fix(config)!: validate and derive config, drop the unread keys (#2482)

fluxer_admin/src/middleware/csrf.rs

@@ -28,7 +28,7 @@ pub async fn csrf_protection(
     let config = state.config();
     let secret = config.secret_key_base.clone();
     let admin_endpoint = config.admin_endpoint.clone();
-    let is_production = config.is_production();
+    let secure_cookies = config.secure_cookies();
 
     let user_id = request
         .extensions()
@@ -76,17 +76,17 @@ pub async fn csrf_protection(
 
     let mut response = next.run(request).await;
 
-    let cookie_name = if is_production {
+    let cookie_name = if secure_cookies {
         HOST_CSRF_COOKIE_NAME
     } else {
         CSRF_COOKIE_NAME
     };
-    let secure = if is_production { "; Secure" } else { "" };
+    let secure = if secure_cookies { "; Secure" } else { "" };
     let cookie_value = format!("{cookie_name}={token}; Path=/; SameSite=Lax; HttpOnly{secure}");
     if let Ok(value) = HeaderValue::from_str(&cookie_value) {
         response.headers_mut().append(header::SET_COOKIE, value);
     }
-    if is_production
+    if secure_cookies
         && let Ok(value) = HeaderValue::from_str(&format!(
             "{CSRF_COOKIE_NAME}=; Path=/; SameSite=Lax; HttpOnly; Max-Age=0"
         ))
@@ -199,6 +199,81 @@ pub fn get_csrf_token(request: &Request) -> String {
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::config::{AdminConfig, ProxyConfig, RuntimeEnv};
+    use crate::state::AppState;
+    use axum::{Router, middleware::from_fn_with_state, routing::get};
+    use tower::ServiceExt;
+
+    fn state_with_admin_endpoint(admin_endpoint: &str) -> AppState {
+        AppState::new(AdminConfig {
+            env: RuntimeEnv::Production,
+            host: String::new(),
+            port: 3020,
+            secret_key_base: "test-secret".to_owned(),
+            base_path: String::new(),
+            api_endpoint: String::new(),
+            media_endpoint: String::new(),
+            static_cdn_endpoint: String::new(),
+            admin_endpoint: admin_endpoint.to_owned(),
+            web_app_endpoint: String::new(),
+            kv_url: String::new(),
+            oauth_client_id: String::new(),
+            oauth_client_secret: String::new(),
+            oauth_redirect_uri: String::new(),
+            build_version: "test".to_owned(),
+            release_channel: String::new(),
+            self_hosted: false,
+            proxy: ProxyConfig {
+                trust_client_ip_header: false,
+                client_ip_header_name: String::new(),
+            },
+        })
+    }
+
+    async fn csrf_cookies(admin_endpoint: &str) -> Vec<String> {
+        let state = state_with_admin_endpoint(admin_endpoint);
+        let app = Router::new()
+            .route("/", get(|| async { "ok" }))
+            .layer(from_fn_with_state(state, csrf_protection));
+        let response = app
+            .oneshot(Request::builder().uri("/").body(Body::empty()).unwrap())
+            .await
+            .expect("router responds");
+        response
+            .headers()
+            .get_all(header::SET_COOKIE)
+            .iter()
+            .filter_map(|value| value.to_str().ok())
+            .map(|value| value.to_owned())
+            .collect()
+    }
+
+    #[tokio::test]
+    async fn https_admin_endpoint_sets_a_host_prefixed_secure_cookie() {
+        let cookies = csrf_cookies("https://example.com/admin").await;
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("__Host-csrf_token=")
+                    && cookie.contains("; Secure")),
+            "expected a secure __Host- cookie, got {cookies:?}"
+        );
+    }
+
+    #[tokio::test]
+    async fn http_admin_endpoint_sets_a_plain_cookie_without_secure() {
+        let cookies = csrf_cookies("http://example.com/admin").await;
+        assert!(
+            cookies
+                .iter()
+                .any(|cookie| cookie.starts_with("csrf_token=") && !cookie.contains("Secure")),
+            "expected a plain csrf_token cookie, got {cookies:?}"
+        );
+        assert!(
+            !cookies.iter().any(|cookie| cookie.contains("__Host-")),
+            "expected no __Host- cookie, got {cookies:?}"
+        );
+    }
 
     #[test]
     fn oauth2_callback_is_exempt() {

fluxer_admin/src/middleware/flash.rs

@@ -92,9 +92,9 @@ pub fn clear_flash_cookie(response: &mut Response) {
     }
 }
 
-pub fn redirect_with_flash(url: &str, flash: FlashData, is_production: bool) -> Response {
+pub fn redirect_with_flash(url: &str, flash: FlashData, secure: bool) -> Response {
     let encoded = serialize_flash(&flash);
-    let secure_flag = if is_production { "; Secure" } else { "" };
+    let secure_flag = if secure { "; Secure" } else { "" };
     let cookie_value = format!(
         "{FLASH_COOKIE_NAME}={encoded}; Path=/; HttpOnly; SameSite=Lax; Max-Age=60{secure_flag}"
     );