Andrew S Erwin
4e421f6ea2
release gate / check (push) Failing after 6m43s
High severity: - wire TRUSTED_PROXY through Compose/deploy/docs and warn at web startup - bucket public rate limits on effective client IP, add per-bookmark budget, and forward the signed browser identity from the share page - disable first-run bootstrap in server deployments and document seeding - serialize last-admin demotion in one advisory-locked transaction Medium/low: - cap and batch share recipient inserts - add a shared outbound budget for preview/CardDAV/IMAP/signal work - pin CardDAV dials to 443 and bound IMAP logout - fix rightward kanban column drags and normalize cards on column delete - classify backend outages in auth guards, add request timeouts and an error boundary, remove the dead login route, surface throttling - enforce pinned/unpinned page reorder grouping server-side - avoid preview work for stale bookmark versions; drop duplicate dialog fetch - sequence-guard collection/tag/calendar/quick-find loads - validate property config and fix MULTI_SELECT/DATE filter inputs - document index maintenance; apply same-origin check to sign-out - trim signup names, unique shared dates and kanban keys (migration 010), reset reference cache on identity changes, hide OIDC issuer, return 413 for oversized direct bodies, escape Markdown link destinations - remove dead template files and duplicate test helper Verified with go build/vet, full PostgreSQL race suite, db convergence, tsc, both ESLint configs and a Next production build.
82 lines
2.6 KiB
Go
82 lines
2.6 KiB
Go
package config
|
|
|
|
import "testing"
|
|
|
|
func TestCookieSecureDerivation(t *testing.T) {
|
|
t.Setenv("COOKIE_SECURE", "")
|
|
https := &Config{NextAuthURL: "https://app.example.com"}
|
|
if !https.CookieSecure() {
|
|
t.Fatal("https NEXTAUTH_URL must imply Secure cookies")
|
|
}
|
|
local := &Config{NextAuthURL: "http://localhost:3000"}
|
|
if local.CookieSecure() {
|
|
t.Fatal("http NEXTAUTH_URL must not set Secure")
|
|
}
|
|
if (&Config{}).CookieSecure() {
|
|
t.Fatal("unset NEXTAUTH_URL must not set Secure")
|
|
}
|
|
t.Setenv("COOKIE_SECURE", "1")
|
|
if !local.CookieSecure() {
|
|
t.Fatal("explicit COOKIE_SECURE=1 must win over http URL")
|
|
}
|
|
t.Setenv("COOKIE_SECURE", "0")
|
|
if https.CookieSecure() {
|
|
t.Fatal("explicit COOKIE_SECURE=0 must win over https URL")
|
|
}
|
|
}
|
|
|
|
func TestSecretPrecedence(t *testing.T) {
|
|
c := &Config{NextAuthSecret: "next", AuthSecret: "auth"}
|
|
if c.Secret() != "next" {
|
|
t.Fatal("NEXTAUTH_SECRET must win")
|
|
}
|
|
if (&Config{AuthSecret: "auth"}).Secret() != "auth" {
|
|
t.Fatal("AUTH_SECRET fallback broken")
|
|
}
|
|
}
|
|
|
|
// Review M-12: fail fast on unusable configuration at startup.
|
|
func TestValidate(t *testing.T) {
|
|
if err := (&Config{}).Validate(); err == nil {
|
|
t.Fatal("missing secret passed validation")
|
|
}
|
|
if err := (&Config{AuthSecret: "secret", NextAuthURL: "not a url"}).Validate(); err == nil {
|
|
t.Fatal("relative NEXTAUTH_URL passed validation")
|
|
}
|
|
for _, u := range []string{"", "http://localhost:3000", "https://app.example.com"} {
|
|
if err := (&Config{AuthSecret: "secret", NextAuthURL: u}).Validate(); err != nil {
|
|
t.Fatalf("valid configuration %q rejected: %v", u, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Review M-12: the parsed ADMIN_EMAILS list is memoized but still follows
|
|
// env changes (tests and operator restarts rely on that).
|
|
func TestAdminEmailsTracksEnv(t *testing.T) {
|
|
t.Setenv("ADMIN_EMAILS", " A@Example.com ,, b@example.com ")
|
|
if got := AdminEmails(); len(got) != 2 || got[0] != "a@example.com" || got[1] != "b@example.com" {
|
|
t.Fatalf("unexpected parse: %v", got)
|
|
}
|
|
t.Setenv("ADMIN_EMAILS", "")
|
|
if got := AdminEmails(); len(got) != 0 {
|
|
t.Fatalf("cache did not follow the env change: %v", got)
|
|
}
|
|
if IsAdminEmail("a@example.com") {
|
|
t.Fatal("stale admin email after env change")
|
|
}
|
|
}
|
|
|
|
// Review OPS-01: a dedicated ENCRYPTION_KEY decouples integration-credential
|
|
// encryption from the session signing secret.
|
|
func TestEncryptionSecretPrecedence(t *testing.T) {
|
|
c := &Config{AuthSecret: "auth"}
|
|
t.Setenv("ENCRYPTION_KEY", "")
|
|
if c.EncryptionSecret() != "auth" {
|
|
t.Fatal("without ENCRYPTION_KEY the auth secret must remain the key")
|
|
}
|
|
t.Setenv("ENCRYPTION_KEY", "dedicated-key")
|
|
if c.EncryptionSecret() != "dedicated-key" {
|
|
t.Fatal("ENCRYPTION_KEY must win over the auth secret")
|
|
}
|
|
}
|