senlinai/agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(backend): harden final MVP invariants

Browse Source
This commit is contained in:
yanweidong
2026-07-22 01:24:41 +08:00
parent c527cd6ed0
commit 26c3e6fd8a
26 changed files with 684 additions and 179 deletions
Download Patch File Download Diff File Expand all files Collapse all files

66
backend/internal/config/config_test.go
View File

@@ -58,7 +58,7 @@ func TestLoadFromDirDefaultsToDevYAML(t *testing.T) {
func TestLoadFromDirUsesSENLINAppMode(t *testing.T) {
configDir := t.TempDir()
writeConfig(t, configDir, "agent.dev.yaml", "development", "18080", "postgres://dev", "./dev-files", "dev-auth", "", "dev-ai")
writeConfig(t, configDir, "agent.prod.yaml", "production", "80", "postgres://prod", "/data/files", "prod-auth", "prod-system", "prod-ai")
writeConfig(t, configDir, "agent.prod.yaml", "production", "80", "postgres://prod", "/data/files", "production-auth-signing-key-2026-safe", "prod-system", "production-ai-encryption-key-2026-safe")
t.Setenv("SENLIN_APP_MODE", "prod")
cfg, err := LoadFromDir(configDir)
@@ -68,9 +68,9 @@ func TestLoadFromDirUsesSENLINAppMode(t *testing.T) {
require.Equal(t, "80", cfg.Port)
require.Equal(t, "postgres://prod", cfg.DSN)
require.Equal(t, "/data/files", cfg.StorageDir)
require.Equal(t, "prod-auth", cfg.AuthSecret)
require.Equal(t, "production-auth-signing-key-2026-safe", cfg.AuthSecret)
require.Equal(t, "prod-system", cfg.SystemAIKey)
require.Equal(t, "prod-ai", cfg.AIKeyEncryptionSecret)
require.Equal(t, "production-ai-encryption-key-2026-safe", cfg.AIKeyEncryptionSecret)
require.Equal(t, []string{"https://workbench.example.com"}, cfg.AllowedOrigins)
}
@@ -100,6 +100,66 @@ func TestLoadFromDirRejectsMissingAllowedOrigins(t *testing.T) {
require.ErrorContains(t, err, "allowed_origins")
}
func TestLoadFromDirRejectsUnsafeProductionSecrets(t *testing.T) {
tests := []struct {
name string
authSecret string
encryptionSecret string
expectedFieldName string
}{
{name: "empty auth", authSecret: "", encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "short auth", authSecret: "short", encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "development auth sentinel", authSecret: "development-auth-secret-change-me", encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "dev auth sentinel", authSecret: "dev-secret-dev-secret-dev-secret-000", encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "empty encryption", authSecret: "production-auth-signing-key-2026-safe", encryptionSecret: "", expectedFieldName: "ai_key_encryption_secret"},
{name: "short encryption", authSecret: "production-auth-signing-key-2026-safe", encryptionSecret: "short", expectedFieldName: "ai_key_encryption_secret"},
{name: "common encryption sentinel", authSecret: "production-auth-signing-key-2026-safe", encryptionSecret: "change-me-change-me-change-me-change-me", expectedFieldName: "ai_key_encryption_secret"},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
configDir := t.TempDir()
writeConfig(t, configDir, "agent.prod.yaml", "production", "80", "postgres://prod", "/data/files", test.authSecret, "", test.encryptionSecret)
t.Setenv("SENLIN_APP_MODE", "prod")
_, err := LoadFromDir(configDir)
require.ErrorContains(t, err, test.expectedFieldName)
})
}
}
func TestLoadFromDirRequiresExplicitDevelopmentSecrets(t *testing.T) {
for _, missingField := range []string{"auth", "encryption"} {
t.Run(missingField, func(t *testing.T) {
configDir := t.TempDir()
authSecret, encryptionSecret := "development-auth", "development-encryption"
if missingField == "auth" {
authSecret = ""
} else {
encryptionSecret = ""
}
writeConfig(t, configDir, "agent.dev.yaml", "development", "9150", "postgres://dev", "./files", authSecret, "", encryptionSecret)
t.Setenv("SENLIN_APP_MODE", "dev")
_, err := LoadFromDir(configDir)
require.Error(t, err)
})
}
}
func TestLoadFromDirAllowsExplicitTestSecrets(t *testing.T) {
configDir := t.TempDir()
writeConfig(t, configDir, "agent.test.yaml", "test", "9150", "postgres://test", "./files", "test-auth", "", "test-ai")
t.Setenv("SENLIN_APP_MODE", "test")
cfg, err := LoadFromDir(configDir)
require.NoError(t, err)
require.Equal(t, "test-auth", cfg.AuthSecret)
require.Equal(t, "test-ai", cfg.AIKeyEncryptionSecret)
}
func writeConfig(t *testing.T, dir string, name string, env string, port string, databaseURL string, storageDir string, authSecret string, systemAIKey string, aiKeySecret string) {
t.Helper()
allowedOrigins := " - http://localhost:5173\n - http://tauri.localhost\n"