mirror of
https://github.com/0rangebananaspy/authelia.git
synced 2024-09-14 22:47:21 +07:00
347bd1be77
This adds an AES-GCM 256bit encryption layer for storage for sensitive items. This is only TOTP secrets for the time being but this may be expanded later. This will require a configuration change as per https://www.authelia.com/docs/configuration/migration.html#4330. Closes #682
133 lines
4.3 KiB
Go
133 lines
4.3 KiB
Go
package validator
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/suite"
|
|
|
|
"github.com/authelia/authelia/v4/internal/configuration/schema"
|
|
)
|
|
|
|
type StorageSuite struct {
|
|
suite.Suite
|
|
configuration schema.StorageConfiguration
|
|
validator *schema.StructValidator
|
|
}
|
|
|
|
func (suite *StorageSuite) SetupTest() {
|
|
suite.validator = schema.NewStructValidator()
|
|
suite.configuration.EncryptionKey = testEncryptionKey
|
|
suite.configuration.Local = &schema.LocalStorageConfiguration{
|
|
Path: "/this/is/a/path",
|
|
}
|
|
}
|
|
|
|
func (suite *StorageSuite) TestShouldValidateOneStorageIsConfigured() {
|
|
suite.configuration.Local = nil
|
|
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Require().Len(suite.validator.Errors(), 1)
|
|
suite.Assert().EqualError(suite.validator.Errors()[0], "A storage configuration must be provided. It could be 'local', 'mysql' or 'postgres'")
|
|
}
|
|
|
|
func (suite *StorageSuite) TestShouldValidateLocalPathIsProvided() {
|
|
suite.configuration.Local.Path = ""
|
|
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Require().Len(suite.validator.Errors(), 1)
|
|
|
|
suite.Assert().EqualError(suite.validator.Errors()[0], "A file path must be provided with key 'path'")
|
|
|
|
suite.validator.Clear()
|
|
suite.configuration.Local.Path = "/myapth"
|
|
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Assert().False(suite.validator.HasErrors())
|
|
}
|
|
|
|
func (suite *StorageSuite) TestShouldValidateSQLUsernamePasswordAndDatabaseAreProvided() {
|
|
suite.configuration.MySQL = &schema.MySQLStorageConfiguration{}
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Require().Len(suite.validator.Errors(), 2)
|
|
suite.Assert().EqualError(suite.validator.Errors()[0], "the SQL username and password must be provided")
|
|
suite.Assert().EqualError(suite.validator.Errors()[1], "the SQL database must be provided")
|
|
|
|
suite.validator.Clear()
|
|
suite.configuration.MySQL = &schema.MySQLStorageConfiguration{
|
|
SQLStorageConfiguration: schema.SQLStorageConfiguration{
|
|
Username: "myuser",
|
|
Password: "pass",
|
|
Database: "database",
|
|
},
|
|
}
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Assert().False(suite.validator.HasErrors())
|
|
}
|
|
|
|
func (suite *StorageSuite) TestShouldValidatePostgresSSLModeIsDisableByDefault() {
|
|
suite.configuration.PostgreSQL = &schema.PostgreSQLStorageConfiguration{
|
|
SQLStorageConfiguration: schema.SQLStorageConfiguration{
|
|
Username: "myuser",
|
|
Password: "pass",
|
|
Database: "database",
|
|
},
|
|
}
|
|
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Assert().False(suite.validator.HasErrors())
|
|
|
|
suite.Assert().Equal("disable", suite.configuration.PostgreSQL.SSLMode)
|
|
}
|
|
|
|
func (suite *StorageSuite) TestShouldValidatePostgresSSLModeMustBeValid() {
|
|
suite.configuration.PostgreSQL = &schema.PostgreSQLStorageConfiguration{
|
|
SQLStorageConfiguration: schema.SQLStorageConfiguration{
|
|
Username: "myuser",
|
|
Password: "pass",
|
|
Database: "database",
|
|
},
|
|
SSLMode: "unknown",
|
|
}
|
|
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Require().Len(suite.validator.Errors(), 1)
|
|
suite.Assert().EqualError(suite.validator.Errors()[0], "SSL mode must be 'disable', 'require', 'verify-ca', or 'verify-full'")
|
|
}
|
|
|
|
func (suite *StorageSuite) TestShouldRaiseErrorOnNoEncryptionKey() {
|
|
suite.configuration.EncryptionKey = ""
|
|
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Require().Len(suite.validator.Errors(), 1)
|
|
suite.Assert().EqualError(suite.validator.Errors()[0], "the configuration option storage.encryption_key must be provided")
|
|
}
|
|
|
|
func (suite *StorageSuite) TestShouldRaiseErrorOnShortEncryptionKey() {
|
|
suite.configuration.EncryptionKey = "abc"
|
|
|
|
ValidateStorage(suite.configuration, suite.validator)
|
|
|
|
suite.Assert().False(suite.validator.HasWarnings())
|
|
suite.Require().Len(suite.validator.Errors(), 1)
|
|
suite.Assert().EqualError(suite.validator.Errors()[0], "the configuration option storage.encryption_key must be 20 characters or longer")
|
|
}
|
|
|
|
func TestShouldRunStorageSuite(t *testing.T) {
|
|
suite.Run(t, new(StorageSuite))
|
|
}
|