services_hardening_config_parser.rs (1714B)
1 #![forbid(unsafe_code)] 2 3 use std::error::Error; 4 5 use myc::{ 6 MYC_CONFIG_SCHEMA, MYC_CONFIG_SCHEMA_VERSION, MycConfigProfile, MycConfigV1ErrorKind, 7 parse_myc_config_v1, 8 }; 9 10 const EXAMPLE: &str = include_str!("../contracts/services_hardening/config.v1.example.toml"); 11 12 #[test] 13 fn root_api_admits_the_canonical_document_and_exposes_only_redacted_effective_output() { 14 let document = parse_myc_config_v1(EXAMPLE.as_bytes(), MycConfigProfile::Production) 15 .expect("canonical configuration"); 16 assert_eq!(document.schema(), MYC_CONFIG_SCHEMA); 17 assert_eq!(document.schema_version(), MYC_CONFIG_SCHEMA_VERSION); 18 assert_eq!(document.relay_count(), 2); 19 20 let effective = document.effective().canonical_json(); 21 assert!(effective.contains("\"source\":\"document\"")); 22 assert!(effective.contains("[redacted-public-key]")); 23 for forbidden in [ 24 "/var/lib/radroots", 25 "/run/radroots", 26 "relay-primary.example.test", 27 "4444444444444444", 28 "transport_wrapping_key", 29 ] { 30 assert!(!effective.contains(forbidden)); 31 assert!(!format!("{document:?}").contains(forbidden)); 32 } 33 } 34 35 #[test] 36 fn root_api_failure_is_stable_and_source_free() { 37 let secret = "never-render-this-value"; 38 let invalid = EXAMPLE.replacen( 39 "shutdown_grace_ms = 30000", 40 &format!("unknown = \"{secret}\""), 41 1, 42 ); 43 let failure = parse_myc_config_v1(invalid.as_bytes(), MycConfigProfile::Production) 44 .expect_err("unknown field must fail"); 45 assert_eq!(failure.kind(), MycConfigV1ErrorKind::InvalidDocument); 46 assert!(Error::source(&failure).is_none()); 47 assert!(!format!("{failure} {failure:?}").contains(secret)); 48 }