From e7fdfa0bcc8d5bf80163cae53a821682cf5322fe Mon Sep 17 00:00:00 2001
From: onidoru <onidoru@yahoo.com>
Date: Wed, 31 Jan 2024 18:30:54 +0200
Subject: [PATCH] fix: Add credentials config verification

---
 .github/workflows/verify-config.yaml | 46 ++++++++++++++++++++++++++++
 Makefile                             |  2 +-
 examples/README.md                   |  4 +--
 examples/config-example.json         |  3 +-
 examples/config-example.yaml         |  3 +-
 pkg/cli/server/root.go               |  4 +--
 6 files changed, 53 insertions(+), 9 deletions(-)
 create mode 100644 .github/workflows/verify-config.yaml

diff --git a/.github/workflows/verify-config.yaml b/.github/workflows/verify-config.yaml
new file mode 100644
index 00000000..9f4f0261
--- /dev/null
+++ b/.github/workflows/verify-config.yaml
@@ -0,0 +1,46 @@
+name: "Verify Example Config Files"
+
+# Validate all example config files are relevant and valid.
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches: [main]
+  release:
+    types:
+      - published
+
+permissions: read-all
+
+jobs:
+  verify-config:
+    name: Verify Config Files
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install go
+        uses: actions/setup-go@v5
+        with:
+          cache: false
+          go-version: 1.20.x
+      - name: Cache go dependencies
+        id: cache-go-dependencies
+        uses: actions/cache@v4
+        with:
+          path: |
+            ~/go/pkg/mod
+          key: ${{ runner.os }}-go-mod-${{ hashFiles('**/go.sum') }}
+          restore-keys: |
+            ${{ runner.os }}-go-mod-
+      - name: Install go dependencies
+        if: steps.cache-go-dependencies.outputs.cache-hit != 'true'
+        run: |
+          cd $GITHUB_WORKSPACE
+          go mod download
+      - uses: ./.github/actions/setup-localstack
+      - name: run verify-config
+        run: |
+          cd $GITHUB_WORKSPACE
+          make verify-config
diff --git a/Makefile b/Makefile
index f6860abb..2203fe0a 100644
--- a/Makefile
+++ b/Makefile
@@ -392,7 +392,7 @@ verify-config: _verify-config verify-config-warnings verify-config-commited
 .PHONY: _verify-config
 _verify-config: binary
 	rm -f output.txt
-	$(foreach file, $(wildcard examples/config-*), ./bin/zot-$(OS)-$(ARCH) verify $(file) 2>&1 | tee -a output.txt || exit 1;)
+	$(foreach file, $(filter-out examples/config-ldap-credentials.json, $(wildcard examples/config-*)), ./bin/zot-$(OS)-$(ARCH) verify $(file) 2>&1 | tee -a output.txt || exit 1;)
 
 .PHONY: verify-config-warnings
 verify-config-warnings: _verify-config
diff --git a/examples/README.md b/examples/README.md
index 16efa6ce..03db18f1 100644
--- a/examples/README.md
+++ b/examples/README.md
@@ -225,14 +225,14 @@ authentication:
         "startTLS":false,
         "baseDN":"ou=Users,dc=example,dc=org",
         "userAttribute":"uid",
-        "bindDN":"cn=ldap-searcher,ou=Users,dc=example,dc=org",
-        "bindPassword":"ldap-searcher-password",
+        "credentialsFile": "config-ldap-credentials.json",
         "skipVerify":false,
         "subtreeSearch":true
       },
 ```
 
 NOTE: When both htpasswd and LDAP configuration are specified, LDAP authentication is given preference.
+NOTE: The separate file for storing DN and password credentials must be created. You can see example in `examples/config-ldap-credentials.json` file.
 
 **OAuth2 authentication** (client credentials grant type) support via _Bearer Token_ configured with:
 
diff --git a/examples/config-example.json b/examples/config-example.json
index cf744d89..7534e4f1 100644
--- a/examples/config-example.json
+++ b/examples/config-example.json
@@ -18,8 +18,7 @@
         "startTLS": false,
         "baseDN": "ou=Users,dc=example,dc=org",
         "userAttribute": "uid",
-        "bindDN": "cn=ldap-searcher,ou=Users,dc=example,dc=org",
-        "bindPassword": "ldap-searcher-password",
+        "credentialsFile": "examples/config-ldap-credentials.json",
         "skipVerify": false,
         "subtreeSearch": true
       },
diff --git a/examples/config-example.yaml b/examples/config-example.yaml
index a627ad96..8b3098b5 100644
--- a/examples/config-example.yaml
+++ b/examples/config-example.yaml
@@ -8,8 +8,7 @@ http:
     ldap:
       address: ldap.example.org
       basedn: ou=Users,dc=example,dc=org
-      binddn: cn=ldap-searcher,ou=Users,dc=example,dc=org
-      bindpassword: ldap-searcher-password
+      credentialsFile: examples/config-ldap-credentials.json
       port: 389
       skipverify: false
       starttls: false
diff --git a/pkg/cli/server/root.go b/pkg/cli/server/root.go
index 71fe9f77..b8922863 100644
--- a/pkg/cli/server/root.go
+++ b/pkg/cli/server/root.go
@@ -861,8 +861,8 @@ func readLDAPCredentials(ldapConfigPath string) (config.LDAPCredentials, error)
 
 	var ldapCredentials config.LDAPCredentials
 
-	if err := viperInstance.Unmarshal(&ldapCredentials); err != nil {
-		log.Error().Err(err).Msg("failed to unmarshal new config")
+	if err := viperInstance.UnmarshalExact(&ldapCredentials); err != nil {
+		log.Error().Err(err).Msg("failed to unmarshal ldap credentials config")
 
 		return config.LDAPCredentials{}, err
 	}