faktory/cli/security_test.go at f74d7c6f5b0c4e5981e58c97d707b8c340f6b8c0 · contribsys/faktory · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
package cli

import (
	"os"
	"testing"

	"github.com/stretchr/testify/assert"
)

func pwdCfg(value string) map[string]any {
	return map[string]any{
		"faktory": map[string]any{
			"password": value,
		},
	}
}
func webPwdCfg(value string) map[string]any {
	return map[string]any{
		"web": map[string]any{
			"password": value,
		},
	}
}

func TestPasswords(t *testing.T) {
	emptyCfg := map[string]any{}
	// nolint:gosec
	pwd := "cce29d6565ab7376"

	t.Run("DevWithPassword", func(t *testing.T) {
		cfg := pwdCfg(pwd)
		pwd, err := fetchPassword(cfg, "development", passwordTypeServer)
		assert.NoError(t, err)
		assert.Equal(t, 16, len(pwd))
		assert.Equal(t, "cce29d6565ab7376", pwd)
		assert.Equal(t, "********", cfg["faktory"].(map[string]any)["password"])
	})

	t.Run("DevWithWebPassword", func(t *testing.T) {
		cfg := webPwdCfg(pwd)
		pwd, err := fetchPassword(cfg, "development", passwordTypeWebUI)
		assert.NoError(t, err)
		assert.Equal(t, 16, len(pwd))
		assert.Equal(t, "cce29d6565ab7376", pwd)
		assert.Equal(t, "********", cfg["web"].(map[string]any)["password"])
	})

	t.Run("DevWithoutPassword", func(t *testing.T) {
		pwd, err := fetchPassword(emptyCfg, "development", passwordTypeServer)
		assert.NoError(t, err)
		assert.Equal(t, "", pwd)
	})

	t.Run("ProductionWithoutPassword", func(t *testing.T) {
		pwd, err := fetchPassword(emptyCfg, "production", passwordTypeServer)
		assert.Error(t, err)
		assert.Equal(t, "", pwd)
	})

	t.Run("ProductionWithFile", func(t *testing.T) {
		// nolint:gosec
		err := os.WriteFile("/tmp/test-password", []byte("foobar"), os.FileMode(0o666))
		assert.NoError(t, err)
		cfg := pwdCfg("/tmp/test-password")
		pwd, err := fetchPassword(cfg, "production", passwordTypeServer)
		assert.NoError(t, err)
		assert.Equal(t, "foobar", pwd)
	})

	t.Run("ProductionWithPassword", func(t *testing.T) {
		cfg := pwdCfg(pwd)
		pwd, err := fetchPassword(cfg, "production", passwordTypeServer)
		assert.NoError(t, err)
		assert.Equal(t, 16, len(pwd))
		assert.Equal(t, "cce29d6565ab7376", pwd)
		assert.Equal(t, "********", cfg["faktory"].(map[string]any)["password"])
	})

	t.Run("ProductionEnvPassword", func(t *testing.T) {
		os.Setenv("FAKTORY_PASSWORD", "abc123")

		pwd, err := fetchPassword(emptyCfg, "production", passwordTypeServer)
		assert.NoError(t, err)
		assert.Equal(t, "abc123", pwd)
	})

	os.Unsetenv("FAKTORY_PASSWORD")

	t.Run("ProductionEnvPassword", func(t *testing.T) {
		os.Setenv("FAKTORY_WEBUI_PASSWORD", "webuipass")

		pwd, err := fetchPassword(emptyCfg, "production", passwordTypeWebUI)
		assert.NoError(t, err)
		assert.Equal(t, "webuipass", pwd)
	})

	os.Unsetenv("FAKTORY_WEBUI_PASSWORD")

	t.Run("ProductionSkipPassword", func(t *testing.T) {
		os.Setenv("FAKTORY_SKIP_PASSWORD", "yes")

		pwd, err := fetchPassword(emptyCfg, "production", passwordTypeServer)
		assert.NoError(t, err)
		assert.Equal(t, "", pwd)
	})

	os.Unsetenv("FAKTORY_SKIP_PASSWORD")

}