fix(runtime): harden smoke and credential boundaries

2026-08-04 16:05:06 +00:00
parent 09d849de07
commit c49989631f
16 changed files with 517 additions and 8 deletions
@@ -0,0 +1,65 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+import { validateEnvironment } from '../runtime/validate-env.mjs';
+
+const validEnv = {
+  DOMAIN: 'game.test.invalid',
+  ACME_EMAIL: 'admin@test.invalid',
+  CORE_REPOSITORY_URL: 'https://git.test.invalid/team/core2026.git',
+  POSTGRES_PASSWORD: 'p'.repeat(24),
+  REDIS_PASSWORD: 'r'.repeat(24),
+  GAME_TOKEN_SECRET: 'g'.repeat(32),
+  GATEWAY_BOOTSTRAP_TOKEN: 'b'.repeat(32),
+  INITIAL_ADMIN_USERNAME: 'admin',
+  INITIAL_ADMIN_PASSWORD: 'a'.repeat(16),
+  KAKAO_REST_KEY: 'kakao-test-key',
+};
+
+test('accepts a complete public repository environment', () => {
+  assert.deepEqual(validateEnvironment(validEnv), []);
+});
+
+test('accepts paired HTTPS credentials without embedding them in the URL', () => {
+  assert.deepEqual(
+    validateEnvironment({ ...validEnv, CORE_REPOSITORY_USERNAME: 'deploy', CORE_REPOSITORY_TOKEN: 'token' }),
+    [],
+  );
+});
+
+test('accepts a paired SSH deploy key and pinned host data', () => {
+  assert.deepEqual(
+    validateEnvironment({
+      ...validEnv,
+      CORE_REPOSITORY_URL: 'ssh://git@git.test.invalid:2222/team/core2026.git',
+      CORE_SSH_PRIVATE_KEY_BASE64: Buffer.from('-----BEGIN OPENSSH PRIVATE KEY-----\ntest\n').toString('base64'),
+      CORE_SSH_KNOWN_HOSTS_BASE64: Buffer.from('git.test.invalid ssh-ed25519 test\n').toString('base64'),
+    }),
+    [],
+  );
+});
+
+test('rejects placeholders, weak secrets, and partial credentials', () => {
+  const errors = validateEnvironment({
+    ...validEnv,
+    DOMAIN: 'game.example.com',
+    POSTGRES_PASSWORD: 'short',
+    CORE_REPOSITORY_USERNAME: 'deploy',
+  });
+  assert.ok(errors.some((error) => error.includes('DOMAIN still contains')));
+  assert.ok(errors.some((error) => error.includes('POSTGRES_PASSWORD must contain')));
+  assert.ok(errors.some((error) => error.includes('must be set together')));
+});
+
+test('rejects credentials embedded in repository URLs and mixed auth modes', () => {
+  const errors = validateEnvironment({
+    ...validEnv,
+    CORE_REPOSITORY_URL: 'https://deploy:secret@git.test.invalid/team/core2026.git',
+    CORE_REPOSITORY_USERNAME: 'deploy',
+    CORE_REPOSITORY_TOKEN: 'token',
+    CORE_SSH_PRIVATE_KEY_BASE64: 'key',
+    CORE_SSH_KNOWN_HOSTS_BASE64: 'hosts',
+  });
+  assert.ok(errors.some((error) => error.includes('must not embed credentials')));
+  assert.ok(errors.some((error) => error.includes('only one Core repository authentication mode')));
+});