47 lines
1.4 KiB
Python
47 lines
1.4 KiB
Python
"""生产配置校验：公网暴露前拦住弱密钥与错误配置。"""
|
|
from app.config import Settings
|
|
|
|
_STRONG = "x" * 40
|
|
_FERNET = "8ZQvW0nGx1Kc3pYtRj7Lm9BdEfHsUaNqZvXcTgWyPkI="
|
|
|
|
|
|
def _settings(**overrides) -> Settings:
|
|
base = {
|
|
"debug": False,
|
|
"jwt_secret": _STRONG,
|
|
"fernet_key": _FERNET,
|
|
"cors_origins": "https://example.com",
|
|
}
|
|
return Settings(**{**base, **overrides})
|
|
|
|
|
|
def test_valid_production_config_passes():
|
|
assert _settings().check_production_secrets() == []
|
|
|
|
|
|
def test_default_jwt_secret_rejected():
|
|
problems = _settings(jwt_secret="dev-only-change-me").check_production_secrets()
|
|
assert any("默认值" in p for p in problems)
|
|
|
|
|
|
def test_short_jwt_secret_rejected():
|
|
"""HS256 密钥短于 32 字节会削弱签名强度。"""
|
|
problems = _settings(jwt_secret="tooshort").check_production_secrets()
|
|
assert any("32 字节" in p for p in problems)
|
|
|
|
|
|
def test_missing_fernet_key_rejected():
|
|
problems = _settings(fernet_key="").check_production_secrets()
|
|
assert any("FERNET_KEY" in p for p in problems)
|
|
|
|
|
|
def test_wildcard_cors_rejected():
|
|
problems = _settings(cors_origins="*").check_production_secrets()
|
|
assert any("CORS" in p for p in problems)
|
|
|
|
|
|
def test_debug_mode_skips_checks():
|
|
"""本地开发不该被这些检查挡住。"""
|
|
s = _settings(debug=True, jwt_secret="dev-only-change-me", fernet_key="")
|
|
assert s.check_production_secrets() == []
|