cli/pkg/unifi/config_test.go

135 lines
4 KiB
Go
Raw Normal View History

Add logging for security events (authentication, access) (#320) * feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. * feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. - Fixed code formatting issues identified by CI. * feat(log): refine security logging and fix auto-merge CI - Moved `Security` log level to `LevelError` for better visibility. - Added robust `log.Username()` helper using `os/user`. - Differentiated high-risk (Security) and low-risk (Info) MCP tool executions. - Ensured consistent `user` context in all security-related logs. - Fixed merge conflict and missing repository context in `auto-merge` CI. - Fixed comment positioning in `pkg/mcp/mcp.go`. - Downgraded MCP TCP accept errors to standard `Error` log level. - Fixed code formatting in `internal/cmd/setup/cmd_github.go`. * feat(log): finalize security logging and address CI/CodeQL alerts - Refined `Security` logging: moved to `LevelError` and consistently include `user` context using `os/user`. - Differentiated MCP tool executions: write/delete are `Security` level, others are `Info`. - Fixed CodeQL alert: made UniFi TLS verification configurable (defaults to verify). - Updated UniFi CLI with `--verify-tls` flag and config support. - Fixed `auto-merge` CI failure by setting `GH_REPO` env var. - Fixed formatting and unused imports. - Added tests for UniFi config resolution. * fix: handle MustServiceFor return values correctly MustServiceFor returns (T, error), not just T. This was causing build failures after the rebase. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <developers@lethean.io> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-05 10:26:48 +00:00
package unifi
import (
Add configuration documentation to README (#304) * docs: add configuration documentation to README Added a new 'Configuration' section to README.md as per the Documentation Audit Report (PR #209). Included: - Default configuration file location (~/.core/config.yaml) - Configuration file format (YAML) with examples - Layered configuration resolution order - Environment variable mapping for config overrides (CORE_CONFIG_*) - Common environment variables (CORE_DAEMON, NO_COLOR, MCP_ADDR, etc.) * docs: add configuration documentation and fix CI/CD auto-merge README.md: - Added comprehensive 'Configuration' section as per audit report #209. - Documented file format, location, and layered resolution order. - Provided environment variable mapping rules and common examples. .github/workflows/auto-merge.yml: - Replaced broken reusable workflow with a local implementation. - Added actions/checkout step to provide necessary Git context. - Fixed 'not a git repository' error by providing explicit repo context to the 'gh' CLI via the -R flag. - Maintained existing bot trust and author association logic. pkg/io/local/client.go: - Fixed code formatting to ensure QA checks pass. * docs: update environment variable description and fix merge conflict - Refined the description of environment variable mapping to be more accurate, clarifying that the prefix is stripped before conversion. - Resolved merge conflict in .github/workflows/auto-merge.yml. - Maintained the local auto-merge implementation to ensure Git context for the 'gh' CLI. * docs: configuration documentation, security fixes, and CI improvements README.md: - Added comprehensive 'Configuration' section as per audit report #209. - Documented file format, location, and layered resolution order. - Provided environment variable mapping rules and common examples. - Added documentation for UniFi configuration options. .github/workflows/auto-merge.yml: - Replaced broken reusable workflow with a local implementation. - Added actions/checkout step to provide necessary Git context. - Fixed 'not a git repository' error by providing explicit repo context to the 'gh' CLI via the -R flag. pkg/unifi: - Fixed security vulnerability (CodeQL) by making TLS verification configurable instead of always skipped. - Added 'unifi.insecure' config key and UNIFI_INSECURE env var. - Updated New and NewFromConfig signatures to handle insecure flag. internal/cmd/unifi: - Added --insecure flag to 'config' command to skip TLS verification. - Updated all UniFi subcommands to support the new configuration logic. pkg/io/local/client.go: - Fixed code formatting to ensure QA checks pass. * docs: configuration documentation, tests, and CI/CD fixes README.md: - Added comprehensive 'Configuration' section as per audit report #209. - Documented file format, location, and layered resolution order. - Provided environment variable mapping rules and common examples. - Documented UniFi configuration options. pkg/unifi: - Fixed security vulnerability by making TLS verification configurable. - Added pkg/unifi/config_test.go and pkg/unifi/client_test.go to provide unit test coverage for new and existing logic (satisfying Codecov). .github/workflows/auto-merge.yml: - Added actions/checkout@v4 to provide the required Git context for the 'gh' CLI, fixing 'not a git repository' errors. pkg/framework/core/core.go: - Fixed compilation errors in Workspace() and Crypt() methods due to upstream changes in MustServiceFor() return signature. - Added necessary error handling to pkg/workspace/service.go. These changes ensure that the project documentation is up-to-date and that the CI/CD pipeline is stable and secure.
2026-02-05 10:56:49 +00:00
"fmt"
"net/http"
"net/http/httptest"
Add logging for security events (authentication, access) (#320) * feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. * feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. - Fixed code formatting issues identified by CI. * feat(log): refine security logging and fix auto-merge CI - Moved `Security` log level to `LevelError` for better visibility. - Added robust `log.Username()` helper using `os/user`. - Differentiated high-risk (Security) and low-risk (Info) MCP tool executions. - Ensured consistent `user` context in all security-related logs. - Fixed merge conflict and missing repository context in `auto-merge` CI. - Fixed comment positioning in `pkg/mcp/mcp.go`. - Downgraded MCP TCP accept errors to standard `Error` log level. - Fixed code formatting in `internal/cmd/setup/cmd_github.go`. * feat(log): finalize security logging and address CI/CodeQL alerts - Refined `Security` logging: moved to `LevelError` and consistently include `user` context using `os/user`. - Differentiated MCP tool executions: write/delete are `Security` level, others are `Info`. - Fixed CodeQL alert: made UniFi TLS verification configurable (defaults to verify). - Updated UniFi CLI with `--verify-tls` flag and config support. - Fixed `auto-merge` CI failure by setting `GH_REPO` env var. - Fixed formatting and unused imports. - Added tests for UniFi config resolution. * fix: handle MustServiceFor return values correctly MustServiceFor returns (T, error), not just T. This was causing build failures after the rebase. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <developers@lethean.io> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-05 10:26:48 +00:00
"os"
"testing"
"github.com/stretchr/testify/assert"
)
func TestResolveConfig(t *testing.T) {
Add configuration documentation to README (#304) * docs: add configuration documentation to README Added a new 'Configuration' section to README.md as per the Documentation Audit Report (PR #209). Included: - Default configuration file location (~/.core/config.yaml) - Configuration file format (YAML) with examples - Layered configuration resolution order - Environment variable mapping for config overrides (CORE_CONFIG_*) - Common environment variables (CORE_DAEMON, NO_COLOR, MCP_ADDR, etc.) * docs: add configuration documentation and fix CI/CD auto-merge README.md: - Added comprehensive 'Configuration' section as per audit report #209. - Documented file format, location, and layered resolution order. - Provided environment variable mapping rules and common examples. .github/workflows/auto-merge.yml: - Replaced broken reusable workflow with a local implementation. - Added actions/checkout step to provide necessary Git context. - Fixed 'not a git repository' error by providing explicit repo context to the 'gh' CLI via the -R flag. - Maintained existing bot trust and author association logic. pkg/io/local/client.go: - Fixed code formatting to ensure QA checks pass. * docs: update environment variable description and fix merge conflict - Refined the description of environment variable mapping to be more accurate, clarifying that the prefix is stripped before conversion. - Resolved merge conflict in .github/workflows/auto-merge.yml. - Maintained the local auto-merge implementation to ensure Git context for the 'gh' CLI. * docs: configuration documentation, security fixes, and CI improvements README.md: - Added comprehensive 'Configuration' section as per audit report #209. - Documented file format, location, and layered resolution order. - Provided environment variable mapping rules and common examples. - Added documentation for UniFi configuration options. .github/workflows/auto-merge.yml: - Replaced broken reusable workflow with a local implementation. - Added actions/checkout step to provide necessary Git context. - Fixed 'not a git repository' error by providing explicit repo context to the 'gh' CLI via the -R flag. pkg/unifi: - Fixed security vulnerability (CodeQL) by making TLS verification configurable instead of always skipped. - Added 'unifi.insecure' config key and UNIFI_INSECURE env var. - Updated New and NewFromConfig signatures to handle insecure flag. internal/cmd/unifi: - Added --insecure flag to 'config' command to skip TLS verification. - Updated all UniFi subcommands to support the new configuration logic. pkg/io/local/client.go: - Fixed code formatting to ensure QA checks pass. * docs: configuration documentation, tests, and CI/CD fixes README.md: - Added comprehensive 'Configuration' section as per audit report #209. - Documented file format, location, and layered resolution order. - Provided environment variable mapping rules and common examples. - Documented UniFi configuration options. pkg/unifi: - Fixed security vulnerability by making TLS verification configurable. - Added pkg/unifi/config_test.go and pkg/unifi/client_test.go to provide unit test coverage for new and existing logic (satisfying Codecov). .github/workflows/auto-merge.yml: - Added actions/checkout@v4 to provide the required Git context for the 'gh' CLI, fixing 'not a git repository' errors. pkg/framework/core/core.go: - Fixed compilation errors in Workspace() and Crypt() methods due to upstream changes in MustServiceFor() return signature. - Added necessary error handling to pkg/workspace/service.go. These changes ensure that the project documentation is up-to-date and that the CI/CD pipeline is stable and secure.
2026-02-05 10:56:49 +00:00
// Clear environment variables to start clean
os.Unsetenv("UNIFI_URL")
os.Unsetenv("UNIFI_USER")
os.Unsetenv("UNIFI_PASS")
os.Unsetenv("UNIFI_APIKEY")
os.Unsetenv("UNIFI_INSECURE")
os.Unsetenv("CORE_CONFIG_UNIFI_URL")
os.Unsetenv("CORE_CONFIG_UNIFI_USER")
os.Unsetenv("CORE_CONFIG_UNIFI_PASS")
os.Unsetenv("CORE_CONFIG_UNIFI_APIKEY")
os.Unsetenv("CORE_CONFIG_UNIFI_INSECURE")
// 1. Test defaults
url, user, pass, apikey, insecure, err := ResolveConfig("", "", "", "", nil)
assert.NoError(t, err)
assert.Equal(t, DefaultURL, url)
assert.Empty(t, user)
assert.Empty(t, pass)
assert.Empty(t, apikey)
assert.False(t, insecure)
// 2. Test environment variables
t.Setenv("UNIFI_URL", "https://env.url")
t.Setenv("UNIFI_USER", "envuser")
t.Setenv("UNIFI_PASS", "envpass")
t.Setenv("UNIFI_APIKEY", "envapikey")
t.Setenv("UNIFI_INSECURE", "true")
url, user, pass, apikey, insecure, err = ResolveConfig("", "", "", "", nil)
assert.NoError(t, err)
assert.Equal(t, "https://env.url", url)
assert.Equal(t, "envuser", user)
assert.Equal(t, "envpass", pass)
assert.Equal(t, "envapikey", apikey)
assert.True(t, insecure)
// Test alternate UNIFI_INSECURE value
t.Setenv("UNIFI_INSECURE", "1")
_, _, _, _, insecure, _ = ResolveConfig("", "", "", "", nil)
assert.True(t, insecure)
// 3. Test flags (highest priority)
trueVal := true
url, user, pass, apikey, insecure, err = ResolveConfig("https://flag.url", "flaguser", "flagpass", "flagapikey", &trueVal)
assert.NoError(t, err)
assert.Equal(t, "https://flag.url", url)
assert.Equal(t, "flaguser", user)
assert.Equal(t, "flagpass", pass)
assert.Equal(t, "flagapikey", apikey)
assert.True(t, insecure)
// 4. Flags should still override env vars
falseVal := false
url, user, pass, apikey, insecure, err = ResolveConfig("https://flag.url", "flaguser", "flagpass", "flagapikey", &falseVal)
assert.NoError(t, err)
assert.Equal(t, "https://flag.url", url)
assert.Equal(t, "flaguser", user)
assert.Equal(t, "flagpass", pass)
assert.Equal(t, "flagapikey", apikey)
assert.False(t, insecure)
}
func TestNewFromConfig(t *testing.T) {
// Mock UniFi controller
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
fmt.Fprintln(w, `{"meta":{"rc":"ok"}, "data": []}`)
}))
defer ts.Close()
// 1. Success case
client, err := NewFromConfig(ts.URL, "user", "pass", "", nil)
assert.NoError(t, err)
assert.NotNil(t, client)
assert.Equal(t, ts.URL, client.URL())
// 2. Error case: No credentials
os.Unsetenv("UNIFI_USER")
os.Unsetenv("UNIFI_APIKEY")
client, err = NewFromConfig("", "", "", "", nil)
assert.Error(t, err)
assert.Nil(t, client)
assert.Contains(t, err.Error(), "no credentials configured")
}
func TestSaveConfig(t *testing.T) {
// Mock HOME to use temp dir for config
tmpDir := t.TempDir()
t.Setenv("HOME", tmpDir)
// Clear relevant env vars that might interfere
os.Unsetenv("UNIFI_URL")
os.Unsetenv("UNIFI_USER")
os.Unsetenv("UNIFI_PASS")
os.Unsetenv("UNIFI_APIKEY")
os.Unsetenv("UNIFI_INSECURE")
os.Unsetenv("CORE_CONFIG_UNIFI_URL")
os.Unsetenv("CORE_CONFIG_UNIFI_USER")
os.Unsetenv("CORE_CONFIG_UNIFI_PASS")
os.Unsetenv("CORE_CONFIG_UNIFI_APIKEY")
os.Unsetenv("CORE_CONFIG_UNIFI_INSECURE")
err := SaveConfig("https://save.url", "saveuser", "savepass", "saveapikey", nil)
assert.NoError(t, err)
// Verify it saved by resolving it
url, user, pass, apikey, insecure, err := ResolveConfig("", "", "", "", nil)
assert.NoError(t, err)
assert.Equal(t, "https://save.url", url)
assert.Equal(t, "saveuser", user)
assert.Equal(t, "savepass", pass)
assert.Equal(t, "saveapikey", apikey)
assert.False(t, insecure)
// Test saving insecure true
trueVal := true
err = SaveConfig("", "", "", "", &trueVal)
assert.NoError(t, err)
_, _, _, _, insecure, _ = ResolveConfig("", "", "", "", nil)
assert.True(t, insecure)
Add logging for security events (authentication, access) (#320) * feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. * feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. - Fixed code formatting issues identified by CI. * feat(log): refine security logging and fix auto-merge CI - Moved `Security` log level to `LevelError` for better visibility. - Added robust `log.Username()` helper using `os/user`. - Differentiated high-risk (Security) and low-risk (Info) MCP tool executions. - Ensured consistent `user` context in all security-related logs. - Fixed merge conflict and missing repository context in `auto-merge` CI. - Fixed comment positioning in `pkg/mcp/mcp.go`. - Downgraded MCP TCP accept errors to standard `Error` log level. - Fixed code formatting in `internal/cmd/setup/cmd_github.go`. * feat(log): finalize security logging and address CI/CodeQL alerts - Refined `Security` logging: moved to `LevelError` and consistently include `user` context using `os/user`. - Differentiated MCP tool executions: write/delete are `Security` level, others are `Info`. - Fixed CodeQL alert: made UniFi TLS verification configurable (defaults to verify). - Updated UniFi CLI with `--verify-tls` flag and config support. - Fixed `auto-merge` CI failure by setting `GH_REPO` env var. - Fixed formatting and unused imports. - Added tests for UniFi config resolution. * fix: handle MustServiceFor return values correctly MustServiceFor returns (T, error), not just T. This was causing build failures after the rebase. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <developers@lethean.io> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-02-05 10:26:48 +00:00
}