admin
f037be7a6a
gates / gates (push) Successful in 48s
R-970: /api/config, /api/config/hash, /api/config/apply removed (they read and replaced controller.yaml with every secret, reachable with the box's own hub API key, unsigned; nothing called them). The hub-key Bearer door on /api/selfupdate/ and /api/geo/ and the matching CSRF exemption are gone; the dashboard keeps using those with a session. The route table is buildMux, so a test drives the real one. Data tab: the export password field is autocomplete=new-password with a non-login name; the 2nd copy's status rows that repeated the form are gone (the no-target reason moves into the form). R-1103: app_fields.html loses its installed-only branches (no page serves them since R-1095); the tests that rendered that dead path are retired, their rules asserted on the settings tab (R-694 moved there). Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
42 lines
1.5 KiB
Go
42 lines
1.5 KiB
Go
package api
|
|
|
|
import (
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// R-970 (v0.322.0): the router has no /config routes at all — even a SIGNED-IN request gets the router's 404 for every
|
|
// method, and the settings file is neither served nor written.
|
|
// RED-PROOF (2026-10-16, REPORT): with the `/config` GET case put back, this failed at „GET /api/config answered 200".
|
|
func TestR970_ConfigRoutesAreGone(t *testing.T) {
|
|
dir := t.TempDir()
|
|
path := filepath.Join(dir, "controller.yaml")
|
|
planted := "customer:\n id: t\n domain: example.hu\nhub:\n api_key: TESTONLY-key-r970\n"
|
|
if err := os.WriteFile(path, []byte(planted), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r := &Router{configPath: path, logger: log.New(io.Discard, "", 0)}
|
|
r.restart = func() { t.Fatal("a /config request restarted the controller") }
|
|
for _, p := range []string{"/api/config", "/api/config/", "/api/config/apply", "/api/config/hash"} {
|
|
for _, m := range []string{http.MethodGet, http.MethodPost, http.MethodPut, http.MethodDelete, http.MethodPatch} {
|
|
w := httptest.NewRecorder()
|
|
r.ServeHTTP(w, httptest.NewRequest(m, p, strings.NewReader("customer:\n id: evil\n domain: e.example\n")))
|
|
if w.Code != http.StatusNotFound {
|
|
t.Errorf("%s %s answered %d, want the router's 404", m, p, w.Code)
|
|
}
|
|
if strings.Contains(w.Body.String(), "TESTONLY-key-r970") {
|
|
t.Fatalf("%s %s served the settings file", m, p)
|
|
}
|
|
}
|
|
}
|
|
if got, _ := os.ReadFile(path); string(got) != planted {
|
|
t.Fatal("the settings file was written")
|
|
}
|
|
}
|