| 1 | package dbreads |
| 2 | |
| 3 | import ( |
| 4 | "crypto/ed25519" |
| 5 | "crypto/rand" |
| 6 | "encoding/base64" |
| 7 | "encoding/json" |
| 8 | "errors" |
| 9 | "strconv" |
| 10 | "strings" |
| 11 | "testing" |
| 12 | "time" |
| 13 | |
| 14 | "github.com/carlosframework/platform/internal/release" |
| 15 | ) |
| 16 | |
| 17 | var testNow = time.Date(2026, 10, 22, 9, 0, 0, 0, time.UTC) |
| 18 | |
| 19 | func testRequest(t *testing.T) Request { |
| 20 | t.Helper() |
| 21 | priv, err := NewReplyKey() |
| 22 | if err != nil { |
| 23 | t.Fatal(err) |
| 24 | } |
| 25 | return Request{ |
| 26 | ID: "dbr_aaaaaaaaaaaaaaaaaaaaaaaaaa", Account: "bab", App: "shop", Host: "shop.example.com", |
| 27 | Incarnation: "inc", Region: "uk", Op: OpQuery, SQL: "SELECT count(*) FROM orders", |
| 28 | ReplyKey: EncodeReplyKey(priv.PublicKey()), By: "member@example.com", |
| 29 | IssuedAt: testNow.Format(time.RFC3339), |
| 30 | } |
| 31 | } |
| 32 | |
| 33 | func rootKeys(t *testing.T) (ed25519.PublicKey, ed25519.PrivateKey) { |
| 34 | t.Helper() |
| 35 | pub, priv, err := ed25519.GenerateKey(rand.Reader) |
| 36 | if err != nil { |
| 37 | t.Fatal(err) |
| 38 | } |
| 39 | return pub, priv |
| 40 | } |
| 41 | |
| 42 | func TestEnvelopeVerifiesWhatTheRootSigned(t *testing.T) { |
| 43 | t.Parallel() |
| 44 | pub, priv := rootKeys(t) |
| 45 | req := testRequest(t) |
| 46 | wire, err := Sign(release.RootSigner(priv), req) |
| 47 | if err != nil { |
| 48 | t.Fatal(err) |
| 49 | } |
| 50 | got, err := Verify(pub, wire, req.ID, "uk", testNow.Add(30*time.Second)) |
| 51 | if err != nil { |
| 52 | t.Fatal(err) |
| 53 | } |
| 54 | req.Purpose, req.V = Purpose, 1 |
| 55 | if got != req { |
| 56 | t.Fatalf("got %+v, want %+v", got, req) |
| 57 | } |
| 58 | } |
| 59 | |
| 60 | // T4 (spec §11.4), the envelope half: every forgery and replay the envelope |
| 61 | // alone must stop. |
| 62 | func TestEnvelopeRefusesForgeryAndReplay(t *testing.T) { |
| 63 | t.Parallel() |
| 64 | pub, priv := rootKeys(t) |
| 65 | _, otherPriv := rootKeys(t) |
| 66 | req := testRequest(t) |
| 67 | good, err := Sign(release.RootSigner(priv), req) |
| 68 | if err != nil { |
| 69 | t.Fatal(err) |
| 70 | } |
| 71 | unsigned, _ := json.Marshal(map[string]string{"payload": base64.StdEncoding.EncodeToString([]byte(`{}`)), "sig": ""}) |
| 72 | wrongKey, err := Sign(release.RootSigner(otherPriv), req) |
| 73 | if err != nil { |
| 74 | t.Fatal(err) |
| 75 | } |
| 76 | cases := []struct { |
| 77 | name string |
| 78 | wire []byte |
| 79 | id string |
| 80 | region string |
| 81 | now time.Time |
| 82 | }{ |
| 83 | {"unsigned", unsigned, req.ID, "uk", testNow}, |
| 84 | {"wrong key", wrongKey, req.ID, "uk", testNow}, |
| 85 | {"moved to another id", good, "dbr_bbbbbbbbbbbbbbbbbbbbbbbbbb", "uk", testNow}, |
| 86 | {"moved to another region", good, req.ID, "ie", testNow}, |
| 87 | {"older than the window", good, req.ID, "uk", testNow.Add(61 * time.Second)}, |
| 88 | {"from the future", good, req.ID, "uk", testNow.Add(-61 * time.Second)}, |
| 89 | } |
| 90 | for _, c := range cases { |
| 91 | if _, err := Verify(pub, c.wire, c.id, c.region, c.now); !errors.Is(err, ErrEnvelope) && !errors.Is(err, release.ErrRootEnvelope) { |
| 92 | t.Errorf("%s: Verify = %v, want a refusal", c.name, err) |
| 93 | } |
| 94 | } |
| 95 | } |
| 96 | |
| 97 | // A scoped release key cannot sign: the console that holds only one cannot |
| 98 | // forward (spec §5.5). |
| 99 | func TestEnvelopeScopedKeyCannotSign(t *testing.T) { |
| 100 | t.Parallel() |
| 101 | rootPub, rootPriv := rootKeys(t) |
| 102 | seed, grant, err := release.MintKeyGrant(rootPriv, "ci", []string{"canary"}, time.Hour) |
| 103 | if err != nil { |
| 104 | t.Fatal(err) |
| 105 | } |
| 106 | key, err := release.ParseSigningKey(seed, "scoped") |
| 107 | if err != nil { |
| 108 | t.Fatal(err) |
| 109 | } |
| 110 | sg, err := release.ScopedSigner(key, grant, rootPub) |
| 111 | if err != nil { |
| 112 | t.Fatal(err) |
| 113 | } |
| 114 | if _, err := Sign(sg, testRequest(t)); !errors.Is(err, release.ErrRootEnvelope) { |
| 115 | t.Fatalf("a scoped key signed: %v", err) |
| 116 | } |
| 117 | } |
| 118 | |
| 119 | func TestEnvelopeRefusesWhatItCannotCarry(t *testing.T) { |
| 120 | t.Parallel() |
| 121 | _, priv := rootKeys(t) |
| 122 | for name, mut := range map[string]func(*Request){ |
| 123 | "bad id": func(r *Request) { r.ID = "run_aaaaaaaaaaaaaaaaaaaaaaaaaa" }, |
| 124 | "fleet region": func(r *Request) { r.Region = "fleet/acme" }, |
| 125 | "bad host": func(r *Request) { r.Host = "../../etc" }, |
| 126 | "bad op": func(r *Request) { r.Op = "shell" }, |
| 127 | "empty sql": func(r *Request) { r.SQL = "" }, |
| 128 | "huge sql": func(r *Request) { r.SQL = strings.Repeat("x", MaxSQLBytes+1) }, |
| 129 | "invalid utf-8": func(r *Request) { r.SQL = "SELECT '\xff'" }, |
| 130 | "bad at": func(r *Request) { r.At = "yesterday" }, |
| 131 | "bad reply key": func(r *Request) { r.ReplyKey = "AAAA" }, |
| 132 | "bad issued_at": func(r *Request) { r.IssuedAt = "now" }, |
| 133 | } { |
| 134 | req := testRequest(t) |
| 135 | mut(&req) |
| 136 | if _, err := Sign(release.RootSigner(priv), req); !errors.Is(err, ErrEnvelope) { |
| 137 | t.Errorf("%s: Sign = %v", name, err) |
| 138 | } |
| 139 | } |
| 140 | } |
| 141 | |
| 142 | // Review Focus 1: the SQL a person typed is the SQL the box runs. |
| 143 | func TestEnvelopeSQLRoundTripsByteForByte(t *testing.T) { |
| 144 | t.Parallel() |
| 145 | pub, priv := rootKeys(t) |
| 146 | req := testRequest(t) |
| 147 | req.SQL = "SELECT '<a href=\"x\">&</a>' || char(10) || '
é' WHERE 1 < 2 AND 3 > 2" |
| 148 | wire, err := Sign(release.RootSigner(priv), req) |
| 149 | if err != nil { |
| 150 | t.Fatal(err) |
| 151 | } |
| 152 | got, err := Verify(pub, wire, req.ID, "uk", testNow) |
| 153 | if err != nil || got.SQL != req.SQL { |
| 154 | t.Fatalf("Verify = %q, %v", got.SQL, err) |
| 155 | } |
| 156 | } |
| 157 | |
| 158 | func TestQueueMatchesNeedsEveryPart(t *testing.T) { |
| 159 | t.Parallel() |
| 160 | req := testRequest(t) |
| 161 | issued, _ := req.Issued() |
| 162 | good, _ := ParseQueueKey(QueueKey("uk", issued, req.ID)) |
| 163 | if !QueueMatches(good, req) { |
| 164 | t.Fatal("the console's own entry does not match") |
| 165 | } |
| 166 | for name, key := range map[string]string{ |
| 167 | "other region": QueueKey("ie", issued, req.ID), |
| 168 | "other time": QueueKey("uk", issued.Add(time.Second), req.ID), |
| 169 | "other hour": QueueHourPrefix("uk", issued.Add(time.Hour)) + strconv.FormatInt(issued.Unix(), 10) + "-" + req.ID, |
| 170 | "other id": QueueKey("uk", issued, "dbr_bbbbbbbbbbbbbbbbbbbbbbbbbb"), |
| 171 | } { |
| 172 | e, ok := ParseQueueKey(key) |
| 173 | if ok && QueueMatches(e, req) { |
| 174 | t.Errorf("%s matched", name) |
| 175 | } |
| 176 | } |
| 177 | } |
| 178 | |
| 179 | // A pull is an op this build signs and serves (plan 3), and carries no SQL. |
| 180 | func TestEnvelopeCarriesAPull(t *testing.T) { |
| 181 | t.Parallel() |
| 182 | pub, priv := rootKeys(t) |
| 183 | req := testRequest(t) |
| 184 | req.Op, req.SQL = OpPull, "" |
| 185 | wire, err := Sign(release.RootSigner(priv), req) |
| 186 | if err != nil { |
| 187 | t.Fatal(err) |
| 188 | } |
| 189 | if got, err := Verify(pub, wire, req.ID, "uk", testNow); err != nil || got.Op != OpPull { |
| 190 | t.Fatalf("%+v %v", got, err) |
| 191 | } |
| 192 | req.SQL = "SELECT 1" |
| 193 | if _, err := Sign(release.RootSigner(priv), req); !errors.Is(err, ErrEnvelope) { |
| 194 | t.Fatalf("a pull carrying SQL signed: %v", err) |
| 195 | } |
| 196 | } |
| 197 | |
amadan