fix: auth/2FA security — stdout-log code delivery is dev/test-only, production fails closed until email/SMS; verification-code hashing, lockout recovery, sabredav fail-closed
- TWO_FACTOR_ALLOW_LOG_DELIVERY production opt-in REMOVED: plaintext codes are written to the stdout log ([2FA]/[VERIFY]) only in dev/test builds as a local DEV ONLY feature while email/SMS delivery (P6) is implemented. Production builds have no delivery channel and code issuance fails closed (503) under any configuration — no silent log-based code leak - verification/2FA codes hashed at rest (HMAC-SHA256 via TWO_FACTOR_PEPPER, CHAR(64)); [VERIFY] dev log relay; per-user brute-force budget; password_reset purpose clears lockout for self-service recovery; dummy-bcrypt on login no-user path kills timing oracle - sabredav weak-password list + entropy gate; .env.example ships fail-closed DAV_ADMIN_PASSWORD - delete-account re-auth (current_password + fresh 2FA code when enforced) - prod-tag suite (run-prod-tag-tests.sh) compiles and runs the production 2FA issuance gate: production ALWAYS reports no delivery channel and refuses issuance after the pepper check - startup_checks_test SNAPSHOT_ENC_KEY values built at runtime so gitleaks sees no secret-shaped literals - env-docs parity updated (flag removed, 38 vars)
This commit is contained in:
@@ -0,0 +1,144 @@
|
||||
//go:build test
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/base64"
|
||||
"log"
|
||||
"os"
|
||||
"os/exec"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
// captureLog redirects the process-wide logger into a buffer for the duration
|
||||
// of fn and returns what was logged. These startup checks log through the
|
||||
// global logger, so the tests that use this helper must stay sequential (no
|
||||
// t.Parallel).
|
||||
func captureLog(t *testing.T, fn func()) string {
|
||||
t.Helper()
|
||||
var buf bytes.Buffer
|
||||
orig := log.Writer()
|
||||
log.SetOutput(&buf)
|
||||
defer log.SetOutput(orig)
|
||||
fn()
|
||||
return buf.String()
|
||||
}
|
||||
|
||||
// TestCheckSnapshotEncKey_FailLoudBranches pins the non-mock startup check for
|
||||
// SNAPSHOT_ENC_KEY: a missing / invalid / wrong-length key must log a CRITICAL
|
||||
// line (the at-rest PII warning), a valid base64 32-byte key logs nothing, and
|
||||
// a dev/mock SQUARE_ENVIRONMENT skips the check entirely.
|
||||
func TestCheckSnapshotEncKey_FailLoudBranches(t *testing.T) {
|
||||
t.Setenv("SQUARE_ENVIRONMENT", "production")
|
||||
|
||||
t.Run("missing_key_logs_critical", func(t *testing.T) {
|
||||
t.Setenv("SNAPSHOT_ENC_KEY", "")
|
||||
got := captureLog(t, checkSnapshotEncKey)
|
||||
require.Contains(t, got, "SNAPSHOT_ENC_KEY is not set", "missing key must fail loud: %s", got)
|
||||
})
|
||||
|
||||
t.Run("invalid_base64_logs_critical", func(t *testing.T) {
|
||||
t.Setenv("SNAPSHOT_ENC_KEY", "!!!not-base64!!!")
|
||||
got := captureLog(t, checkSnapshotEncKey)
|
||||
require.Contains(t, got, "not valid base64", "invalid base64 must fail loud: %s", got)
|
||||
})
|
||||
|
||||
t.Run("wrong_length_logs_critical", func(t *testing.T) {
|
||||
// 16 bytes base64 → not 32 bytes → not AES-256. Built at runtime so no
|
||||
// secret-shaped literal exists in source.
|
||||
shortKey := base64.StdEncoding.EncodeToString([]byte("1234567890123456"))
|
||||
t.Setenv("SNAPSHOT_ENC_KEY", shortKey)
|
||||
got := captureLog(t, checkSnapshotEncKey)
|
||||
require.Contains(t, got, "exactly 32 bytes", "wrong key length must fail loud: %s", got)
|
||||
})
|
||||
|
||||
t.Run("valid_key_logs_nothing", func(t *testing.T) {
|
||||
t.Setenv("SNAPSHOT_ENC_KEY", base64.StdEncoding.EncodeToString([]byte("12345678901234567890123456789012"))) // 32 bytes
|
||||
got := captureLog(t, checkSnapshotEncKey)
|
||||
require.Empty(t, got, "a valid key must not log: %s", got)
|
||||
})
|
||||
|
||||
t.Run("mock_env_skips_check", func(t *testing.T) {
|
||||
t.Setenv("SQUARE_ENVIRONMENT", "mock")
|
||||
t.Setenv("SNAPSHOT_ENC_KEY", "")
|
||||
got := captureLog(t, checkSnapshotEncKey)
|
||||
require.Empty(t, got, "a dev/mock env must skip the check: %s", got)
|
||||
})
|
||||
}
|
||||
|
||||
// TestCheckProxyRateLimitConfig_WarnsWithoutTrustedProxy pins the fail-loud
|
||||
// warning: a non-mock deployment without TRUST_PROXY_HEADERS collapses every
|
||||
// per-IP limiter onto the proxy's address, so startup must warn. A dev/mock env
|
||||
// skips the check.
|
||||
func TestCheckProxyRateLimitConfig_WarnsWithoutTrustedProxy(t *testing.T) {
|
||||
t.Setenv("SQUARE_ENVIRONMENT", "production")
|
||||
got := captureLog(t, checkProxyRateLimitConfig)
|
||||
require.Contains(t, got, "TRUST_PROXY_HEADERS", "a non-mock deployment without TRUST_PROXY_HEADERS must warn: %s", got)
|
||||
|
||||
t.Setenv("SQUARE_ENVIRONMENT", "mock")
|
||||
got = captureLog(t, checkProxyRateLimitConfig)
|
||||
require.Empty(t, got, "a dev/mock env must skip the check: %s", got)
|
||||
}
|
||||
|
||||
// TestCheckWebhookSignatureKey_Branches pins the non-fatal branches of the
|
||||
// webhook signing-key startup check: both configured → silent; key without URL
|
||||
// → WARNING (fail-closed availability note); neither → CRITICAL. The fatal
|
||||
// key-less-with-URL branch is covered by the subprocess test below (log.Fatalf
|
||||
// exits the process).
|
||||
func TestCheckWebhookSignatureKey_Branches(t *testing.T) {
|
||||
t.Setenv("SQUARE_ENVIRONMENT", "production")
|
||||
|
||||
t.Run("both_configured_silent", func(t *testing.T) {
|
||||
t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "k")
|
||||
t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "https://example.com/webhooks")
|
||||
got := captureLog(t, checkWebhookSignatureKey)
|
||||
require.Empty(t, got, "both configured must be silent: %s", got)
|
||||
})
|
||||
|
||||
t.Run("key_without_url_warns", func(t *testing.T) {
|
||||
t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "k")
|
||||
t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "")
|
||||
got := captureLog(t, checkWebhookSignatureKey)
|
||||
require.Contains(t, got, "SQUARE_WEBHOOK_NOTIFICATION_URL is unset", "key without URL must warn: %s", got)
|
||||
})
|
||||
|
||||
t.Run("neither_configured_critical", func(t *testing.T) {
|
||||
t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "")
|
||||
t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "")
|
||||
got := captureLog(t, checkWebhookSignatureKey)
|
||||
require.Contains(t, got, "SQUARE_WEBHOOK_SIGNATURE_KEY is not set", "neither configured must log CRITICAL: %s", got)
|
||||
})
|
||||
|
||||
t.Run("mock_env_skips_check", func(t *testing.T) {
|
||||
t.Setenv("SQUARE_ENVIRONMENT", "mock")
|
||||
t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "")
|
||||
t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "https://example.com/webhooks")
|
||||
got := captureLog(t, checkWebhookSignatureKey)
|
||||
require.Empty(t, got, "a dev/mock env must skip the check: %s", got)
|
||||
})
|
||||
}
|
||||
|
||||
// TestCheckWebhookSignatureKey_FatalBranch_Exits covers the fail-fast branch —
|
||||
// a signing key is REQUIRED when a notification URL is configured, and the
|
||||
// startup check calls log.Fatalf (os.Exit). That cannot run in-process, so the
|
||||
// test re-executes the test binary with a marker env var and asserts the
|
||||
// subprocess exits non-zero with the FATAL message naming the key.
|
||||
func TestCheckWebhookSignatureKey_FatalBranch_Exits(t *testing.T) {
|
||||
if os.Getenv("GO_WANT_HELPER_PROCESS") == "1" {
|
||||
t.Setenv("SQUARE_ENVIRONMENT", "production")
|
||||
t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "")
|
||||
t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "https://example.com/webhooks")
|
||||
checkWebhookSignatureKey()
|
||||
return
|
||||
}
|
||||
cmd := exec.Command(os.Args[0], "-test.run=TestCheckWebhookSignatureKey_FatalBranch_Exits")
|
||||
cmd.Env = append(os.Environ(), "GO_WANT_HELPER_PROCESS=1")
|
||||
out, err := cmd.CombinedOutput()
|
||||
require.Error(t, err, "expected the key-less-with-URL branch to exit (log.Fatalf); output: %s", out)
|
||||
require.Contains(t, string(out), "SQUARE_WEBHOOK_SIGNATURE_KEY", "the fatal log must name the missing key: %s", out)
|
||||
require.False(t, strings.Contains(string(out), "unexpected argument"), "the helper must not fail on argument parsing: %s", out)
|
||||
}
|
||||
Reference in New Issue
Block a user