Crussell/backend/startup_checks_test.go

//go:build test

package main

import (
	"bytes"
	"encoding/base64"
	"log"
	"os"
	"os/exec"
	"strings"
	"testing"

	"github.com/stretchr/testify/require"
)

// captureLog redirects the process-wide logger into a buffer for the duration
// of fn and returns what was logged. These startup checks log through the
// global logger, so the tests that use this helper must stay sequential (no
// t.Parallel).
func captureLog(t *testing.T, fn func()) string {
	t.Helper()
	var buf bytes.Buffer
	orig := log.Writer()
	log.SetOutput(&buf)
	defer log.SetOutput(orig)
	fn()
	return buf.String()
}

// TestCheckSnapshotEncKey_FailLoudBranches pins the non-mock startup check for
// SNAPSHOT_ENC_KEY: a missing / invalid / wrong-length key must log a CRITICAL
// line (the at-rest PII warning), a valid base64 32-byte key logs nothing, and
// a dev/mock SQUARE_ENVIRONMENT skips the check entirely.
func TestCheckSnapshotEncKey_FailLoudBranches(t *testing.T) {
	t.Setenv("SQUARE_ENVIRONMENT", "production")

	t.Run("missing_key_logs_critical", func(t *testing.T) {
		t.Setenv("SNAPSHOT_ENC_KEY", "")
		got := captureLog(t, checkSnapshotEncKey)
		require.Contains(t, got, "SNAPSHOT_ENC_KEY is not set", "missing key must fail loud: %s", got)
	})

	t.Run("invalid_base64_logs_critical", func(t *testing.T) {
		t.Setenv("SNAPSHOT_ENC_KEY", "!!!not-base64!!!")
		got := captureLog(t, checkSnapshotEncKey)
		require.Contains(t, got, "not valid base64", "invalid base64 must fail loud: %s", got)
	})

	t.Run("wrong_length_logs_critical", func(t *testing.T) {
		// 16 bytes base64 → not 32 bytes → not AES-256. Built at runtime so no
		// secret-shaped literal exists in source.
		shortKey := base64.StdEncoding.EncodeToString([]byte("1234567890123456"))
		t.Setenv("SNAPSHOT_ENC_KEY", shortKey)
		got := captureLog(t, checkSnapshotEncKey)
		require.Contains(t, got, "exactly 32 bytes", "wrong key length must fail loud: %s", got)
	})

	t.Run("valid_key_logs_nothing", func(t *testing.T) {
		t.Setenv("SNAPSHOT_ENC_KEY", base64.StdEncoding.EncodeToString([]byte("12345678901234567890123456789012"))) // 32 bytes
		got := captureLog(t, checkSnapshotEncKey)
		require.Empty(t, got, "a valid key must not log: %s", got)
	})

	t.Run("mock_env_skips_check", func(t *testing.T) {
		t.Setenv("SQUARE_ENVIRONMENT", "mock")
		t.Setenv("SNAPSHOT_ENC_KEY", "")
		got := captureLog(t, checkSnapshotEncKey)
		require.Empty(t, got, "a dev/mock env must skip the check: %s", got)
	})
}

// TestCheckProxyRateLimitConfig_WarnsWithoutTrustedProxy pins the fail-loud
// warning: a non-mock deployment without TRUST_PROXY_HEADERS collapses every
// per-IP limiter onto the proxy's address, so startup must warn. A dev/mock env
// skips the check.
func TestCheckProxyRateLimitConfig_WarnsWithoutTrustedProxy(t *testing.T) {
	t.Setenv("SQUARE_ENVIRONMENT", "production")
	got := captureLog(t, checkProxyRateLimitConfig)
	require.Contains(t, got, "TRUST_PROXY_HEADERS", "a non-mock deployment without TRUST_PROXY_HEADERS must warn: %s", got)

	t.Setenv("SQUARE_ENVIRONMENT", "mock")
	got = captureLog(t, checkProxyRateLimitConfig)
	require.Empty(t, got, "a dev/mock env must skip the check: %s", got)
}

// TestCheckWebhookSignatureKey_Branches pins the non-fatal branches of the
// webhook signing-key startup check: both configured → silent; key without URL
// → WARNING (fail-closed availability note); neither → CRITICAL. The fatal
// key-less-with-URL branch is covered by the subprocess test below (log.Fatalf
// exits the process).
func TestCheckWebhookSignatureKey_Branches(t *testing.T) {
	t.Setenv("SQUARE_ENVIRONMENT", "production")

	t.Run("both_configured_silent", func(t *testing.T) {
		t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "k")
		t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "https://example.com/webhooks")
		got := captureLog(t, checkWebhookSignatureKey)
		require.Empty(t, got, "both configured must be silent: %s", got)
	})

	t.Run("key_without_url_warns", func(t *testing.T) {
		t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "k")
		t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "")
		got := captureLog(t, checkWebhookSignatureKey)
		require.Contains(t, got, "SQUARE_WEBHOOK_NOTIFICATION_URL is unset", "key without URL must warn: %s", got)
	})

	t.Run("neither_configured_critical", func(t *testing.T) {
		t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "")
		t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "")
		got := captureLog(t, checkWebhookSignatureKey)
		require.Contains(t, got, "SQUARE_WEBHOOK_SIGNATURE_KEY is not set", "neither configured must log CRITICAL: %s", got)
	})

	t.Run("mock_env_skips_check", func(t *testing.T) {
		t.Setenv("SQUARE_ENVIRONMENT", "mock")
		t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "")
		t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "https://example.com/webhooks")
		got := captureLog(t, checkWebhookSignatureKey)
		require.Empty(t, got, "a dev/mock env must skip the check: %s", got)
	})
}

// TestCheckWebhookSignatureKey_FatalBranch_Exits covers the fail-fast branch —
// a signing key is REQUIRED when a notification URL is configured, and the
// startup check calls log.Fatalf (os.Exit). That cannot run in-process, so the
// test re-executes the test binary with a marker env var and asserts the
// subprocess exits non-zero with the FATAL message naming the key.
func TestCheckWebhookSignatureKey_FatalBranch_Exits(t *testing.T) {
	if os.Getenv("GO_WANT_HELPER_PROCESS") == "1" {
		t.Setenv("SQUARE_ENVIRONMENT", "production")
		t.Setenv("SQUARE_WEBHOOK_SIGNATURE_KEY", "")
		t.Setenv("SQUARE_WEBHOOK_NOTIFICATION_URL", "https://example.com/webhooks")
		checkWebhookSignatureKey()
		return
	}
	cmd := exec.Command(os.Args[0], "-test.run=TestCheckWebhookSignatureKey_FatalBranch_Exits")
	cmd.Env = append(os.Environ(), "GO_WANT_HELPER_PROCESS=1")
	out, err := cmd.CombinedOutput()
	require.Error(t, err, "expected the key-less-with-URL branch to exit (log.Fatalf); output: %s", out)
	require.Contains(t, string(out), "SQUARE_WEBHOOK_SIGNATURE_KEY", "the fatal log must name the missing key: %s", out)
	require.False(t, strings.Contains(string(out), "unexpected argument"), "the helper must not fail on argument parsing: %s", out)
}