77 lines
3.2 KiB
Go
77 lines
3.2 KiB
Go
package config
|
|
|
|
import (
|
|
"encoding/base64"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestLoadAcceptsExactly32ByteKeys(t *testing.T) {
|
|
values := map[string]string{
|
|
"DATABASE_URL": "postgres://localhost/test",
|
|
"DATA_ENCRYPTION_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("a", 32))),
|
|
"PHONE_HMAC_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("b", 32))),
|
|
"SESSION_COOKIE_SECURE": "false",
|
|
}
|
|
cfg, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
|
|
if err != nil {
|
|
t.Fatalf("load returned error: %v", err)
|
|
}
|
|
if len(cfg.EncryptionKey) != 32 || len(cfg.PhoneHMACKey) != 32 {
|
|
t.Fatalf("unexpected key lengths: %d, %d", len(cfg.EncryptionKey), len(cfg.PhoneHMACKey))
|
|
}
|
|
}
|
|
|
|
func TestLoadRejectsWrongKeyLength(t *testing.T) {
|
|
values := map[string]string{
|
|
"DATABASE_URL": "postgres://localhost/test",
|
|
"DATA_ENCRYPTION_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("a", 31))),
|
|
"PHONE_HMAC_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("b", 32))),
|
|
}
|
|
_, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
|
|
if err == nil || !strings.Contains(err.Error(), "exactly 32 bytes") {
|
|
t.Fatalf("expected exact length error, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestLoadRequiresSecureCookieInProduction(t *testing.T) {
|
|
key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("x", 32)))
|
|
values := map[string]string{
|
|
"APP_ENV": "production",
|
|
"DATABASE_URL": "postgres://localhost/test",
|
|
"DATA_ENCRYPTION_KEY_BASE64": key,
|
|
"PHONE_HMAC_KEY_BASE64": key,
|
|
"SESSION_COOKIE_SECURE": "false",
|
|
}
|
|
_, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
|
|
if err == nil || !strings.Contains(err.Error(), "must be true") {
|
|
t.Fatalf("expected production cookie error, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestLoadRequiresTLSAndReleaseMigrationsInProduction(t *testing.T) {
|
|
key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("x", 32)))
|
|
values := map[string]string{
|
|
"APP_ENV": "production",
|
|
"DATABASE_URL": "postgres://queue:secret@pg.internal/queue?sslmode=verify-full",
|
|
"DATA_ENCRYPTION_KEY_BASE64": key,
|
|
"PHONE_HMAC_KEY_BASE64": key,
|
|
"SESSION_COOKIE_SECURE": "true",
|
|
"MIGRATE_ON_START": "false",
|
|
}
|
|
if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err != nil {
|
|
t.Fatalf("secure production configuration rejected: %v", err)
|
|
}
|
|
|
|
values["DATABASE_URL"] = "postgres://queue:secret@pg.internal/queue?sslmode=disable"
|
|
if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err == nil || !strings.Contains(err.Error(), "TLS") {
|
|
t.Fatalf("expected production database TLS error, got %v", err)
|
|
}
|
|
|
|
values["DATABASE_URL"] = "postgres://queue:secret@pg.internal/queue?sslmode=verify-full"
|
|
values["MIGRATE_ON_START"] = "true"
|
|
if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err == nil || !strings.Contains(err.Error(), "MIGRATE_ON_START") {
|
|
t.Fatalf("expected production migration mode error, got %v", err)
|
|
}
|
|
}
|