Merging latest wip/api-modules changes

env.js

@@ -2,6 +2,7 @@
 
 var env = { };
 var crypto = require('crypto');
+var consts = require('./lib/constants');
 // Module to constrain all config and environment parsing to one spot.
 function config ( ) {
 
@@ -26,6 +27,13 @@ function config ( ) {
   env.api_secret = null;
   // if a passphrase was provided, get the hex digest to mint a single token
   if (useSecret) {
+    if (process.env.API_SECRET.length < consts.MIN_PASSPHRASE_LENGTH) {
+      var msg = ["API_SECRET should be at least", consts.MIN_PASSPHRASE_LENGTH, "characters"];
+      var err = new Error(msg.join(' '));
+      // console.error(err);
+      throw err;
+      process.exit(1);
+    }
     shasum.update(process.env.API_SECRET);
     env.api_secret = shasum.digest('hex');
   }

lib/constants.json

@@ -1,4 +1,5 @@
 {
+  "MIN_PASSPHRASE_LENGTH": 12,
   "HTTP_OK" : 200,
   "HTTP_UNAUTHORIZED" : 401,
   "HTTP_VALIDATION_ERROR" : 422,

tests/api.entries.test.js

@@ -31,7 +31,7 @@ describe('Entries REST api', function ( ) {
       .get('/entries/.json')
       .expect(200)
       .end(function (err, res)  {
-        console.log('body', res.body);
+        // console.log('body', res.body);
         res.body.length.should.equal(30);
         done( );
       });
@@ -57,7 +57,7 @@ describe('Entries REST api', function ( ) {
         .send(load('json'))
         .expect(201)
         .end(function (err, res)  {
-          console.log(res.body);
+          // console.log(res.body);
           res.body.length.should.equal(30);
           done( );
           // console.log('err', err, 'res', res);

tests/security.test.js

@@ -0,0 +1,86 @@
+'use strict';
+
+var request = require('supertest');
+var should = require('should');
+var load = require('./fixtures/load');
+
+describe('API_SECRET', function ( ) {
+  var api = require('../lib/api/');
+  api.should.be.ok;
+
+  var scope = this;
+  function setup_app (env, fn) {
+    var ctx = { };
+    ctx.wares = require('../lib/middleware/')(env);
+    ctx.store = require('../lib/storage')(env);
+    ctx.archive = require('../lib/entries')(env.mongo_collection, ctx.store);
+    ctx.settings = require('../lib/settings')(env.settings_collection, ctx.store);
+
+    ctx.store(function ( ) {
+      ctx.app = api(env, ctx.wares, ctx.archive, ctx.settings);
+      scope.app = ctx.app;
+      ctx.archive.create(load('json'), fn);
+      scope.archive = ctx.archive;
+    });
+
+    return ctx;
+  }
+  /*
+  before(function (done) {
+
+  });
+  */
+  after(function (done) {
+    scope.archive( ).remove({ }, done);
+  });
+
+  it('should work fine absent', function (done) {
+    delete process.env.API_SECRET;
+    var env = require('../env')( );
+    should.not.exist(env.api_secret);
+    var ctx = setup_app(env,  function ( ) {
+      ctx.app.enabled('api').should.be.false;
+      ping_status(ctx.app, done);
+    });
+  });
+
+
+  it('should work fine set', function (done) {
+    var known = 'b723e97aa97846eb92d5264f084b2823f57c4aa1';
+    delete process.env.API_SECRET;
+    process.env.API_SECRET = 'this is my long pass phrase';
+    var env = require('../env')( );
+    env.api_secret.should.equal(known);
+    var ctx = setup_app(env,  function ( ) {
+      // console.log(this.app.enabled('api'));
+      ctx.app.enabled('api').should.be.true;
+      ping_status(ctx.app, done);
+    });
+
+  });
+
+  it('should not work short', function ( ) {
+    var known = 'c1d117818a97e847bdf286aa02d9dc8e8f7148f5';
+    delete process.env.API_SECRET;
+    process.env.API_SECRET = 'tooshort';
+    var env;
+    (function ( ) {
+      env = require('../env')( );
+    }).should.throw( );
+    should.not.exist(env);
+  });
+
+  function ping_status (app, fn) {
+      request(app)
+        .get('/status/.json')
+        .expect(200)
+        .end(function (err, res)  {
+          // console.log(res.body);
+          res.body.status.should.equal('ok');
+          fn( );
+          // console.log('err', err, 'res', res);
+        })
+  }
+
+});
+