From 0a5186782f9b05b6c02b2a69b7b5adf53ba1ce58 Mon Sep 17 00:00:00 2001
From: lobo <andreas.dahm@gmail.com>
Date: Fri, 25 Sep 2026 08:37:55 +0200
Subject: [PATCH] test: generate the JWT test keys, drop application-dev.yml

The dev config held real keys. Local dev config now lives outside the repo; integration tests create a fresh Ed25519 keypair per run.
---
 .gitignore                                    |  4 +++
 .../api/PublicProfileControllerTest.java      | 25 +-----------------
 .../shared/test/AbstractIntegrationTest.java  | 26 ++++++++++++++++++-
 3 files changed, 30 insertions(+), 25 deletions(-)

diff --git a/.gitignore b/.gitignore
index 52d8a0c..e7d1367 100644
--- a/.gitignore
+++ b/.gitignore
@@ -34,3 +34,7 @@ build/
 
 ### Local secrets ###
 .env
+
+### Local dev config, never committed ###
+application-dev.yml
+application-dev.yaml
diff --git a/src/test/java/core_service/modules/library/api/PublicProfileControllerTest.java b/src/test/java/core_service/modules/library/api/PublicProfileControllerTest.java
index 009aff2..1b87efc 100644
--- a/src/test/java/core_service/modules/library/api/PublicProfileControllerTest.java
+++ b/src/test/java/core_service/modules/library/api/PublicProfileControllerTest.java
@@ -12,14 +12,9 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
-import org.springframework.test.context.DynamicPropertyRegistry;
-import org.springframework.test.context.DynamicPropertySource;
 import org.springframework.test.web.servlet.MockMvc;
 
-import java.security.KeyPair;
-import java.security.KeyPairGenerator;
 import java.time.Instant;
-import java.util.Base64;
 import java.util.Date;
 import java.util.List;
 
@@ -29,28 +24,10 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
 
-/**
- * Signs its own tickets: the test key pair replaces the dev public key.
- */
 @AutoConfigureMockMvc
 class PublicProfileControllerTest extends AbstractIntegrationTest {
 
     private static final long USER_ID = 7L;
-    private static final KeyPair KEYS = generateKeys();
-
-    private static KeyPair generateKeys() {
-        try {
-            return KeyPairGenerator.getInstance("Ed25519").generateKeyPair();
-        } catch (Exception e) {
-            throw new IllegalStateException(e);
-        }
-    }
-
-    @DynamicPropertySource
-    static void properties(DynamicPropertyRegistry registry) {
-        registry.add("security.jwt.public-key", () -> Base64.getEncoder().encodeToString(KEYS.getPublic().getEncoded()));
-    }
-
     @Autowired
     private MockMvc mockMvc;
 
@@ -62,7 +39,7 @@ class PublicProfileControllerTest extends AbstractIntegrationTest {
 
     private static String ticket(long userId) {
         return Jwts.builder().subject("public-profile").claim("typ", "public-profile").claim("profileUserId", String.valueOf(userId))
-                .expiration(new Date(System.currentTimeMillis() + 60_000)).signWith(KEYS.getPrivate(), Jwts.SIG.EdDSA).compact();
+                .expiration(new Date(System.currentTimeMillis() + 60_000)).signWith(TEST_KEYS.getPrivate(), Jwts.SIG.EdDSA).compact();
     }
 
     private UserGame game(long appid, int playtime, GameStatus status, Integer rating) {
diff --git a/src/test/java/core_service/shared/test/AbstractIntegrationTest.java b/src/test/java/core_service/shared/test/AbstractIntegrationTest.java
index f0e4589..6363401 100644
--- a/src/test/java/core_service/shared/test/AbstractIntegrationTest.java
+++ b/src/test/java/core_service/shared/test/AbstractIntegrationTest.java
@@ -4,14 +4,21 @@ import org.junit.jupiter.api.Tag;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.boot.testcontainers.service.connection.ServiceConnection;
 import org.springframework.test.context.ActiveProfiles;
+import org.springframework.test.context.DynamicPropertyRegistry;
+import org.springframework.test.context.DynamicPropertySource;
 import org.testcontainers.containers.PostgreSQLContainer;
 
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.NoSuchAlgorithmException;
+import java.util.Base64;
+
 /**
  * Base class for integration tests.
  * Full Spring context with Testcontainers.
  */
 @Tag("IntegrationTest")
-// The nightly sync would call Steam with the dev key if a test ran at 23:55.
+// The nightly sync would call Steam if a test ran at 23:55.
 @SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT, properties = "app.library.nightly-sync-cron=-")
 @ActiveProfiles("dev")
 public abstract class AbstractIntegrationTest {
@@ -24,4 +31,21 @@ public abstract class AbstractIntegrationTest {
     static {
         postgres.start();
     }
+
+    // No key is committed: a fresh one per JVM. Tests that sign tokens use TEST_KEYS.getPrivate().
+    protected static final KeyPair TEST_KEYS = generateKeys();
+
+    @DynamicPropertySource
+    static void secrets(DynamicPropertyRegistry registry) {
+        registry.add("security.jwt.public-key", () -> Base64.getEncoder().encodeToString(TEST_KEYS.getPublic().getEncoded()));
+        registry.add("app.steam.api-key", () -> "test-key");
+    }
+
+    private static KeyPair generateKeys() {
+        try {
+            return KeyPairGenerator.getInstance("Ed25519").generateKeyPair();
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException(e);
+        }
+    }
 }