chore: Add tests for backup service, crowdsec startup, log service, and security headers

- Implement tests for BackupService to handle database extraction from backup archives with SHM and WAL entries.
- Add tests for BackupService to validate behavior when creating backups for non-SQLite databases and handling oversized database entries.
- Introduce tests for CrowdSec startup to ensure proper error handling during configuration creation.
- Enhance LogService tests to cover scenarios for skipping dot and empty directories and handling read directory errors.
- Add tests for SecurityHeadersService to ensure proper error handling during preset creation and updates.
- Update ProxyHostForm tests to include HSTS subdomains toggle and validation for port input handling.
- Enhance DNSProviders tests to validate manual challenge completion and error handling when no providers are available.
- Extend UsersPage tests to ensure fallback mechanisms for clipboard operations when the clipboard API fails.

Author: actions-user

backend/internal/api/handlers/certificate_handler_test.go

@@ -399,6 +399,45 @@ func TestCertificateHandler_Upload_MissingKeyFile(t *testing.T) {
 	}
 }
 
+func TestCertificateHandler_Upload_MissingKeyFile_MultipartWithCert(t *testing.T) {
+	db, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})
+	if err != nil {
+		t.Fatalf("failed to open db: %v", err)
+	}
+	if err = db.AutoMigrate(&models.SSLCertificate{}, &models.ProxyHost{}); err != nil {
+		t.Fatalf("failed to migrate: %v", err)
+	}
+
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.Use(mockAuthMiddleware())
+	svc := services.NewCertificateService("/tmp", db)
+	h := NewCertificateHandler(svc, nil, nil)
+	r.POST("/api/certificates", h.Upload)
+
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	_ = writer.WriteField("name", "testcert")
+	part, createErr := writer.CreateFormFile("certificate_file", "cert.pem")
+	if createErr != nil {
+		t.Fatalf("failed to create form file: %v", createErr)
+	}
+	_, _ = part.Write([]byte("-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----"))
+	_ = writer.Close()
+
+	req := httptest.NewRequest(http.MethodPost, "/api/certificates", &body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 Bad Request, got %d, body=%s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), "key_file") {
+		t.Fatalf("expected error message about key_file, got: %s", w.Body.String())
+	}
+}
+
 // Test Upload handler success path using a mock CertificateService
 func TestCertificateHandler_Upload_Success(t *testing.T) {
 	db, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{})

backend/internal/api/handlers/crowdsec_wave3_test.go

@@ -0,0 +1,87 @@
+package handlers
+
+import (
+	"bytes"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestResolveAcquisitionConfigPath_Validation(t *testing.T) {
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", "")
+	resolved, err := resolveAcquisitionConfigPath()
+	require.NoError(t, err)
+	require.Equal(t, "/etc/crowdsec/acquis.yaml", resolved)
+
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", "relative/acquis.yaml")
+	_, err = resolveAcquisitionConfigPath()
+	require.Error(t, err)
+
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", "/tmp/../etc/acquis.yaml")
+	_, err = resolveAcquisitionConfigPath()
+	require.Error(t, err)
+
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", "/tmp/acquis.yaml")
+	resolved, err = resolveAcquisitionConfigPath()
+	require.NoError(t, err)
+	require.Equal(t, "/tmp/acquis.yaml", resolved)
+}
+
+func TestReadAcquisitionConfig_ErrorsAndSuccess(t *testing.T) {
+	tmp := t.TempDir()
+	path := filepath.Join(tmp, "acquis.yaml")
+	require.NoError(t, os.WriteFile(path, []byte("source: file\n"), 0o600))
+
+	content, err := readAcquisitionConfig(path)
+	require.NoError(t, err)
+	assert.Contains(t, string(content), "source: file")
+
+	_, err = readAcquisitionConfig(filepath.Join(tmp, "missing.yaml"))
+	require.Error(t, err)
+}
+
+func TestCrowdsec_AcquisitionEndpoints_InvalidConfiguredPath(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", "relative/path.yaml")
+
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
+	r := gin.New()
+	g := r.Group("/api/v1")
+	h.RegisterRoutes(g)
+
+	wGet := httptest.NewRecorder()
+	reqGet := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/acquisition", http.NoBody)
+	r.ServeHTTP(wGet, reqGet)
+	require.Equal(t, http.StatusInternalServerError, wGet.Code)
+
+	wPut := httptest.NewRecorder()
+	reqPut := httptest.NewRequest(http.MethodPut, "/api/v1/admin/crowdsec/acquisition", bytes.NewBufferString(`{"content":"source: file"}`))
+	reqPut.Header.Set("Content-Type", "application/json")
+	r.ServeHTTP(wPut, reqPut)
+	require.Equal(t, http.StatusInternalServerError, wPut.Code)
+}
+
+func TestCrowdsec_GetBouncerKey_NotConfigured(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	t.Setenv("CROWDSEC_API_KEY", "")
+	t.Setenv("CROWDSEC_BOUNCER_API_KEY", "")
+	t.Setenv("CERBERUS_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CHARON_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CPM_SECURITY_CROWDSEC_API_KEY", "")
+
+	h := newTestCrowdsecHandler(t, OpenTestDB(t), &fakeExec{}, "/bin/false", t.TempDir())
+	r := gin.New()
+	g := r.Group("/api/v1")
+	h.RegisterRoutes(g)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/bouncer/key", http.NoBody)
+	r.ServeHTTP(w, req)
+	require.Equal(t, http.StatusNotFound, w.Code)
+}

backend/internal/api/handlers/crowdsec_wave5_test.go

@@ -0,0 +1,127 @@
+package handlers
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/Wikid82/charon/backend/internal/models"
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCrowdsecWave5_ResolveAcquisitionConfigPath_RelativeRejected(t *testing.T) {
+	t.Setenv("CHARON_CROWDSEC_ACQUIS_PATH", "relative/acquis.yaml")
+	_, err := resolveAcquisitionConfigPath()
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "must be absolute")
+}
+
+func TestCrowdsecWave5_ReadAcquisitionConfig_InvalidFilenameBranch(t *testing.T) {
+	_, err := readAcquisitionConfig("/")
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "filename is invalid")
+}
+
+func TestCrowdsecWave5_GetLAPIDecisions_Unauthorized(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db := setupCrowdDB(t)
+	tmpDir := t.TempDir()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusUnauthorized)
+	}))
+	t.Cleanup(server.Close)
+
+	original := validateCrowdsecLAPIBaseURLFunc
+	validateCrowdsecLAPIBaseURLFunc = func(raw string) (*url.URL, error) {
+		return url.Parse(raw)
+	}
+	t.Cleanup(func() {
+		validateCrowdsecLAPIBaseURLFunc = original
+	})
+
+	require.NoError(t, db.Create(&models.SecurityConfig{UUID: "default", CrowdSecAPIURL: server.URL}).Error)
+
+	h := newTestCrowdsecHandler(t, db, &fakeExec{}, "/bin/false", tmpDir)
+	r := gin.New()
+	g := r.Group("/api/v1")
+	h.RegisterRoutes(g)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions/lapi", http.NoBody)
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusUnauthorized, w.Code)
+	require.Contains(t, w.Body.String(), "authentication failed")
+}
+
+func TestCrowdsecWave5_GetLAPIDecisions_NonJSONContentTypeFallsBack(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	db := setupCrowdDB(t)
+	tmpDir := t.TempDir()
+
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "text/html")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("<html>not-json</html>"))
+	}))
+	t.Cleanup(server.Close)
+
+	original := validateCrowdsecLAPIBaseURLFunc
+	validateCrowdsecLAPIBaseURLFunc = func(raw string) (*url.URL, error) {
+		return url.Parse(raw)
+	}
+	t.Cleanup(func() {
+		validateCrowdsecLAPIBaseURLFunc = original
+	})
+
+	require.NoError(t, db.Create(&models.SecurityConfig{UUID: "default", CrowdSecAPIURL: server.URL}).Error)
+
+	h := newTestCrowdsecHandler(t, db, &fakeExec{}, "/bin/false", tmpDir)
+	h.CmdExec = &mockCmdExecutor{output: []byte("[]"), err: nil}
+	r := gin.New()
+	g := r.Group("/api/v1")
+	h.RegisterRoutes(g)
+
+	w := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/decisions/lapi", http.NoBody)
+	r.ServeHTTP(w, req)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	require.Contains(t, w.Body.String(), "decisions")
+}
+
+func TestCrowdsecWave5_GetBouncerInfo_And_GetBouncerKey_FileSource(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	t.Setenv("CROWDSEC_BOUNCER_API_KEY", "")
+	t.Setenv("CERBERUS_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CHARON_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CPM_SECURITY_CROWDSEC_API_KEY", "")
+	db := setupCrowdDB(t)
+	tmpDir := t.TempDir()
+
+	h := newTestCrowdsecHandler(t, db, &fakeExec{}, "/bin/false", tmpDir)
+	keyPath := h.bouncerKeyPath()
+	require.NoError(t, os.MkdirAll(filepath.Dir(keyPath), 0o750))
+	require.NoError(t, os.WriteFile(keyPath, []byte("abcdefghijklmnop1234567890"), 0o600))
+
+	r := gin.New()
+	g := r.Group("/api/v1")
+	h.RegisterRoutes(g)
+
+	wInfo := httptest.NewRecorder()
+	reqInfo := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/bouncer", http.NoBody)
+	r.ServeHTTP(wInfo, reqInfo)
+	require.Equal(t, http.StatusOK, wInfo.Code)
+	require.Contains(t, wInfo.Body.String(), "file")
+
+	wKey := httptest.NewRecorder()
+	reqKey := httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/bouncer/key", http.NoBody)
+	r.ServeHTTP(wKey, reqKey)
+	require.Equal(t, http.StatusOK, wKey.Code)
+	require.Contains(t, wKey.Body.String(), "\"source\":\"file\"")
+}

backend/internal/api/handlers/crowdsec_wave6_test.go

@@ -0,0 +1,65 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+)
+
+func TestCrowdsecWave6_BouncerKeyPath_UsesEnvFallback(t *testing.T) {
+	t.Setenv("CHARON_CROWDSEC_BOUNCER_KEY_PATH", "/tmp/test-bouncer-key")
+	h := &CrowdsecHandler{}
+	require.Equal(t, "/tmp/test-bouncer-key", h.bouncerKeyPath())
+}
+
+func TestCrowdsecWave6_GetBouncerInfo_NoneSource(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	t.Setenv("CROWDSEC_API_KEY", "")
+	t.Setenv("CROWDSEC_BOUNCER_API_KEY", "")
+	t.Setenv("CERBERUS_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CHARON_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CPM_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CHARON_CROWDSEC_BOUNCER_KEY_PATH", "/tmp/non-existent-wave6-key")
+
+	h := &CrowdsecHandler{CmdExec: &mockCmdExecutor{output: []byte(`[]`)}}
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/bouncer", nil)
+
+	h.GetBouncerInfo(c)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	var payload map[string]any
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &payload))
+	require.Equal(t, "none", payload["key_source"])
+}
+
+func TestCrowdsecWave6_GetKeyStatus_NoKeyConfiguredMessage(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	t.Setenv("CROWDSEC_API_KEY", "")
+	t.Setenv("CROWDSEC_BOUNCER_API_KEY", "")
+	t.Setenv("CERBERUS_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CHARON_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CPM_SECURITY_CROWDSEC_API_KEY", "")
+	t.Setenv("CHARON_CROWDSEC_BOUNCER_KEY_PATH", "/tmp/non-existent-wave6-key")
+
+	h := &CrowdsecHandler{}
+
+	w := httptest.NewRecorder()
+	c, _ := gin.CreateTestContext(w)
+	c.Request = httptest.NewRequest(http.MethodGet, "/api/v1/admin/crowdsec/key-status", nil)
+
+	h.GetKeyStatus(c)
+
+	require.Equal(t, http.StatusOK, w.Code)
+	var payload map[string]any
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &payload))
+	require.Equal(t, "none", payload["key_source"])
+	require.Equal(t, false, payload["valid"])
+	require.Contains(t, payload["message"], "No CrowdSec API key configured")
+}