gengx

im/backend/internal/app/security_test.go

@@ -0,0 +1,88 @@
+package app
+
+import (
+	"bytes"
+	"testing"
+)
+
+func productionConfigForTest() Config {
+	return Config{
+		Port:                8888,
+		DSN:                 "xingyu:password@tcp(mysql:3306)/im",
+		JWTSecret:           "0123456789abcdef0123456789abcdef",
+		ConfigEncryptionKey: "abcdef0123456789abcdef0123456789",
+		Environment:         "production",
+		AllowedOrigins:      []string{"https://app.example.com", "https://admin.example.com"},
+	}
+}
+
+func TestValidateProductionConfig(t *testing.T) {
+	config := productionConfigForTest()
+	if err := validateConfig(config); err != nil {
+		t.Fatalf("expected a valid production config: %v", err)
+	}
+
+	tests := []struct {
+		name   string
+		mutate func(*Config)
+	}{
+		{"root database account", func(config *Config) { config.DSN = "root:root@tcp(mysql:3306)/im" }},
+		{"weak jwt", func(config *Config) { config.JWTSecret = "short" }},
+		{"missing encryption key", func(config *Config) { config.ConfigEncryptionKey = "" }},
+		{"wildcard cors", func(config *Config) { config.AllowedOrigins = []string{"*"} }},
+		{"insecure origin", func(config *Config) { config.AllowedOrigins = []string{"http://app.example.com"} }},
+		{"demo seed", func(config *Config) { config.SeedDemo = true }},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			invalid := config
+			test.mutate(&invalid)
+			if err := validateConfig(invalid); err == nil {
+				t.Fatal("expected production validation to reject config")
+			}
+		})
+	}
+}
+
+func TestPhoneEncryptionRoundTrip(t *testing.T) {
+	application := &App{config: productionConfigForTest()}
+	phone := "13800138000"
+	first, err := application.encryptPhone(phone)
+	if err != nil {
+		t.Fatal(err)
+	}
+	second, err := application.encryptPhone(phone)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Equal(first, second) {
+		t.Fatal("phone encryption must use a unique random nonce")
+	}
+	decrypted, err := application.decryptPhone(first)
+	if err != nil || decrypted != phone {
+		t.Fatalf("unexpected decrypted phone %q: %v", decrypted, err)
+	}
+}
+
+func TestProductionURLValidation(t *testing.T) {
+	if !validHTTPSURL("https://pay.example.com/create") {
+		t.Fatal("expected HTTPS URL to be accepted")
+	}
+	for _, value := range []string{"http://pay.example.com", "javascript:alert(1)", "https:///missing-host", ""} {
+		if validHTTPSURL(value) {
+			t.Fatalf("expected URL to be rejected: %s", value)
+		}
+	}
+}
+
+func TestPasswordAndPhoneRules(t *testing.T) {
+	if !validUserPassword("Password123") || validUserPassword("12345678") || validUserPassword("password") {
+		t.Fatal("password policy is not enforced")
+	}
+	if !strongAdminPassword("AdminPassword@123") || strongAdminPassword("Password123") || strongAdminPassword("adminpassword@123") {
+		t.Fatal("admin password policy is not enforced")
+	}
+	if !validPhone("13800138000") || validPhone("23800138000") || validPhone("1380013800x") {
+		t.Fatal("phone policy is not enforced")
+	}
+}