Andy Dixon
89580c0a79
- TOTP second factor (RFC 6238, secret encrypted under the master key), ten hashed single-use recovery codes, two-step login with a pending token bound to the client address, account enrolment/disable, admin reset - tests/security: prompt-injection corpus never acts or creates evidence-free beliefs; roles and CSRF on form and API paths; cross-mind isolation (demo scenario 5); stored-XSS escaping and CSP across pages; secrets never echoed (API, pages, database, archives); hostile archive import; session lifecycle and security headers - OpenAPI 3.1 document generated from the route table, served at /api/v1/openapi.json and kept complete by a test - gosec clean (justified #nosec annotations, cookie/redirect hardening, bounded multipart parsing, UUID packing without narrowing conversions); govulncheck clean with toolchain pinned to go1.26.8 - THREAT_MODEL verification pointers, SECURITY.md testing section, README, CHANGELOG 0.1.0, docs/RELEASE_NOTES.md, PLAN status
42 lines
1.1 KiB
Go
42 lines
1.1 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"regexp"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// TestOpenAPICoversEveryRoute keeps openapi.json honest: every /api/v1 route
|
|
// registered in this package must be documented with its method.
|
|
func TestOpenAPICoversEveryRoute(t *testing.T) {
|
|
var doc struct {
|
|
Paths map[string]map[string]any `json:"paths"`
|
|
}
|
|
if err := json.Unmarshal(openAPI, &doc); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
re := regexp.MustCompile(`Handle(?:Func)?\("(GET|POST|PUT|PATCH|DELETE) (/api/v1[^"]*)"`)
|
|
entries, _ := os.ReadDir(".")
|
|
var missing []string
|
|
for _, e := range entries {
|
|
if !strings.HasSuffix(e.Name(), ".go") || strings.HasSuffix(e.Name(), "_test.go") {
|
|
continue
|
|
}
|
|
src, _ := os.ReadFile(e.Name())
|
|
for _, m := range re.FindAllStringSubmatch(string(src), -1) {
|
|
method, path := strings.ToLower(m[1]), m[2]
|
|
if path == "/api/v1/openapi.json" {
|
|
continue
|
|
}
|
|
if _, ok := doc.Paths[path][method]; !ok {
|
|
missing = append(missing, m[1]+" "+path)
|
|
}
|
|
}
|
|
}
|
|
if len(missing) > 0 {
|
|
t.Fatalf("routes missing from openapi.json (regenerate it):\n%s", strings.Join(missing, "\n"))
|
|
}
|
|
}
|