internal/net/p2_hardening_test.go


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

package net

import (
	"testing"

	"thehouseoficarus/internal/config"
)

// TestPartialTLSConfigIsFatal: an operator who sets only one of
// tls.cert_file / tls.key_file must get a startup error instead of a silent
// self-signed fallback that makes clients fail verification confusingly.
func TestPartialTLSConfigIsFatal(t *testing.T) {
	cfg := config.Default()
	cfg.TLS.CertFile = "/tmp/only-cert.pem"
	cfg.TLS.KeyFile = ""
	if _, err := loadOrGenerateCert(cfg, "test"); err == nil {
		t.Fatal("accepted a half-configured TLS cert pair")
	}
}

// TestPreAuthStatesUseShortTimeout: the new-account prompts are pre-auth
// states and must use the short login window, not the 30-minute idle window.
func TestPreAuthStatesUseShortTimeout(t *testing.T) {
	for _, st := range []SessionState{StateAccountName, StatePassword, StateNewAccountPass, StateNewAccount} {
		sess := &Session{}
		sess.SetState(st)
		if got := sessionIdleTimeout(sess); got != loginReadTimeout {
			t.Fatalf("state %v timeout = %v, want %v", st, got, loginReadTimeout)
		}
	}
}