From 65a0b7a0e419db2fe44c213171d0af79409da54f Mon Sep 17 00:00:00 2001 From: rcourtman Date: Wed, 4 Feb 2026 11:12:54 +0000 Subject: [PATCH] test: cover change-password and public export/import guards --- internal/api/security_regression_test.go | 45 ++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/internal/api/security_regression_test.go b/internal/api/security_regression_test.go index f86bc8ee0..bd1953d64 100644 --- a/internal/api/security_regression_test.go +++ b/internal/api/security_regression_test.go @@ -173,6 +173,19 @@ func TestSchedulerHealthRequiresAuthInAPIMode(t *testing.T) { } } +func TestChangePasswordRequiresAuthInAPIMode(t *testing.T) { + record := newTokenRecord(t, "change-pass-token-123.12345678", []string{config.ScopeSettingsWrite}, nil) + cfg := newTestConfigWithTokens(t, record) + router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0") + + req := httptest.NewRequest(http.MethodPost, "/api/security/change-password", strings.NewReader(`{}`)) + rec := httptest.NewRecorder() + router.Handler().ServeHTTP(rec, req) + if rec.Code != http.StatusUnauthorized { + t.Fatalf("expected 401 without auth, got %d", rec.Code) + } +} + func TestLicenseFeaturesRequiresAuthInAPIMode(t *testing.T) { record := newTokenRecord(t, "license-token-123.12345678", []string{config.ScopeMonitoringRead}, nil) cfg := newTestConfigWithTokens(t, record) @@ -1387,6 +1400,38 @@ func TestConfigImportRequiresAuthInAPIMode(t *testing.T) { } } +func TestConfigExportBlocksPublicNetworkWithoutAuth(t *testing.T) { + cfg := &config.Config{ + DataPath: t.TempDir(), + ConfigPath: t.TempDir(), + } + router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0") + + req := httptest.NewRequest(http.MethodPost, "/api/config/export", strings.NewReader(`{}`)) + req.RemoteAddr = "203.0.113.10:1234" + rec := httptest.NewRecorder() + router.Handler().ServeHTTP(rec, req) + if rec.Code != http.StatusForbidden { + t.Fatalf("expected 403 for public network without auth, got %d", rec.Code) + } +} + +func TestConfigImportBlocksPublicNetworkWithoutAuth(t *testing.T) { + cfg := &config.Config{ + DataPath: t.TempDir(), + ConfigPath: t.TempDir(), + } + router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0") + + req := httptest.NewRequest(http.MethodPost, "/api/config/import", strings.NewReader(`{}`)) + req.RemoteAddr = "203.0.113.10:1234" + rec := httptest.NewRecorder() + router.Handler().ServeHTTP(rec, req) + if rec.Code != http.StatusForbidden { + t.Fatalf("expected 403 for public network without auth, got %d", rec.Code) + } +} + func TestAutoRegisterRequiresAuth(t *testing.T) { cfg := newTestConfigWithTokens(t) router := NewRouter(cfg, nil, nil, nil, nil, "1.0.0")