51 lines
1.5 KiB
Go
51 lines
1.5 KiB
Go
package config
|
|
|
|
import "testing"
|
|
|
|
func TestCookieSecureDerivation(t *testing.T) {
|
|
t.Setenv("COOKIE_SECURE", "")
|
|
https := &Config{NextAuthURL: "https://app.example.com"}
|
|
if !https.CookieSecure() {
|
|
t.Fatal("https NEXTAUTH_URL must imply Secure cookies")
|
|
}
|
|
local := &Config{NextAuthURL: "http://localhost:3000"}
|
|
if local.CookieSecure() {
|
|
t.Fatal("http NEXTAUTH_URL must not set Secure")
|
|
}
|
|
if (&Config{}).CookieSecure() {
|
|
t.Fatal("unset NEXTAUTH_URL must not set Secure")
|
|
}
|
|
t.Setenv("COOKIE_SECURE", "1")
|
|
if !local.CookieSecure() {
|
|
t.Fatal("explicit COOKIE_SECURE=1 must win over http URL")
|
|
}
|
|
t.Setenv("COOKIE_SECURE", "0")
|
|
if https.CookieSecure() {
|
|
t.Fatal("explicit COOKIE_SECURE=0 must win over https URL")
|
|
}
|
|
}
|
|
|
|
func TestSecretPrecedence(t *testing.T) {
|
|
c := &Config{NextAuthSecret: "next", AuthSecret: "auth"}
|
|
if c.Secret() != "next" {
|
|
t.Fatal("NEXTAUTH_SECRET must win")
|
|
}
|
|
if (&Config{AuthSecret: "auth"}).Secret() != "auth" {
|
|
t.Fatal("AUTH_SECRET fallback broken")
|
|
}
|
|
}
|
|
|
|
// Review OPS-01: a dedicated ENCRYPTION_KEY decouples integration-credential
|
|
// encryption from the session signing secret.
|
|
func TestEncryptionSecretPrecedence(t *testing.T) {
|
|
c := &Config{AuthSecret: "auth"}
|
|
t.Setenv("ENCRYPTION_KEY", "")
|
|
if c.EncryptionSecret() != "auth" {
|
|
t.Fatal("without ENCRYPTION_KEY the auth secret must remain the key")
|
|
}
|
|
t.Setenv("ENCRYPTION_KEY", "dedicated-key")
|
|
if c.EncryptionSecret() != "dedicated-key" {
|
|
t.Fatal("ENCRYPTION_KEY must win over the auth secret")
|
|
}
|
|
}
|