@@ -34,124 +34,48 @@ pub fn get_settings() -> Result<Settings, Report<TrustedServerError>> {
3434 message : "Failed to validate configuration" . to_string ( ) ,
3535 } ) ?;
3636
37- // Reject known placeholder values for secrets that feed into cryptographic operations.
38- settings. reject_placeholder_secrets ( ) ?;
39-
4037 if !settings. proxy . certificate_check {
4138 log:: warn!(
4239 "INSECURE: proxy.certificate_check is disabled — TLS certificates will NOT be verified"
4340 ) ;
4441 }
4542
46- Ok ( settings)
47- }
48-
49- #[ cfg( test) ]
50- mod tests {
51- use crate :: error:: TrustedServerError ;
52- use crate :: settings:: Settings ;
53- use crate :: test_support:: tests:: crate_test_settings_str;
54-
55- /// Builds a TOML string with the given secret values swapped in.
56- ///
57- /// # Panics
58- ///
59- /// Panics if the replacement patterns no longer match the test TOML,
60- /// which would cause the substitution to silently no-op.
61- fn toml_with_secrets ( secret_key : & str , proxy_secret : & str ) -> String {
62- let original = crate_test_settings_str ( ) ;
63- let after_secret_key = original. replace (
64- r#"secret_key = "test-secret-key""# ,
65- & format ! ( r#"secret_key = "{secret_key}""# ) ,
66- ) ;
67- assert_ne ! (
68- after_secret_key, original,
69- "should have replaced secret_key value"
70- ) ;
71- let result = after_secret_key. replace (
72- r#"proxy_secret = "unit-test-proxy-secret""# ,
73- & format ! ( r#"proxy_secret = "{proxy_secret}""# ) ,
74- ) ;
75- assert_ne ! (
76- result, after_secret_key,
77- "should have replaced proxy_secret value"
78- ) ;
79- result
80- }
81-
82- #[ test]
83- fn rejects_placeholder_secret_key ( ) {
84- let toml = toml_with_secrets ( "secret-key" , "real-proxy-secret" ) ;
85- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
86- let err = settings
87- . reject_placeholder_secrets ( )
88- . expect_err ( "should reject placeholder secret_key" ) ;
89- let root = err. current_context ( ) ;
90- assert ! (
91- matches!( root, TrustedServerError :: InsecureDefault { field } if field. contains( "synthetic.secret_key" ) ) ,
92- "error should mention synthetic.secret_key, got: {root}"
43+ if settings. synthetic . secret_key . expose ( ) == "trusted-server" {
44+ log:: warn!(
45+ "INSECURE: synthetic.secret_key is set to the default placeholder — \
46+ \
47+
9348 ) ;
9449 }
9550
96- #[ test]
97- fn rejects_placeholder_proxy_secret ( ) {
98- let toml = toml_with_secrets ( "real-secret-key" , "change-me-proxy-secret" ) ;
99- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
100- let err = settings
101- . reject_placeholder_secrets ( )
102- . expect_err ( "should reject placeholder proxy_secret" ) ;
103- let root = err. current_context ( ) ;
104- assert ! (
105- matches!( root, TrustedServerError :: InsecureDefault { field } if field. contains( "publisher.proxy_secret" ) ) ,
106- "error should mention publisher.proxy_secret, got: {root}"
51+ if settings. publisher . proxy_secret . expose ( ) == "change-me-proxy-secret" {
52+ log:: warn!(
53+ "INSECURE: publisher.proxy_secret is set to the default placeholder — \
54+ \
55+
10756 ) ;
10857 }
10958
110- #[ test]
111- fn rejects_both_placeholders_in_single_error ( ) {
112- let toml = toml_with_secrets ( "secret_key" , "change-me-proxy-secret" ) ;
113- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
114- let err = settings
115- . reject_placeholder_secrets ( )
116- . expect_err ( "should reject both placeholder secrets" ) ;
117- let root = err. current_context ( ) ;
118- match root {
119- TrustedServerError :: InsecureDefault { field } => {
120- assert ! (
121- field. contains( "synthetic.secret_key" ) ,
122- "error should mention synthetic.secret_key, got: {field}"
123- ) ;
124- assert ! (
125- field. contains( "publisher.proxy_secret" ) ,
126- "error should mention publisher.proxy_secret, got: {field}"
127- ) ;
128- }
129- other => panic ! ( "expected InsecureDefault, got: {other}" ) ,
130- }
131- }
59+ Ok ( settings)
60+ }
13261
133- #[ test]
134- fn accepts_non_placeholder_secrets ( ) {
135- let toml = toml_with_secrets ( "production-secret-key" , "production-proxy-secret" ) ;
136- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
137- settings
138- . reject_placeholder_secrets ( )
139- . expect ( "non-placeholder secrets should pass validation" ) ;
140- }
62+ #[ cfg( test) ]
63+ mod tests {
64+ use super :: * ;
14165
142- /// Smoke-test the full `get_settings()` pipeline (embedded bytes → UTF-8 →
143- /// parse → validate → placeholder check). The build-time TOML ships with
144- /// placeholder secrets, so the expected outcome is an [`InsecureDefault`]
145- /// error — but reaching that error proves every earlier stage succeeded.
14666 #[ test]
147- fn get_settings_rejects_embedded_placeholder_secrets ( ) {
148- let err = super :: get_settings ( ) . expect_err ( "should reject embedded placeholder secrets" ) ;
149- assert ! (
150- matches!(
151- err. current_context( ) ,
152- TrustedServerError :: InsecureDefault { .. }
153- ) ,
154- "should fail with InsecureDefault, got: {err}"
155- ) ;
67+ fn get_settings_loads_embedded_toml_successfully ( ) {
68+ // The embedded TOML contains placeholder secrets (e.g. "trusted-server",
69+ // "change-me-proxy-secret"). This is expected — production builds override
70+ // them via TRUSTED_SERVER__* env vars at build time.
71+ let settings = get_settings ( ) . expect ( "should load settings from embedded TOML" ) ;
72+ // Verify basic structure is loaded
73+ assert ! ( !settings. publisher. domain. is_empty( ) ) ;
74+ assert ! ( !settings. publisher. cookie_domain. is_empty( ) ) ;
75+ assert ! ( !settings. publisher. origin_url. is_empty( ) ) ;
76+ assert ! ( !settings. synthetic. counter_store. is_empty( ) ) ;
77+ assert ! ( !settings. synthetic. opid_store. is_empty( ) ) ;
78+ assert ! ( !settings. synthetic. secret_key. expose( ) . is_empty( ) ) ;
79+ assert ! ( !settings. synthetic. template. is_empty( ) ) ;
15680 }
15781}
0 commit comments