mirror of
https://github.com/MeshCore-Beacon/beacon-server.git
synced 2026-10-17 02:50:00 +00:00
MrAlders0n
5ccb1a2ce3
Warn at startup when limits are on without trusted_proxies, and once when a request carries forwarding headers Beacon ignores. Reject short or whitespace admin keys and negative durations. Key default-window stats by hour, return 500 for scope lookup failures, and validate IATA path params.
84 lines
2.4 KiB
Go
84 lines
2.4 KiB
Go
// Copyright 2026 Beacon Contributors
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
package config
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestLoadAuth(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
name, env, want string
|
|
file, set bool
|
|
}{
|
|
{"no config", "", "", false, false},
|
|
{"YAML", "", "yaml-test-key-0123456789", true, false},
|
|
{"environment overrides", "env-test-key-0123456789", "env-test-key-0123456789", true, true},
|
|
{"empty environment disables", "", "", true, true},
|
|
{"environment without file", "env-test-key-0123456789", "env-test-key-0123456789", false, true},
|
|
{"surrounding whitespace trimmed", " env-test-key-0123456789\n", "env-test-key-0123456789", true, true},
|
|
{"whitespace-only disables", " \t", "", true, true},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Setenv("BEACON_API_KEY", tc.env)
|
|
if !tc.set {
|
|
if err := os.Unsetenv("BEACON_API_KEY"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
path := filepath.Join(t.TempDir(), "config.yaml")
|
|
if tc.file {
|
|
if err := os.WriteFile(path, []byte("auth:\n api_key: yaml-test-key-0123456789\n"), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
cfg, err := Load(path)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if cfg.Auth.APIKey != tc.want {
|
|
t.Fatal("wrong auth configuration precedence")
|
|
}
|
|
encoded, err := json.Marshal(cfg)
|
|
if err != nil || strings.Contains(string(encoded), "test-key") {
|
|
t.Fatal("key exposed in JSON")
|
|
}
|
|
if strings.Contains(Resolve(cfg).String(), "test-key") {
|
|
t.Fatal("key exposed in startup summary")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestLoadAuthRejectsUnusableKey(t *testing.T) {
|
|
for _, tc := range []struct{ name, key, want string }{
|
|
{"inner space", "env-test-key 0123456789", "whitespace"},
|
|
{"inner tab", "env-test-key\t0123456789", "whitespace"},
|
|
{"too short", "short-test-key", "at least 16"},
|
|
} {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
t.Setenv("BEACON_API_KEY", tc.key)
|
|
for _, file := range []bool{false, true} {
|
|
path := filepath.Join(t.TempDir(), "config.yaml")
|
|
if file {
|
|
if err := os.WriteFile(path, []byte("log:\n level: info\n"), 0600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
_, err := Load(path)
|
|
if err == nil || !strings.Contains(err.Error(), tc.want) {
|
|
t.Fatalf("file=%t: err = %v, want %q", file, err, tc.want)
|
|
}
|
|
if strings.Contains(err.Error(), "test-key") {
|
|
t.Fatal("key exposed in error")
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|