46 lines
3.0 KiB
TypeScript
Executable File
46 lines
3.0 KiB
TypeScript
Executable File
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { mkdtemp, writeFile, rm } from 'node:fs/promises';
|
|
import { join } from 'node:path';
|
|
import { tmpdir } from 'node:os';
|
|
import { postgresConfig } from '../server/market/postgres-config.ts';
|
|
|
|
test('PostgreSQL verified TLS remains the default and cannot be downgraded through URL options', async t => {
|
|
const dir = await mkdtemp(join(tmpdir(), 'wikideck-transport-'));
|
|
t.after(() => rm(dir, { recursive: true, force: true }));
|
|
const file = join(dir, 'connection');
|
|
// Synthetic configuration fixture, never sent to a database.
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody', { mode: 0o600 });
|
|
const env = { WIKIDECK_CUSTODY_PG_URL_FILE: file };
|
|
const config = await postgresConfig(env);
|
|
assert.equal((config.ssl as { rejectUnauthorized: boolean }).rejectUnauthorized, true);
|
|
assert.deepEqual(config.ssl, (await postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_TRANSPORT: 'tls' })).ssl);
|
|
for (const mode of ['', 'off', 'disable', 'false', 'mesh', 'TLS']) {
|
|
await assert.rejects(postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_TRANSPORT: mode }), /configuration/);
|
|
}
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody?sslmode=disable');
|
|
await assert.rejects(postgresConfig(env), /configuration/);
|
|
});
|
|
|
|
test('infrastructure-managed transport requires exact opt-in and rejects mixed TLS/test configuration', async t => {
|
|
const dir = await mkdtemp(join(tmpdir(), 'wikideck-infrastructure-'));
|
|
t.after(() => rm(dir, { recursive: true, force: true }));
|
|
const file = join(dir, 'connection');
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody', { mode: 0o600 });
|
|
const env = { WIKIDECK_CUSTODY_PG_URL_FILE: file, WIKIDECK_CUSTODY_PG_TRANSPORT: 'infrastructure' };
|
|
await assert.rejects(postgresConfig(env), /configuration/);
|
|
for (const ack of ['', 'true', 'firewall', 'encrypted-authenticated-path-enforced ']) {
|
|
await assert.rejects(postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_INFRASTRUCTURE_ACK: ack }), /configuration/);
|
|
}
|
|
const approved = { ...env, WIKIDECK_CUSTODY_PG_INFRASTRUCTURE_ACK: 'encrypted-authenticated-path-enforced' };
|
|
assert.equal((await postgresConfig(approved)).ssl, false);
|
|
for (const conflict of [{ WIKIDECK_CUSTODY_PG_CA_FILE: file }, { WIKIDECK_CUSTODY_PG_LOCAL_TEST: '1' }]) {
|
|
await assert.rejects(postgresConfig({ ...approved, ...conflict }), /configuration/);
|
|
}
|
|
await assert.rejects(postgresConfig({ ...approved, WIKIDECK_CUSTODY_PG_TRANSPORT: 'tls' }), /configuration/);
|
|
await writeFile(file, 'postgresql://fixture@database.cluster.example/custody');
|
|
await assert.rejects(postgresConfig(approved), /configuration/); // Password auth remains mandatory.
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody?sslmode=require');
|
|
await assert.rejects(postgresConfig(approved), /configuration/);
|
|
});
|