71 lines
4.7 KiB
TypeScript
Executable File
71 lines
4.7 KiB
TypeScript
Executable File
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { mkdtemp, writeFile, chmod, rm } from 'node:fs/promises';
|
|
import { join } from 'node:path';
|
|
import { tmpdir } from 'node:os';
|
|
import { execFileSync } from 'node:child_process';
|
|
import { postgresConfig } from '../server/market/postgres-config.ts';
|
|
|
|
test('PostgreSQL verified TLS remains the default and cannot be downgraded through URL options', async t => {
|
|
const dir = await mkdtemp(join(tmpdir(), 'wikideck-transport-'));
|
|
t.after(() => rm(dir, { recursive: true, force: true }));
|
|
const file = join(dir, 'connection');
|
|
// Synthetic configuration fixture, never sent to a database.
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody', { mode: 0o600 });
|
|
const env = { WIKIDECK_CUSTODY_PG_URL_FILE: file };
|
|
const config = await postgresConfig(env);
|
|
assert.equal((config.ssl as { rejectUnauthorized: boolean }).rejectUnauthorized, true);
|
|
assert.deepEqual(config.ssl, (await postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_TRANSPORT: 'tls' })).ssl);
|
|
for (const mode of ['', 'off', 'disable', 'false', 'mesh', 'TLS']) {
|
|
await assert.rejects(postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_TRANSPORT: mode }), /configuration/);
|
|
}
|
|
if (process.platform !== 'win32') {
|
|
await chmod(file, 0o644);
|
|
await assert.rejects(postgresConfig(env), /configuration/);
|
|
await chmod(file, 0o600);
|
|
}
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody?sslmode=disable');
|
|
await assert.rejects(postgresConfig(env), /configuration/);
|
|
});
|
|
|
|
test('PostgreSQL public CA is validated separately from owner-only credential URL files', async t => {
|
|
if (process.platform === 'win32') return;
|
|
const dir = await mkdtemp(join(tmpdir(), 'wikideck-ca-'));
|
|
t.after(() => rm(dir, { recursive: true, force: true }));
|
|
const urlFile = join(dir, 'connection'), caFile = join(dir, 'ca.crt'), keyFile = join(dir, 'ca.key');
|
|
await writeFile(urlFile, 'postgresql://fixture:fixture-only@database/custody', { mode: 0o600 });
|
|
execFileSync('openssl', ['req', '-x509', '-newkey', 'rsa:2048', '-sha256', '-nodes', '-days', '2',
|
|
'-subj', '/CN=fixture CA', '-keyout', keyFile, '-out', caFile], { stdio: 'ignore' });
|
|
await chmod(urlFile, 0o600); await chmod(caFile, 0o644); await chmod(keyFile, 0o600);
|
|
const config = await postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: urlFile, WIKIDECK_CUSTODY_PG_CA_FILE: caFile });
|
|
assert.equal((config.ssl as { rejectUnauthorized: boolean }).rejectUnauthorized, true);
|
|
assert.ok((config.ssl as { ca: string }).ca.includes('BEGIN CERTIFICATE'));
|
|
await chmod(urlFile, 0o644);
|
|
await assert.rejects(postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: urlFile, WIKIDECK_CUSTODY_PG_CA_FILE: caFile }), /configuration/);
|
|
await chmod(urlFile, 0o600);
|
|
await writeFile(caFile, 'not a certificate', { mode: 0o644 }); await chmod(caFile, 0o644);
|
|
await assert.rejects(postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: urlFile, WIKIDECK_CUSTODY_PG_CA_FILE: caFile }), /configuration/);
|
|
});
|
|
|
|
test('infrastructure-managed transport requires exact opt-in and rejects mixed TLS/test configuration', async t => {
|
|
const dir = await mkdtemp(join(tmpdir(), 'wikideck-infrastructure-'));
|
|
t.after(() => rm(dir, { recursive: true, force: true }));
|
|
const file = join(dir, 'connection');
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody', { mode: 0o600 });
|
|
const env = { WIKIDECK_CUSTODY_PG_URL_FILE: file, WIKIDECK_CUSTODY_PG_TRANSPORT: 'infrastructure' };
|
|
await assert.rejects(postgresConfig(env), /configuration/);
|
|
for (const ack of ['', 'true', 'firewall', 'encrypted-authenticated-path-enforced ']) {
|
|
await assert.rejects(postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_INFRASTRUCTURE_ACK: ack }), /configuration/);
|
|
}
|
|
const approved = { ...env, WIKIDECK_CUSTODY_PG_INFRASTRUCTURE_ACK: 'encrypted-authenticated-path-enforced' };
|
|
assert.equal((await postgresConfig(approved)).ssl, false);
|
|
for (const conflict of [{ WIKIDECK_CUSTODY_PG_CA_FILE: file }, { WIKIDECK_CUSTODY_PG_LOCAL_TEST: '1' }]) {
|
|
await assert.rejects(postgresConfig({ ...approved, ...conflict }), /configuration/);
|
|
}
|
|
await assert.rejects(postgresConfig({ ...approved, WIKIDECK_CUSTODY_PG_TRANSPORT: 'tls' }), /configuration/);
|
|
await writeFile(file, 'postgresql://fixture@database.cluster.example/custody');
|
|
await assert.rejects(postgresConfig(approved), /configuration/); // Password auth remains mandatory.
|
|
await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody?sslmode=require');
|
|
await assert.rejects(postgresConfig(approved), /configuration/);
|
|
});
|