fix: Opt-in lockdown for global config (#278)

* fix: Reject overriding managed flags * fix: Lockdown overrides when global config present * fix: Opt-in lock-down enforcement for global config * fix: Code review fixes * fix: Code review fixes * fix: Code review fixes
2026-08-03 07:24:09 +02:00 · 2026-05-21 16:37:26 +05:30
parent b15ce33fe4
commit 0e3bb52f8c
9 changed files with 487 additions and 51 deletions
@@ -85,6 +85,93 @@ func TestSetConfigValueRefusedWhenManaged(t *testing.T) {
 	assert.NoFileExists(t, filepath.Join(userDir, "config.yml"))
 }

+func TestEnvDoesNotOverrideLockedConfig(t *testing.T) {
+	globalDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(globalDir, "config.yml"), []byte("paranoid: true\nglobal_lockdown: true\n"), 0o644))
+
+	useManagedConfigDir(t, globalDir)
+	t.Setenv("PMG_CONFIG_DIR", t.TempDir())
+	t.Setenv("PMG_PARANOID", "false")
+	initConfig()
+
+	require.True(t, Get().IsLocked())
+	assert.True(t, Get().Config.Paranoid, "PMG_PARANOID must not override a locked config")
+}
+
+func TestEnvOverridesManagedConfigWhenNotLocked(t *testing.T) {
+	globalDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(globalDir, "config.yml"), []byte("paranoid: true\n"), 0o644))
+
+	useManagedConfigDir(t, globalDir)
+	t.Setenv("PMG_CONFIG_DIR", t.TempDir())
+	t.Setenv("PMG_PARANOID", "false")
+	initConfig()
+
+	require.True(t, Get().IsManaged())
+	require.False(t, Get().IsLocked())
+	assert.False(t, Get().Config.Paranoid, "without lockdown, PMG_PARANOID overrides the managed baseline")
+}
+
+func TestEnvOverridesUserConfigWhenNotManaged(t *testing.T) {
+	userDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(userDir, "config.yml"), []byte("paranoid: true\n"), 0o644))
+
+	useManagedConfigDir(t, t.TempDir()) // empty global dir -> not managed
+	t.Setenv("PMG_CONFIG_DIR", userDir)
+	t.Setenv("PMG_PARANOID", "false")
+	initConfig()
+
+	require.False(t, Get().IsManaged())
+	assert.False(t, Get().Config.Paranoid, "PMG_PARANOID should override the per-user config")
+}
+
+func TestInsecureInstallationEnvIgnoredWhenLocked(t *testing.T) {
+	globalDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(globalDir, "config.yml"), []byte("global_lockdown: true\n"), 0o644))
+
+	useManagedConfigDir(t, globalDir)
+	t.Setenv("PMG_INSECURE_INSTALLATION", "true")
+	initConfig()
+
+	require.True(t, Get().IsLocked())
+	assert.False(t, Get().InsecureInstallation, "PMG_INSECURE_INSTALLATION must not bypass a locked config")
+}
+
+func TestInsecureInstallationHonoredWhenManagedNotLocked(t *testing.T) {
+	globalDir := t.TempDir()
+	require.NoError(t, os.WriteFile(filepath.Join(globalDir, "config.yml"), []byte("paranoid: true\n"), 0o644))
+
+	useManagedConfigDir(t, globalDir)
+	t.Setenv("PMG_INSECURE_INSTALLATION", "true")
+	initConfig()
+
+	require.True(t, Get().IsManaged())
+	require.False(t, Get().IsLocked())
+	assert.True(t, Get().InsecureInstallation, "without lockdown, PMG_INSECURE_INSTALLATION is honored")
+}
+
+func TestInsecureInstallationEnvHonoredWhenNotManaged(t *testing.T) {
+	useManagedConfigDir(t, t.TempDir()) // empty global dir -> not managed
+	t.Setenv("PMG_CONFIG_DIR", t.TempDir())
+	t.Setenv("PMG_INSECURE_INSTALLATION", "true")
+	initConfig()
+
+	require.False(t, Get().IsManaged())
+	assert.True(t, Get().InsecureInstallation)
+}
+
+func TestMalformedGlobalConfigFailsClosed(t *testing.T) {
+	globalDir := t.TempDir()
+	// Present but unparseable YAML ("mapping values not allowed in this context").
+	require.NoError(t, os.WriteFile(filepath.Join(globalDir, "config.yml"), []byte("a: b: c\n"), 0o644))
+
+	useManagedConfigDir(t, globalDir)
+	initConfig()
+
+	require.True(t, Get().IsManaged())
+	assert.True(t, Get().IsLocked(), "a present but unparseable global config must fail closed (locked)")
+}
+
 func TestRemoveUserConfigFileNeverTouchesGlobal(t *testing.T) {
 	globalDir := t.TempDir()
 	userDir := t.TempDir()