cgalo5758
ea4fee18b6
- Rotate the session token at the OIDC callback and restore the full lifetime; cap pre-auth sessions at 15 minutes and write no session for bare anonymous requests - Treat db-dsn as a secret: accept db-dsn-file, log only host, port, database and user, and never echo a malformed DSN in an error - Guard the logout callback with a state cookie so a forged visit cannot end a live session - Collapse FedWiki site actions on a foreign tenant's domain to the not-found answer, as for a domain that does not exist
59 lines
1.8 KiB
Go
59 lines
1.8 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
|
|
// SPDX-FileCopyrightText: 2025-2026 Christian Galo
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/spf13/viper"
|
|
)
|
|
|
|
// TestResolveSecretFiles_DBDSN covers task 1.1 (security-audit-remediation-2,
|
|
// spec startup-configuration): db-dsn joins the core secret pairs the same
|
|
// way valkey-password already does, so db-dsn-file is loaded into db-dsn and
|
|
// setting both is reported as the same ambiguity the other pairs report.
|
|
func TestResolveSecretFiles_DBDSN(t *testing.T) {
|
|
t.Run("db-dsn-file loads the DSN", func(t *testing.T) {
|
|
viper.Reset()
|
|
t.Cleanup(viper.Reset)
|
|
|
|
dsn := "postgres://widget:hunter2@db.example.com:5432/widgets"
|
|
path := filepath.Join(t.TempDir(), "db-dsn")
|
|
if err := os.WriteFile(path, []byte(dsn+"\n"), 0o600); err != nil {
|
|
t.Fatalf("write fixture file: %v", err)
|
|
}
|
|
viper.Set("db-dsn-file", path)
|
|
|
|
if err := resolveSecretFiles(nil); err != nil {
|
|
t.Fatalf("resolveSecretFiles: %v", err)
|
|
}
|
|
if got := viper.GetString("db-dsn"); got != dsn {
|
|
t.Errorf("db-dsn = %q, want %q", got, dsn)
|
|
}
|
|
})
|
|
|
|
t.Run("db-dsn and db-dsn-file both set is ambiguous", func(t *testing.T) {
|
|
viper.Reset()
|
|
t.Cleanup(viper.Reset)
|
|
|
|
path := filepath.Join(t.TempDir(), "db-dsn")
|
|
if err := os.WriteFile(path, []byte("postgres://widget:hunter2@db.example.com:5432/widgets"), 0o600); err != nil {
|
|
t.Fatalf("write fixture file: %v", err)
|
|
}
|
|
viper.Set("db-dsn", "postgres://widget:hunter2@db.example.com:5432/widgets")
|
|
viper.Set("db-dsn-file", path)
|
|
|
|
err := resolveSecretFiles(nil)
|
|
if err == nil {
|
|
t.Fatal("resolveSecretFiles: want ambiguity error, got nil")
|
|
}
|
|
if !strings.Contains(err.Error(), "db-dsn") {
|
|
t.Errorf("error = %q, want it to name db-dsn", err.Error())
|
|
}
|
|
})
|
|
}
|