carlos / platform Public

Download this file

1	package host
2
3	import (
4	"bytes"
5	"context"
6	"errors"
7	"log"
8	"os"
9	"path/filepath"
10	"strings"
11	"testing"
12
13	"github.com/carlosframework/platform/internal/appconfig"
14	"github.com/carlosframework/platform/internal/instancekey"
15	"github.com/carlosframework/platform/internal/registry"
16	"github.com/carlosframework/platform/internal/release"
17	)
18
19	// Ruling 30 (Astra round 6 finding 2): the list is read again at every
20	// call, so the procedure's invalidation and its new entries take effect at
21	// the next replica launch, with no restart. An absent list verifies
22	// nothing.
23	func TestReplicaHomeKeysReadsTheListAtEveryLaunch(t *testing.T) {
24	a, b := instancekey.Digest("home-key-a"), instancekey.Digest("home-key-b")
25	path := filepath.Join(t.TempDir(), "replica-home-keys")
26	keys := replicaHomeKeys(func() ([]byte, error) { return os.ReadFile(path) })
27	if _, ok := keys("shop-au.example.com"); ok {
28	t.Fatal("an absent list verified a key")
29	}
30	write := func(body string) {
31	t.Helper()
32	tmp := path + ".tmp"
33	if err := os.WriteFile(tmp, []byte(body), 0o640); err != nil {
34	t.Fatal(err)
35	}
36	if err := os.Rename(tmp, path); err != nil {
37	t.Fatal(err)
38	}
39	}
40	write("shop-au.example.com=" + a + "\nshop-uk.example.com=" + a + "\n")
41	if got, ok := keys("shop-au.example.com"); !ok || got != a {
42	t.Fatalf("listed replica = %q, %v", got, ok)
43	}
44	// The procedure's invalidation: the entry is gone at the next call.
45	write("shop-uk.example.com=" + a + "\n")
46	if _, ok := keys("shop-au.example.com"); ok {
47	t.Fatal("a removed entry still verified: the list was cached")
48	}
49	// And its replacement, after the key change and the re-run check.
50	write("shop-au.example.com=" + b + ",shop-uk.example.com=" + a)
51	if got, ok := keys("shop-au.example.com"); !ok || got != b {
52	t.Fatalf("the replaced entry = %q, %v; want the new digest", got, ok)
53	}
54	if _, ok := keys("shop-nz.example.com"); ok {
55	t.Fatal("an unlisted replica verified")
56	}
57	}
58
59	// Astra round 5 finding 3: a malformed list is logged by entry position and
60	// reason, never by its text (a bare digest, with no host before it, would
61	// otherwise reach the log), and verifies nothing.
62	func TestReplicaHomeKeysLogsAMalformedListWithoutItsText(t *testing.T) {
63	sha := instancekey.Digest("home-key")
64	var buf bytes.Buffer
65	log.SetOutput(&buf)
66	defer log.SetOutput(os.Stderr)
67	keys := replicaHomeKeys(func() ([]byte, error) { return []byte("shop-au.example.com=" + sha + "\n" + sha + "\n"), nil })
68	if _, ok := keys("shop-au.example.com"); ok {
69	t.Fatal("a malformed list verified a key")
70	}
71	line := buf.String()
72	if !strings.Contains(line, replicaHomeKeysPath) || !strings.Contains(line, "replica home keys entry 2") || strings.Contains(line, sha[:16]) || strings.Contains(line, "shop-au") {
73	t.Fatalf("log line %q: want the entry's position and reason, and none of its text", line)
74	}
75	buf.Reset()
76	if _, ok := replicaHomeKeys(func() ([]byte, error) { return nil, errors.New("permission denied") })("shop-au.example.com"); ok {
77	t.Fatal("an unreadable list verified a key")
78	}
79	if !strings.Contains(buf.String(), "could not be read") {
80	t.Fatalf("log line %q", buf.String())
81	}
82	}
83
84	// Rulings 5 and 27's fresh read, as the agent wires it: the bucket's
85	// current configured key, through the deploy store and the box's secrets
86	// key. Which boxes have a configuration to read follows the config guard:
87	// no secrets key still reads the bucket and renders a plain value (a
88	// sealed one fails the render, as it fails the guard); no deployment
89	// store is an error, unless CARLOS_NO_SEALED_CONFIG says this deployment
90	// has no configuration at all, where nothing is on its way and no key is
91	// rendered.
92	func TestConfiguredKeyReadsTheBucketNow(t *testing.T) {
93	ctx := context.Background()
94	s := release.NewDirStore(t.TempDir())
95	priv, pubB64, err := appconfig.GenerateKey()
96	if err != nil {
97	t.Fatal(err)
98	}
99	if err := appconfig.SetEnv(ctx, s, "acct", "shop", map[string]string{instancekey.Var: "key-A"}); err != nil {
100	t.Fatal(err)
101	}
102	rt := registry.Route{Host: "shop-au.example.com", Kind: "instance", App: "shop", Account: "acct", Replica: true}
103	opened := 0
104	open := func(context.Context) (release.Store, error) { opened++; return s, nil }
105	read := configuredKey(func(k string) string {
106	if k == "CARLOS_SECRETS_KEY" {
107	return priv
108	}
109	return ""
110	}, open)
111	for i := 0; i < 2; i++ {
112	if got, err := read(ctx, rt); err != nil || got != instancekey.Digest("key-A") {
113	t.Fatalf("read %d = %q, %v", i, got, err)
114	}
115	}
116	if opened != 1 {
117	t.Fatalf("the store was opened %d times, want once", opened)
118	}
119	failing := configuredKey(func(string) string { return priv }, func(context.Context) (release.Store, error) { return nil, errors.New("bucket unreachable") })
120	if _, err := failing(ctx, rt); err == nil {
121	t.Fatal("an unreachable bucket was not an error")
122	}
123	if got, err := configuredKey(func(string) string { return "" }, open)(ctx, rt); err != nil || got != instancekey.Digest("key-A") {
124	t.Fatalf("no secrets key, a plain configured key = %q, %v; want the digest (the guard admits plain config on a keyless box)", got, err)
125	}
126	pub, err := appconfig.ParsePublicKey(pubB64, "test")
127	if err != nil {
128	t.Fatal(err)
129	}
130	envelope, err := appconfig.SealUnbound(pub, []byte("x"))
131	if err != nil {
132	t.Fatal(err)
133	}
134	if err := appconfig.SetSecret(ctx, s, "acct", "shop", map[string]string{"SEALED": envelope}); err != nil {
135	t.Fatal(err)
136	}
137	if _, err := configuredKey(func(string) string { return "" }, open)(ctx, rt); err == nil {
138	t.Fatal("no secrets key beside a sealed value was not an error")
139	}
140	noStore := func(context.Context) (release.Store, error) { return nil, errNoDeployStore }
141	if _, err := configuredKey(func(string) string { return "" }, noStore)(ctx, rt); err == nil {
142	t.Fatal("no deployment store was not an error")
143	}
144	bypass := func(k string) string {
145	if k == "CARLOS_NO_SEALED_CONFIG" {
146	return "1"
147	}
148	return ""
149	}
150	if got, err := configuredKey(bypass, noStore)(ctx, rt); err != nil || got != "" {
151	t.Fatalf("no store under CARLOS_NO_SEALED_CONFIG = %q, %v; want no key and no error", got, err)
152	}
153	}
154
155	// A failed first open is not kept: the same closure opens the store again
156	// at the next replica launch, and reads the bucket once it opens.
157	func TestConfiguredKeyRetriesAFailedOpen(t *testing.T) {
158	ctx := context.Background()
159	s := release.NewDirStore(t.TempDir())
160	priv, _, err := appconfig.GenerateKey()
161	if err != nil {
162	t.Fatal(err)
163	}
164	if err := appconfig.SetEnv(ctx, s, "acct", "shop", map[string]string{instancekey.Var: "key-A"}); err != nil {
165	t.Fatal(err)
166	}
167	rt := registry.Route{Host: "shop-au.example.com", Kind: "instance", App: "shop", Account: "acct", Replica: true}
168	opens := 0
169	read := configuredKey(func(string) string { return priv }, func(context.Context) (release.Store, error) {
170	opens++
171	if opens == 1 {
172	return nil, errors.New("bucket unreachable")
173	}
174	return s, nil
175	})
176	if _, err := read(ctx, rt); err == nil {
177	t.Fatal("the failed first open was not an error")
178	}
179	for i := 0; i < 2; i++ {
180	if got, err := read(ctx, rt); err != nil || got != instancekey.Digest("key-A") {
181	t.Fatalf("read %d after the failure = %q, %v", i, got, err)
182	}
183	}
184	if opens != 2 {
185	t.Fatalf("the store was opened %d times, want twice: once failed, once kept", opens)
186	}
187	}
188