Hide_D
663e66b8f9
VAPID private key를 Compose secret으로 주입하고 Web Push를 기본 비활성으로 전달한다. 활성화 입력과 Compose 모델 검증, 운영 README를 함께 추가한다.
107 lines
4.0 KiB
JavaScript
107 lines
4.0 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
|
|
import { validateEnvironment } from '../runtime/validate-env.mjs';
|
|
|
|
const validEnv = {
|
|
DOMAIN: 'game.test.invalid',
|
|
ACME_EMAIL: 'admin@test.invalid',
|
|
CORE_REPOSITORY_URL: 'https://git.test.invalid/team/core2026.git',
|
|
POSTGRES_PASSWORD: 'p'.repeat(24),
|
|
REDIS_PASSWORD: 'r'.repeat(24),
|
|
GAME_TOKEN_SECRET: 'g'.repeat(32),
|
|
GATEWAY_BOOTSTRAP_TOKEN: 'b'.repeat(32),
|
|
INITIAL_ADMIN_USERNAME: 'admin',
|
|
INITIAL_ADMIN_PASSWORD: 'a'.repeat(16),
|
|
KAKAO_REST_KEY: 'kakao-test-key',
|
|
};
|
|
|
|
test('accepts a complete public repository environment', () => {
|
|
assert.deepEqual(validateEnvironment(validEnv), []);
|
|
});
|
|
|
|
test('accepts an HTTP Caddy address for external TLS termination', () => {
|
|
assert.deepEqual(
|
|
validateEnvironment({ ...validEnv, CADDY_SITE_ADDRESS: 'http://game.test.invalid' }),
|
|
[],
|
|
);
|
|
});
|
|
|
|
test('rejects a Caddy address for a different host', () => {
|
|
const errors = validateEnvironment({ ...validEnv, CADDY_SITE_ADDRESS: 'http://other.test.invalid' });
|
|
assert.ok(errors.some((error) => error.includes('CADDY_SITE_ADDRESS')));
|
|
});
|
|
|
|
test('accepts paired HTTPS credentials without embedding them in the URL', () => {
|
|
assert.deepEqual(
|
|
validateEnvironment({ ...validEnv, CORE_REPOSITORY_USERNAME: 'deploy', CORE_REPOSITORY_TOKEN: 'token' }),
|
|
[],
|
|
);
|
|
});
|
|
|
|
test('accepts a paired SSH deploy key and pinned host data', () => {
|
|
assert.deepEqual(
|
|
validateEnvironment({
|
|
...validEnv,
|
|
CORE_REPOSITORY_URL: 'ssh://git@git.test.invalid:2222/team/core2026.git',
|
|
CORE_SSH_PRIVATE_KEY_BASE64: Buffer.from('-----BEGIN OPENSSH PRIVATE KEY-----\ntest\n').toString('base64'),
|
|
CORE_SSH_KNOWN_HOSTS_BASE64: Buffer.from('git.test.invalid ssh-ed25519 test\n').toString('base64'),
|
|
}),
|
|
[],
|
|
);
|
|
});
|
|
|
|
test('rejects placeholders, weak secrets, and partial credentials', () => {
|
|
const errors = validateEnvironment({
|
|
...validEnv,
|
|
DOMAIN: 'game.example.com',
|
|
POSTGRES_PASSWORD: 'short',
|
|
CORE_REPOSITORY_USERNAME: 'deploy',
|
|
});
|
|
assert.ok(errors.some((error) => error.includes('DOMAIN still contains')));
|
|
assert.ok(errors.some((error) => error.includes('POSTGRES_PASSWORD must contain')));
|
|
assert.ok(errors.some((error) => error.includes('must be set together')));
|
|
});
|
|
|
|
test('rejects credentials embedded in repository URLs and mixed auth modes', () => {
|
|
const errors = validateEnvironment({
|
|
...validEnv,
|
|
CORE_REPOSITORY_URL: 'https://deploy:secret@git.test.invalid/team/core2026.git',
|
|
CORE_REPOSITORY_USERNAME: 'deploy',
|
|
CORE_REPOSITORY_TOKEN: 'token',
|
|
CORE_SSH_PRIVATE_KEY_BASE64: 'key',
|
|
CORE_SSH_KNOWN_HOSTS_BASE64: 'hosts',
|
|
});
|
|
assert.ok(errors.some((error) => error.includes('must not embed credentials')));
|
|
assert.ok(errors.some((error) => error.includes('only one Core repository authentication mode')));
|
|
});
|
|
|
|
test('keeps Web Push disabled by default and validates activation inputs', () => {
|
|
assert.deepEqual(validateEnvironment({ ...validEnv, WEB_PUSH_ENABLED: 'false' }), []);
|
|
|
|
const errors = validateEnvironment({ ...validEnv, WEB_PUSH_ENABLED: 'true' });
|
|
assert.ok(errors.some((error) => error.includes('WEB_PUSH_VAPID_SUBJECT')));
|
|
assert.ok(errors.some((error) => error.includes('WEB_PUSH_VAPID_PUBLIC_KEY')));
|
|
assert.ok(errors.some((error) => error.includes('WEB_PUSH_VAPID_PRIVATE_KEY_FILE')));
|
|
assert.ok(
|
|
validateEnvironment({
|
|
...validEnv,
|
|
WEB_PUSH_ENABLED: 'true',
|
|
WEB_PUSH_VAPID_SUBJECT: 'mailto:admin@test.invalid',
|
|
WEB_PUSH_VAPID_PUBLIC_KEY: 'test-public-key',
|
|
WEB_PUSH_VAPID_PRIVATE_KEY_FILE: './secrets/web_push_vapid_private_key.example',
|
|
}).some((error) => error.includes('WEB_PUSH_VAPID_PRIVATE_KEY_FILE')),
|
|
);
|
|
|
|
assert.deepEqual(
|
|
validateEnvironment({
|
|
...validEnv,
|
|
WEB_PUSH_ENABLED: 'true',
|
|
WEB_PUSH_VAPID_SUBJECT: 'mailto:admin@test.invalid',
|
|
WEB_PUSH_VAPID_PUBLIC_KEY: 'test-public-key',
|
|
WEB_PUSH_VAPID_PRIVATE_KEY_FILE: './secrets/web-push-private-key',
|
|
}),
|
|
[],
|
|
);
|
|
});
|