Configuration Hardening 2

What changed: - Added visible runtime override reporting with masking for sensitive values. - Expanded effective config for build cleanup, script compiler discovery/env, extract layout/cleanup/ HAK discovery, wiki deploy defaults, autogen cache policy, and release-source env names. - Wired configured values into build, script compiler resolution, extract, autogen cache refresh/max age, parts manifest release source, wiki generation/deploy, and TLK output naming. - Added config sources override output and validation-rule hints in config explain. - Added CONFIGURATION_HARDENING_AUDIT.md. - Updated README.md with config commands, schema defaults, and JSON artifact boundaries. - Added regression tests for override visibility/masking, compiler/extract/wiki/autogen config, configured HAK discovery, and config sources output.
2026-05-07 14:22:47 +02:00
parent 60d2de9f2d
commit b39bdf13e8
17 changed files with 877 additions and 171 deletions
@@ -136,6 +136,116 @@ autogen:
 	}
 }

+func TestEffectiveConfigHonorsConfiguredCompilerExtractWikiAndAutogenPolicy(t *testing.T) {
+	root := t.TempDir()
+	writeProjectFile(t, filepath.Join(root, ConfigFile), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  source: src
+  tools: custom-tools
+scripts:
+  source_dir: module-scripts
+  compiler:
+    path: bin/compiler
+    search:
+      - "{paths.tools}/compiler"
+    env:
+      path: TEST_COMPILER
+      nwn_root:
+        - TEST_NWN_ROOT
+      nwn_user_directory:
+        - TEST_NWN_USER
+extract:
+  layout: nwn_canonical_json
+  hak_discovery: configured_haks
+  cleanup_stale: false
+topdata:
+  wiki:
+    managed_namespaces:
+      - skills
+    deploy_manifest: wiki-manifest.json
+    deploy_edit_summary: Custom summary
+autogen:
+  cache:
+    root: "{paths.cache}/released"
+    max_age: 30m
+    refresh_env: TEST_AUTOGEN_REFRESH
+  release_source:
+    provider: gitea
+    server_url_env: TEST_ASSETS_SERVER
+    repo_env: TEST_ASSETS_REPO
+`)
+
+	proj, err := Load(root)
+	if err != nil {
+		t.Fatalf("Load returned error: %v", err)
+	}
+	effective := proj.EffectiveConfig()
+	if got, want := proj.ScriptSourceDir(), filepath.Join(root, "src", "module-scripts"); got != want {
+		t.Fatalf("expected script source dir %s, got %s", want, got)
+	}
+	if got, want := proj.ScriptCompilerPath(), filepath.Join(root, "bin", "compiler"); got != want {
+		t.Fatalf("expected compiler path %s, got %s", want, got)
+	}
+	if got, want := effective.Scripts.Compiler.Search[0], "custom-tools/compiler"; got != want {
+		t.Fatalf("expected compiler search %q, got %q", want, got)
+	}
+	if got, want := effective.Scripts.Compiler.Env.Path, "TEST_COMPILER"; got != want {
+		t.Fatalf("expected compiler env %q, got %q", want, got)
+	}
+	if got, want := effective.Extract.HAKDiscovery, "configured_haks"; got != want {
+		t.Fatalf("expected extract hak discovery %q, got %q", want, got)
+	}
+	if effective.Extract.CleanupStale == nil || *effective.Extract.CleanupStale {
+		t.Fatalf("expected cleanup_stale false, got %#v", effective.Extract.CleanupStale)
+	}
+	if got, want := effective.TopData.Wiki.DeployManifest, "wiki-manifest.json"; got != want {
+		t.Fatalf("expected wiki deploy manifest %q, got %q", want, got)
+	}
+	if got, want := effective.Autogen.Cache.MaxAge, "30m"; got != want {
+		t.Fatalf("expected autogen cache max age %q, got %q", want, got)
+	}
+	if got, want := proj.AutogenRefreshEnv(), "TEST_AUTOGEN_REFRESH"; got != want {
+		t.Fatalf("expected autogen refresh env %q, got %q", want, got)
+	}
+}
+
+func TestActiveOverridesAreVisibleAndSensitiveValuesAreMasked(t *testing.T) {
+	root := t.TempDir()
+	writeProjectFile(t, filepath.Join(root, ConfigFile), `
+module:
+  name: Test Module
+  resref: testmod
+paths:
+  source: src
+`)
+	t.Setenv("SOW_BUILD_HAKS_KEEP_EXISTING", "1")
+	t.Setenv("NODEBB_API_TOKEN", "secret-token")
+
+	proj, err := Load(root)
+	if err != nil {
+		t.Fatalf("Load returned error: %v", err)
+	}
+	overrides := proj.ActiveOverrides()
+	var sawKeepExisting, sawMaskedToken bool
+	for _, override := range overrides {
+		if override.Key == "build.keep_existing_haks" && override.Value == "1" {
+			sawKeepExisting = true
+		}
+		if override.Key == "wiki.token" && override.Value == "<set>" {
+			sawMaskedToken = true
+		}
+	}
+	if !sawKeepExisting {
+		t.Fatalf("expected build keep existing override in %#v", overrides)
+	}
+	if !sawMaskedToken {
+		t.Fatalf("expected masked wiki token override in %#v", overrides)
+	}
+}
+
 func TestEffectiveConfigJSONIsDeterministic(t *testing.T) {
 	root := t.TempDir()
 	writeProjectFile(t, filepath.Join(root, ConfigFile), `