| package report |
|
|
| import ( |
| "os" |
| "path/filepath" |
| "testing" |
|
|
| "github.com/pinchtab/pinchtab/internal/config" |
| ) |
|
|
| func TestAssessSecurityWarnings(t *testing.T) { |
| t.Run("safe local defaults stay quiet", func(t *testing.T) { |
| cfg := &config.RuntimeConfig{ |
| Bind: "127.0.0.1", |
| Token: "secret", |
| AttachAllowHosts: []string{"127.0.0.1", "localhost", "::1"}, |
| AttachAllowSchemes: []string{"ws", "wss"}, |
| IDPI: config.IDPIConfig{ |
| Enabled: true, |
| AllowedDomains: []string{"127.0.0.1", "localhost", "::1"}, |
| StrictMode: true, |
| ScanContent: true, |
| WrapContent: true, |
| }, |
| } |
|
|
| warnings := assessSecurityWarnings(cfg) |
| if len(warnings) != 0 { |
| t.Fatalf("expected no warnings, got %+v", warnings) |
| } |
| }) |
|
|
| t.Run("website whitelist missing and other security gaps are flagged", func(t *testing.T) { |
| cfg := &config.RuntimeConfig{ |
| Bind: "0.0.0.0", |
| Token: "", |
| AllowEvaluate: true, |
| AllowDownload: true, |
| AttachEnabled: true, |
| AttachAllowHosts: []string{"localhost", "chrome.internal"}, |
| IDPI: config.IDPIConfig{ |
| Enabled: true, |
| }, |
| } |
|
|
| warnings := assessSecurityWarnings(cfg) |
| ids := make(map[string]bool, len(warnings)) |
| for _, warning := range warnings { |
| ids[warning.ID] = true |
| } |
|
|
| for _, expected := range []string{ |
| "sensitive_endpoints_enabled", |
| "api_auth_disabled", |
| "sensitive_endpoints_without_auth", |
| "non_loopback_bind", |
| "idpi_whitelist_not_set", |
| "idpi_warn_mode", |
| "idpi_content_protection_disabled", |
| "attach_external_hosts", |
| } { |
| if !ids[expected] { |
| t.Fatalf("expected warning %q, got %+v", expected, warnings) |
| } |
| } |
| }) |
|
|
| t.Run("wildcard whitelist is warned", func(t *testing.T) { |
| cfg := &config.RuntimeConfig{ |
| Bind: "127.0.0.1", |
| Token: "secret", |
| IDPI: config.IDPIConfig{ |
| Enabled: true, |
| AllowedDomains: []string{"*"}, |
| StrictMode: true, |
| ScanContent: true, |
| }, |
| } |
|
|
| warnings := assessSecurityWarnings(cfg) |
| ids := make(map[string]bool, len(warnings)) |
| for _, warning := range warnings { |
| ids[warning.ID] = true |
| } |
|
|
| if !ids["idpi_whitelist_allows_all"] { |
| t.Fatalf("expected wildcard whitelist warning, got %+v", warnings) |
| } |
| }) |
|
|
| t.Run("disabled IDPI is warned", func(t *testing.T) { |
| cfg := &config.RuntimeConfig{ |
| Bind: "127.0.0.1", |
| Token: "secret", |
| AttachAllowHosts: []string{"127.0.0.1", "localhost", "::1"}, |
| AttachAllowSchemes: []string{"ws", "wss"}, |
| } |
|
|
| warnings := assessSecurityWarnings(cfg) |
| ids := make(map[string]bool, len(warnings)) |
| for _, warning := range warnings { |
| ids[warning.ID] = true |
| } |
|
|
| if !ids["idpi_disabled"] { |
| t.Fatalf("expected idpi_disabled warning, got %+v", warnings) |
| } |
| }) |
| } |
|
|
| func TestAssessSecurityPosture(t *testing.T) { |
| t.Run("fully locked local config scores all defaults", func(t *testing.T) { |
| cfg := &config.RuntimeConfig{ |
| Bind: "127.0.0.1", |
| Token: "secret", |
| AttachAllowHosts: []string{"127.0.0.1", "localhost", "::1"}, |
| AttachAllowSchemes: []string{"ws", "wss"}, |
| IDPI: config.IDPIConfig{ |
| Enabled: true, |
| AllowedDomains: []string{"127.0.0.1", "localhost", "::1"}, |
| StrictMode: true, |
| ScanContent: true, |
| WrapContent: true, |
| }, |
| } |
|
|
| posture := assessSecurityPosture(cfg) |
| if posture.Passed != posture.Total { |
| t.Fatalf("expected all checks to pass, got %d/%d", posture.Passed, posture.Total) |
| } |
| if posture.Level != "LOCKED" { |
| t.Fatalf("expected LOCKED posture, got %q", posture.Level) |
| } |
| }) |
|
|
| t.Run("exposed config drops posture score", func(t *testing.T) { |
| cfg := &config.RuntimeConfig{ |
| Bind: "0.0.0.0", |
| AllowEvaluate: true, |
| AllowDownload: true, |
| AttachEnabled: true, |
| AttachAllowHosts: []string{"chrome.internal"}, |
| IDPI: config.IDPIConfig{ |
| Enabled: true, |
| }, |
| } |
|
|
| posture := assessSecurityPosture(cfg) |
| if posture.Passed >= 3 { |
| t.Fatalf("expected exposed posture below 3 passed checks, got %d/%d", posture.Passed, posture.Total) |
| } |
| if posture.Level != "EXPOSED" { |
| t.Fatalf("expected EXPOSED posture, got %q", posture.Level) |
| } |
| }) |
| } |
|
|
| func TestApplyRecommendedSecurityDefaults(t *testing.T) { |
| allowEvaluate := true |
| attachEnabled := true |
| fc := &config.FileConfig{ |
| Server: config.ServerConfig{ |
| Port: "9999", |
| Bind: "0.0.0.0", |
| Token: "secret", |
| }, |
| Security: config.SecurityConfig{ |
| AllowEvaluate: &allowEvaluate, |
| Attach: config.AttachConfig{ |
| Enabled: &attachEnabled, |
| AllowHosts: []string{"chrome.internal"}, |
| }, |
| IDPI: config.IDPIConfig{ |
| Enabled: false, |
| }, |
| }, |
| } |
|
|
| applyRecommendedSecurityDefaults(fc) |
|
|
| if fc.Server.Port != "9999" { |
| t.Fatalf("expected port to be preserved, got %q", fc.Server.Port) |
| } |
| if fc.Server.Token != "secret" { |
| t.Fatalf("expected token to be preserved, got %q", fc.Server.Token) |
| } |
| if fc.Server.Bind != "127.0.0.1" { |
| t.Fatalf("expected bind to reset to loopback, got %q", fc.Server.Bind) |
| } |
| if fc.Security.AllowEvaluate == nil || *fc.Security.AllowEvaluate { |
| t.Fatalf("expected allowEvaluate to reset to false, got %+v", fc.Security.AllowEvaluate) |
| } |
| if !fc.Security.IDPI.Enabled { |
| t.Fatalf("expected idpi to be enabled") |
| } |
| } |
|
|
| func TestApplyRecommendedSecurityDefaults_GeneratesTokenWhenMissing(t *testing.T) { |
| fc := &config.FileConfig{} |
|
|
| applyRecommendedSecurityDefaults(fc) |
|
|
| if fc.Server.Token == "" { |
| t.Fatalf("expected generated token, got empty") |
| } |
| } |
|
|
| func TestRestoreSecurityDefaults(t *testing.T) { |
| tmpDir := t.TempDir() |
| configPath := filepath.Join(tmpDir, "config.json") |
| t.Setenv("PINCHTAB_CONFIG", configPath) |
|
|
| allowEvaluate := true |
| attachEnabled := true |
| fc := &config.FileConfig{ |
| Server: config.ServerConfig{ |
| Port: "9999", |
| Bind: "0.0.0.0", |
| Token: "secret", |
| }, |
| Security: config.SecurityConfig{ |
| AllowEvaluate: &allowEvaluate, |
| Attach: config.AttachConfig{ |
| Enabled: &attachEnabled, |
| AllowHosts: []string{"chrome.internal"}, |
| }, |
| IDPI: config.IDPIConfig{ |
| Enabled: false, |
| }, |
| }, |
| } |
| if err := config.SaveFileConfig(fc, configPath); err != nil { |
| t.Fatalf("SaveFileConfig() error = %v", err) |
| } |
|
|
| gotPath, changed, err := restoreSecurityDefaults() |
| if err != nil { |
| t.Fatalf("restoreSecurityDefaults() error = %v", err) |
| } |
| if gotPath != configPath { |
| t.Fatalf("restoreSecurityDefaults() path = %q, want %q", gotPath, configPath) |
| } |
| if !changed { |
| t.Fatalf("restoreSecurityDefaults() changed = false, want true") |
| } |
|
|
| saved, err := os.ReadFile(configPath) |
| if err != nil { |
| t.Fatalf("ReadFile() error = %v", err) |
| } |
| loaded := &config.FileConfig{} |
| if err := config.PatchConfigJSON(loaded, string(saved)); err != nil { |
| t.Fatalf("PatchConfigJSON() error = %v", err) |
| } |
| if loaded.Server.Port != "9999" { |
| t.Fatalf("expected port to be preserved, got %q", loaded.Server.Port) |
| } |
| if loaded.Server.Token != "secret" { |
| t.Fatalf("expected token to be preserved, got %q", loaded.Server.Token) |
| } |
| if loaded.Server.Bind != "127.0.0.1" { |
| t.Fatalf("expected bind to be restored, got %q", loaded.Server.Bind) |
| } |
| if !loaded.Security.IDPI.Enabled { |
| t.Fatalf("expected idpi to be enabled after restore") |
| } |
| } |
|
|
| func TestRestoreSecurityDefaults_TokenOnlyChangeIsSaved(t *testing.T) { |
| tmpDir := t.TempDir() |
| configPath := filepath.Join(tmpDir, "config.json") |
| t.Setenv("PINCHTAB_CONFIG", configPath) |
|
|
| fc := config.DefaultFileConfig() |
| fc.Server.Token = "" |
| if err := config.SaveFileConfig(&fc, configPath); err != nil { |
| t.Fatalf("SaveFileConfig() error = %v", err) |
| } |
|
|
| _, changed, err := restoreSecurityDefaults() |
| if err != nil { |
| t.Fatalf("restoreSecurityDefaults() error = %v", err) |
| } |
| if !changed { |
| t.Fatalf("restoreSecurityDefaults() changed = false, want true") |
| } |
|
|
| loaded, _, err := config.LoadFileConfig() |
| if err != nil { |
| t.Fatalf("LoadFileConfig() error = %v", err) |
| } |
| if loaded.Server.Token == "" { |
| t.Fatalf("expected generated token to be persisted") |
| } |
| } |
|
|
