Secret test at startup

backend/app/core/config.py

@@ -5,6 +5,8 @@ from dataclasses import dataclass
 import os
 from pathlib import Path
 
+from cryptography.fernet import Fernet
+
 
 BASE_DIR = Path(__file__).resolve().parent.parent.parent
 DB_PATH = BASE_DIR / 'data' / 'linklog.db'
@@ -20,6 +22,7 @@ def normalize_public_url(value: str) -> str:
 
 @dataclass
 class Settings:
+    app_env: str = os.getenv('APP_ENV', 'development').lower()
     app_name: str = os.getenv('LINKLOG_APP_NAME', 'LinkLog')
     version: str = os.getenv('LINKLOG_VERSION', '0.1.0')
     database_url: str = os.getenv('LINKLOG_DATABASE_URL', f'sqlite:///{DB_PATH}')
@@ -59,3 +62,19 @@ class Settings:
 
 
 settings = Settings()
+
+
+def validate_configuration(values: Settings) -> None:
+    if values.app_env == 'production':
+        if not values.secret_key or values.secret_key == 'dev-secret-key-change-me':
+            raise RuntimeError('LINKLOG_SECRET_KEY must be configured in production')
+        if len(values.secret_key) < 32 or len(set(values.secret_key)) < 12:
+            raise RuntimeError('LINKLOG_SECRET_KEY must be at least 32 characters with sufficient entropy')
+        if not values.data_encryption_key:
+            raise RuntimeError('LINKLOG_DATA_ENCRYPTION_KEY must be configured in production')
+
+    if values.data_encryption_key:
+        try:
+            Fernet(values.data_encryption_key.encode('ascii'))
+        except (ValueError, UnicodeEncodeError) as error:
+            raise RuntimeError('LINKLOG_DATA_ENCRYPTION_KEY must be a valid Fernet key') from error

backend/app/main.py

@@ -18,11 +18,12 @@ from backend.app.api.public import router as public_router
 from backend.app.api.setup import router as setup_router
 from backend.app.api.setup import has_administrator
 from backend.app.api.user_config import router as user_config_router
-from backend.app.core.config import settings
+from backend.app.core.config import settings, validate_configuration
 from backend.app.database import AVATARS_DIR
 from backend.app.services.link_service import get_public_profile, list_public_links
 
 logging.basicConfig(level=getattr(logging, settings.log_level, logging.INFO))
+validate_configuration(settings)
 
 app = FastAPI(title='LinkLog API', version=settings.version)
 

backend/tests/test_configuration.py

@@ -1,10 +1,36 @@
 import re
 from pathlib import Path
+import pytest
+
+from backend.app.core.config import Settings, validate_configuration
 
 
 ROOT = Path(__file__).resolve().parents[2]
 
 
+def test_production_configuration_rejects_missing_or_default_secret():
+    with pytest.raises(RuntimeError, match='LINKLOG_SECRET_KEY'):
+        validate_configuration(Settings(app_env='production', secret_key='', data_encryption_key=''))
+    with pytest.raises(RuntimeError, match='LINKLOG_SECRET_KEY'):
+        validate_configuration(Settings(app_env='production', secret_key='dev-secret-key-change-me', data_encryption_key=''))
+
+
+def test_production_configuration_rejects_weak_or_missing_encryption_key():
+    with pytest.raises(RuntimeError, match='entropy'):
+        validate_configuration(Settings(app_env='production', secret_key='A' * 32, data_encryption_key=''))
+    with pytest.raises(RuntimeError, match='DATA_ENCRYPTION_KEY'):
+        validate_configuration(Settings(app_env='production', secret_key='A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6', data_encryption_key='invalid'))
+
+
+def test_production_configuration_accepts_strong_secrets():
+    values = Settings(
+        app_env='production',
+        secret_key='A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6',
+        data_encryption_key='L5M4sQYVjD1N7pT2Xk8R0aBcDeFgHiJkLmNoPqRsTuV=',
+    )
+    validate_configuration(values)
+
+
 def test_production_compose_configuration_matches_settings_environment_keys():
     compose = (ROOT / 'docker-compose.yml').read_text()
     settings = (ROOT / 'backend' / 'app' / 'core' / 'config.py').read_text()