yml2213
3ec7febb8c
- 废弃 DATA_ENCRYPTION_KEY 独立要求，敏感数据加密默认统一由 JWT_SECRET 派生 - 移除 cmd/reencrypt_secrets 离线全表重加密脚本与 docs/密钥轮换说明.md，避免生产原地 UPDATE 高危反模式 - 精简 Config.SecurityWarnings，不再刷屏 DATA_ENCRYPTION_KEY 未显式配置警告，保持启动日志干净 - 更新 .env.example、README.md 与项目分析文档说明 - 验证：make lint 与 make test 全量测试 100% 通过
61 lines
1.4 KiB
Go
61 lines
1.4 KiB
Go
package config
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// containsWarning 判断告警列表里是否存在包含指定片段的告警。
|
|
func containsWarning(warnings []string, fragment string) bool {
|
|
for _, w := range warnings {
|
|
if strings.Contains(w, fragment) {
|
|
return true
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
func TestSecurityWarnings(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
cfg Config
|
|
wantWarning string // 期望命中的告警片段；为空表示期望无任何告警
|
|
}{
|
|
{
|
|
name: "示例 JWT_SECRET 必须告警",
|
|
cfg: Config{JWTSecret: exampleJWTSecret, Mode: "debug"},
|
|
wantWarning: "JWT_SECRET",
|
|
},
|
|
{
|
|
name: "release 模式开启 OPEN_API_DEBUG 必须告警",
|
|
cfg: Config{JWTSecret: "a-real-jwt-secret", Mode: "release", OpenAPIDebug: true},
|
|
wantWarning: "OPEN_API_DEBUG",
|
|
},
|
|
{
|
|
name: "健康配置不应产生任何告警",
|
|
cfg: Config{
|
|
JWTSecret: "a-real-jwt-secret",
|
|
Mode: "release",
|
|
OpenAPIDebug: false,
|
|
},
|
|
wantWarning: "",
|
|
},
|
|
}
|
|
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
warnings := tc.cfg.SecurityWarnings()
|
|
|
|
if tc.wantWarning == "" {
|
|
if len(warnings) != 0 {
|
|
t.Fatalf("期望无告警，实际得到 %v", warnings)
|
|
}
|
|
return
|
|
}
|
|
if !containsWarning(warnings, tc.wantWarning) {
|
|
t.Fatalf("期望告警包含 %q，实际得到 %v", tc.wantWarning, warnings)
|
|
}
|
|
})
|
|
}
|
|
}
|