9cd0da0046
CRITICAL fixes: - Race condition (TOCTOU) in payout/refund with SELECT FOR UPDATE (CRITICAL-001/002) - IDOR on analytics endpoint — ownership check enforced (CRITICAL-003) - CSWSH on all WebSocket endpoints — origin whitelist (CRITICAL-004) - Mass assignment on user self-update — strip privileged fields (CRITICAL-005) HIGH fixes: - Path traversal in marketplace upload — UUID filenames (HIGH-001) - IP spoofing — use Gin trusted proxy c.ClientIP() (HIGH-002) - Popularity metrics (followers, likes) set to json:"-" (HIGH-003) - bcrypt cost hardened to 12 everywhere (HIGH-004) - Refresh token lock made mandatory (HIGH-005) - Stream token replay prevention with access_count (HIGH-006) - Subscription trial race condition fixed (HIGH-007) - License download expiration check (HIGH-008) - Webhook amount validation (HIGH-009) - pprof endpoint removed from production (HIGH-010) MEDIUM fixes: - WebSocket message size limit 64KB (MEDIUM-010) - HSTS header in nginx production (MEDIUM-001) - CORS origin restricted in nginx-rtmp (MEDIUM-002) - Docker alpine pinned to 3.21 (MEDIUM-003/004) - Redis authentication enforced (MEDIUM-005) - GDPR account deletion expanded (MEDIUM-006) - .gitignore hardened (MEDIUM-007) LOW/INFO fixes: - GitHub Actions SHA pinning on all workflows (LOW-001) - .env.example security documentation (INFO-001) - Production CORS set to HTTPS (LOW-002) All tests pass. Go and Rust compile clean. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
109 lines
3 KiB
Go
109 lines
3 KiB
Go
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/joho/godotenv"
|
|
"golang.org/x/crypto/bcrypt"
|
|
"gorm.io/driver/postgres"
|
|
"gorm.io/gorm"
|
|
|
|
"veza-backend-api/internal/models"
|
|
)
|
|
|
|
func main() {
|
|
// Load .env file
|
|
if err := godotenv.Load(); err != nil {
|
|
log.Printf("Note: .env file not found, using system environment variables")
|
|
}
|
|
|
|
// Get database connection string
|
|
databaseURL := os.Getenv("DATABASE_URL")
|
|
if databaseURL == "" {
|
|
// Fallback to individual components
|
|
dbHost := getEnv("DB_HOST", "localhost")
|
|
dbPort := getEnv("DB_PORT", "5432")
|
|
dbUser := getEnv("DB_USER", "veza")
|
|
dbPassword := getEnv("DB_PASSWORD", "password")
|
|
dbName := getEnv("DB_NAME", "veza")
|
|
databaseURL = fmt.Sprintf("host=%s port=%s user=%s password=%s dbname=%s sslmode=disable",
|
|
dbHost, dbPort, dbUser, dbPassword, dbName)
|
|
}
|
|
|
|
// Connect to database
|
|
db, err := gorm.Open(postgres.Open(databaseURL), &gorm.Config{})
|
|
if err != nil {
|
|
log.Fatalf("Failed to connect to database: %v", err)
|
|
}
|
|
|
|
// Get test user credentials from environment or use defaults
|
|
email := getEnv("TEST_EMAIL", "user@example.com")
|
|
password := getEnv("TEST_PASSWORD", "password123")
|
|
username := getEnv("TEST_USERNAME", "testuser")
|
|
|
|
// Check if user already exists
|
|
var existingUser models.User
|
|
result := db.Where("email = ?", email).First(&existingUser)
|
|
if result.Error == nil {
|
|
log.Printf("User with email %s already exists (ID: %s)", email, existingUser.ID)
|
|
|
|
// Update password if needed
|
|
hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), 12 /* SECURITY(REM-035): Aligned bcrypt cost */)
|
|
if err != nil {
|
|
log.Fatalf("Failed to hash password: %v", err)
|
|
}
|
|
|
|
existingUser.PasswordHash = string(hashedPassword)
|
|
existingUser.IsVerified = true
|
|
existingUser.IsActive = true
|
|
|
|
if err := db.Save(&existingUser).Error; err != nil {
|
|
log.Fatalf("Failed to update user: %v", err)
|
|
}
|
|
|
|
log.Printf("✅ Updated existing user: %s (password reset, verified and active)", email)
|
|
return
|
|
}
|
|
|
|
// Hash password
|
|
hashedPassword, err := bcrypt.GenerateFromPassword([]byte(password), 12 /* SECURITY(REM-035): Aligned bcrypt cost */)
|
|
if err != nil {
|
|
log.Fatalf("Failed to hash password: %v", err)
|
|
}
|
|
|
|
// Generate slug from username
|
|
slug := strings.ToLower(strings.ReplaceAll(username, "_", "-"))
|
|
|
|
// Create user
|
|
user := &models.User{
|
|
Email: email,
|
|
Username: username,
|
|
Slug: slug,
|
|
PasswordHash: string(hashedPassword),
|
|
IsVerified: true,
|
|
IsActive: true,
|
|
Role: "user",
|
|
FirstName: "Test",
|
|
LastName: "User",
|
|
}
|
|
|
|
if err := db.Create(user).Error; err != nil {
|
|
log.Fatalf("Failed to create user: %v", err)
|
|
}
|
|
|
|
log.Printf("✅ Created test user successfully!")
|
|
log.Printf(" Email: %s", email)
|
|
log.Printf(" Username: %s", username)
|
|
log.Printf(" Password: %s", password)
|
|
log.Printf(" ID: %s", user.ID)
|
|
}
|
|
|
|
func getEnv(key, defaultValue string) string {
|
|
if value := os.Getenv(key); value != "" {
|
|
return strings.TrimSpace(value)
|
|
}
|
|
return defaultValue
|
|
}
|