feat: server transfer rotation

service/singleton/config_test.go

@@ -0,0 +1,54 @@
+package singleton
+
+import (
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/nezhahq/nezha/model"
+)
+
+func TestInitConfigFromPathRotatesJWTSecretKey(t *testing.T) {
+	file, err := os.CreateTemp(t.TempDir(), "nezha-config-*.yaml")
+	if err != nil {
+		t.Fatalf("create temp config: %v", err)
+	}
+	if _, err := file.WriteString("jwt_secret_key: leaked-secret\nagent_secret_key: agent-secret\njwt_secret_key_last_rotated_version: v2.0.12\n"); err != nil {
+		t.Fatalf("write temp config: %v", err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatalf("close temp config: %v", err)
+	}
+
+	originalConf := Conf
+	originalVersion := Version
+	originalTemplates := FrontendTemplates
+	Version = "v2.0.13"
+	FrontendTemplates = nil
+	t.Cleanup(func() {
+		Conf = originalConf
+		Version = originalVersion
+		FrontendTemplates = originalTemplates
+	})
+
+	if err := InitConfigFromPath(file.Name()); err != nil {
+		t.Fatalf("init config: %v", err)
+	}
+	if Conf.JWTSecretKey == "leaked-secret" {
+		t.Fatal("jwt_secret_key was not rotated")
+	}
+	if Conf.JWTSecretKeyLastRotatedVersion != model.JWTSecretKeyRotationBaselineVersion {
+		t.Fatalf("jwt secret key marker = %q, want %q", Conf.JWTSecretKeyLastRotatedVersion, model.JWTSecretKeyRotationBaselineVersion)
+	}
+
+	saved, err := os.ReadFile(file.Name())
+	if err != nil {
+		t.Fatalf("read saved config: %v", err)
+	}
+	if strings.Contains(string(saved), "leaked-secret") {
+		t.Fatalf("saved config still contains leaked jwt_secret_key: %s", saved)
+	}
+	if !strings.Contains(string(saved), "jwt_secret_key_last_rotated_version: v2.0.13") {
+		t.Fatalf("saved config did not persist jwt secret key marker: %s", saved)
+	}
+}