Why this matters: per DEPLOYMENT.md §3.5 and ADR-011, the admin password + * is permanently locked on first deploy (UserDataInitializer only seeds when + * the row is missing). If an operator forgets to set {@code APP_ADMIN_USERNAME} + * / {@code APP_ADMIN_PASSWORD}, prod silently boots with the well-known dev + * defaults — a credential-disclosure foot-gun, not a config typo. See #513. + */ +@ExtendWith(MockitoExtension.class) +class AdminSeedFailClosedTest { + + @Mock AppUserRepository userRepository; + @Mock UserGroupRepository groupRepository; + @Mock Environment environment; + @Mock PasswordEncoder passwordEncoder; + + UserDataInitializer initializer; + + @BeforeEach + void setUp() { + initializer = new UserDataInitializer(userRepository, groupRepository, environment); + } + + @Test + void refuses_to_seed_when_email_is_default_and_profile_is_not_dev() throws Exception { + when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty()); + when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false); + ReflectionTestUtils.setField(initializer, "adminEmail", UserDataInitializer.DEFAULT_ADMIN_EMAIL); + ReflectionTestUtils.setField(initializer, "adminPassword", "operator-set-this-one"); + + CommandLineRunner runner = initializer.initAdminUser(passwordEncoder); + + assertThatThrownBy(() -> runner.run()) + .isInstanceOf(IllegalStateException.class) + .hasMessageContaining("default credentials") + .hasMessageContaining("permanent"); + + verify(userRepository, never()).save(org.mockito.ArgumentMatchers.any()); + } + + @Test + void refuses_to_seed_when_password_is_default_and_profile_is_not_dev() throws Exception { + when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty()); + when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false); + ReflectionTestUtils.setField(initializer, "adminEmail", "admin@archiv.raddatz.cloud"); + ReflectionTestUtils.setField(initializer, "adminPassword", UserDataInitializer.DEFAULT_ADMIN_PASSWORD); + + CommandLineRunner runner = initializer.initAdminUser(passwordEncoder); + + assertThatThrownBy(() -> runner.run()) + .isInstanceOf(IllegalStateException.class) + .hasMessageContaining("default credentials"); + } + + @Test + void allows_seed_when_both_values_are_set_and_profile_is_not_dev() throws Exception { + when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty()); + when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(false); + when(passwordEncoder.encode(anyString())).thenReturn("$2a$10$stub"); + ReflectionTestUtils.setField(initializer, "adminEmail", "admin@archiv.raddatz.cloud"); + ReflectionTestUtils.setField(initializer, "adminPassword", "a-real-strong-password"); + + CommandLineRunner runner = initializer.initAdminUser(passwordEncoder); + runner.run(); + + verify(userRepository).save(org.mockito.ArgumentMatchers.any(AppUser.class)); + } + + @Test + void allows_seed_with_defaults_when_profile_is_dev() throws Exception { + when(userRepository.findByEmail(anyString())).thenReturn(Optional.empty()); + when(environment.matchesProfiles("dev", "test", "e2e")).thenReturn(true); + when(passwordEncoder.encode(anyString())).thenReturn("$2a$10$stub"); + ReflectionTestUtils.setField(initializer, "adminEmail", UserDataInitializer.DEFAULT_ADMIN_EMAIL); + ReflectionTestUtils.setField(initializer, "adminPassword", UserDataInitializer.DEFAULT_ADMIN_PASSWORD); + + CommandLineRunner runner = initializer.initAdminUser(passwordEncoder); + runner.run(); + + verify(userRepository).save(org.mockito.ArgumentMatchers.any(AppUser.class)); + } + + @Test + void does_not_check_defaults_when_admin_already_exists() throws Exception { + AppUser existing = AppUser.builder() + .email("someone@example.com") + .password("$2a$10$stub") + .build(); + when(userRepository.findByEmail(anyString())).thenReturn(Optional.of(existing)); + ReflectionTestUtils.setField(initializer, "adminEmail", UserDataInitializer.DEFAULT_ADMIN_EMAIL); + ReflectionTestUtils.setField(initializer, "adminPassword", UserDataInitializer.DEFAULT_ADMIN_PASSWORD); + + CommandLineRunner runner = initializer.initAdminUser(passwordEncoder); + runner.run(); + + verify(userRepository, never()).save(org.mockito.ArgumentMatchers.any()); + // Importantly, no IllegalStateException — re-deploys must not panic over + // historical default-seeded data they cannot retroactively fix. + } +} diff --git a/backend/src/test/java/org/raddatz/familienarchiv/user/AdminSeedPropertyKeyTest.java b/backend/src/test/java/org/raddatz/familienarchiv/user/AdminSeedPropertyKeyTest.java new file mode 100644 index 00000000..1b835e26 --- /dev/null +++ b/backend/src/test/java/org/raddatz/familienarchiv/user/AdminSeedPropertyKeyTest.java @@ -0,0 +1,95 @@ +package org.raddatz.familienarchiv.user; + +import org.junit.jupiter.api.Test; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.beans.factory.config.YamlPropertiesFactoryBean; +import org.springframework.boot.context.properties.bind.Binder; +import org.springframework.boot.context.properties.source.ConfigurationPropertySources; +import org.springframework.core.env.PropertiesPropertySource; +import org.springframework.core.io.ClassPathResource; + +import java.lang.reflect.Field; +import java.util.Properties; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * Pins the admin-seed property key contract. {@code UserDataInitializer} reads + * {@code @Value("${app.admin.email:...}")} and {@code @Value("${app.admin.password:...}")}. + * The yaml MUST expose those exact keys, not e.g. {@code app.admin.username}, or + * the env vars {@code APP_ADMIN_USERNAME} / {@code APP_ADMIN_PASSWORD} are + * silently ignored and the admin user gets seeded with the hardcoded defaults. + * + *
Discovered as a HIGH bug during the production-deploy bootstrap (#513): on + * first deploy the prod admin password is permanently locked to whatever ends + * up in the database, so a key-name mismatch would lock prod to the dev defaults + * {@code admin@familyarchive.local} / {@code admin123}. + * + *
No Spring context — Binder reads application.yaml directly. + */ +class AdminSeedPropertyKeyTest { + + @Test + void admin_email_key_binds_from_yaml() { + Binder binder = binderFromApplicationYaml(); + + String email = binder.bind("app.admin.email", String.class) + .orElseThrow(() -> new AssertionError( + "app.admin.email is missing from application.yaml. " + + "UserDataInitializer reads this exact key; if the yaml uses " + + "a different name (e.g. 'username'), the env var " + + "APP_ADMIN_USERNAME is silently ignored.")); + + assertThat(email) + .as("app.admin.email must resolve from APP_ADMIN_USERNAME or its default") + .isNotBlank(); + } + + @Test + void admin_password_key_binds_from_yaml() { + Binder binder = binderFromApplicationYaml(); + + String password = binder.bind("app.admin.password", String.class) + .orElseThrow(() -> new AssertionError( + "app.admin.password is missing from application.yaml. " + + "UserDataInitializer reads this exact key.")); + + assertThat(password) + .as("app.admin.password must resolve from APP_ADMIN_PASSWORD or its default") + .isNotBlank(); + } + + @Test + void userDataInitializer_reads_app_admin_email_not_username() throws NoSuchFieldException { + // Pin the Java side too: a future rename of the @Value placeholder + // (e.g. back to `${app.admin.username:...}`) would silently break the + // binding while the yaml-side assertions above still pass. See #513. + Field field = UserDataInitializer.class.getDeclaredField("adminEmail"); + Value annotation = field.getAnnotation(Value.class); + assertThat(annotation) + .as("UserDataInitializer.adminEmail must be @Value-annotated") + .isNotNull(); + assertThat(annotation.value()) + .as("UserDataInitializer must read app.admin.email — not username or any other key") + .startsWith("${app.admin.email:"); + } + + @Test + void userDataInitializer_reads_app_admin_password() throws NoSuchFieldException { + Field field = UserDataInitializer.class.getDeclaredField("adminPassword"); + Value annotation = field.getAnnotation(Value.class); + assertThat(annotation).isNotNull(); + assertThat(annotation.value()) + .as("UserDataInitializer must read app.admin.password") + .startsWith("${app.admin.password:"); + } + + private Binder binderFromApplicationYaml() { + YamlPropertiesFactoryBean yaml = new YamlPropertiesFactoryBean(); + yaml.setResources(new ClassPathResource("application.yaml")); + Properties props = yaml.getObject(); + assertThat(props).as("application.yaml must be on the classpath").isNotNull(); + return new Binder(ConfigurationPropertySources.from( + new PropertiesPropertySource("application", props))); + } +}