@@ -34,9 +34,6 @@ pub fn get_settings() -> Result<Settings, Report<TrustedServerError>> {
3434 message : "Failed to validate configuration" . to_string ( ) ,
3535 } ) ?;
3636
37- // Reject known placeholder values for secrets that feed into cryptographic operations.
38- settings. reject_placeholder_secrets ( ) ?;
39-
4037 if !settings. proxy . certificate_check {
4138 log:: warn!(
4239 "INSECURE: proxy.certificate_check is disabled — TLS certificates will NOT be verified"
@@ -48,110 +45,22 @@ pub fn get_settings() -> Result<Settings, Report<TrustedServerError>> {
4845
4946#[ cfg( test) ]
5047mod tests {
51- use crate :: error:: TrustedServerError ;
52- use crate :: settings:: Settings ;
53- use crate :: test_support:: tests:: crate_test_settings_str;
54-
55- /// Builds a TOML string with the given secret values swapped in.
56- ///
57- /// # Panics
58- ///
59- /// Panics if the replacement patterns no longer match the test TOML,
60- /// which would cause the substitution to silently no-op.
61- fn toml_with_secrets ( secret_key : & str , proxy_secret : & str ) -> String {
62- let original = crate_test_settings_str ( ) ;
63- let after_secret_key = original. replace (
64- r#"secret_key = "test-secret-key""# ,
65- & format ! ( r#"secret_key = "{secret_key}""# ) ,
66- ) ;
67- assert_ne ! (
68- after_secret_key, original,
69- "should have replaced secret_key value"
70- ) ;
71- let result = after_secret_key. replace (
72- r#"proxy_secret = "unit-test-proxy-secret""# ,
73- & format ! ( r#"proxy_secret = "{proxy_secret}""# ) ,
74- ) ;
75- assert_ne ! (
76- result, after_secret_key,
77- "should have replaced proxy_secret value"
78- ) ;
79- result
80- }
81-
82- #[ test]
83- fn rejects_placeholder_secret_key ( ) {
84- let toml = toml_with_secrets ( "secret-key" , "real-proxy-secret" ) ;
85- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
86- let err = settings
87- . reject_placeholder_secrets ( )
88- . expect_err ( "should reject placeholder secret_key" ) ;
89- let root = err. current_context ( ) ;
90- assert ! (
91- matches!( root, TrustedServerError :: InsecureDefault { field } if field. contains( "synthetic.secret_key" ) ) ,
92- "error should mention synthetic.secret_key, got: {root}"
93- ) ;
94- }
48+ use super :: * ;
9549
9650 #[ test]
97- fn rejects_placeholder_proxy_secret ( ) {
98- let toml = toml_with_secrets ( "real-secret-key" , "change-me-proxy-secret" ) ;
99- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
100- let err = settings
101- . reject_placeholder_secrets ( )
102- . expect_err ( "should reject placeholder proxy_secret" ) ;
103- let root = err. current_context ( ) ;
104- assert ! (
105- matches!( root, TrustedServerError :: InsecureDefault { field } if field. contains( "publisher.proxy_secret" ) ) ,
106- "error should mention publisher.proxy_secret, got: {root}"
107- ) ;
108- }
109-
110- #[ test]
111- fn rejects_both_placeholders_in_single_error ( ) {
112- let toml = toml_with_secrets ( "secret_key" , "change-me-proxy-secret" ) ;
113- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
114- let err = settings
115- . reject_placeholder_secrets ( )
116- . expect_err ( "should reject both placeholder secrets" ) ;
117- let root = err. current_context ( ) ;
118- match root {
119- TrustedServerError :: InsecureDefault { field } => {
120- assert ! (
121- field. contains( "synthetic.secret_key" ) ,
122- "error should mention synthetic.secret_key, got: {field}"
123- ) ;
124- assert ! (
125- field. contains( "publisher.proxy_secret" ) ,
126- "error should mention publisher.proxy_secret, got: {field}"
127- ) ;
128- }
129- other => panic ! ( "expected InsecureDefault, got: {other}" ) ,
130- }
131- }
132-
133- #[ test]
134- fn accepts_non_placeholder_secrets ( ) {
135- let toml = toml_with_secrets ( "production-secret-key" , "production-proxy-secret" ) ;
136- let settings = Settings :: from_toml ( & toml) . expect ( "should parse TOML" ) ;
137- settings
138- . reject_placeholder_secrets ( )
139- . expect ( "non-placeholder secrets should pass validation" ) ;
140- }
141-
142- /// Smoke-test the full `get_settings()` pipeline (embedded bytes → UTF-8 →
143- /// parse → validate → placeholder check). The build-time TOML ships with
144- /// placeholder secrets, so the expected outcome is an [`InsecureDefault`]
145- /// error — but reaching that error proves every earlier stage succeeded.
146- #[ test]
147- fn get_settings_rejects_embedded_placeholder_secrets ( ) {
148- let err = super :: get_settings ( ) . expect_err ( "should reject embedded placeholder secrets" ) ;
149- assert ! (
150- matches!(
151- err. current_context( ) ,
152- TrustedServerError :: InsecureDefault { .. }
153- ) ,
154- "should fail with InsecureDefault, got: {err}"
155- ) ;
51+ fn test_get_settings ( ) {
52+ // Test that Settings::new() loads successfully
53+ let settings = get_settings ( ) ;
54+ assert ! ( settings. is_ok( ) , "Settings should load from embedded TOML" ) ;
55+
56+ let settings = settings. expect ( "should load settings from embedded TOML" ) ;
57+ // Verify basic structure is loaded
58+ assert ! ( !settings. publisher. domain. is_empty( ) ) ;
59+ assert ! ( !settings. publisher. cookie_domain. is_empty( ) ) ;
60+ assert ! ( !settings. publisher. origin_url. is_empty( ) ) ;
61+ assert ! ( !settings. synthetic. counter_store. is_empty( ) ) ;
62+ assert ! ( !settings. synthetic. opid_store. is_empty( ) ) ;
63+ assert ! ( !settings. synthetic. secret_key. expose( ) . is_empty( ) ) ;
64+ assert ! ( !settings. synthetic. template. is_empty( ) ) ;
15665 }
15766}
0 commit comments