jschoubben
5cdf8295f3
The controller nox forwarded every line to is unassigned (issue 1126), so nox answered nothing but enrol open. Each line now calls the seat verb or module tool that owns its job through this machine's console (mesh_call); a line no seat owns says so and names what to use, never failing silently. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
81 lines
3.5 KiB
Go
81 lines
3.5 KiB
Go
package main
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"io"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"golang.org/x/crypto/nacl/box"
|
|
)
|
|
|
|
// 774/S51/AC1, AC2 (novox/hq ADR 0587 §6, §8): a token sealed to a test operator key (as mesh-vault seals it: the text
|
|
// of the token, anonymous box, base64) is opened with the private half and printed as a token the engine's parser reads
|
|
// (base64url of version 1 JSON with node, broker, fingerprint, signer and secret), and nothing is asked of the console, which
|
|
// here is an address nobody listens on; the wrong key prints nothing and says the token is not sealed to it.
|
|
func TestEnrolOpenOpensASealedTokenLocallyAndOnlyWithItsKey(t *testing.T) {
|
|
t.Setenv("MESH_VERB", "")
|
|
token := base64.RawURLEncoding.EncodeToString([]byte(`{"v":1,"node":"new1","broker":"tls://10.77.0.1:4222",` +
|
|
`"fingerprint":"sha256:bus","signer":"` + base64.StdEncoding.EncodeToString(make([]byte, 32)) + `","secret":"one-time"}`))
|
|
pub, priv, _ := box.GenerateKey(rand.Reader)
|
|
_, otherPriv, _ := box.GenerateKey(rand.Reader)
|
|
sealed, err := box.SealAnonymous(nil, []byte(token), pub, rand.Reader)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
dir := t.TempDir()
|
|
keyFile := func(name string, k *[32]byte) string {
|
|
p := filepath.Join(dir, name)
|
|
if err := os.WriteFile(p, []byte(base64.StdEncoding.EncodeToString(k[:])+"\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return p
|
|
}
|
|
beforeIn := standardInput
|
|
t.Setenv("MESH_CONSOLE", "http://127.0.0.1:1/mcp") // nothing listens: enrol open asks nothing of the mesh
|
|
t.Cleanup(func() { standardInput = beforeIn })
|
|
for _, c := range []struct {
|
|
name string
|
|
args []string
|
|
stdin string
|
|
code int
|
|
out string
|
|
err string
|
|
}{
|
|
{"the right key", []string{"enrol", "open", "--key", keyFile("op", priv)}, base64.StdEncoding.EncodeToString(sealed) + "\n", 0, token + "\n", ""},
|
|
{"the key as --key=", []string{"enrol", "open", "--key=" + keyFile("op2", priv)}, base64.StdEncoding.EncodeToString(sealed), 0, token + "\n", ""},
|
|
{"the wrong key", []string{"enrol", "open", "--key", keyFile("other", otherPriv)}, base64.StdEncoding.EncodeToString(sealed), 1, "", "not sealed to that key"},
|
|
{"no key", []string{"enrol", "open"}, base64.StdEncoding.EncodeToString(sealed), 2, "", "nox enrol open --key"},
|
|
{"not a sealed token", []string{"enrol", "open", "--key", keyFile("op3", priv)}, "@@@", 1, "", "not a sealed token"},
|
|
} {
|
|
standardInput = func() (io.Reader, bool) { return strings.NewReader(c.stdin), false }
|
|
var out, errOut bytes.Buffer
|
|
code := run(context.Background(), c.args, &out, &errOut)
|
|
if code != c.code || out.String() != c.out || !strings.Contains(errOut.String(), c.err) {
|
|
t.Errorf("%s: exit %d, stdout %q, stderr %q", c.name, code, out.String(), errOut.String())
|
|
}
|
|
}
|
|
// What it prints is a token the engine's parser reads.
|
|
var parsed struct {
|
|
V int `json:"v"`
|
|
Node string `json:"node"`
|
|
Secret string `json:"secret"`
|
|
}
|
|
raw, _ := base64.RawURLEncoding.DecodeString(token)
|
|
if json.Unmarshal(raw, &parsed) != nil || parsed.V != 1 || parsed.Node != "new1" || parsed.Secret != "one-time" {
|
|
t.Errorf("the token is %+v", parsed)
|
|
}
|
|
// Standard input a terminal is never read.
|
|
standardInput = func() (io.Reader, bool) { return strings.NewReader("x"), true }
|
|
var out, errOut bytes.Buffer
|
|
if code := run(context.Background(), []string{"enrol", "open", "--key", keyFile("op4", priv)}, &out, &errOut); code != 2 || out.Len() != 0 {
|
|
t.Errorf("a terminal on standard input: exit %d, stdout %q", code, out.String())
|
|
}
|
|
}
|