mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-13 04:07:37 +00:00
lukaszraczylo
2ff14556d0
Security/correctness fixes: - fail-open token validation preserved with lenient-audience; access token that fails verification and has no ID token to corroborate now fails closed - token_manager blacklist-expiry: fix impossible tautology (x>24h && x<24h) - constant-time OAuth state compare; clear state/nonce/code_verifier on callback token-exchange failure to prevent replay of half-failed flows - StopAllTasks gated on last-instance close - background-task panic recovery; remove task-registry counter leak - circuit breaker half-open: release probe slot; CB + per-session outcome recorded once per refresh operation, not once per waiter - Redis connection pool: handle nil receive when pool closed concurrently - FileStore: atomic temp-write + rename - errors_recovery health-check data race -> atomic Test-isolation / hardening: - reset helpers for Once-pinned global cache manager and transport pool - coverage: utils 70->93% (redirect URL security contract); fuzz targets for bearer parsers; concurrent ServeHTTP race tests for the shared request path Dead-code removal (verified orphaned, build+suite green): internal/providers (30 files, 0 importers), internal/compat, internal/features, input_validation. Verified: govulncheck, go mod tidy, yaegi-validate, cross-compile (darwin+ linux), golangci-lint (new-from-rev clean), 3x full race+shuffle green.
53 lines
1.9 KiB
Go
53 lines
1.9 KiB
Go
package traefikoidc
|
|
|
|
import "testing"
|
|
|
|
// TestRedisConfig_ApplyEnvFallbacks_Resilience guards the fix that wires the
|
|
// documented REDIS_* resilience env fallbacks (examples/redis-config.yaml) into
|
|
// ApplyEnvFallbacks. Previously an operator following the documented names got
|
|
// no effect: the fields existed but the env vars were never read.
|
|
func TestRedisConfig_ApplyEnvFallbacks_Resilience(t *testing.T) {
|
|
t.Setenv("REDIS_ENABLED", "true")
|
|
t.Setenv("REDIS_ENABLE_CIRCUIT_BREAKER", "true")
|
|
t.Setenv("REDIS_CIRCUIT_BREAKER_THRESHOLD", "7")
|
|
t.Setenv("REDIS_CIRCUIT_BREAKER_TIMEOUT", "90")
|
|
t.Setenv("REDIS_ENABLE_HEALTH_CHECK", "true")
|
|
t.Setenv("REDIS_HEALTH_CHECK_INTERVAL", "45")
|
|
|
|
rc := &RedisConfig{}
|
|
rc.ApplyEnvFallbacks()
|
|
|
|
if !rc.Enabled {
|
|
t.Error("expected Redis enabled from REDIS_ENABLED")
|
|
}
|
|
if !rc.EnableCircuitBreaker {
|
|
t.Error("expected EnableCircuitBreaker from REDIS_ENABLE_CIRCUIT_BREAKER")
|
|
}
|
|
if rc.CircuitBreakerThreshold != 7 {
|
|
t.Errorf("expected CircuitBreakerThreshold 7, got %d", rc.CircuitBreakerThreshold)
|
|
}
|
|
if rc.CircuitBreakerTimeout != 90 {
|
|
t.Errorf("expected CircuitBreakerTimeout 90, got %d", rc.CircuitBreakerTimeout)
|
|
}
|
|
if !rc.EnableHealthCheck {
|
|
t.Error("expected EnableHealthCheck from REDIS_ENABLE_HEALTH_CHECK")
|
|
}
|
|
if rc.HealthCheckInterval != 45 {
|
|
t.Errorf("expected HealthCheckInterval 45, got %d", rc.HealthCheckInterval)
|
|
}
|
|
}
|
|
|
|
// TestRedisConfig_ApplyEnvFallbacks_ConfigTakesPrecedence ensures explicitly-set
|
|
// config fields are not overridden by the env fallbacks.
|
|
func TestRedisConfig_ApplyEnvFallbacks_ConfigTakesPrecedence(t *testing.T) {
|
|
t.Setenv("REDIS_ENABLED", "true")
|
|
t.Setenv("REDIS_CIRCUIT_BREAKER_THRESHOLD", "9")
|
|
|
|
rc := &RedisConfig{Enabled: true, CircuitBreakerThreshold: 4}
|
|
rc.ApplyEnvFallbacks()
|
|
|
|
if rc.CircuitBreakerThreshold != 4 {
|
|
t.Errorf("expected config value 4 to take precedence, got %d", rc.CircuitBreakerThreshold)
|
|
}
|
|
}
|