senlinai/agent
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(backend): secure production startup and migrations

Browse Source
This commit is contained in:
yanweidong
2026-07-22 13:11:30 +08:00
parent 0daea4def9
commit 7980943660
13 changed files with 220 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
backend/internal/config/config_test.go
View File

@@ -74,6 +74,28 @@ func TestLoadFromDirUsesSENLINAppMode(t *testing.T) {
require.Equal(t, []string{"https://workbench.example.com"}, cfg.AllowedOrigins)
}
func TestLoadFromDirRejectsProductionModeWithDevelopmentEnvironment(t *testing.T) {
configDir := t.TempDir()
writeConfig(t, configDir, "agent.prod.yaml", "development", "80", "postgres://prod", "/data/files", "production-auth-signing-key-2026-safe", "", "production-ai-encryption-key-2026-safe")
t.Setenv("SENLIN_APP_MODE", "prod")
_, err := LoadFromDir(configDir)
require.ErrorContains(t, err, "SENLIN_APP_MODE prod")
require.ErrorContains(t, err, "env development")
}
func TestLoadFromDirRejectsModeEnvironmentMismatchOutsideProduction(t *testing.T) {
configDir := t.TempDir()
writeConfig(t, configDir, "agent.dev.yaml", "production", "9150", "postgres://dev", "./files", "production-auth-signing-key-2026-safe", "", "production-ai-encryption-key-2026-safe")
t.Setenv("SENLIN_APP_MODE", "dev")
_, err := LoadFromDir(configDir)
require.ErrorContains(t, err, "SENLIN_APP_MODE dev")
require.ErrorContains(t, err, "env production")
}
func TestLoadFromDirRejectsMissingStorageDir(t *testing.T) {
configDir := t.TempDir()
writeConfig(t, configDir, "agent.dev.yaml", "development", "9150", "postgres://agent", "", "dev-auth", "", "dev-ai")
@@ -111,9 +133,12 @@ func TestLoadFromDirRejectsUnsafeProductionSecrets(t *testing.T) {
{name: "short auth", authSecret: "short", encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "development auth sentinel", authSecret: "development-auth-secret-change-me", encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "dev auth sentinel", authSecret: "dev-secret-dev-secret-dev-secret-000", encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "repeated auth character", authSecret: strings.Repeat("x", 32), encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "repeated auth pattern", authSecret: strings.Repeat("abcd", 8), encryptionSecret: "production-ai-encryption-key-2026-safe", expectedFieldName: "auth_secret"},
{name: "empty encryption", authSecret: "production-auth-signing-key-2026-safe", encryptionSecret: "", expectedFieldName: "ai_key_encryption_secret"},
{name: "short encryption", authSecret: "production-auth-signing-key-2026-safe", encryptionSecret: "short", expectedFieldName: "ai_key_encryption_secret"},
{name: "common encryption sentinel", authSecret: "production-auth-signing-key-2026-safe", encryptionSecret: "change-me-change-me-change-me-change-me", expectedFieldName: "ai_key_encryption_secret"},
{name: "repeated encryption character", authSecret: "production-auth-signing-key-2026-safe", encryptionSecret: strings.Repeat("9", 64), expectedFieldName: "ai_key_encryption_secret"},
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {