cgalo5758
0b28a9dc29
- Replace gorilla/csrf with net/http CrossOriginProtection - Require valkey-password and add TLS options for session store - End session at /logout and revoke refresh tokens - Re-derive identity and roles from provider every five minutes - Process each Stripe webhook event in its own Temporal workflow - Give each outbox entry its own workflow with Temporal retries - Guard against stale Stripe events with provider timestamps - Derive transport security from base-url scheme
69 lines
2.2 KiB
Go
69 lines
2.2 KiB
Go
// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
|
|
// SPDX-FileCopyrightText: 2025-2026 Christian Galo
|
|
|
|
package auth
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/spf13/viper"
|
|
)
|
|
|
|
// baseOptions is the count valkeyDialOptions always returns: connect, read and
|
|
// write timeouts. Anything above it is a configured credential or TLS.
|
|
const baseOptions = 3
|
|
|
|
func withViper(t *testing.T, kv map[string]any) {
|
|
t.Helper()
|
|
for k, v := range kv {
|
|
viper.Set(k, v)
|
|
}
|
|
t.Cleanup(func() {
|
|
for k := range kv {
|
|
viper.Set(k, nil)
|
|
}
|
|
})
|
|
}
|
|
|
|
// An unconfigured deployment must dial exactly as it did before these keys
|
|
// existed, so upgrading cannot break a running stack.
|
|
func TestValkeyDialOptionsDefaultToNoCredentials(t *testing.T) {
|
|
if got := len(valkeyDialOptions(t.Context())); got != baseOptions {
|
|
t.Errorf("unconfigured store produced %d options, want %d (timeouts only)", got, baseOptions)
|
|
}
|
|
}
|
|
|
|
func TestValkeyDialOptionsAddCredentialsWhenConfigured(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
cfg map[string]any
|
|
extra int
|
|
}{
|
|
{"password only", map[string]any{"valkey-password": "s3cret"}, 1},
|
|
{"username and password", map[string]any{"valkey-username": "app", "valkey-password": "s3cret"}, 2},
|
|
{"tls", map[string]any{"valkey-tls": true}, 1},
|
|
{"tls with skip-verify", map[string]any{"valkey-tls": true, "valkey-tls-skip-verify": true}, 3},
|
|
// skip-verify without tls is inert: nothing is encrypted, so there is
|
|
// nothing to skip verifying.
|
|
{"skip-verify without tls", map[string]any{"valkey-tls-skip-verify": true}, 0},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
withViper(t, tc.cfg)
|
|
want := baseOptions + tc.extra
|
|
if got := len(valkeyDialOptions(t.Context())); got != want {
|
|
t.Errorf("got %d options, want %d", got, want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// An empty password must not register an option: a blank value would otherwise
|
|
// send an AUTH with no secret and fail against a store that wants none.
|
|
func TestValkeyDialOptionsIgnoreBlankCredentials(t *testing.T) {
|
|
withViper(t, map[string]any{"valkey-username": "", "valkey-password": ""})
|
|
if got := len(valkeyDialOptions(t.Context())); got != baseOptions {
|
|
t.Errorf("blank credentials produced %d options, want %d", got, baseOptions)
|
|
}
|
|
}
|