Serve node-launcher's hidden prompt, answering sealed to the asker, so a secret typed at the desk is never in the clear (hq ADR 0259 §10)

2026-10-09 17:08:17 +02:00
parent d902e1550e
commit ad5a85398e
8 changed files with 231 additions and 2 deletions
@@ -0,0 +1,90 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"golang.org/x/crypto/nacl/box"
+)
+
+const typedValue = "123456789:AAEhBP0av28P4XFQnIuR-o-7Xnz1kkUzW3g"
+
+func aKey(t *testing.T) (string, *[32]byte, *[32]byte) {
+	t.Helper()
+	pub, priv, err := box.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return base64.StdEncoding.EncodeToString(pub[:]), pub, priv
+}
+
+// novox/hq ADR 0259 §10: what the operator types in the hidden prompt is answered sealed to the asker's
+// key, and never in the clear — not in the answer, not in an error.
+func TestWhatIsTypedIsAnsweredSealedToTheAskersKeyAndNeverInTheClear(t *testing.T) {
+	withSession(t)
+	bin := fakeBinaries(t, map[string]string{"rofi": `echo "$*" > "$LOG"; echo "` + typedValue + `"`})
+	t.Setenv("LOG", filepath.Join(bin, "log"))
+	key, pub, priv := aKey(t)
+	q, err := secretQuestion(map[string]any{"prompt": "telegram-token for telegram", "message": "The mesh asks", "seal_to": key})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := Secret(q)
+	if err != nil || got.Cancelled || got.Sealed == "" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	raw, _ := json.Marshal(got)
+	if strings.Contains(string(raw), typedValue) || strings.Contains(string(raw), "AAEhBP0") {
+		t.Fatal("the answer carries what was typed in the clear")
+	}
+	blob, _ := base64.StdEncoding.DecodeString(got.Sealed)
+	opened, ok := box.OpenAnonymous(nil, blob, pub, priv)
+	if !ok || string(opened) != typedValue {
+		t.Fatalf("the answer does not open to what was typed, its line ending taken off")
+	}
+	asked, _ := os.ReadFile(filepath.Join(bin, "log"))
+	for _, want := range []string{"-dmenu", "-password", "-p telegram-token for telegram", "-mesg The mesh asks"} {
+		if !strings.Contains(string(asked), want) {
+			t.Errorf("rofi was not asked %q: %s", want, asked)
+		}
+	}
+	if strings.Contains(string(asked), "-no-custom") {
+		t.Error("the prompt takes no typed answer")
+	}
+}
+
+func TestADismissedEmptyOrLatePromptIsACancelAndAFailureNeverSaysTheValue(t *testing.T) {
+	withSession(t)
+	key, _, _ := aKey(t)
+	q, _ := secretQuestion(map[string]any{"prompt": "p", "seal_to": key, "timeout_seconds": 1})
+	for script, timedOut := range map[string]bool{`exit 1`: false, `echo ""`: false, `sleep 30`: true} {
+		fakeBinaries(t, map[string]string{"rofi": script})
+		got, err := Secret(q)
+		if err != nil || !got.Cancelled || got.TimedOut != timedOut || got.Sealed != "" {
+			t.Errorf("%s: %+v %v", script, got, err)
+		}
+	}
+	fakeBinaries(t, map[string]string{"rofi": `echo "` + typedValue + `"; echo "rofi broke" >&2; exit 3`})
+	if _, err := Secret(q); err == nil || strings.Contains(err.Error(), typedValue) || !strings.Contains(err.Error(), "rofi broke") {
+		t.Errorf("a failure said %v", err)
+	}
+}
+
+func TestASecretIsAskedOnlyWithAKeyToSealItTo(t *testing.T) {
+	for _, args := range []map[string]any{
+		{"prompt": "p"},
+		{"prompt": "p", "seal_to": "not a key"},
+		{"prompt": "p", "seal_to": base64.StdEncoding.EncodeToString([]byte("short"))},
+		{"seal_to": base64.StdEncoding.EncodeToString(make([]byte, 32))},
+		{"prompt": "p", "seal_to": base64.StdEncoding.EncodeToString(make([]byte, 32)), "timeout_seconds": 60},
+	} {
+		if _, err := secretQuestion(args); err == nil {
+			t.Errorf("%v was taken", args)
+		}
+	}
+}