v0.20.0 mtls hardening, fail-closed config, startup warnings, sink fixes

cmd/logwisp/reload_test.go

@@ -3,8 +3,12 @@ package main
 import (
 	"context"
 	"path/filepath"
+	"strings"
 	"testing"
+	"time"
 
+	"logwisp/internal/plugin"
+	"logwisp/internal/session"
 	"logwisp/internal/testutil"
 
 	lconfig "github.com/lixenwraith/config"
@@ -77,3 +81,28 @@ func TestInvalidReloadLeavesStatusReporterRunning(t *testing.T) {
 		})
 	}
 }
+
+// Every registered plugin decodes through the checked decoder, so a typo in
+// any plugin's config, security tables included, refuses to start.
+func TestEveryPluginRejectsUnknownKeys(t *testing.T) {
+	testLogger(t)
+	manager := session.NewManager(time.Hour)
+	t.Cleanup(manager.Stop)
+	proxy := session.NewProxy(manager, "typo")
+	bad := map[string]any{"no_such_key": true}
+	check := func(kind, name string, err error) {
+		if err == nil || !strings.Contains(err.Error(), "no_such_key") {
+			t.Errorf("%s %q accepted an unknown key: %v", kind, name, err)
+		}
+	}
+	for _, name := range plugin.ListSources() {
+		factory, _ := plugin.GetSource(name)
+		_, err := factory("typo", bad, logger, proxy)
+		check("source", name, err)
+	}
+	for _, name := range plugin.ListSinks() {
+		factory, _ := plugin.GetSink(name)
+		_, err := factory("typo", bad, logger, proxy)
+		check("sink", name, err)
+	}
+}