mirror of https://github.com/usememos/memos
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
30 lines
1.0 KiB
Go
30 lines
1.0 KiB
Go
package v1
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
|
|
storepb "github.com/usememos/memos/proto/gen/store"
|
|
"github.com/usememos/memos/store"
|
|
)
|
|
|
|
// TestConvertUserWebhookFromUserSettingOmitsSigningSecret guards the core security
|
|
// invariant of the signing-secret feature: the secret is INPUT_ONLY and must never
|
|
// be copied into an API response, even though it is persisted in the user setting.
|
|
func TestConvertUserWebhookFromUserSettingOmitsSigningSecret(t *testing.T) {
|
|
user := &store.User{Username: "alice"}
|
|
stored := &storepb.WebhooksUserSetting_Webhook{
|
|
Id: "webhook-id",
|
|
Title: "My Webhook",
|
|
Url: "https://example.com/postreceive",
|
|
SigningSecret: "whsec_super-secret-value",
|
|
}
|
|
|
|
apiWebhook := convertUserWebhookFromUserSetting(stored, user)
|
|
|
|
require.Equal(t, "My Webhook", apiWebhook.DisplayName)
|
|
require.Equal(t, "https://example.com/postreceive", apiWebhook.Url)
|
|
require.Empty(t, apiWebhook.SigningSecret, "signing secret must never be returned in API responses")
|
|
}
|