1package app
2
3import (
4 "context"
5 "testing"
6
7 "github.com/bnema/gordon/internal/domain"
8 "github.com/bnema/zerowrap"
9 "github.com/spf13/viper"
10 "github.com/stretchr/testify/assert"
11 "github.com/stretchr/testify/require"
12)
13
14func TestBuildAuthConfig_UsesConfigEnabledFlag(t *testing.T) {
15 t.Setenv(TokenSecretEnvVar, "test-token-secret-that-is-at-least-32-bytes-long")
16
17 cfg := Config{}
18 cfg.Auth.Enabled = false
19 cfg.Auth.Type = "token"
20
21 authCfg, err := buildAuthConfig(context.Background(), cfg, domain.AuthTypeToken, domain.SecretsBackendUnsafe, t.TempDir(), zerowrap.Default())
22 require.NoError(t, err)
23 assert.False(t, authCfg.Enabled, "expected auth config enabled=false")
24}
25
26func TestResolveSecretsBackend_RejectsMissingBackend(t *testing.T) {
27 _, err := resolveSecretsBackend("")
28 require.Error(t, err)
29 assert.Contains(t, err.Error(), "auth.secrets_backend is required")
30}
31
32func TestResolveSecretsBackend_RejectsUnknownBackend(t *testing.T) {
33 _, err := resolveSecretsBackend("vault")
34 require.Error(t, err)
35 assert.Contains(t, err.Error(), `unsupported auth.secrets_backend "vault"`)
36}
37
38func TestResolveAuthType_RejectsPassword(t *testing.T) {
39 cfg := Config{}
40 cfg.Auth.Type = "password"
41 _, err := resolveAuthType(cfg)
42 require.Error(t, err)
43 assert.Contains(t, err.Error(), "unsupported auth.type")
44}
45
46func TestResolveAuthType_AcceptsToken(t *testing.T) {
47 cfg := Config{}
48 cfg.Auth.Type = "token"
49 authType, err := resolveAuthType(cfg)
50 require.NoError(t, err)
51 assert.Equal(t, domain.AuthTypeToken, authType)
52}
53
54func TestResolveAuthType_AcceptsEmpty(t *testing.T) {
55 cfg := Config{}
56 authType, err := resolveAuthType(cfg)
57 require.NoError(t, err)
58 assert.Equal(t, domain.AuthTypeToken, authType)
59}
60
61func TestLoadConfig_DoesNotDefaultSecretsBackendToUnsafe(t *testing.T) {
62 v := viper.New()
63
64 err := loadConfig(v, "")
65 require.NoError(t, err)
66 assert.Empty(t, v.GetString("auth.secrets_backend"), "expected empty default for auth.secrets_backend")
67}