75 lines
3.2 KiB
Go
75 lines
3.2 KiB
Go
package initialize
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"testing"
|
|
"time"
|
|
|
|
"kra/internal/biz/system"
|
|
"kra/internal/config"
|
|
|
|
"gorm.io/gorm"
|
|
)
|
|
|
|
type configurationBackend struct {
|
|
value *config.Config
|
|
persisted *config.Config
|
|
}
|
|
|
|
func (b *configurationBackend) IsInitialized(context.Context) (bool, error) { return true, nil }
|
|
func (b *configurationBackend) InitializeDatabase(context.Context, *system.DatabaseConfig, func(context.Context, *gorm.DB) error) error {
|
|
return nil
|
|
}
|
|
func (b *configurationBackend) PersistConfig(context.Context) error { return nil }
|
|
func (b *configurationBackend) PersistRuntimeConfig(_ context.Context, value *config.Config) error {
|
|
b.persisted = config.Clone(value)
|
|
return nil
|
|
}
|
|
func (b *configurationBackend) ReloadConfig(context.Context) error { return nil }
|
|
func (b *configurationBackend) Config() *config.Config { return config.Clone(b.value) }
|
|
|
|
func TestConfigurationJSONMasksSecretsWithoutMutatingConfig(t *testing.T) {
|
|
backend := &configurationBackend{value: &config.Config{
|
|
Data: &config.Data{Database: &config.Database{Password: "database-secret", Source: "dsn"}, Redis: &config.Redis{Password: "redis-secret"}},
|
|
Admin: &config.Admin{JWT: &config.JWT{SigningKey: "jwt-secret", ExpiresTime: 24 * time.Hour}, Email: &config.Email{Secret: "email-secret"}, Storage: &config.Storage{Qiniu: &config.Qiniu{SecretKey: "storage-secret"}}},
|
|
}}
|
|
raw, err := (&Repo{backend: backend}).ConfigurationJSON()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !json.Valid(raw) {
|
|
t.Fatalf("invalid response: %s", raw)
|
|
}
|
|
for _, secret := range []string{"database-secret", "redis-secret", "jwt-secret", "email-secret", "storage-secret", "dsn"} {
|
|
if bytes.Contains(raw, []byte(secret)) {
|
|
t.Fatalf("configuration response exposed %q: %s", secret, raw)
|
|
}
|
|
}
|
|
if backend.value.Data.Database.Password != "database-secret" || backend.value.Admin.JWT.SigningKey != "jwt-secret" {
|
|
t.Fatal("ConfigurationJSON mutated the live configuration")
|
|
}
|
|
}
|
|
|
|
func TestSaveConfigurationJSONMergesPartialValuesAndPreservesSecrets(t *testing.T) {
|
|
backend := &configurationBackend{value: &config.Config{
|
|
Data: &config.Data{Database: &config.Database{Driver: "mysql", Host: "old", Password: "database-secret", Source: "old-dsn"}, Redis: &config.Redis{Name: "main", Password: "redis-secret"}},
|
|
Admin: &config.Admin{ConfigPath: "config.yaml", JWT: &config.JWT{SigningKey: "jwt-secret", Issuer: "old"}, Email: &config.Email{Host: "old.smtp", Secret: "email-secret"}},
|
|
}}
|
|
raw := json.RawMessage(`{"data":{"database":{"host":"new","password":"******"}},"admin":{"jwt":{"issuer":"new","signing_key":"******"}},"email":{"host":"new.smtp","secret":"******"}}`)
|
|
if err := (&Repo{backend: backend}).SaveConfigurationJSON(context.Background(), raw); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got := backend.persisted
|
|
if got == nil || got.Data.Database.Host != "new" || got.Admin.JWT.Issuer != "new" || got.Admin.Email.Host != "new.smtp" {
|
|
t.Fatalf("partial update was not applied: %#v", got)
|
|
}
|
|
if got.Data.Database.Password != "database-secret" || got.Admin.JWT.SigningKey != "jwt-secret" || got.Admin.Email.Secret != "email-secret" {
|
|
t.Fatal("masked secrets were not preserved")
|
|
}
|
|
if got.Admin.ConfigPath != "config.yaml" {
|
|
t.Fatalf("config path = %q", got.Admin.ConfigPath)
|
|
}
|
|
}
|