dfc684a8fa
* feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. * feat(log): add security events logging for authentication and access control - Added `Security` method to `log.Logger` with `[SEC]` prefix at `LevelWarn`. - Added `SecurityStyle` (purple) to `pkg/cli` and `LogSecurity` helper. - Added security logging for GitHub CLI authentication checks. - Added security logging for Agentic configuration loading and token validation. - Added security logging for sandbox escape detection in `local.Medium`. - Updated MCP service to support logger injection and log tool executions and connections. - Ensured all security logs include `user` context for better auditability. - Fixed code formatting issues identified by CI. * feat(log): refine security logging and fix auto-merge CI - Moved `Security` log level to `LevelError` for better visibility. - Added robust `log.Username()` helper using `os/user`. - Differentiated high-risk (Security) and low-risk (Info) MCP tool executions. - Ensured consistent `user` context in all security-related logs. - Fixed merge conflict and missing repository context in `auto-merge` CI. - Fixed comment positioning in `pkg/mcp/mcp.go`. - Downgraded MCP TCP accept errors to standard `Error` log level. - Fixed code formatting in `internal/cmd/setup/cmd_github.go`. * feat(log): finalize security logging and address CI/CodeQL alerts - Refined `Security` logging: moved to `LevelError` and consistently include `user` context using `os/user`. - Differentiated MCP tool executions: write/delete are `Security` level, others are `Info`. - Fixed CodeQL alert: made UniFi TLS verification configurable (defaults to verify). - Updated UniFi CLI with `--verify-tls` flag and config support. - Fixed `auto-merge` CI failure by setting `GH_REPO` env var. - Fixed formatting and unused imports. - Added tests for UniFi config resolution. * fix: handle MustServiceFor return values correctly MustServiceFor returns (T, error), not just T. This was causing build failures after the rebase. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Claude <developers@lethean.io> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
40 lines
1.1 KiB
Go
40 lines
1.1 KiB
Go
package unifi
|
|
|
|
import (
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestResolveConfig(t *testing.T) {
|
|
// Set env vars
|
|
os.Setenv("UNIFI_URL", "https://env-url")
|
|
os.Setenv("UNIFI_USER", "env-user")
|
|
os.Setenv("UNIFI_PASS", "env-pass")
|
|
os.Setenv("UNIFI_VERIFY_TLS", "false")
|
|
defer func() {
|
|
os.Unsetenv("UNIFI_URL")
|
|
os.Unsetenv("UNIFI_USER")
|
|
os.Unsetenv("UNIFI_PASS")
|
|
os.Unsetenv("UNIFI_VERIFY_TLS")
|
|
}()
|
|
|
|
url, user, pass, apikey, verifyTLS, err := ResolveConfig("", "", "", "", nil)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, "https://env-url", url)
|
|
assert.Equal(t, "env-user", user)
|
|
assert.Equal(t, "env-pass", pass)
|
|
assert.Equal(t, "", apikey)
|
|
assert.False(t, verifyTLS)
|
|
|
|
// Flag overrides
|
|
url, user, pass, apikey, verifyTLS, err = ResolveConfig("https://flag-url", "flag-user", "flag-pass", "flag-apikey", nil)
|
|
assert.NoError(t, err)
|
|
assert.Equal(t, "https://flag-url", url)
|
|
assert.Equal(t, "flag-user", user)
|
|
assert.Equal(t, "flag-pass", pass)
|
|
assert.Equal(t, "flag-apikey", apikey)
|
|
// Env var for verifyTLS still applies if not overridden in ResolveConfig (which it isn't currently via flags)
|
|
assert.False(t, verifyTLS)
|
|
}
|