StasonJatham
62a7d2eb2e
Readability capabilities (exists/object_readable/listable) are now tracked
separately instead of a single exposure flag, matching how providers differ:
- Azure 'Blob' mode = object readable, not listable; 'Container' = listable
- Cloudflare R2 public URLs are never anonymously listable (root 500); R2 is
object-read only and is no longer probed for listing
- S3/GCS: 200 list = listable; 403 + readable index.html/robots.txt =
object readable only
New columns: cloud_assets.listable, cloud_assets.object_readable.
Azure: account-level container listing is never anonymous; discover containers
by probing a bounded common-name set (or the container from a URL path), then
list blobs.
Classifier: added the legacy AWS '.s3-<region>.amazonaws.com' bucket form.
On-demand scan: POST /api/scan {target} classifies a host or URL, follows CNAME
for custom domains, probes, and indexes readable resources; Azure container
comes from the URL path. UI has a Scan box.
Backfill: POST /api/reprobe re-probes already-discovered assets with the current
checks and indexes any readable ones, recovering findings from earlier probes.
DNS: CNAME-only enrichment (A/AAAA resolved only for matches), 64 workers,
larger queue.
Verified live against real public resources:
veteran1.nyc3.digitaloceanspaces.com listable, entries
bucket-01.s3-eu-west-1.amazonaws.com listable, entries
tartugeo-podcast.storage.googleapis.com listable, entries
eroticfeeldev.blob.core.windows.net/images listable, entries
54 lines
1.3 KiB
Go
54 lines
1.3 KiB
Go
package config
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestLoadDefaults(t *testing.T) {
|
|
t.Setenv("DATABASE_URL", "postgres://localhost/ctcloud")
|
|
c, err := Load()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if c.DatabaseURL != "postgres://localhost/ctcloud" {
|
|
t.Fatalf("database url = %q", c.DatabaseURL)
|
|
}
|
|
if c.DNSWorkers != 64 || c.DNSMaxCNAMEdepth != 8 {
|
|
t.Fatalf("unexpected DNS defaults: %+v", c)
|
|
}
|
|
if c.ActiveProbing {
|
|
t.Fatal("active probing must default to false")
|
|
}
|
|
}
|
|
|
|
func TestLoadOverrides(t *testing.T) {
|
|
t.Setenv("DATABASE_URL", "postgres://localhost/ctcloud")
|
|
t.Setenv("DNS_WORKERS", "4")
|
|
t.Setenv("ACTIVE_PROBING", "true")
|
|
t.Setenv("DB_FLUSH_INTERVAL", "250ms")
|
|
t.Setenv("STATS_INTERVAL", "30s")
|
|
c, err := Load()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if c.DNSWorkers != 4 || !c.ActiveProbing {
|
|
t.Fatalf("overrides not applied: %+v", c)
|
|
}
|
|
if c.DBFlushInterval != 250*time.Millisecond || c.StatsInterval != 30*time.Second {
|
|
t.Fatalf("duration overrides not applied: %+v", c)
|
|
}
|
|
}
|
|
|
|
func TestLoadInvalid(t *testing.T) {
|
|
t.Setenv("DATABASE_URL", "")
|
|
if _, err := Load(); err == nil {
|
|
t.Fatal("expected error without DATABASE_URL")
|
|
}
|
|
t.Setenv("DATABASE_URL", "postgres://localhost/ctcloud")
|
|
t.Setenv("LOG_LEVEL", "verbose")
|
|
if _, err := Load(); err == nil {
|
|
t.Fatal("expected error for bad LOG_LEVEL")
|
|
}
|
|
}
|