fix: harden runtime deployment defaults

2026-08-04 15:32:41 +08:00
parent fea537b9d7
commit 4fc755d558
3 changed files with 34 additions and 21 deletions
@@ -0,0 +1,18 @@
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_compose_does_not_embed_password_or_net_admin_capability():
+    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")
+
+    assert "POSTGRES_PASSWORD=pingwatch123" not in compose
+    assert "NET_ADMIN" not in compose
+    assert "127.0.0.1:8001:8000" in compose
+
+
+def test_oauth_client_does_not_disable_tls_verification():
+    auth_source = (ROOT / "backend" / "app" / "core" / "auth.py").read_text(encoding="utf-8")
+
+    assert "verify=False" not in auth_source