clawbot
88e1b1cdfa
check / check (push) Waiting to run
The example config allowlisted github.com and user-images.githubusercontent.com, where anyone can put an image, so a deployment set up as Getting Started says served every image there to anyone without a signature. The example now allowlists nothing and shows one commented entry under example.com. README.md says in Getting Started and in "Running under upaas" that every image on an allowlisted host is served without a signature, so an allowlisted host must be one the operator controls. A new test loads the example config and fails if it allowlists any host. Model: opus-5-5
125 lines
3.0 KiB
Go
125 lines
3.0 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"git.eeqj.de/sneak/smartconfig"
|
|
)
|
|
|
|
// writeTestConfig writes yamlContent to a temp config file and returns
|
|
// the file path.
|
|
func writeTestConfig(t *testing.T, yamlContent string) string {
|
|
t.Helper()
|
|
|
|
tmpDir := t.TempDir()
|
|
configPath := filepath.Join(tmpDir, "config.yml")
|
|
|
|
err := os.WriteFile(configPath, []byte(yamlContent), 0o600)
|
|
if err != nil {
|
|
t.Fatalf("failed to write test config: %v", err)
|
|
}
|
|
|
|
return configPath
|
|
}
|
|
|
|
// checkAllowlistHosts loads the config at configPath and asserts that
|
|
// getStringSlice returns the three expected hosts.
|
|
func checkAllowlistHosts(t *testing.T, configPath string) {
|
|
t.Helper()
|
|
|
|
sc, err := loadTestConfig(configPath)
|
|
if err != nil {
|
|
t.Fatalf("failed to load config: %v", err)
|
|
}
|
|
|
|
hosts := getStringSlice(sc)
|
|
|
|
if len(hosts) != 3 {
|
|
t.Errorf("expected 3 hosts, got %d: %v", len(hosts), hosts)
|
|
}
|
|
|
|
expected := []string{"static.sneak.cloud", "sneak.berlin", testHostS3}
|
|
for i, want := range expected {
|
|
if i >= len(hosts) {
|
|
t.Errorf("missing host at index %d: want %q", i, want)
|
|
|
|
continue
|
|
}
|
|
|
|
if hosts[i] != want {
|
|
t.Errorf("host[%d] = %q, want %q", i, hosts[i], want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestGetStringSlice_YAMLList(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
yamlContent := `
|
|
allowlist_hosts:
|
|
- static.sneak.cloud
|
|
- sneak.berlin
|
|
- s3.sneak.cloud
|
|
`
|
|
|
|
checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
|
|
}
|
|
|
|
func TestGetStringSlice_CommaSeparated(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// Backwards compatibility with comma-separated string values.
|
|
yamlContent := `allowlist_hosts: "static.sneak.cloud, sneak.berlin, s3.sneak.cloud"`
|
|
|
|
checkAllowlistHosts(t, writeTestConfig(t, yamlContent))
|
|
}
|
|
|
|
func TestGetStringSlice_Empty(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
configPath := writeTestConfig(t, `port: 8080`)
|
|
|
|
sc, err := loadTestConfig(configPath)
|
|
if err != nil {
|
|
t.Fatalf("failed to load config: %v", err)
|
|
}
|
|
|
|
hosts := getStringSlice(sc)
|
|
if len(hosts) != 0 {
|
|
t.Errorf("expected nil or empty slice, got %v", hosts)
|
|
}
|
|
}
|
|
|
|
// TestExampleConfigAllowlistsNoHost loads configs/config.example.yml
|
|
// with a real signing key, as Getting Started in README.md has it copied
|
|
// and edited, and checks that it allowlists no host: every image on an
|
|
// allowlisted host is served to anyone without a signature.
|
|
func TestExampleConfigAllowlistsNoHost(t *testing.T) {
|
|
t.Setenv("PIXA_SIGNING_KEY", validTestSigningKey)
|
|
|
|
examplePath := filepath.Join("..", "..", "configs", "config.example.yml")
|
|
|
|
sc, err := loadTestConfig(examplePath)
|
|
if err != nil {
|
|
t.Fatalf("failed to load %s: %v", examplePath, err)
|
|
}
|
|
|
|
c, err := newFromSmartConfig(sc)
|
|
if err != nil {
|
|
t.Fatalf("%s is not a valid config: %v", examplePath, err)
|
|
}
|
|
|
|
t.Logf("allowlist_hosts in %s: %v", examplePath, c.AllowlistHosts)
|
|
|
|
if len(c.AllowlistHosts) != 0 {
|
|
t.Errorf("%s allowlists %v, want no host", examplePath, c.AllowlistHosts)
|
|
}
|
|
}
|
|
|
|
// loadTestConfig is a helper to load a config file for testing.
|
|
func loadTestConfig(path string) (*smartconfig.Config, error) {
|
|
return smartconfig.NewFromConfigPath(path)
|
|
}
|