security: harden webhooks and session secrets

2026-04-26 19:46:57 +03:00
parent 94b0787cad
commit 77370eb963
17 changed files with 622 additions and 138 deletions
@@ -0,0 +1,28 @@
+import unittest
+
+from pydantic import ValidationError
+
+from config.settings import Settings
+
+
+class SettingsTests(unittest.TestCase):
+    def test_blank_postgres_password_is_rejected(self):
+        with self.assertRaises(ValidationError):
+            Settings(
+                _env_file=None,
+                BOT_TOKEN="token",
+                POSTGRES_USER="app_user",
+                POSTGRES_PASSWORD="",
+            )
+
+    def test_webapp_secrets_are_generated_when_missing(self):
+        settings = Settings(
+            _env_file=None,
+            BOT_TOKEN="token",
+            POSTGRES_USER="app_user",
+            POSTGRES_PASSWORD="app_password",
+        )
+
+        self.assertTrue(settings.WEBAPP_SESSION_SECRET)
+        self.assertTrue(settings.WEBHOOK_SECRET_TOKEN)
+        self.assertEqual(settings.WEBAPP_SESSION_TTL_SECONDS, 86400)