Fail-fast secrets in stage/prod via EVENTHUB_ENV. Refs EventHub/EventHubBack#25

2026-07-07 19:52:04 +03:00
parent 018bf85b87
commit cf8e6bcc07
10 changed files with 855 additions and 583 deletions
@@ -0,0 +1,62 @@
+-module(infra_secrets_tests).
+-include_lib("eunit/include/eunit.hrl").
+
+-define(STRONG_JWT, <<"this-is-a-strong-user-jwt-secret-32b">>).
+-define(STRONG_ADMIN, <<"this-is-a-strong-admin-jwt-secret32">>).
+
+setup() ->
+  application:load(eventhub),
+  ok.
+
+cleanup(_) ->
+  application:unset_env(eventhub, jwt_secret),
+  application:unset_env(eventhub, admin_jwt_secret),
+  os:unsetenv("EVENTHUB_ENV"),
+  os:unsetenv("JWT_SECRET"),
+  os:unsetenv("ADMIN_JWT_SECRET"),
+  ok.
+
+with_env(Key, Val, Fun) ->
+  os:putenv(Key, Val),
+  try Fun() after os:unsetenv(Key) end.
+
+infra_secrets_test_() ->
+  {foreach, fun setup/0, fun cleanup/1, [
+    {"dev mode allows missing secrets", fun test_dev_missing_ok/0},
+    {"stage rejects missing JWT_SECRET", fun test_stage_missing_jwt/0},
+    {"stage rejects weak JWT_SECRET", fun test_stage_weak_jwt/0},
+    {"stage accepts strong secrets", fun test_stage_strong_ok/0},
+    {"require_admin_seed_password rejects 123456", fun test_weak_admin_password/0}
+  ]}.
+
+test_dev_missing_ok() ->
+  with_env("EVENTHUB_ENV", "dev", fun() ->
+    ?assertEqual(dev, infra_secrets:mode()),
+    ?assertEqual(ok, infra_secrets:validate_startup())
+  end).
+
+test_stage_missing_jwt() ->
+  with_env("EVENTHUB_ENV", "stage", fun() ->
+    ?assertMatch({error, {missing_secret, jwt_secret}},
+      infra_secrets:validate_startup())
+  end).
+
+test_stage_weak_jwt() ->
+  with_env("EVENTHUB_ENV", "stage", fun() ->
+    os:putenv("JWT_SECRET", "123456"),
+    os:putenv("ADMIN_JWT_SECRET", binary_to_list(?STRONG_ADMIN)),
+    ?assertMatch({error, {weak_secret, jwt_secret}},
+      infra_secrets:validate_startup())
+  end).
+
+test_stage_strong_ok() ->
+  with_env("EVENTHUB_ENV", "stage", fun() ->
+    os:putenv("JWT_SECRET", binary_to_list(?STRONG_JWT)),
+    os:putenv("ADMIN_JWT_SECRET", binary_to_list(?STRONG_ADMIN)),
+    ?assertEqual(ok, infra_secrets:validate_startup())
+  end).
+
+test_weak_admin_password() ->
+  os:putenv("ADMIN_PASSWORD", "123456"),
+  ?assertMatch({error, {weak_secret, 'ADMIN_PASSWORD'}},
+    infra_secrets:require_admin_seed_password("ADMIN_PASSWORD")).