode error, got %v", err)
+	}
+}