89 lines
2.8 KiB
Go
89 lines
2.8 KiB
Go
package app
|
|
|
|
import (
|
|
"bytes"
|
|
"testing"
|
|
)
|
|
|
|
func productionConfigForTest() Config {
|
|
return Config{
|
|
Port: 8888,
|
|
DSN: "xingyu:password@tcp(mysql:3306)/im",
|
|
JWTSecret: "0123456789abcdef0123456789abcdef",
|
|
ConfigEncryptionKey: "abcdef0123456789abcdef0123456789",
|
|
Environment: "production",
|
|
AllowedOrigins: []string{"https://app.example.com", "https://admin.example.com"},
|
|
}
|
|
}
|
|
|
|
func TestValidateProductionConfig(t *testing.T) {
|
|
config := productionConfigForTest()
|
|
if err := validateConfig(config); err != nil {
|
|
t.Fatalf("expected a valid production config: %v", err)
|
|
}
|
|
|
|
tests := []struct {
|
|
name string
|
|
mutate func(*Config)
|
|
}{
|
|
{"root database account", func(config *Config) { config.DSN = "root:root@tcp(mysql:3306)/im" }},
|
|
{"weak jwt", func(config *Config) { config.JWTSecret = "short" }},
|
|
{"missing encryption key", func(config *Config) { config.ConfigEncryptionKey = "" }},
|
|
{"wildcard cors", func(config *Config) { config.AllowedOrigins = []string{"*"} }},
|
|
{"insecure origin", func(config *Config) { config.AllowedOrigins = []string{"http://app.example.com"} }},
|
|
{"demo seed", func(config *Config) { config.SeedDemo = true }},
|
|
}
|
|
for _, test := range tests {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
invalid := config
|
|
test.mutate(&invalid)
|
|
if err := validateConfig(invalid); err == nil {
|
|
t.Fatal("expected production validation to reject config")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPhoneEncryptionRoundTrip(t *testing.T) {
|
|
application := &App{config: productionConfigForTest()}
|
|
phone := "13800138000"
|
|
first, err := application.encryptPhone(phone)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second, err := application.encryptPhone(phone)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if bytes.Equal(first, second) {
|
|
t.Fatal("phone encryption must use a unique random nonce")
|
|
}
|
|
decrypted, err := application.decryptPhone(first)
|
|
if err != nil || decrypted != phone {
|
|
t.Fatalf("unexpected decrypted phone %q: %v", decrypted, err)
|
|
}
|
|
}
|
|
|
|
func TestProductionURLValidation(t *testing.T) {
|
|
if !validHTTPSURL("https://pay.example.com/create") {
|
|
t.Fatal("expected HTTPS URL to be accepted")
|
|
}
|
|
for _, value := range []string{"http://pay.example.com", "javascript:alert(1)", "https:///missing-host", ""} {
|
|
if validHTTPSURL(value) {
|
|
t.Fatalf("expected URL to be rejected: %s", value)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestPasswordAndPhoneRules(t *testing.T) {
|
|
if !validUserPassword("Password123") || validUserPassword("12345678") || validUserPassword("password") {
|
|
t.Fatal("password policy is not enforced")
|
|
}
|
|
if !strongAdminPassword("AdminPassword@123") || strongAdminPassword("Password123") || strongAdminPassword("adminpassword@123") {
|
|
t.Fatal("admin password policy is not enforced")
|
|
}
|
|
if !validPhone("13800138000") || validPhone("23800138000") || validPhone("1380013800x") {
|
|
t.Fatal("phone policy is not enforced")
|
|
}
|
|
}
|