init

internal/notify/notify_test.go

@@ -0,0 +1,24 @@
+package notify
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestConfigSecretsEncryptedAtRest(t *testing.T) {
+	s := New(nil, []byte("0123456789abcdef0123456789abcdef"))
+	raw, err := s.encodeConfig(map[string]string{"url": "https://example.invalid/hook", "token": "super-secret-token", "password": "pw123"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if strings.Contains(raw, "super-secret-token") || strings.Contains(raw, "pw123") {
+		t.Fatalf("secret leaked in persisted config: %s", raw)
+	}
+	cfg, err := s.decodeConfig(raw)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg["token"] != "super-secret-token" || cfg["password"] != "pw123" {
+		t.Fatalf("roundtrip mismatch: %#v", cfg)
+	}
+}