pixa/internal/config/config_validation_internal_test.go

package config

import (
	"log/slog"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"git.eeqj.de/sneak/smartconfig"
)

// validTestSigningKey is a 32-character signing key that satisfies the
// minimum length requirement in validate().
const validTestSigningKey = "0123456789abcdef0123456789abcdef"

// signingKeyLine is a valid signing_key config line used as the base of
// test config files.
const signingKeyLine = "signing_key: " + validTestSigningKey + "\n"

// testHostS3 is an allowlist host entry used across the config tests.
const testHostS3 = "s3.sneak.cloud"

// nullValueText is the substring that error messages about explicitly
// null config values must contain.
const nullValueText = "null"

// abortCase describes a config file that must abort startup with an
// error mentioning every string in wantErrSubstrings.
type abortCase struct {
	name string
	yaml string
	// wantErrSubstrings must all appear in the error message.
	wantErrSubstrings []string
}

// configFromYAML writes yamlContent to a temporary config file, loads it
// via smartconfig, and constructs a Config from it using the same code
// path the server uses at startup.
func configFromYAML(t *testing.T, yamlContent string) (*Config, error) {
	t.Helper()

	tmpDir := t.TempDir()
	configPath := filepath.Join(tmpDir, "config.yml")

	err := os.WriteFile(configPath, []byte(yamlContent), 0o600)
	if err != nil {
		t.Fatalf("failed to write test config: %v", err)
	}

	sc, err := smartconfig.NewFromConfigPath(configPath)
	if err != nil {
		t.Fatalf("failed to load test config: %v", err)
	}

	return newFromSmartConfig(sc)
}

func TestOmittedValuesUseDefaults(t *testing.T) {
	t.Parallel()

	c, err := configFromYAML(t, signingKeyLine)
	if err != nil {
		t.Fatalf("minimal config should be valid, got error: %v", err)
	}

	if c.Port != DefaultPort {
		t.Errorf("Port = %d, want default %d", c.Port, DefaultPort)
	}

	if c.StateDir != DefaultStateDir {
		t.Errorf("StateDir = %q, want default %q", c.StateDir, DefaultStateDir)
	}

	if c.UpstreamConnectionsPerHost != DefaultUpstreamConnectionsPerHost {
		t.Errorf("UpstreamConnectionsPerHost = %d, want default %d",
			c.UpstreamConnectionsPerHost, DefaultUpstreamConnectionsPerHost)
	}

	if c.Debug {
		t.Error("Debug = true, want default false")
	}

	if c.MaintenanceMode {
		t.Error("MaintenanceMode = true, want default false")
	}

	if c.AllowHTTP {
		t.Error("AllowHTTP = true, want default false")
	}

	if len(c.AllowlistHosts) != 0 {
		t.Errorf("AllowlistHosts = %v, want empty", c.AllowlistHosts)
	}

	wantDBURL := "file:" + DefaultStateDir + "/state.sqlite3?_journal_mode=WAL"
	if c.DBURL != wantDBURL {
		t.Errorf("DBURL = %q, want derived default %q", c.DBURL, wantDBURL)
	}
}

func TestExplicitValidValuesAreUsed(t *testing.T) {
	t.Parallel()

	yamlContent := `
port: 9090
debug: true
maintenance_mode: true
state_dir: /tmp/pixa-test-state
db_url: "file:/tmp/pixa-test-state/other.sqlite3"
signing_key: ` + validTestSigningKey + `
allowlist_hosts:
  - s3.sneak.cloud
  - .example.com
allow_http: true
upstream_connections_per_host: 5
sentry_dsn: "https://abc123@sentry.example.com/42"
metrics:
  username: metricsuser
  password: metricspass
`

	c, err := configFromYAML(t, yamlContent)
	if err != nil {
		t.Fatalf("valid config should load, got error: %v", err)
	}

	if c.Port != 9090 {
		t.Errorf("Port = %d, want 9090", c.Port)
	}

	if !c.Debug || !c.MaintenanceMode || !c.AllowHTTP {
		t.Errorf("bool fields = debug %v maintenance %v allow_http %v, want all true",
			c.Debug, c.MaintenanceMode, c.AllowHTTP)
	}

	if c.StateDir != "/tmp/pixa-test-state" {
		t.Errorf("StateDir = %q, want /tmp/pixa-test-state", c.StateDir)
	}

	if c.DBURL != "file:/tmp/pixa-test-state/other.sqlite3" {
		t.Errorf("DBURL = %q, want explicit value", c.DBURL)
	}

	if len(c.AllowlistHosts) != 2 || c.AllowlistHosts[0] != testHostS3 ||
		c.AllowlistHosts[1] != ".example.com" {
		t.Errorf("AllowlistHosts = %v, want [s3.sneak.cloud .example.com]",
			c.AllowlistHosts)
	}

	if c.UpstreamConnectionsPerHost != 5 {
		t.Errorf("UpstreamConnectionsPerHost = %d, want 5", c.UpstreamConnectionsPerHost)
	}

	if c.SentryDSN != "https://abc123@sentry.example.com/42" {
		t.Errorf("SentryDSN = %q, want explicit value", c.SentryDSN)
	}

	if c.MetricsUsername != "metricsuser" || c.MetricsPassword != "metricspass" {
		t.Errorf("metrics = %q/%q, want metricsuser/metricspass",
			c.MetricsUsername, c.MetricsPassword)
	}
}

func TestCommaSeparatedAllowlistStillSupported(t *testing.T) {
	t.Parallel()

	yamlContent := signingKeyLine +
		`allowlist_hosts: "s3.sneak.cloud, sneak.berlin"
`

	c, err := configFromYAML(t, yamlContent)
	if err != nil {
		t.Fatalf("comma-separated allowlist should load, got error: %v", err)
	}

	if len(c.AllowlistHosts) != 2 || c.AllowlistHosts[0] != testHostS3 ||
		c.AllowlistHosts[1] != "sneak.berlin" {
		t.Errorf("AllowlistHosts = %v, want [s3.sneak.cloud sneak.berlin]",
			c.AllowlistHosts)
	}
}

// runAbortCases asserts that each case's config aborts startup with an
// error message mentioning every expected substring.
func runAbortCases(t *testing.T, cases []abortCase) {
	t.Helper()

	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			c, err := configFromYAML(t, tc.yaml)
			if err == nil {
				t.Fatalf("config with %s must abort startup, got config: %+v", tc.name, c)
			}

			t.Logf("got expected error: %v", err)

			for _, want := range tc.wantErrSubstrings {
				if !strings.Contains(err.Error(), want) {
					t.Errorf("error %q does not mention %q", err.Error(), want)
				}
			}
		})
	}
}

// invalidScalarValueCases are configs where a scalar key is explicitly
// set to an unparseable or out-of-range value; each must abort startup
// naming the offending key, never silently fall back to the default.
func invalidScalarValueCases() []abortCase {
	return []abortCase{
		{
			name:              "port not a number",
			yaml:              signingKeyLine + "port: banana\n",
			wantErrSubstrings: []string{keyPort, "banana"},
		},
		{
			name:              "port zero",
			yaml:              signingKeyLine + "port: 0\n",
			wantErrSubstrings: []string{keyPort, "0"},
		},
		{
			name:              "port above 65535",
			yaml:              signingKeyLine + "port: 99999\n",
			wantErrSubstrings: []string{keyPort, "99999"},
		},
		{
			name:              "port fractional",
			yaml:              signingKeyLine + "port: 8080.5\n",
			wantErrSubstrings: []string{keyPort, "8080.5"},
		},
		{
			name:              "debug not a bool",
			yaml:              signingKeyLine + "debug: notabool\n",
			wantErrSubstrings: []string{keyDebug, "notabool"},
		},
		{
			name:              "maintenance_mode not a bool",
			yaml:              signingKeyLine + "maintenance_mode: sometimes\n",
			wantErrSubstrings: []string{keyMaintenanceMode, "sometimes"},
		},
		{
			name:              "allow_http numeric",
			yaml:              signingKeyLine + "allow_http: 2\n",
			wantErrSubstrings: []string{keyAllowHTTP, "2"},
		},
		{
			name:              "upstream_connections_per_host zero",
			yaml:              signingKeyLine + "upstream_connections_per_host: 0\n",
			wantErrSubstrings: []string{keyUpstreamConnectionsPerHost, "0"},
		},
		{
			name:              "upstream_connections_per_host negative",
			yaml:              signingKeyLine + "upstream_connections_per_host: -3\n",
			wantErrSubstrings: []string{keyUpstreamConnectionsPerHost, "-3"},
		},
		{
			name:              "upstream_connections_per_host not a number",
			yaml:              signingKeyLine + "upstream_connections_per_host: many\n",
			wantErrSubstrings: []string{keyUpstreamConnectionsPerHost, "many"},
		},
	}
}

// invalidHostAndCredentialCases are configs where allowlist_hosts,
// signing_key, state_dir, sentry_dsn, or metrics is explicitly set to
// an invalid value; each must abort startup naming the offending key.
func invalidHostAndCredentialCases() []abortCase {
	return []abortCase{
		{
			name: "allowlist host with scheme",
			yaml: signingKeyLine + "allowlist_hosts:\n  - https://example.com\n",
			wantErrSubstrings: []string{
				keyAllowlistHosts, "https://example.com",
			},
		},
		{
			name: "allowlist host with path",
			yaml: signingKeyLine + "allowlist_hosts:\n  - example.com/images\n",
			wantErrSubstrings: []string{
				keyAllowlistHosts, "example.com/images",
			},
		},
		{
			name:              "allowlist host with whitespace",
			yaml:              signingKeyLine + "allowlist_hosts:\n  - \"exa mple.com\"\n",
			wantErrSubstrings: []string{keyAllowlistHosts, "exa mple.com"},
		},
		{
			name:              "allowlist entry not a string",
			yaml:              signingKeyLine + "allowlist_hosts:\n  - 123\n",
			wantErrSubstrings: []string{keyAllowlistHosts, "123"},
		},
		{
			name:              "allowlist not a list",
			yaml:              signingKeyLine + "allowlist_hosts:\n  key: value\n",
			wantErrSubstrings: []string{keyAllowlistHosts},
		},
		{
			name:              "signing_key too short",
			yaml:              "signing_key: short\n",
			wantErrSubstrings: []string{keySigningKey},
		},
		{
			name:              "signing_key is the documented placeholder",
			yaml:              "signing_key: " + placeholderSigningKey + "\n",
			wantErrSubstrings: []string{keySigningKey},
		},
		{
			name:              "signing_key missing",
			yaml:              "port: 8080\n",
			wantErrSubstrings: []string{keySigningKey},
		},
		{
			name:              "state_dir explicitly empty",
			yaml:              signingKeyLine + "state_dir: \"\"\n",
			wantErrSubstrings: []string{keyStateDir},
		},
		{
			name:              "sentry_dsn not a URL",
			yaml:              signingKeyLine + "sentry_dsn: \"not a url\"\n",
			wantErrSubstrings: []string{keySentryDSN, "not a url"},
		},
		{
			name:              "metrics username without password",
			yaml:              signingKeyLine + "metrics:\n  username: bob\n",
			wantErrSubstrings: []string{keyMetrics},
		},
		{
			name:              "metrics password without username",
			yaml:              signingKeyLine + "metrics:\n  password: hunter2\n",
			wantErrSubstrings: []string{keyMetrics},
		},
	}
}

// TestSetButInvalidValueAbortsStartup verifies the no-silent-fallback
// rule: a key that is explicitly set to an unparseable or out-of-range
// value must produce a startup error naming the offending key, never
// silently fall back to the default.
func TestSetButInvalidValueAbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, append(
		invalidScalarValueCases(), invalidHostAndCredentialCases()...))
}

// explicitNullValueCases are configs where a key is explicitly set to
// null (including the bare "key:" form and the "~" alias); each must
// abort startup naming the key.
func explicitNullValueCases() []abortCase {
	return []abortCase{
		{
			name:              "port explicit null",
			yaml:              signingKeyLine + "port: null\n",
			wantErrSubstrings: []string{keyPort, nullValueText},
		},
		{
			name:              "port bare key no value",
			yaml:              signingKeyLine + "port:\n",
			wantErrSubstrings: []string{keyPort, nullValueText},
		},
		{
			name:              "debug tilde null",
			yaml:              signingKeyLine + "debug: ~\n",
			wantErrSubstrings: []string{keyDebug, nullValueText},
		},
		{
			name:              "maintenance_mode null",
			yaml:              signingKeyLine + "maintenance_mode: null\n",
			wantErrSubstrings: []string{keyMaintenanceMode, nullValueText},
		},
		{
			name:              "allow_http null",
			yaml:              signingKeyLine + "allow_http: null\n",
			wantErrSubstrings: []string{keyAllowHTTP, nullValueText},
		},
		{
			name:              "state_dir null",
			yaml:              signingKeyLine + "state_dir: null\n",
			wantErrSubstrings: []string{keyStateDir, nullValueText},
		},
		{
			name:              "db_url null",
			yaml:              signingKeyLine + "db_url: null\n",
			wantErrSubstrings: []string{keyDBURL, nullValueText},
		},
		{
			name:              "sentry_dsn null",
			yaml:              signingKeyLine + "sentry_dsn: null\n",
			wantErrSubstrings: []string{keySentryDSN, nullValueText},
		},
		{
			name:              "upstream_connections_per_host null",
			yaml:              signingKeyLine + "upstream_connections_per_host: null\n",
			wantErrSubstrings: []string{keyUpstreamConnectionsPerHost, nullValueText},
		},
		{
			name:              "allowlist_hosts null",
			yaml:              signingKeyLine + "allowlist_hosts: null\n",
			wantErrSubstrings: []string{keyAllowlistHosts, nullValueText},
		},
		{
			name:              "signing_key null",
			yaml:              "signing_key: null\n",
			wantErrSubstrings: []string{keySigningKey, nullValueText},
		},
		{
			name:              "metrics null",
			yaml:              signingKeyLine + "metrics: null\n",
			wantErrSubstrings: []string{keyMetrics, nullValueText},
		},
		{
			name: "metrics subkeys null",
			yaml: signingKeyLine + "metrics:\n  username: null\n  password: null\n",
			wantErrSubstrings: []string{
				keyMetricsUsername, keyMetricsPassword, nullValueText,
			},
		},
	}
}

// TestExplicitNullValueAbortsStartup verifies that a key explicitly
// set to null (including the bare "key:" form and the "~" alias) aborts
// startup naming the key. An explicit null is a SET value: it must
// never silently fall back to the default the way an omitted key does.
func TestExplicitNullValueAbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, explicitNullValueCases())
}

// TestExplicitlyEmptyDBURLAbortsStartup verifies that db_url set to an
// empty string aborts startup: the derived file:...state.sqlite3 URL is
// a default, and defaults apply only to omitted keys. This matches
// state_dir, where an explicitly empty value already aborts.
func TestExplicitlyEmptyDBURLAbortsStartup(t *testing.T) {
	t.Parallel()

	yamlContent := signingKeyLine + "db_url: \"\"\n"

	c, err := configFromYAML(t, yamlContent)
	if err == nil {
		t.Fatalf("explicitly empty db_url must abort startup, got config: %+v", c)
	}

	t.Logf("got expected error: %v", err)

	if !strings.Contains(err.Error(), keyDBURL) {
		t.Errorf("error %q does not name the offending key db_url", err.Error())
	}
}

// TestAllowlistHostsRejectsDotOnlyEntries verifies that entries with no
// hostname labels are rejected. The allowlist matcher treats a leading
// dot as a suffix pattern, so a bare "." entry would match any upstream
// host written in FQDN trailing-dot form (e.g. evil.com.) and
// effectively disable URL signing with a single character.
func TestAllowlistHostsRejectsDotOnlyEntries(t *testing.T) {
	t.Parallel()

	for _, entry := range []string{".", ".."} {
		t.Run(entry, func(t *testing.T) {
			t.Parallel()

			yamlContent := signingKeyLine +
				"allowlist_hosts:\n  - \"" + entry + "\"\n"

			c, err := configFromYAML(t, yamlContent)
			if err == nil {
				t.Fatalf("allowlist entry %q must abort startup, got config: %+v",
					entry, c)
			}

			t.Logf("got expected error: %v", err)

			if !strings.Contains(err.Error(), keyAllowlistHosts) {
				t.Errorf("error %q does not name the offending key allowlist_hosts",
					err.Error())
			}
		})
	}
}

func TestUnknownTopLevelKeyAbortsStartup(t *testing.T) {
	t.Parallel()

	yamlContent := signingKeyLine + `whitelist_hosts:
  - example.com
`

	c, err := configFromYAML(t, yamlContent)
	if err == nil {
		t.Fatalf("config with unknown key must abort startup, got config: %+v", c)
	}

	t.Logf("got expected error: %v", err)

	if !strings.Contains(err.Error(), "whitelist_hosts") {
		t.Errorf("error %q does not name the unknown key whitelist_hosts", err.Error())
	}
}

func TestUnknownMetricsSubkeyAbortsStartup(t *testing.T) {
	t.Parallel()

	yamlContent := signingKeyLine + `metrics:
  username: bob
  password: hunter2
  port: 9100
`

	c, err := configFromYAML(t, yamlContent)
	if err == nil {
		t.Fatalf("config with unknown metrics subkey must abort startup, got config: %+v", c)
	}

	t.Logf("got expected error: %v", err)

	if !strings.Contains(err.Error(), "metrics.port") {
		t.Errorf("error %q does not name the unknown key metrics.port", err.Error())
	}
}

func TestEnvSectionIsPermitted(t *testing.T) {
	t.Parallel()

	yamlContent := signingKeyLine + `env:
  PIXA_TEST_ENV_INJECTION: injected
`

	_, err := configFromYAML(t, yamlContent)
	if err != nil {
		t.Fatalf(
			"env section must be permitted (smartconfig consumes it), got error: %v",
			err)
	}
}

func TestMalformedConfigFileAbortsStartup(t *testing.T) {
	tmpDir := t.TempDir()
	configPath := filepath.Join(tmpDir, "config.yml")

	err := os.WriteFile(configPath, []byte("port: [unclosed\n"), 0o600)
	if err != nil {
		t.Fatalf("failed to write malformed config: %v", err)
	}

	// loadConfigFile falls through to the relative config.yml candidate;
	// the appname is chosen so no /etc or $HOME candidate can exist.
	t.Setenv("PIXA_CONFIG_PATH", "")
	t.Chdir(tmpDir)

	log := slog.New(slog.DiscardHandler)

	sc, err := loadConfigFile(log, "pixa-test-nonexistent-app")
	if err == nil {
		t.Fatalf("malformed config file must abort startup, got config: %v", sc)
	}

	t.Logf("got expected error: %v", err)
}

func TestEnsureStateDirCreatesDirectory(t *testing.T) {
	t.Parallel()

	stateDir := filepath.Join(t.TempDir(), "nested", "state")

	c := &Config{StateDir: stateDir}

	err := c.ensureStateDirWritable()
	if err != nil {
		t.Fatalf("creatable state_dir must validate, got error: %v", err)
	}

	info, err := os.Stat(stateDir)
	if err != nil || !info.IsDir() {
		t.Fatalf("state_dir was not created: info=%v err=%v", info, err)
	}
}

func TestEnsureStateDirFailsOnUncreatablePath(t *testing.T) {
	t.Parallel()

	// A path below /dev/null can never be created, even when running
	// as root (as in the Docker build).
	c := &Config{StateDir: "/dev/null/pixa-state"}

	err := c.ensureStateDirWritable()
	if err == nil {
		t.Fatal("uncreatable state_dir must abort startup, got nil error")
	}

	t.Logf("got expected error: %v", err)

	if !strings.Contains(err.Error(), keyStateDir) {
		t.Errorf("error %q does not name the offending key state_dir", err.Error())
	}
}

// TestOmittedOriginTimeoutsAndSizeUseDefaults checks that the CORS
// origin, the upstream fetch timeout, the upstream response size limit
// and the downstream timeout default to the values pixa used before they
// could be configured.
func TestOmittedOriginTimeoutsAndSizeUseDefaults(t *testing.T) {
	t.Parallel()

	c, err := configFromYAML(t, signingKeyLine)
	if err != nil {
		t.Fatalf("minimal config should be valid, got error: %v", err)
	}

	if c.AccessControlAllowOrigin != "*" {
		t.Errorf("AccessControlAllowOrigin = %q, want *", c.AccessControlAllowOrigin)
	}

	if c.UpstreamFetchTimeout != 30*time.Second {
		t.Errorf("UpstreamFetchTimeout = %v, want 30s", c.UpstreamFetchTimeout)
	}

	if c.UpstreamMaxResponseSize != 50<<20 {
		t.Errorf("UpstreamMaxResponseSize = %d, want %d (50 MiB)",
			c.UpstreamMaxResponseSize, 50<<20)
	}

	if c.DownstreamTimeout != 60*time.Second {
		t.Errorf("DownstreamTimeout = %v, want 60s", c.DownstreamTimeout)
	}
}

// TestExplicitOriginTimeoutsAndSizeAreUsed checks that valid values for
// the CORS origin, the two timeouts and the response size limit are used
// as given. The size is the largest accepted, 1 GiB.
func TestExplicitOriginTimeoutsAndSizeAreUsed(t *testing.T) {
	t.Parallel()

	c, err := configFromYAML(t, signingKeyLine+`
access_control_allow_origin: https://app.example.com
upstream_fetch_timeout: 10s
upstream_max_response_size: 1073741824
downstream_timeout: 2m
`)
	if err != nil {
		t.Fatalf("valid config should load, got error: %v", err)
	}

	if c.AccessControlAllowOrigin != "https://app.example.com" {
		t.Errorf("AccessControlAllowOrigin = %q, want https://app.example.com",
			c.AccessControlAllowOrigin)
	}

	if c.UpstreamFetchTimeout != 10*time.Second {
		t.Errorf("UpstreamFetchTimeout = %v, want 10s", c.UpstreamFetchTimeout)
	}

	if c.UpstreamMaxResponseSize != 1073741824 {
		t.Errorf("UpstreamMaxResponseSize = %d, want 1073741824",
			c.UpstreamMaxResponseSize)
	}

	if c.DownstreamTimeout != 2*time.Minute {
		t.Errorf("DownstreamTimeout = %v, want 2m", c.DownstreamTimeout)
	}
}

// TestOriginWithPortOrAnyOriginIsAccepted checks the other accepted forms
// of access_control_allow_origin: "*", an origin with a port, and origins
// whose host is an IPv4 or IPv6 address.
func TestOriginWithPortOrAnyOriginIsAccepted(t *testing.T) {
	t.Parallel()

	for _, origin := range []string{
		"*", "http://localhost:3000", "http://192.0.2.1", "http://[2001:db8::1]:8080",
	} {
		c, err := configFromYAML(t, signingKeyLine+
			"access_control_allow_origin: \""+origin+"\"\n")
		if err != nil {
			t.Fatalf("origin %q should be accepted, got error: %v", origin, err)
		}

		if c.AccessControlAllowOrigin != origin {
			t.Errorf("AccessControlAllowOrigin = %q, want %q",
				c.AccessControlAllowOrigin, origin)
		}
	}
}

// invalidTimeoutCases are configs where upstream_fetch_timeout or
// downstream_timeout is not a positive Go duration string; each must
// abort startup naming the key and the value.
func invalidTimeoutCases() []abortCase {
	return []abortCase{
		{
			name:              "upstream_fetch_timeout not a duration",
			yaml:              signingKeyLine + "upstream_fetch_timeout: soon\n",
			wantErrSubstrings: []string{keyUpstreamFetchTimeout, "soon"},
		},
		{
			name:              "upstream_fetch_timeout number without a unit",
			yaml:              signingKeyLine + "upstream_fetch_timeout: 45\n",
			wantErrSubstrings: []string{keyUpstreamFetchTimeout, "45"},
		},
		{
			name:              "upstream_fetch_timeout zero",
			yaml:              signingKeyLine + "upstream_fetch_timeout: 0s\n",
			wantErrSubstrings: []string{keyUpstreamFetchTimeout, "0s"},
		},
		{
			name:              "upstream_fetch_timeout negative",
			yaml:              signingKeyLine + "upstream_fetch_timeout: -5s\n",
			wantErrSubstrings: []string{keyUpstreamFetchTimeout, "-5s"},
		},
		{
			name:              "upstream_fetch_timeout null",
			yaml:              signingKeyLine + "upstream_fetch_timeout: null\n",
			wantErrSubstrings: []string{keyUpstreamFetchTimeout, nullValueText},
		},
		{
			name:              "downstream_timeout not a duration",
			yaml:              signingKeyLine + "downstream_timeout: 1 minute\n",
			wantErrSubstrings: []string{keyDownstreamTimeout, "1 minute"},
		},
		{
			name:              "downstream_timeout zero",
			yaml:              signingKeyLine + "downstream_timeout: 0s\n",
			wantErrSubstrings: []string{keyDownstreamTimeout, "0s"},
		},
		{
			name:              "downstream_timeout negative",
			yaml:              signingKeyLine + "downstream_timeout: -1m\n",
			wantErrSubstrings: []string{keyDownstreamTimeout, "-1m"},
		},
		{
			name:              "downstream_timeout null",
			yaml:              signingKeyLine + "downstream_timeout:\n",
			wantErrSubstrings: []string{keyDownstreamTimeout, nullValueText},
		},
	}
}

// invalidSizeAndOriginCases are configs where upstream_max_response_size
// is not a whole number of bytes from 1 to 1 GiB, or
// access_control_allow_origin is neither "*" nor an origin; each must
// abort startup naming the key and the value.
func invalidSizeAndOriginCases() []abortCase {
	badOrigins := []string{
		"",                           // empty
		"example.com",                // no scheme
		"https://example.com/images", // a path
		"https://example.com/",       // a trailing slash
		// The CORS middleware reads a * inside an origin as a pattern
		// that lets other sites read responses.
		"https://*",
		"https://*.example.com",
		"https://*example.com",
		"https://a.com,b.com",       // two hosts
		"https://example.com:",      // an empty port
		"https://:8443",             // no host
		"https://example.com:0",     // a port below 1
		"https://example.com:99999", // a port above 65535
		"https://exämple.com",       // a host name that is not ASCII
	}

	cases := make([]abortCase, 0, len(badOrigins))
	for _, origin := range badOrigins {
		cases = append(cases, abortCase{
			name: "access_control_allow_origin " + origin,
			yaml: signingKeyLine +
				"access_control_allow_origin: \"" + origin + "\"\n",
			wantErrSubstrings: []string{keyAccessControlAllowOrigin, origin},
		})
	}

	return append(cases, []abortCase{
		{
			name:              "access_control_allow_origin null",
			yaml:              signingKeyLine + "access_control_allow_origin: null\n",
			wantErrSubstrings: []string{keyAccessControlAllowOrigin, nullValueText},
		},
		{
			name:              "upstream_max_response_size with a unit",
			yaml:              signingKeyLine + "upstream_max_response_size: 50MB\n",
			wantErrSubstrings: []string{keyUpstreamMaxResponseSize, "50MB"},
		},
		{
			name:              "upstream_max_response_size fractional",
			yaml:              signingKeyLine + "upstream_max_response_size: 1.5\n",
			wantErrSubstrings: []string{keyUpstreamMaxResponseSize, "1.5"},
		},
		{
			name:              "upstream_max_response_size zero",
			yaml:              signingKeyLine + "upstream_max_response_size: 0\n",
			wantErrSubstrings: []string{keyUpstreamMaxResponseSize, "0"},
		},
		{
			name:              "upstream_max_response_size negative",
			yaml:              signingKeyLine + "upstream_max_response_size: -1\n",
			wantErrSubstrings: []string{keyUpstreamMaxResponseSize, "-1"},
		},
		{
			name:              "upstream_max_response_size null",
			yaml:              signingKeyLine + "upstream_max_response_size: null\n",
			wantErrSubstrings: []string{keyUpstreamMaxResponseSize, nullValueText},
		},
		{
			name:              "upstream_max_response_size above 1 GiB",
			yaml:              signingKeyLine + "upstream_max_response_size: 1073741825\n",
			wantErrSubstrings: []string{keyUpstreamMaxResponseSize, "1073741825"},
		},
		{
			name: "upstream_max_response_size largest 64-bit integer",
			yaml: signingKeyLine +
				"upstream_max_response_size: 9223372036854775807\n",
			wantErrSubstrings: []string{
				keyUpstreamMaxResponseSize, "9223372036854775807",
			},
		},
	}...)
}

// TestInvalidOriginTimeoutOrSizeAbortsStartup verifies the
// no-silent-fallback rule for the CORS origin, the two timeouts and the
// response size limit: a value that does not parse or is out of range
// aborts startup naming the key and the value.
func TestInvalidOriginTimeoutOrSizeAbortsStartup(t *testing.T) {
	t.Parallel()

	runAbortCases(t, append(invalidTimeoutCases(), invalidSizeAndOriginCases()...))
}