32 lines
1.1 KiB
Go
32 lines
1.1 KiB
Go
package signals
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// Review NET-02: mailbox credentials must never travel over a plaintext
|
|
// socket unless the explicit development fixture flag is set.
|
|
func TestPlaintextTransportRejected(t *testing.T) {
|
|
t.Setenv("INTEGRATIONS_ALLOW_INSECURE_IMAP", "")
|
|
if e := checkTransport(Mailbox{TLS: false}); e == nil {
|
|
t.Fatal("plaintext mailbox accepted without the development flag")
|
|
}
|
|
if e := checkTransport(Mailbox{TLS: true}); e != nil {
|
|
t.Fatalf("TLS mailbox rejected: %v", e)
|
|
}
|
|
// The guard runs before any dial, so Connect fails fast without network.
|
|
ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
|
|
defer cancel()
|
|
_, e := Connect(ctx, Mailbox{Host: "127.0.0.1", Port: 1, TLS: false})
|
|
if e == nil || !strings.Contains(e.Error(), "TLS is required") {
|
|
t.Fatalf("plaintext Connect was not refused up front: %v", e)
|
|
}
|
|
t.Setenv("INTEGRATIONS_ALLOW_INSECURE_IMAP", "1")
|
|
if e := checkTransport(Mailbox{TLS: false}); e != nil {
|
|
t.Fatalf("development fixture flag did not permit plaintext: %v", e)
|
|
}
|
|
}
|