admin
5277d859d5
gates / gates (push) Successful in 12m26s
The Cloudflare tunnel token, Cloudflare API token and git token inside customer_configs.config_json now hold the 05 §16.2 seal (enc:v1:, OFFSITE_SECRET_KEY). Old rows sealed once at start-up without a config_version bump, then VACUUM + WAL checkpoint (an UPDATE leaves the old plaintext in a freed block). -unseal-box-secrets opens them too. Eight tests, each red-proved. Built, not deployed. Audit: documentation/audits/hub-token-seal-2026-10-23/.
37 lines
1.2 KiB
Go
37 lines
1.2 KiB
Go
package configgen
|
|
|
|
import (
|
|
"io"
|
|
"log"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-hub/internal/store"
|
|
)
|
|
|
|
// R-975: the tokens are sealed in the database, and the box still receives the REAL tunnel token in its
|
|
// generated controller.yaml (the consequence — a sealed string there would be a dead tunnel).
|
|
func TestR975_GeneratedConfigCarriesThePlainTunnelToken(t *testing.T) {
|
|
st, err := store.New(filepath.Join(t.TempDir(), "t.db"), log.New(io.Discard, "", 0))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() { st.Close() })
|
|
js := `{"infrastructure":{"cf_tunnel_token":"tunnel-canary-r975","cf_api_token":"cfapi-canary-r975"}}`
|
|
if err := st.SaveCustomerConfig(&store.CustomerConfig{CustomerID: "c1", RetrievalPassword: "p", APIKey: "k1", ConfigJSON: js}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
cfg, err := st.GetCustomerConfig("c1")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out, err := Generate("hub: {}\n", cfg, nil)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.Contains(out, "cf_tunnel_token: tunnel-canary-r975") || strings.Contains(out, "enc:v1:") {
|
|
t.Fatalf("controller.yaml does not carry the plain tunnel token (or carries a sealed string):\n%s", out)
|
|
}
|
|
}
|