Sansan
d31bf3551c
Echo compares allowed origins literally, so "https://*" and "http://*" never matched a real origin and no CORS headers were sent. The allowed origins now come from CORS_ALLOWED_ORIGINS (comma-separated, checked at startup). When it is empty, only same-origin requests work, which is enough for the bundled frontend. Credentials are no longer allowed since the API uses Bearer tokens. Browsers may now send Range and X-Queue-Id and read X-Queue-Id and Content-Range.
81 lines
2.3 KiB
Go
81 lines
2.3 KiB
Go
package config
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func env(values map[string]string) func(string) string {
|
|
return func(key string) string { return values[key] }
|
|
}
|
|
|
|
func validEnv() map[string]string {
|
|
return map[string]string{
|
|
"DB_HOST": "localhost",
|
|
"DB_PORT": "5432",
|
|
"DB_USERNAME": "user",
|
|
"DB_PASSWORD": "pass",
|
|
"DB_NAME": "music",
|
|
"MUSIC_PATH": "/music",
|
|
"CHARACTERS_PATH": "/characters",
|
|
}
|
|
}
|
|
|
|
func TestLoadDefaults(t *testing.T) {
|
|
cfg, err := load(env(validEnv()))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, 8080, cfg.Port)
|
|
assert.Equal(t, "info", cfg.LogLevel)
|
|
assert.Equal(t, "songs", cfg.SoundCheckPath)
|
|
assert.Equal(t, DefaultReleasesURL, cfg.ReleasesURL)
|
|
assert.Empty(t, cfg.TrustedProxies)
|
|
assert.Empty(t, cfg.CORSAllowedOrigins)
|
|
}
|
|
|
|
func TestLoadMissingRequired(t *testing.T) {
|
|
values := validEnv()
|
|
delete(values, "MUSIC_PATH")
|
|
delete(values, "DB_HOST")
|
|
_, err := load(env(values))
|
|
require.Error(t, err)
|
|
assert.Contains(t, err.Error(), "MUSIC_PATH is required")
|
|
assert.Contains(t, err.Error(), "DB_HOST is required")
|
|
}
|
|
|
|
func TestLoadTrustedProxies(t *testing.T) {
|
|
values := validEnv()
|
|
values["TRUSTED_PROXIES"] = "10.0.0.0/8, 172.16.0.0/12"
|
|
cfg, err := load(env(values))
|
|
require.NoError(t, err)
|
|
require.Len(t, cfg.TrustedProxies, 2)
|
|
assert.Equal(t, "10.0.0.0/8", cfg.TrustedProxies[0].String())
|
|
|
|
values["TRUSTED_PROXIES"] = "not-a-cidr"
|
|
_, err = load(env(values))
|
|
assert.ErrorContains(t, err, "TRUSTED_PROXIES")
|
|
}
|
|
|
|
func TestLoadCORSAllowedOrigins(t *testing.T) {
|
|
values := validEnv()
|
|
values["CORS_ALLOWED_ORIGINS"] = "https://music.example.com, http://localhost:5173,"
|
|
cfg, err := load(env(values))
|
|
require.NoError(t, err)
|
|
assert.Equal(t, []string{"https://music.example.com", "http://localhost:5173"}, cfg.CORSAllowedOrigins)
|
|
|
|
for _, invalid := range []string{"music.example.com", "ftp://example.com", "https://example.com/app",
|
|
"https://*.example.com", "https://*", "*", "https://example.com?x=1", "https://user@example.com"} {
|
|
values["CORS_ALLOWED_ORIGINS"] = invalid
|
|
_, err = load(env(values))
|
|
assert.ErrorContains(t, err, "CORS_ALLOWED_ORIGINS", invalid)
|
|
}
|
|
}
|
|
|
|
func TestLoadInvalidPort(t *testing.T) {
|
|
values := validEnv()
|
|
values["PORT"] = "abc"
|
|
_, err := load(env(values))
|
|
assert.ErrorContains(t, err, "PORT")
|
|
}
|