32ab2c7f47
Go-Quality-Baseline-Rollout ABGESCHLOSSEN. Code-Quality-Backlog (55 → 0): - errcheck: unbehandelte Close/Rollback/Remove explizit `_ =`; fmt.Sscanf `_, _ =` (Zero-Value degradiert sauber). - unused: toter Code entfernt (nodeIDOrHostname, stripTrailingNewline, acme.Service.user, strFold + ungenutzter Import). - noctx (net/http): http.NewRequestWithContext mit vorhandenem ctx. - staticcheck: QF1001/S1009/ST1005/SA9003. - contextcheck: detached-by-design-Stellen mit begründetem //nolint. Zwei echte Bugs beim Aufräumen gefunden+gefixt: - backup/remote SFTP-Upload: dst.Close()-Flush-Fehler wurde verschluckt → unvollständiges Remote-File galt als Erfolg. Jetzt geprüft+gemeldet. - haproxy_test: leere if-Assertion (SA9003) testete faktisch nichts → echte t.Errorf-Prüfung (kein HSTS für HSTS-disabled Domain). Bewusste Config-Entscheidungen (.golangci.yml): - noctx-on-os/exec ausgeschlossen: System-Command-Reloads (systemctl/nft/ wg/pg) dürfen NICHT an den Request-Context gebunden werden — ein Client- Disconnect darf keinen laufenden Reload mitten in der Ausführung killen. net/http-noctx bleibt voll aktiv. KEINE exec-Zeile im Code angefasst. - rowserrcheck/sqlclosecheck raus (database/sql-Linter, bei pgx nur FPs). Gate scharf gestellt: Makefile release-check ruft golangci-lint jetzt als HARTEN Gate (install-if-missing, pinned v2.12.2). `make release-check` grün: vet, golangci-lint, govulncheck, build, test -race. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
86 lines
2.3 KiB
Go
86 lines
2.3 KiB
Go
package handlers
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func init() { gin.SetMode(gin.TestMode) }
|
|
|
|
func setupACME(t *testing.T) (*gin.Engine, string) {
|
|
t.Helper()
|
|
root := t.TempDir()
|
|
if err := os.MkdirAll(filepath.Join(root, ".well-known", "acme-challenge"), 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r := gin.New()
|
|
NewACMEHandler(root).Register(r)
|
|
return r, root
|
|
}
|
|
|
|
func TestACME_ServesExistingToken(t *testing.T) {
|
|
r, root := setupACME(t)
|
|
tokenContent := "abc123-some-key-authorisation"
|
|
tokenPath := filepath.Join(root, ".well-known", "acme-challenge", "tok_42")
|
|
if err := os.WriteFile(tokenPath, []byte(tokenContent), 0o644); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/.well-known/acme-challenge/tok_42", nil)
|
|
r.ServeHTTP(rec, req)
|
|
|
|
if rec.Code != http.StatusOK {
|
|
t.Fatalf("status: %d, body=%s", rec.Code, rec.Body.String())
|
|
}
|
|
if rec.Body.String() != tokenContent {
|
|
t.Errorf("body: %q", rec.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestACME_MissingToken_Returns404(t *testing.T) {
|
|
r, _ := setupACME(t)
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/.well-known/acme-challenge/notthere", nil)
|
|
r.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusNotFound {
|
|
t.Errorf("status: %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestACME_RejectsTraversal(t *testing.T) {
|
|
// gin parses `:token` as one path segment, so `..` literally
|
|
// can't reach the handler — but we still want the validToken
|
|
// guard to reject any non-charset value defensively.
|
|
cases := []string{
|
|
"a/b",
|
|
"..",
|
|
"a%2Fb",
|
|
"with space",
|
|
"semi;colon",
|
|
}
|
|
for _, c := range cases {
|
|
if validToken(c) {
|
|
t.Errorf("validToken(%q) should be false", c)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestACME_DirIsNotAFile(t *testing.T) {
|
|
r, root := setupACME(t)
|
|
if err := os.Mkdir(filepath.Join(root, ".well-known", "acme-challenge", "subdir"), 0o755); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequestWithContext(context.Background(), http.MethodGet, "/.well-known/acme-challenge/subdir", nil)
|
|
r.ServeHTTP(rec, req)
|
|
if rec.Code != http.StatusNotFound {
|
|
t.Errorf("expected 404 for directory, got %d", rec.Code)
|
|
}
|
|
}
|