admin
f037be7a6a
gates / gates (push) Successful in 48s
R-970: /api/config, /api/config/hash, /api/config/apply removed (they read and replaced controller.yaml with every secret, reachable with the box's own hub API key, unsigned; nothing called them). The hub-key Bearer door on /api/selfupdate/ and /api/geo/ and the matching CSRF exemption are gone; the dashboard keeps using those with a session. The route table is buildMux, so a test drives the real one. Data tab: the export password field is autocomplete=new-password with a non-login name; the 2nd copy's status rows that repeated the form are gone (the no-target reason moves into the form). R-1103: app_fields.html loses its installed-only branches (no page serves them since R-1095); the tests that rendered that dead path are retired, their rules asserted on the settings tab (R-694 moved there). Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
43 lines
1.5 KiB
Go
43 lines
1.5 KiB
Go
package web
|
|
|
|
import (
|
|
"io"
|
|
"log"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-controller/internal/config"
|
|
"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
|
|
)
|
|
|
|
// R-970 (v0.322.0): the box's hub API key is no CSRF exemption any more — no route accepts it, so a POST that carries
|
|
// it and no session CSRF token is refused like any other.
|
|
// RED-PROOF (2026-10-16, REPORT): with the Bearer exemption put back in CsrfProtect, this failed at „passed CSRF".
|
|
func TestR970_HubKeyIsNoCSRFExemption(t *testing.T) {
|
|
cfg := config.Default()
|
|
cfg.Hub.APIKey = "TESTONLY-hub-key-csrf"
|
|
lg := log.New(io.Discard, "", 0)
|
|
sett, err := settings.Load(filepath.Join(t.TempDir(), "settings.json"), lg)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := sett.SetPasswordHash("$2a$10$abcdefghijklmnopqrstuuJ1A9pDq6s9F2x1H3bQb0v8Y3wq6z2Om"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
s := &Server{cfg: cfg, settings: sett, logger: lg}
|
|
if !s.authEnabled() {
|
|
t.Fatal("control: auth is not on, so CSRF would pass everything and this test would measure nothing")
|
|
}
|
|
reached := false
|
|
h := s.CsrfProtect(http.HandlerFunc(func(http.ResponseWriter, *http.Request) { reached = true }))
|
|
req := httptest.NewRequest(http.MethodPost, "/api/selfupdate/update", nil)
|
|
req.Header.Set("Authorization", "Bearer "+cfg.Hub.APIKey)
|
|
w := httptest.NewRecorder()
|
|
h.ServeHTTP(w, req)
|
|
if reached || w.Code/100 == 2 {
|
|
t.Fatalf("a POST carrying the hub key passed CSRF (code %d)", w.Code)
|
|
}
|
|
}
|