| 1 | package operator |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "testing" |
| 6 | "time" |
| 7 | |
| 8 | "github.com/go-json-experiment/json" |
| 9 | ) |
| 10 | |
| 11 | func inspectChallenge(f *directoryFixture) InspectChallenge { |
| 12 | p := f.engine.verifier.pins |
| 13 | return InspectChallenge{1, "operator-inspect", p.Role, p.Origin, p.Installation, p.Registry, p.Device, token(85), f.now.Unix(), f.now.Unix() + 300} |
| 14 | } |
| 15 | func TestInspectDoesNotInitializeOrReserveAuthority(t *testing.T) { |
| 16 | f := newDirectoryFixture(t) |
| 17 | challenge := inspectChallenge(f) |
| 18 | raw, err := SignInspect(f.key, challenge) |
| 19 | if err != nil { |
| 20 | t.Fatal(err) |
| 21 | } |
| 22 | read := func(wantGen *string, wantID int64) { |
| 23 | t.Helper() |
| 24 | out, err := f.directory.Inspect(context.Background(), raw) |
| 25 | if err != nil { |
| 26 | t.Fatal(err) |
| 27 | } |
| 28 | var got Inspection |
| 29 | if err = json.Unmarshal(out, &got); err != nil { |
| 30 | t.Fatal(err) |
| 31 | } |
| 32 | if got.Challenge != challenge.Challenge || got.TeamID != wantID || got.Observed != f.now.Unix() || (got.Generation == nil) != (wantGen == nil) || (wantGen != nil && *got.Generation != *wantGen) { |
| 33 | t.Fatal("wrong inspection") |
| 34 | } |
| 35 | } |
| 36 | read(nil, 1) |
| 37 | read(nil, 1) |
| 38 | if countRows(t, f.db, "directory_operator_state") != 0 || countRows(t, f.db, "directory_operator_results") != 0 || countRows(t, f.db, "teams") != 0 { |
| 39 | t.Fatal("inspection minted authority") |
| 40 | } |
| 41 | f.initialize(t) |
| 42 | gen := token(10) |
| 43 | read(&gen, 1) |
| 44 | if _, err = f.seed(t, 1, "alpha"); err != nil { |
| 45 | t.Fatal(err) |
| 46 | } |
| 47 | read(&gen, 2) |
| 48 | if countRows(t, f.db, "directory_operator_results") != 2 { |
| 49 | t.Fatal("inspection advanced accepted stream") |
| 50 | } |
| 51 | if _, err = f.directory.Execute(context.Background(), raw); err != ErrRefused { |
| 52 | t.Fatal("inspection became mutation", err) |
| 53 | } |
| 54 | *f.now = f.now.Add(300 * time.Second) |
| 55 | if _, err = f.directory.Inspect(context.Background(), raw); err != ErrRefused { |
| 56 | t.Fatal("expired inspection replayed", err) |
| 57 | } |
| 58 | } |
| 59 | func TestInspectWrongBindingsAndMutableInputRefuse(t *testing.T) { |
| 60 | f := newDirectoryFixture(t) |
| 61 | for _, change := range []func(*InspectChallenge){func(c *InspectChallenge) { c.Origin = "https://other.oficina.works" }, func(c *InspectChallenge) { c.Device = token(86) }, func(c *InspectChallenge) { c.Registry = token(86) }, func(c *InspectChallenge) { c.Installation = token(86) }, func(c *InspectChallenge) { c.Role = "credential" }, func(c *InspectChallenge) { c.Issued++; c.Expires++ }} { |
| 62 | c := inspectChallenge(f) |
| 63 | change(&c) |
| 64 | raw, err := SignInspect(f.key, c) |
| 65 | if err != nil { |
| 66 | t.Fatal(err) |
| 67 | } |
| 68 | if _, err = f.directory.Inspect(context.Background(), raw); err != ErrRefused { |
| 69 | t.Fatal("wrong inspection accepted", err) |
| 70 | } |
| 71 | } |
| 72 | raw, err := SignInspect(f.key, inspectChallenge(f)) |
| 73 | if err != nil { |
| 74 | t.Fatal(err) |
| 75 | } |
| 76 | if _, err = f.directory.Inspect(context.Background(), append(raw, ' ')); err != ErrRefused { |
| 77 | t.Fatal("noncanonical challenge", err) |
| 78 | } |
| 79 | } |
| 80 | |
amadan