mirror of
https://github.com/zitadel/zitadel.git
synced 2026-08-18 17:05:03 -05:00
76 lines
2.4 KiB
Go
76 lines
2.4 KiB
Go
|
package cmd
|
||
|
|
|
||
|
|
import (
|
||
|
|
"bytes"
|
||
|
|
"testing"
|
||
|
|
|
||
|
|
"github.com/spf13/viper"
|
||
|
|
"github.com/stretchr/testify/assert"
|
||
|
|
"github.com/stretchr/testify/require"
|
||
|
|
|
||
|
|
"github.com/zitadel/zitadel/internal/crypto"
|
||
|
|
)
|
||
|
|
|
||
|
|
func testViper(t *testing.T) *viper.Viper {
|
||
|
|
t.Helper()
|
||
|
|
v := viper.New()
|
||
|
|
v.SetConfigType("yaml")
|
||
|
|
return v
|
||
|
|
}
|
||
|
|
|
||
|
|
func loadAndUnmarshalHashConfig(t *testing.T, v *viper.Viper, key string) crypto.HashConfig {
|
||
|
|
t.Helper()
|
||
|
|
var cfg crypto.HashConfig
|
||
|
|
require.NoError(t, v.UnmarshalKey(key, &cfg))
|
||
|
|
return cfg
|
||
|
|
}
|
||
|
|
|
||
|
|
func loadBaseDefaultConfig(t *testing.T, v *viper.Viper) {
|
||
|
|
t.Helper()
|
||
|
|
require.NoError(t, v.ReadConfig(bytes.NewBuffer(defaultConfig)))
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestLoadDefaultConfig_NonFIPSPasswordHasher(t *testing.T) {
|
||
|
|
v := testViper(t)
|
||
|
|
require.NoError(t, loadDefaultConfigInto(v))
|
||
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.PasswordHasher")
|
||
|
|
assert.Equal(t, crypto.HashNameBcrypt, cfg.Hasher.Algorithm)
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestLoadDefaultConfig_NonFIPSSecretHasher(t *testing.T) {
|
||
|
|
v := testViper(t)
|
||
|
|
require.NoError(t, loadDefaultConfigInto(v))
|
||
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.SecretHasher")
|
||
|
|
assert.Equal(t, crypto.HashNameBcrypt, cfg.Hasher.Algorithm)
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestLoadDefaultConfig_FIPSPasswordHasher(t *testing.T) {
|
||
|
|
v := testViper(t)
|
||
|
|
loadBaseDefaultConfig(t, v)
|
||
|
|
require.NoError(t, applyFipsDefaultOverlay(v))
|
||
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.PasswordHasher")
|
||
|
|
assert.Equal(t, crypto.HashNamePBKDF2, cfg.Hasher.Algorithm)
|
||
|
|
assert.Equal(t, 290000, v.GetInt("SystemDefaults.PasswordHasher.Hasher.Rounds"))
|
||
|
|
assert.Equal(t, "sha256", v.GetString("SystemDefaults.PasswordHasher.Hasher.Hash"))
|
||
|
|
assert.Empty(t, cfg.Verifiers)
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestLoadDefaultConfig_FIPSSecretHasher(t *testing.T) {
|
||
|
|
v := testViper(t)
|
||
|
|
loadBaseDefaultConfig(t, v)
|
||
|
|
require.NoError(t, applyFipsDefaultOverlay(v))
|
||
|
|
cfg := loadAndUnmarshalHashConfig(t, v, "SystemDefaults.SecretHasher")
|
||
|
|
assert.Equal(t, crypto.HashNamePBKDF2, cfg.Hasher.Algorithm)
|
||
|
|
assert.Equal(t, 290000, v.GetInt("SystemDefaults.SecretHasher.Hasher.Rounds"))
|
||
|
|
assert.Equal(t, "sha256", v.GetString("SystemDefaults.SecretHasher.Hasher.Hash"))
|
||
|
|
assert.Empty(t, cfg.Verifiers)
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestLoadDefaultConfig_FIPSVerifierKeysEmpty(t *testing.T) {
|
||
|
|
v := testViper(t)
|
||
|
|
loadBaseDefaultConfig(t, v)
|
||
|
|
require.NoError(t, applyFipsDefaultOverlay(v))
|
||
|
|
assert.Empty(t, v.GetStringSlice("SystemDefaults.PasswordHasher.Verifiers"))
|
||
|
|
assert.Empty(t, v.GetStringSlice("SystemDefaults.SecretHasher.Verifiers"))
|
||
|
|
}
|