feat: log error message when JWT secret is less than 32 characters long

breaking change: PostgREST now fails to start or reload the config when the JWT secret is less than 32 characters long.

test/io/configs/expected/no-defaults.config

@@ -21,7 +21,7 @@ db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
 jwt-aud = "https://postgrest.org"
 jwt-role-claim-key = ".\"user\"[0].\"real-role\""
-jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5"
+jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5aW5iYXNlNjQ="
 jwt-secret-is-base64 = true
 jwt-cache-max-lifetime = 86400
 log-level = "info"

test/io/configs/no-defaults-env.yaml

@@ -24,7 +24,7 @@ PGRST_DB_URI: tmp_db
 PGRST_DB_USE_LEGACY_GUCS: false
 PGRST_JWT_AUD: 'https://postgrest.org'
 PGRST_JWT_ROLE_CLAIM_KEY: '.user[0]."real-role"'
-PGRST_JWT_SECRET: c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5
+PGRST_JWT_SECRET: c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5aW5iYXNlNjQ=
 PGRST_JWT_SECRET_IS_BASE64: true
 PGRST_JWT_CACHE_MAX_LIFETIME: 86400
 PGRST_LOG_LEVEL: info

test/io/configs/no-defaults.config

@@ -21,7 +21,7 @@ db-tx-end = "rollback-allow-override"
 db-uri = "tmp_db"
 jwt-aud = "https://postgrest.org"
 jwt-role-claim-key = ".user[0].\"real-role\""
-jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5"
+jwt-secret = "c2VjdXJpdHl0aHJvdWdob2JzY3VyaXR5aW5iYXNlNjQ="
 jwt-secret-is-base64 = true
 jwt-cache-max-lifetime = 86400
 log-level = "info"

test/io/test_io.py

@@ -66,6 +66,19 @@ def test_read_secret_from_stdin_dbconfig(defaultenv):
         assert response.status_code == 200
 
 
+def test_secret_min_length(defaultenv):
+    "Should log error and not load the config when the secret is shorter than the minimum admitted length"
+
+    env = {**defaultenv, "PGRST_JWT_SECRET": "short_secret"}
+
+    with run(env=env, no_startup_stdout=False, wait_for_readiness=False) as postgrest:
+        exitCode = wait_until_exit(postgrest)
+        assert exitCode == 1
+
+        output = postgrest.read_stdout(nlines=1)
+        assert "The JWT secret must be at least 32 characters long." in output[0]
+
+
 def test_jwt_errors(defaultenv):
     "invalid JWT should throw error"