24 lines
755 B
Go
24 lines
755 B
Go
package main
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestResolveDatabasePasswordRejectsDirectEnvironmentSecret(t *testing.T) {
|
|
t.Setenv("WORK_POSTGRES_PASSWORD", "literal-secret")
|
|
if _, err := resolveDatabasePassword(); err == nil {
|
|
t.Fatal("direct database password environment variable was accepted")
|
|
}
|
|
}
|
|
|
|
func TestResolveDatabasePasswordRejectsPathOutsideProtectedRoot(t *testing.T) {
|
|
root := t.TempDir()
|
|
t.Setenv("SECRET_BACKEND_ROOT", root)
|
|
t.Setenv("WORK_POSTGRES_PASSWORD_FILE", filepath.Join(root, "..", "outside"))
|
|
t.Setenv("WORK_POSTGRES_CREDENTIAL_REF", "credential://domovoy/work/db-password/v1")
|
|
if _, err := resolveDatabasePassword(); err == nil {
|
|
t.Fatal("database password path outside protected root was accepted")
|
|
}
|
|
}
|