Fail-fast secrets in stage/prod via EVENTHUB_ENV. Refs EventHub/EventHubBack#25
This commit is contained in:
+20
-3
@@ -1,4 +1,21 @@
|
||||
# .env.example — закоммитьте этот файл, а реальный .env держите в .gitignore
|
||||
RELEASE_COOKIE=ваш-очень-длинный-секретный-куки
|
||||
# Скопируйте в .env (файл .env в .gitignore). Для локальной разработки: EVENTHUB_ENV=dev
|
||||
|
||||
# Режим: dev | stage | prod (stage/prod — обязательные сильные секреты)
|
||||
EVENTHUB_ENV=dev
|
||||
|
||||
RELEASE_COOKIE=ваш-очень-длинный-секретный-куки-минимум-32-символа
|
||||
GRAFANA_ADMIN_PASSWORD=сложный-уникальный-пароль
|
||||
JWT_SECRET=суперсекрет
|
||||
|
||||
# JWT (минимум 32 символа, не из denylist — см. infra_secrets)
|
||||
JWT_SECRET=замените-на-случайную-строку-минимум-32-символа-для-user-jwt
|
||||
ADMIN_JWT_SECRET=замените-на-другую-случайную-строку-минимум-32-символа
|
||||
|
||||
# Seed админов (обязательны в stage/prod при пустой таблице admin; в dev — опционально)
|
||||
ADMIN_SUPER_EMAIL=superadmin@eventhub.local
|
||||
ADMIN_SUPER_PASSWORD=замените-сильный-пароль-суперадмина
|
||||
ADMIN_EMAIL=admin@eventhub.local
|
||||
ADMIN_PASSWORD=замените-сильный-пароль-админа
|
||||
ADMIN_MODER_EMAIL=moderator@eventhub.local
|
||||
ADMIN_MODER_PASSWORD=замените-сильный-пароль-модератора
|
||||
ADMIN_SUPPORT_EMAIL=support@eventhub.local
|
||||
ADMIN_SUPPORT_PASSWORD=замените-сильный-пароль-поддержки
|
||||
|
||||
+7
-5
@@ -1,12 +1,14 @@
|
||||
EVENTHUB_ENV=stage
|
||||
RELEASE_COOKIE=FuNHSU3SIiW8ICu2XIbl0pvpxAhpBvO2Wki7CT6q2bpHDSlQ8p7gtUgjnyXpPJU5
|
||||
GRAFANA_ADMIN_PASSWORD=admin
|
||||
GRAFANA_ADMIN_PASSWORD=замените-сильный-пароль-grafana
|
||||
JWT_SECRET=IDhKNFRLZFDYgPvVXwg4T7hAviQ2I1VGeEn5vXufQXK3AAErZuhMWy8J1uxJ0kGF
|
||||
ADMIN_JWT_SECRET=K3AAErZuhMWy8J1uxJ0kGFIDhKNFRLZFDYgPvVXwg4T7hAviQ2I1VGeEn5vXufQ
|
||||
TRAEFIK_LOG_PATH=/app/traefik/logs/access.log
|
||||
ADMIN_SUPER_EMAIL=superadmin@eventhub.local
|
||||
ADMIN_SUPER_PASSWORD=123456
|
||||
ADMIN_SUPER_PASSWORD=замените-сильный-пароль-суперадмина-мин32
|
||||
ADMIN_EMAIL=admin@eventhub.local
|
||||
ADMIN_PASSWORD=123456
|
||||
ADMIN_PASSWORD=замените-сильный-пароль-админа-минимум32
|
||||
ADMIN_MODER_EMAIL=moderator@eventhub.local
|
||||
ADMIN_MODER_PASSWORD=123456
|
||||
ADMIN_MODER_PASSWORD=замените-сильный-пароль-модератора-мин32
|
||||
ADMIN_SUPPORT_EMAIL=support@eventhub.local
|
||||
ADMIN_SUPPORT_PASSWORD=123456
|
||||
ADMIN_SUPPORT_PASSWORD=замените-сильный-пароль-поддержки-мин32
|
||||
|
||||
@@ -26,13 +26,19 @@ services:
|
||||
image: git.sabilin.com/eventhub/eventhub:stage
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- EVENTHUB_ENV=stage
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
|
||||
@@ -55,15 +55,19 @@ services:
|
||||
image: eventhub:latest
|
||||
hostname: "eventhub-node{{.Task.Slot}}"
|
||||
environment:
|
||||
- EVENTHUB_ENV=prod
|
||||
- NODE_NAME=eventhub-node{{.Task.Slot}}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE:-eventhub_cookie}
|
||||
- JWT_SECRET=${JWT_SECRET:-eventhub_top_secret}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL:-superadmin@eventhub.local}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD:-123456}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL:-moderator@eventhub.local}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD:-123456}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL:-support@eventhub.local}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD:-123456}
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
- ADMIN_SUPER_EMAIL=${ADMIN_SUPER_EMAIL}
|
||||
- ADMIN_SUPER_PASSWORD=${ADMIN_SUPER_PASSWORD}
|
||||
- ADMIN_EMAIL=${ADMIN_EMAIL}
|
||||
- ADMIN_PASSWORD=${ADMIN_PASSWORD}
|
||||
- ADMIN_MODER_EMAIL=${ADMIN_MODER_EMAIL}
|
||||
- ADMIN_MODER_PASSWORD=${ADMIN_MODER_PASSWORD}
|
||||
- ADMIN_SUPPORT_EMAIL=${ADMIN_SUPPORT_EMAIL}
|
||||
- ADMIN_SUPPORT_PASSWORD=${ADMIN_SUPPORT_PASSWORD}
|
||||
- CLUSTER_MODE=true
|
||||
- DNS_NAME=eventhub-node
|
||||
networks:
|
||||
|
||||
@@ -54,9 +54,11 @@ services:
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node1.local
|
||||
environment:
|
||||
- EVENTHUB_ENV=dev
|
||||
- NODE_NAME=eventhub-node1@eventhub-node1.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
@@ -73,9 +75,11 @@ services:
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node2.local
|
||||
environment:
|
||||
- EVENTHUB_ENV=dev
|
||||
- NODE_NAME=eventhub-node2@eventhub-node2.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
@@ -92,9 +96,11 @@ services:
|
||||
dockerfile: docker/Dockerfile
|
||||
hostname: eventhub-node3.local
|
||||
environment:
|
||||
- EVENTHUB_ENV=dev
|
||||
- NODE_NAME=eventhub-node3@eventhub-node3.local
|
||||
- RELEASE_COOKIE=${RELEASE_COOKIE}
|
||||
- JWT_SECRET=${JWT_SECRET}
|
||||
- ADMIN_JWT_SECRET=${ADMIN_JWT_SECRET}
|
||||
networks:
|
||||
eventhub-net:
|
||||
aliases:
|
||||
|
||||
@@ -4,7 +4,8 @@
|
||||
{ws_port, "${WS_PORT:-8081}"},
|
||||
{admin_http_port, "${ADMIN_HTTP_PORT:-8445}"},
|
||||
{admin_ws_port, "${ADMIN_WS_PORT:-8446}"},
|
||||
{jwt_secret, <<"${JWT_SECRET:-change_me_in_production}">>}
|
||||
{jwt_secret, <<"${JWT_SECRET:-change_me_in_production}">>},
|
||||
{admin_jwt_secret, <<"${ADMIN_JWT_SECRET:-change_me_in_production}">>}
|
||||
]},
|
||||
{kernel, [
|
||||
{logger_level, info},
|
||||
|
||||
+55
-26
@@ -3,6 +3,15 @@
|
||||
-export([start/2, stop/1]).
|
||||
|
||||
start(_StartType, _StartArgs) ->
|
||||
case infra_secrets:validate_startup() of
|
||||
ok ->
|
||||
start_application();
|
||||
{error, Reason} ->
|
||||
io:format("~nFATAL: secret validation failed: ~p~n", [Reason]),
|
||||
{error, Reason}
|
||||
end.
|
||||
|
||||
start_application() ->
|
||||
case infra_sup:start_link() of
|
||||
{ok, Pid} ->
|
||||
% Определяем список узлов кластера, если режим CLUSTER_MODE=true
|
||||
@@ -48,8 +57,10 @@ start(_StartType, _StartArgs) ->
|
||||
start_swagger_http(), % Swagger UI и спецификация (8447)
|
||||
application:ensure_all_started(prometheus),
|
||||
application:ensure_all_started(prometheus_cowboy),
|
||||
init_default_admins(),
|
||||
{ok, Pid};
|
||||
case init_default_admins() of
|
||||
ok -> {ok, Pid};
|
||||
{error, Reason} -> {error, Reason}
|
||||
end;
|
||||
Error ->
|
||||
Error
|
||||
end.
|
||||
@@ -199,31 +210,49 @@ start_swagger_http() ->
|
||||
init_default_admins() ->
|
||||
case core_admin:list_all() of
|
||||
[] ->
|
||||
% Суперадмин
|
||||
SuperEmail = list_to_binary(os:getenv("ADMIN_SUPER_EMAIL", "superadmin@eventhub.local")),
|
||||
SuperPass = list_to_binary(os:getenv("ADMIN_SUPER_PASSWORD", "123456")),
|
||||
{ok, _} = core_admin:create(SuperEmail, SuperPass, superadmin),
|
||||
io:format("Default superadmin created: ~s~n", [SuperEmail]),
|
||||
|
||||
% Админ
|
||||
AdminEmail = list_to_binary(os:getenv("ADMIN_EMAIL", "admin@eventhub.local")),
|
||||
AdminPass = list_to_binary(os:getenv("ADMIN_PASSWORD", "123456")),
|
||||
{ok, _} = core_admin:create(AdminEmail, AdminPass, admin),
|
||||
io:format("Default admin created: ~s~n", [AdminEmail]),
|
||||
|
||||
% Модератор
|
||||
ModerEmail = list_to_binary(os:getenv("ADMIN_MODER_EMAIL", "moderator@eventhub.local")),
|
||||
ModerPass = list_to_binary(os:getenv("ADMIN_MODER_PASSWORD", "123456")),
|
||||
{ok, _} = core_admin:create(ModerEmail, ModerPass, moderator),
|
||||
io:format("Default moderator created: ~s~n", [ModerEmail]),
|
||||
|
||||
% Поддержка
|
||||
SupportEmail = list_to_binary(os:getenv("ADMIN_SUPPORT_EMAIL", "support@eventhub.local")),
|
||||
SupportPass = list_to_binary(os:getenv("ADMIN_SUPPORT_PASSWORD", "123456")),
|
||||
{ok, _} = core_admin:create(SupportEmail, SupportPass, support),
|
||||
io:format("Default support created: ~s~n", [SupportEmail]);
|
||||
seed_default_admins();
|
||||
_ ->
|
||||
io:format("Admins already exist. Skipping creation.~n")
|
||||
io:format("Admins already exist. Skipping creation.~n"),
|
||||
ok
|
||||
end.
|
||||
|
||||
seed_default_admins() ->
|
||||
Admins = [
|
||||
{superadmin, "ADMIN_SUPER_EMAIL", "superadmin@eventhub.local",
|
||||
"ADMIN_SUPER_PASSWORD", "123456"},
|
||||
{admin, "ADMIN_EMAIL", "admin@eventhub.local",
|
||||
"ADMIN_PASSWORD", "123456"},
|
||||
{moderator, "ADMIN_MODER_EMAIL", "moderator@eventhub.local",
|
||||
"ADMIN_MODER_PASSWORD", "123456"},
|
||||
{support, "ADMIN_SUPPORT_EMAIL", "support@eventhub.local",
|
||||
"ADMIN_SUPPORT_PASSWORD", "123456"}
|
||||
],
|
||||
lists:foldl(fun seed_admin/2, ok, Admins).
|
||||
|
||||
seed_admin({Role, EmailKey, DefaultEmail, PassKey, DefaultPass}, ok) ->
|
||||
case admin_credentials(EmailKey, DefaultEmail, PassKey, DefaultPass) of
|
||||
{error, _} = Err -> Err;
|
||||
{ok, {Email, Pass}} ->
|
||||
{ok, _} = core_admin:create(Email, Pass, Role),
|
||||
io:format("Default ~p created: ~s~n", [Role, Email]),
|
||||
ok
|
||||
end;
|
||||
seed_admin(_, Err) -> Err.
|
||||
|
||||
admin_credentials(EmailKey, DefaultEmail, PassKey, DefaultPass) ->
|
||||
case infra_secrets:is_dev() of
|
||||
true ->
|
||||
{ok, {list_to_binary(os:getenv(EmailKey, DefaultEmail)),
|
||||
list_to_binary(os:getenv(PassKey, DefaultPass))}};
|
||||
false ->
|
||||
case infra_secrets:require_admin_seed_email(EmailKey) of
|
||||
{error, _} = Err -> Err;
|
||||
{ok, Email} ->
|
||||
case infra_secrets:require_admin_seed_password(PassKey) of
|
||||
{error, _} = Err -> Err;
|
||||
{ok, Pass} -> {ok, {Email, Pass}}
|
||||
end
|
||||
end
|
||||
end.
|
||||
|
||||
get_env_int(Key, Default) ->
|
||||
|
||||
@@ -24,7 +24,11 @@ get_user_secret() ->
|
||||
|
||||
get_user_secret_from_env() ->
|
||||
case os:getenv("JWT_SECRET") of
|
||||
false -> <<"user-secret-key-32-bytes-minimum!">>;
|
||||
false ->
|
||||
case infra_secrets:is_dev() of
|
||||
true -> <<"user-secret-key-32-bytes-minimum!">>;
|
||||
false -> error({missing_secret, jwt_secret})
|
||||
end;
|
||||
S -> list_to_binary(S)
|
||||
end.
|
||||
|
||||
@@ -37,7 +41,11 @@ get_admin_secret() ->
|
||||
|
||||
get_admin_secret_from_env() ->
|
||||
case os:getenv("ADMIN_JWT_SECRET") of
|
||||
false -> <<"admin-secret-key-32-bytes-minimum!">>;
|
||||
false ->
|
||||
case infra_secrets:is_dev() of
|
||||
true -> <<"admin-secret-key-32-bytes-minimum!">>;
|
||||
false -> error({missing_secret, admin_jwt_secret})
|
||||
end;
|
||||
S -> list_to_binary(S)
|
||||
end.
|
||||
|
||||
|
||||
@@ -0,0 +1,137 @@
|
||||
%%%-------------------------------------------------------------------
|
||||
%%% @doc Валидация секретов и паролей при старте (EVENTHUB_ENV).
|
||||
%%% dev — допускаются documented fallbacks; stage/prod — fail-fast.
|
||||
%%% @end
|
||||
%%%-------------------------------------------------------------------
|
||||
-module(infra_secrets).
|
||||
-export([mode/0, is_dev/0, validate_startup/0,
|
||||
require_admin_seed_password/1, require_admin_seed_email/1]).
|
||||
|
||||
-define(MIN_SECRET_LEN, 32).
|
||||
|
||||
%%%-------------------------------------------------------------------
|
||||
%%% API
|
||||
%%%-------------------------------------------------------------------
|
||||
|
||||
-spec mode() -> dev | stage | prod.
|
||||
mode() ->
|
||||
case os:getenv("EVENTHUB_ENV") of
|
||||
false -> dev;
|
||||
Env ->
|
||||
case string:lowercase(Env) of
|
||||
"dev" -> dev;
|
||||
"stage" -> stage;
|
||||
"prod" -> prod;
|
||||
"production" -> prod;
|
||||
_ -> stage
|
||||
end
|
||||
end.
|
||||
|
||||
-spec is_dev() -> boolean().
|
||||
is_dev() -> mode() =:= dev.
|
||||
|
||||
%% @doc Проверка JWT-секретов до поднятия Mnesia/HTTP.
|
||||
-spec validate_startup() -> ok | {error, {missing_secret, atom()} | {weak_secret, atom()}}.
|
||||
validate_startup() ->
|
||||
case mode() of
|
||||
dev ->
|
||||
dev_warn_if_weak(jwt_secret, effective_jwt_secret()),
|
||||
dev_warn_if_weak(admin_jwt_secret, effective_admin_jwt_secret()),
|
||||
ok;
|
||||
_ ->
|
||||
case require_strong_secret(jwt_secret, effective_jwt_secret()) of
|
||||
ok -> require_strong_secret(admin_jwt_secret, effective_admin_jwt_secret());
|
||||
Err -> Err
|
||||
end
|
||||
end.
|
||||
|
||||
-spec require_admin_seed_email(string()) ->
|
||||
{ok, binary()} | {error, {missing_secret, atom()}}.
|
||||
require_admin_seed_email(EnvKey) ->
|
||||
case os:getenv(EnvKey) of
|
||||
false -> {error, {missing_secret, list_to_atom(EnvKey)}};
|
||||
"" -> {error, {missing_secret, list_to_atom(EnvKey)}};
|
||||
Email -> {ok, list_to_binary(Email)}
|
||||
end.
|
||||
|
||||
-spec require_admin_seed_password(string()) ->
|
||||
{ok, binary()} | {error, {missing_secret, atom()} | {weak_secret, atom()}}.
|
||||
require_admin_seed_password(EnvKey) ->
|
||||
case os:getenv(EnvKey) of
|
||||
false -> {error, {missing_secret, list_to_atom(EnvKey)}};
|
||||
"" -> {error, {missing_secret, list_to_atom(EnvKey)}};
|
||||
Pass ->
|
||||
Bin = list_to_binary(Pass),
|
||||
case is_strong_secret(Bin) of
|
||||
true -> {ok, Bin};
|
||||
false -> {error, {weak_secret, list_to_atom(EnvKey)}}
|
||||
end
|
||||
end.
|
||||
|
||||
%%%-------------------------------------------------------------------
|
||||
%%% Effective values (порядок как в eventhub_auth)
|
||||
%%%-------------------------------------------------------------------
|
||||
|
||||
effective_jwt_secret() ->
|
||||
effective_secret(jwt_secret, "JWT_SECRET").
|
||||
|
||||
effective_admin_jwt_secret() ->
|
||||
effective_secret(admin_jwt_secret, "ADMIN_JWT_SECRET").
|
||||
|
||||
effective_secret(AppKey, OsKey) ->
|
||||
case application:get_env(eventhub, AppKey) of
|
||||
{ok, Secret} when is_binary(Secret), byte_size(Secret) > 0 ->
|
||||
case is_placeholder(Secret) of
|
||||
true -> os_getenv_binary(OsKey);
|
||||
false -> Secret
|
||||
end;
|
||||
_ ->
|
||||
os_getenv_binary(OsKey)
|
||||
end.
|
||||
|
||||
%%%-------------------------------------------------------------------
|
||||
%%% Internal
|
||||
%%%-------------------------------------------------------------------
|
||||
|
||||
require_strong_secret(Name, undefined) ->
|
||||
{error, {missing_secret, Name}};
|
||||
require_strong_secret(Name, Secret) ->
|
||||
case is_strong_secret(Secret) of
|
||||
true -> ok;
|
||||
false -> {error, {weak_secret, Name}}
|
||||
end.
|
||||
|
||||
is_strong_secret(Secret) when is_binary(Secret) ->
|
||||
byte_size(Secret) >= ?MIN_SECRET_LEN andalso not lists:member(Secret, denylist()).
|
||||
|
||||
is_placeholder(Secret) ->
|
||||
lists:member(Secret, [
|
||||
<<"change_me_in_production">>,
|
||||
<<"${JWT_SECRET:-change_me_in_production}">>,
|
||||
<<"${ADMIN_JWT_SECRET:-change_me_in_production}">>
|
||||
]).
|
||||
|
||||
denylist() -> [
|
||||
<<"123456">>,
|
||||
<<"change_me_in_production">>,
|
||||
<<"eventhub_top_secret">>,
|
||||
<<"user-secret-key-32-bytes-minimum!">>,
|
||||
<<"admin-secret-key-32-bytes-minimum!">>,
|
||||
<<"botpass123">>
|
||||
].
|
||||
|
||||
os_getenv_binary(Key) ->
|
||||
case os:getenv(Key) of
|
||||
false -> undefined;
|
||||
"" -> undefined;
|
||||
Val -> list_to_binary(Val)
|
||||
end.
|
||||
|
||||
dev_warn_if_weak(_Name, undefined) -> ok;
|
||||
dev_warn_if_weak(Name, Secret) ->
|
||||
case is_strong_secret(Secret) of
|
||||
true -> ok;
|
||||
false ->
|
||||
io:format("~n[infra_secrets] WARNING: ~p is weak or missing in dev mode; "
|
||||
"runtime fallbacks may apply.~n", [Name])
|
||||
end.
|
||||
@@ -0,0 +1,62 @@
|
||||
-module(infra_secrets_tests).
|
||||
-include_lib("eunit/include/eunit.hrl").
|
||||
|
||||
-define(STRONG_JWT, <<"this-is-a-strong-user-jwt-secret-32b">>).
|
||||
-define(STRONG_ADMIN, <<"this-is-a-strong-admin-jwt-secret32">>).
|
||||
|
||||
setup() ->
|
||||
application:load(eventhub),
|
||||
ok.
|
||||
|
||||
cleanup(_) ->
|
||||
application:unset_env(eventhub, jwt_secret),
|
||||
application:unset_env(eventhub, admin_jwt_secret),
|
||||
os:unsetenv("EVENTHUB_ENV"),
|
||||
os:unsetenv("JWT_SECRET"),
|
||||
os:unsetenv("ADMIN_JWT_SECRET"),
|
||||
ok.
|
||||
|
||||
with_env(Key, Val, Fun) ->
|
||||
os:putenv(Key, Val),
|
||||
try Fun() after os:unsetenv(Key) end.
|
||||
|
||||
infra_secrets_test_() ->
|
||||
{foreach, fun setup/0, fun cleanup/1, [
|
||||
{"dev mode allows missing secrets", fun test_dev_missing_ok/0},
|
||||
{"stage rejects missing JWT_SECRET", fun test_stage_missing_jwt/0},
|
||||
{"stage rejects weak JWT_SECRET", fun test_stage_weak_jwt/0},
|
||||
{"stage accepts strong secrets", fun test_stage_strong_ok/0},
|
||||
{"require_admin_seed_password rejects 123456", fun test_weak_admin_password/0}
|
||||
]}.
|
||||
|
||||
test_dev_missing_ok() ->
|
||||
with_env("EVENTHUB_ENV", "dev", fun() ->
|
||||
?assertEqual(dev, infra_secrets:mode()),
|
||||
?assertEqual(ok, infra_secrets:validate_startup())
|
||||
end).
|
||||
|
||||
test_stage_missing_jwt() ->
|
||||
with_env("EVENTHUB_ENV", "stage", fun() ->
|
||||
?assertMatch({error, {missing_secret, jwt_secret}},
|
||||
infra_secrets:validate_startup())
|
||||
end).
|
||||
|
||||
test_stage_weak_jwt() ->
|
||||
with_env("EVENTHUB_ENV", "stage", fun() ->
|
||||
os:putenv("JWT_SECRET", "123456"),
|
||||
os:putenv("ADMIN_JWT_SECRET", binary_to_list(?STRONG_ADMIN)),
|
||||
?assertMatch({error, {weak_secret, jwt_secret}},
|
||||
infra_secrets:validate_startup())
|
||||
end).
|
||||
|
||||
test_stage_strong_ok() ->
|
||||
with_env("EVENTHUB_ENV", "stage", fun() ->
|
||||
os:putenv("JWT_SECRET", binary_to_list(?STRONG_JWT)),
|
||||
os:putenv("ADMIN_JWT_SECRET", binary_to_list(?STRONG_ADMIN)),
|
||||
?assertEqual(ok, infra_secrets:validate_startup())
|
||||
end).
|
||||
|
||||
test_weak_admin_password() ->
|
||||
os:putenv("ADMIN_PASSWORD", "123456"),
|
||||
?assertMatch({error, {weak_secret, 'ADMIN_PASSWORD'}},
|
||||
infra_secrets:require_admin_seed_password("ADMIN_PASSWORD")).
|
||||
Reference in New Issue
Block a user