fix(#15): harden transport config validation #18

Merged
KofTwentyTwo merged 2 commits from feature/GH-15-transport-hardening into develop 2026-10-06 23:57:57 +00:00
KofTwentyTwo commented 2026-10-06 22:56:56 +00:00 (Migrated from github.com)

Summary

  • tls.hostnameVerification=false now logs a WARN when the transport is built. No validation gate: certificate chain checks still apply, and configs that set it deliberately keep working.
  • Username, password, tls.caCertificatePath, tls.trustStorePath and tls.keyStorePath must resolve to content. Null, empty and blank count as missing, and the error names the field plus the ${...} reference, never a resolved value. This replaces "Failed to create OpenSearch transport: null".
  • opensearchUrl with userinfo (https://u:p@host or https://u@host) is a validation error; the message does not echo the credentials.

Testing

  • New OpenSearchTransportFactoryTest (empty, blank and unset references for BASIC credentials and each TLS path; hostname warning via QCollectingLogger) and a userinfo case in QuickSearchQBitConfigValidationTest. All failed before the fix.
  • CI=true ./mvnw verify: 312 unit and 18 integration tests pass, JaCoCo checks met.

Closes #15

## Summary - `tls.hostnameVerification=false` now logs a WARN when the transport is built. No validation gate: certificate chain checks still apply, and configs that set it deliberately keep working. - Username, password, `tls.caCertificatePath`, `tls.trustStorePath` and `tls.keyStorePath` must resolve to content. Null, empty and blank count as missing, and the error names the field plus the `${...}` reference, never a resolved value. This replaces "Failed to create OpenSearch transport: null". - `opensearchUrl` with userinfo (`https://u:p@host` or `https://u@host`) is a validation error; the message does not echo the credentials. ## Testing - New `OpenSearchTransportFactoryTest` (empty, blank and unset references for BASIC credentials and each TLS path; hostname warning via `QCollectingLogger`) and a userinfo case in `QuickSearchQBitConfigValidationTest`. All failed before the fix. - `CI=true ./mvnw verify`: 312 unit and 18 integration tests pass, JaCoCo checks met. Closes #15
Sign in to join this conversation.