第一次提交

tests/test_config.py

@@ -0,0 +1,46 @@
+"""生产配置校验：公网暴露前拦住弱密钥与错误配置。"""
+from app.config import Settings
+
+_STRONG = "x" * 40
+_FERNET = "8ZQvW0nGx1Kc3pYtRj7Lm9BdEfHsUaNqZvXcTgWyPkI="
+
+
+def _settings(**overrides) -> Settings:
+    base = {
+        "debug": False,
+        "jwt_secret": _STRONG,
+        "fernet_key": _FERNET,
+        "cors_origins": "https://example.com",
+    }
+    return Settings(**{**base, **overrides})
+
+
+def test_valid_production_config_passes():
+    assert _settings().check_production_secrets() == []
+
+
+def test_default_jwt_secret_rejected():
+    problems = _settings(jwt_secret="dev-only-change-me").check_production_secrets()
+    assert any("默认值" in p for p in problems)
+
+
+def test_short_jwt_secret_rejected():
+    """HS256 密钥短于 32 字节会削弱签名强度。"""
+    problems = _settings(jwt_secret="tooshort").check_production_secrets()
+    assert any("32 字节" in p for p in problems)
+
+
+def test_missing_fernet_key_rejected():
+    problems = _settings(fernet_key="").check_production_secrets()
+    assert any("FERNET_KEY" in p for p in problems)
+
+
+def test_wildcard_cors_rejected():
+    problems = _settings(cors_origins="*").check_production_secrets()
+    assert any("CORS" in p for p in problems)
+
+
+def test_debug_mode_skips_checks():
+    """本地开发不该被这些检查挡住。"""
+    s = _settings(debug=True, jwt_secret="dev-only-change-me", fernet_key="")
+    assert s.check_production_secrets() == []