package cmd import ( "strings" "testing" ) func TestServiceConfigKeepsConnectivityDisabledWithoutExplicitAuthorization(t *testing.T) { configured, err := serviceConfigFromEnvironment(testEnvironment(nil)) if err != nil { t.Fatalf("configure disabled connectivity: %v", err) } if configured.config.AllowConnectivityChecks || configured.config.Probe != nil { t.Fatal("connectivity probe must not be created without explicit authorization") } } func TestServiceConfigRequiresAllExplicitConnectivityLimits(t *testing.T) { _, err := serviceConfigFromEnvironment(testEnvironment(map[string]string{ "CHORUS_ADMIN_ALLOW_CONNECTIVITY_PROBES": "1", })) if err == nil || !strings.Contains(err.Error(), "CHORUS_ADMIN_CONNECTIVITY_COOLDOWN_SECONDS") { t.Fatalf("missing cooldown error = %v", err) } } func TestServiceConfigRejectsInvalidProviderAllowedPorts(t *testing.T) { _, err := serviceConfigFromEnvironment(testEnvironment(map[string]string{ "CHORUS_ADMIN_ALLOW_CONNECTIVITY_PROBES": "1", "CHORUS_ADMIN_CONNECTIVITY_COOLDOWN_SECONDS": "60", "CHORUS_PROVIDER_HTTP_TIMEOUT_SECONDS": "10", "CHORUS_PROVIDER_MAX_RESPONSE_BYTES": "1024", "CHORUS_PROVIDER_ALLOWED_PORTS": "80,,443", })) if err == nil || !strings.Contains(err.Error(), "CHORUS_PROVIDER_ALLOWED_PORTS") { t.Fatalf("invalid provider ports error = %v", err) } } func TestServiceConfigAcceptsCustomProviderAllowedPort(t *testing.T) { configured, err := serviceConfigFromEnvironment(testEnvironment(map[string]string{ "CHORUS_ADMIN_ALLOW_CONNECTIVITY_PROBES": "1", "CHORUS_ADMIN_CONNECTIVITY_COOLDOWN_SECONDS": "60", "CHORUS_PROVIDER_HTTP_TIMEOUT_SECONDS": "10", "CHORUS_PROVIDER_MAX_RESPONSE_BYTES": "1024", "CHORUS_PROVIDER_ALLOWED_PORTS": "80,443,8080", })) if err != nil { t.Fatal(err) } if !configured.config.AllowConnectivityChecks || configured.config.Probe == nil { t.Fatal("connectivity probe was not configured") } } func testEnvironment(values map[string]string) func(string) (string, bool) { return func(key string) (string, bool) { value, ok := values[key] return value, ok } }