Janady13/missionmatch / internal/platform/config/config_test.go

Source identity

Field	Recorded value
Source type	GitHub source
Original record	Janady13/missionmatch / internal/platform/config/config_test.go
Date	Not specified in source
Repository	Janady13/missionmatch
Revision	720d47fae476b0d38477ae4401697d372b1ea2bc
Branch	feature/opportunity-to-outcome
Path or archive member	internal/platform/config/config_test.go
Original SHA-256	cae332c5827fc075dfc37a886969e660b0632679f4e31e6b5eb2af2a80d4062e
Git blob SHA	8c747340cbf881701e602246ce659160bcc2a954
Reading-copy SHA-256	cae332c5827fc075dfc37a886969e660b0632679f4e31e6b5eb2af2a80d4062e

Original source ↗

Every recorded occurrence

These 35 records contain identical original source bytes. Their paths and revisions remain part of the archive.

Original record	Branch or archive	Revision / identifier	Original location
Janady13/missionmatch / internal/platform/config/config_test.go	feature/opportunity-to-outcome	720d47fae476b0d38477ae4401697d372b1ea2bc	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	per-tenant-routing	9bde0f9a74b89d01980fa658e5253acda7528d0c	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	collision-deconfliction	4ee5a09972608ed89f8377c6665542d5f450f0a6	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ws6-retrieval	6c56e29231ec05735927fa265c97d517499dfeaf	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-a-shared-core	e0de03ac3a1ec826bd15d0e048e3b02baa23eeff	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	m5-price-to-win	41000ad30fff4129fdaf5ec84e15ba14c27d4890	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-c-slatematch	5cd60c918301b46ecd6ed3e03e20c395da0062e2	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ws1-ontology-sync	b596f449a32a1016fbd403c36505cc00a1ac9ee6	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	master	1e9249840a4302ec82e123b9c9cb6f75badea3e4	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ws8-teaching-loop	c823f0fb6bb2aba0f39001eb6de96f4000d9321f	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	w3-ai-staffing-recommendations	43d56387270ef4da4cabd794d97ca6a49909bc7d	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	mag-substrate	b82c7100a492dec67dfd1eda6b3f53def859be35	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ws3-clearance	4b8e7ce594c068621867f9c9deed0ec64ae6c553	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-d-command-center	255e7d1d420abf5e277d0cd8c9b14f6f72b6acb9	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	phase2-eval-fairness	d361af254701975fe239927656ababb56374655e	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-e-dataflow-deploy	433815a042f9741411e60fa553fe72143e9b10db	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ruthless-debug-sweep	b7d742f8f032984be3817efffa3eb8b13b651c1f	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	time-to-fill-survival	b66e1e505863d4f17741a4b9ede73509e45bd6c6	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ai-intelligence-layer	5d5ddff70393a197c5f54a45280bb5dd42b24755	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	graphrag-foundation	b0ddeb9f633fd138d09309d1a17b7d13bc3a67f7	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-a-opportunity-intelligence	1675031db74316e100782d063e9eda1a597fe3a1	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	deploy-and-ops	bdacd9d0b4d5998d25fc74bf4007f4c3ec538c7a	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ws9-bench-ingestion	f585a9ef32fa554663ce1fba9a414a54b6e49cf0	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ws2-alias-relationship	e4dada4601c6eb101830f9d223a9655dfa120616	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	presentation-readiness	eb574acaa29d71ce4d0f852572e87c275c79fdb7	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	vendor-intelligence	fe9796a19c261951d3f2565206c0c1b5ac294465	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-b-screenmatch	09015496d565a172bcaa15cfe9a8e4b072b13df0	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ws7-federal-signal	6a9f6ce9cfb13345ffb47770d4960e7c2d9c17c2	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-e-commercial-stubs	4437da660539284a400ee380b9b427a300c369ee	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	ai-brain-live	aac32fc49c878cc5bca099459307611562d0bac1	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-d-missionmatch	3be46ba89edb737182075a2b320509b42dc916f8	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	phase2-connectors	e038d4c687aec16f8bd9bc4d907eea14d91f8704	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	workstream-b-sam-contract-awards	d5101cceb98e70000cebb31d3e7ac73d747d3a6d	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	feature/aioe-upgrade	2178e7298d0e5d9af83afa12402fd587f0ba6ed8	Open original
Janady13/missionmatch / internal/platform/config/config_test.go	capture-readiness	bae6af7cb2997e819174a9e9cfff5e16067a1975	Open original

Recovered source transcript

Download complete source text ↓157 lines · 5.7 KB

package config

import (
	"bytes"
	"strings"
	"testing"
)

func TestValidateDevDefaultsOK(t *testing.T) {
	c := Config{
		Env: EnvDevelopment, HTTPAddr: ":8080", Cloud: CloudLocal,
		Embeddings:            Embeddings{Provider: ProviderFake, Dimension: 384},
		DecisionRetentionDays: 90,
		Auth:                  Auth{PepperVersion: 1, SessionIdleSeconds: 900, SessionAbsoluteSeconds: 43200, PendingAbsoluteSeconds: 300},
	}
	if err := c.Validate(); err != nil {
		t.Fatalf("dev defaults should validate, got %v", err)
	}
}

func TestProductionRejectsFakeProviderAndLocalCloud(t *testing.T) {
	c := Config{
		Env: EnvProduction, HTTPAddr: ":8080", Cloud: CloudLocal,
		AppDatabaseURL: "", // also missing
		Embeddings:     Embeddings{Provider: ProviderFake, Dimension: 384},
	}
	err := c.Validate()
	if err == nil {
		t.Fatal("production with fake provider + local cloud + no DB must fail")
	}
	msg := err.Error()
	for _, want := range []string{"MM_DATABASE_URL", "fake embedding provider", "government cloud"} {
		if !strings.Contains(msg, want) {
			t.Errorf("expected error to mention %q; got: %s", want, msg)
		}
	}
}

func TestOpenAIProviderRequiresEndpointAndModel(t *testing.T) {
	c := Config{
		Env: EnvDevelopment, HTTPAddr: ":8080", Cloud: CloudLocal,
		Embeddings: Embeddings{Provider: ProviderOpenAI, Dimension: 384},
	}
	err := c.Validate()
	if err == nil {
		t.Fatal("openai provider without endpoint/model must fail")
	}
	if !strings.Contains(err.Error(), "MM_EMBED_ENDPOINT") || !strings.Contains(err.Error(), "MM_EMBED_MODEL") {
		t.Fatalf("want endpoint+model errors, got: %v", err)
	}
}

func TestInvalidEnumsRejected(t *testing.T) {
	c := Config{Env: "staging", Cloud: "gcp", Embeddings: Embeddings{Provider: "magic", Dimension: 0}}
	err := c.Validate()
	if err == nil {
		t.Fatal("invalid enums + zero dimension must fail")
	}
	for _, want := range []string{"MM_ENV", "MM_CLOUD", "MM_EMBED_PROVIDER", "MM_EMBED_DIMENSION"} {
		if !strings.Contains(err.Error(), want) {
			t.Errorf("expected %q in error; got: %s", want, err.Error())
		}
	}
}

func TestProductionRejectsDevHeaderAuthAndMissingAuthSecrets(t *testing.T) {
	c := Config{
		Env: EnvProduction, HTTPAddr: ":8080", Cloud: CloudAWSGovCloud,
		AppDatabaseURL:     "postgres://app@db/missionmatch",
		Embeddings:         Embeddings{Provider: ProviderOpenAI, Endpoint: "https://e", Model: "m", Dimension: 384},
		RequireFIPS:        false, // also rejected
		AllowDevHeaderAuth: true,  // the backdoor must never be on in production
		Auth:               Auth{PepperVersion: 1, SessionIdleSeconds: 900, SessionAbsoluteSeconds: 43200, PendingAbsoluteSeconds: 300},
	}
	err := c.Validate()
	if err == nil {
		t.Fatal("production with the dev header resolver, no FIPS, and no auth secrets must fail")
	}
	for _, want := range []string{
		"MM_ALLOW_DEV_HEADER_AUTH", "MM_REQUIRE_FIPS", "MM_CREDENTIAL_PEPPER", "MM_TOTP_KEK",
		"MM_CSRF_KEY", "MM_RECOVERY_LOOKUP_KEY", "MM_ALLOWED_ORIGINS", "MM_COOKIE_SECURE",
	} {
		if !strings.Contains(err.Error(), want) {
			t.Errorf("expected error to mention %q; got: %s", want, err.Error())
		}
	}
}

func TestLoadAppliesDefaults(t *testing.T) {
	// No MM_* env set in this test process → all defaults; dev config must load clean.
	for _, k := range []string{
		"MM_ENV", "MM_HTTP_ADDR", "MM_DATABASE_URL", "MM_MIGRATOR_DATABASE_URL", "MM_CLOUD",
		"MM_COMPLIANCE_DATABASE_URL", "MM_DECISION_RETENTION_DAYS",
		"MM_EMBED_PROVIDER", "MM_EMBED_ENDPOINT", "MM_EMBED_MODEL", "MM_EMBED_DIMENSION",
		"MM_EMBED_API_KEY", "MM_REQUIRE_FIPS", "MM_ALLOW_DEV_HEADER_AUTH",
		"MM_ALLOWED_ORIGINS", "MM_TRUSTED_PROXY_HEADER",
		"MM_CREDENTIAL_PEPPER_VERSION", "MM_CREDENTIAL_PEPPER", "MM_CREDENTIAL_PEPPER_PREVIOUS",
		"MM_TOTP_KEK_VERSION", "MM_TOTP_KEK", "MM_CSRF_KEY", "MM_RECOVERY_LOOKUP_KEY",
		"MM_TOTP_ISSUER", "MM_SESSION_IDLE_SECONDS", "MM_SESSION_ABSOLUTE_SECONDS",
		"MM_SESSION_PENDING_SECONDS", "MM_INVITE_EXPIRY_SECONDS", "MM_COOKIE_SECURE",
	} {
		t.Setenv(k, "")
	}
	c, err := Load()
	if err != nil {
		t.Fatalf("Load with defaults failed: %v", err)
	}
	if c.Env != EnvDevelopment || c.Cloud != CloudLocal || c.Embeddings.Provider != ProviderFake {
		t.Fatalf("unexpected defaults: %+v", c)
	}
	if c.Embeddings.Dimension != 384 || c.HTTPAddr != ":8080" {
		t.Fatalf("unexpected scalar defaults: %+v", c)
	}
}

func TestGetBytesEncodings(t *testing.T) {
	const k = "MM_TEST_SECRET"

	cases := []struct {
		name    string
		val     string
		want    []byte
		wantErr bool
	}{
		{"unset yields nil", "", nil, false},
		{"bare base64 decodes", "aGVsbG8=", []byte("hello"), false}, // base64("hello")
		{"explicit base64 prefix", "base64:aGVsbG8=", []byte("hello"), false},
		{"hex prefix decodes", "hex:68656c6c6f", []byte("hello"), false},
		{"raw prefix is literal", "raw:hello", []byte("hello"), false},
		// "hello" is NOT valid standard base64 (length 5), so a bare value must be a hard error rather
		// than silently fall back to the raw five bytes. That silent fall back was the bug.
		{"bare non base64 errors", "hello", nil, true},
		{"bad hex errors", "hex:zz", nil, true},
		{"bad explicit base64 errors", "base64:!!!", nil, true},
		// A raw passphrase that happens to be valid base64 stays literal under the raw: prefix.
		{"raw keeps base64 looking passphrase literal", "raw:aGVsbG8=", []byte("aGVsbG8="), false},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			t.Setenv(k, tc.val)
			got, err := getBytes(k)
			if tc.wantErr {
				if err == nil {
					t.Fatalf("want error for value %q, got nil (bytes %v)", tc.val, got)
				}
				return
			}
			if err != nil {
				t.Fatalf("unexpected error for value %q: %v", tc.val, err)
			}
			if !bytes.Equal(got, tc.want) {
				t.Fatalf("value %q: got %v, want %v", tc.val, got, tc.want)
			}
		})
	}
}