unkin-agent
9161558334
ci/woodpecker/tag/docker Pipeline was successful
Remote and virtual configuration writes are unauthenticated, so anything that can reach the API can repoint or delete repos. Vault identity OIDC tokens give callers a verifiable identity. - add `ARTIFACTAPI_OIDC_ISSUER`/`ARTIFACTAPI_OIDC_AUDIENCE`; unset issuer keeps auth off - require a JWKS-verified bearer token on POST/PUT/DELETE of `/api/v2/remotes` and `/api/v2/virtuals`, 401 otherwise - leave uploads, object deletes, probe, reads and `/v2` open - discover the issuer lazily with a 10s client timeout; fail fast with 503 for 15s after a failed discovery - log the verified `sub`; allow `Authorization` in CORS Reviewed-on: #136 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
84 lines
2.2 KiB
Go
84 lines
2.2 KiB
Go
package config
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
)
|
|
|
|
func TestLoadDefaults(t *testing.T) {
|
|
// Unset the vars Load reads so the fallback defaults are exercised.
|
|
for _, k := range []string{
|
|
"LISTEN_ADDR", "DBHOST", "DBPORT", "DBUSER", "DBPASS", "DBNAME", "DBSSL",
|
|
"REDIS_URL", "MINIO_ENDPOINT", "MINIO_ACCESS_KEY", "MINIO_SECRET_KEY",
|
|
"MINIO_BUCKET", "MINIO_SECURE", "MINIO_REGION",
|
|
} {
|
|
old, ok := os.LookupEnv(k)
|
|
os.Unsetenv(k)
|
|
if ok {
|
|
t.Cleanup(func() { os.Setenv(k, old) })
|
|
}
|
|
}
|
|
|
|
cfg, err := Load()
|
|
if err != nil {
|
|
t.Fatalf("load: %v", err)
|
|
}
|
|
if cfg.ListenAddr != ":8000" || cfg.DBPort != 5432 || cfg.DBUser != "artifacts" {
|
|
t.Errorf("unexpected defaults: %+v", cfg)
|
|
}
|
|
if cfg.RedisURL != "redis://localhost:6379" || cfg.S3Bucket != "artifacts" || cfg.S3Secure {
|
|
t.Errorf("unexpected defaults: %+v", cfg)
|
|
}
|
|
}
|
|
|
|
func TestLoadOverrides(t *testing.T) {
|
|
t.Setenv("LISTEN_ADDR", ":9999")
|
|
t.Setenv("DBHOST", "db.example.com")
|
|
t.Setenv("DBPORT", "6000")
|
|
t.Setenv("DBUSER", "u")
|
|
t.Setenv("DBPASS", "pw")
|
|
t.Setenv("DBNAME", "n")
|
|
t.Setenv("DBSSL", "require")
|
|
t.Setenv("MINIO_SECURE", "true")
|
|
t.Setenv("MINIO_REGION", "us-east-1")
|
|
|
|
cfg, err := Load()
|
|
if err != nil {
|
|
t.Fatalf("load: %v", err)
|
|
}
|
|
if cfg.ListenAddr != ":9999" || cfg.DBHost != "db.example.com" || cfg.DBPort != 6000 {
|
|
t.Errorf("overrides not applied: %+v", cfg)
|
|
}
|
|
if !cfg.S3Secure {
|
|
t.Error("MINIO_SECURE=true not parsed")
|
|
}
|
|
want := "postgres://u:pw@db.example.com:6000/n?sslmode=require"
|
|
if got := cfg.DatabaseDSN(); got != want {
|
|
t.Errorf("DSN = %q, want %q", got, want)
|
|
}
|
|
}
|
|
|
|
func TestLoadInvalidPort(t *testing.T) {
|
|
t.Setenv("DBPORT", "not-a-number")
|
|
if _, err := Load(); err == nil {
|
|
t.Error("expected error for invalid DBPORT")
|
|
}
|
|
}
|
|
|
|
func TestLoadOIDC(t *testing.T) {
|
|
t.Setenv("ARTIFACTAPI_OIDC_ISSUER", "https://vault.example/v1/identity/oidc")
|
|
t.Setenv("ARTIFACTAPI_OIDC_AUDIENCE", " a, ,b ")
|
|
cfg, err := Load()
|
|
if err != nil {
|
|
t.Fatalf("load: %v", err)
|
|
}
|
|
if len(cfg.OIDCAudiences) != 2 || cfg.OIDCAudiences[0] != "a" || cfg.OIDCAudiences[1] != "b" {
|
|
t.Errorf("audiences = %q", cfg.OIDCAudiences)
|
|
}
|
|
|
|
t.Setenv("ARTIFACTAPI_OIDC_AUDIENCE", "")
|
|
if _, err := Load(); err == nil {
|
|
t.Error("expected error for issuer without audience")
|
|
}
|
|
}
|