production-rag-assistant/backend/tests/test_config_check.py at main · ictup/production-rag-assistant · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
from backend.app.core.config import Settings
from backend.app.core.config_check import check_settings, format_report


def make_settings(**overrides: object) -> Settings:
    values = {"api_keys": "dev-key", **overrides}
    return Settings(_env_file=None, **values)


def test_config_check_passes_local_default_settings() -> None:
    report = check_settings(make_settings())

    assert report.passed is True
    assert report.mode == "local"
    assert report.errors == []


def test_config_check_requires_openai_key_when_provider_enabled() -> None:
    report = check_settings(
        make_settings(
            embedding_provider="openai",
            openai_api_key=" ",
        )
    )

    assert report.passed is False
    assert [issue.variable for issue in report.errors] == ["OPENAI_API_KEY"]
    assert "OpenAI provider" in report.errors[0].message


def test_config_check_rejects_insecure_production_api_keys() -> None:
    report = check_settings(
        make_settings(
            env="production",
            api_keys="dev-key,short",
            api_key_workspace_access="dev-key=*",
        )
    )

    assert report.passed is False
    assert [issue.variable for issue in report.errors] == ["API_KEYS"]
    assert "short tokens" in report.errors[0].message


def test_config_check_accepts_stronger_production_api_key() -> None:
    report = check_settings(
        make_settings(
            env="production",
            api_keys="prod-token-1234567890",
            api_key_roles="prod-token-1234567890=admin",
            api_key_workspace_access="prod-token-1234567890=public",
            database_url="postgresql+asyncpg://u:p@postgres:5432/rag",
            sync_database_url="postgresql+psycopg://u:p@postgres:5432/rag",
            rate_limit_enabled=True,
        )
    )

    assert report.passed is True
    assert report.errors == []
    assert report.warnings == []


def test_config_check_reports_production_warnings() -> None:
    report = check_settings(
        make_settings(
            env="production",
            api_keys="prod-token-1234567890",
            database_url="postgresql+asyncpg://u:p@localhost:5432/rag",
            sync_database_url="postgresql+psycopg://u:p@127.0.0.1:5432/rag",
        )
    )

    assert report.passed is True
    assert {issue.variable for issue in report.warnings} == {
        "API_KEY_ROLES",
        "API_KEY_WORKSPACE_ACCESS",
        "DATABASE_URL",
        "RATE_LIMIT_ENABLED",
        "SYNC_DATABASE_URL",
    }


def test_config_check_rejects_wildcard_cors_credentials() -> None:
    report = check_settings(
        make_settings(
            cors_allowed_origins="https://app.example.com,*",
            cors_allow_credentials=True,
        )
    )

    assert report.passed is False
    assert [issue.variable for issue in report.errors] == ["CORS_ALLOW_CREDENTIALS"]


def test_config_check_rejects_invalid_api_key_role_mapping() -> None:
    report = check_settings(
        make_settings(api_key_roles="dev-key=owner"),
    )

    assert report.passed is False
    assert [issue.variable for issue in report.errors] == ["API_KEY_ROLES"]


def test_config_check_can_force_production_mode() -> None:
    report = check_settings(
        make_settings(api_keys="dev-key"),
        strict_production=True,
    )

    assert report.mode == "production"
    assert report.passed is False
    assert [issue.variable for issue in report.errors] == ["API_KEYS"]


def test_format_report_does_not_include_secret_values() -> None:
    report = check_settings(
        make_settings(
            env="production",
            api_keys="prod-secret-token-1234567890",
            openai_api_key="secret-token-should-not-print",
            api_key_workspace_access="",
        )
    )

    formatted = format_report(report)

    assert "prod-secret-token-1234567890" not in formatted
    assert "secret-token-should-not-print" not in formatted
    assert "API_KEY_WORKSPACE_ACCESS" in formatted
    assert "configuration check mode: production" in formatted