mesh-controller/internal/inventory/bususers_integration_test.go

//go:build integration

package inventory

import (
	"context"
	"testing"

	"golang.org/x/crypto/bcrypt"
)

func TestABusPasswordIsReturnedOnceAndOnlyItsHashIsKept(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	password, err := inv.MintBusPassword(ctx, aBusUser("shop"))
	if err != nil {
		t.Fatal(err)
	}
	if password == "" {
		t.Fatal("no password came back, so nothing can be sealed to the module")
	}

	hash, known, err := inv.BusUserHash(ctx, "one.shop")
	if err != nil || !known {
		t.Fatalf("the user was not recorded: %v %v", known, err)
	}
	if hash == password {
		t.Fatal("the store holds the password itself")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)); err != nil {
		t.Fatalf("the recorded hash does not verify the password it was made from: %v", err)
	}
}

func TestMintingAgainRotatesAndMintingIfAbsentHasOneWinner(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	first, err := inv.MintBusPassword(ctx, aBusUser("shop"))
	if err != nil {
		t.Fatal(err)
	}
	second, err := inv.MintBusPassword(ctx, aBusUser("shop"))
	if err != nil {
		t.Fatal(err)
	}
	if first == second {
		t.Fatal("minting twice produced the same password")
	}
	users, err := inv.BusUsers(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if len(users) != 1 {
		t.Fatalf("%d users after two mints for one name", len(users))
	}
	hash := users["one.shop"].PasswordHash
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(second)); err != nil {
		t.Fatal("the kept hash is not the newest password's")
	}
	if bcrypt.CompareHashAndPassword([]byte(hash), []byte(first)) == nil {
		t.Fatal("the previous password still verifies, so a rotation revoked nothing")
	}

	// **Minting only if absent never rotates, and of several at once exactly one wins** (ADR 0543, the review of issue
	// 1945): the assign act and the assignments' watch may both find an account missing; the winner's password is the
	// one the store's hash verifies, so the one it seals is the one the bus accepts, and a loser seals nothing.
	if _, won, err := inv.MintBusPasswordIfAbsent(ctx, aBusUser("shop")); err != nil || won {
		t.Fatalf("a mint-if-absent over a minted account won %v (%v): it would replace a sealed password", won, err)
	}
	const racers = 8
	type minted struct {
		password string
		won      bool
		err      error
	}
	results := make(chan minted, racers)
	for range racers {
		go func() {
			p, won, err := inv.MintBusPasswordIfAbsent(ctx, aBusUser("racer"))
			results <- minted{p, won, err}
		}()
	}
	var winner string
	wins := 0
	for range racers {
		r := <-results
		if r.err != nil {
			t.Fatal(r.err)
		}
		if r.won {
			wins++
			winner = r.password
		} else if r.password != "" {
			t.Fatal("a caller that lost was handed a password to seal")
		}
	}
	if wins != 1 {
		t.Fatalf("%d of %d concurrent mints won, want exactly one", wins, racers)
	}
	stored, _, err := inv.BusUserHash(ctx, "one.racer")
	if err != nil {
		t.Fatal(err)
	}
	if err := bcrypt.CompareHashAndPassword([]byte(stored), []byte(winner)); err != nil {
		t.Fatal("the stored hash is not the winner's password: the node would be sealed a password the bus refuses")
	}
}

func TestForgettingANodeTakesItsBusUsersWithIt(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	for _, u := range []BusUser{
		{Username: "node.one", Kind: BusNode, Node: "one"},
		aBusUser("shop"),
		{Username: "node.two", Kind: BusNode, Node: "two"},
		{Username: "controller", Kind: BusController},
	} {
		if _, err := inv.MintBusPassword(ctx, u); err != nil {
			t.Fatal(err)
		}
	}
	if err := inv.ForgetBusUsersOf(ctx, "one"); err != nil {
		t.Fatal(err)
	}
	users, err := inv.BusUsers(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if _, still := users["node.one"]; still {
		t.Fatal("a forgotten node's host credential still works")
	}
	if _, still := users["one.shop"]; still {
		t.Fatal("a module on a forgotten node still has a credential")
	}
	// And nothing else went with it: the controller has no node, and another machine's user is
	// another machine's.
	for _, kept := range []string{"node.two", "controller"} {
		if _, ok := users[kept]; !ok {
			t.Fatalf("%s was removed with another node's users", kept)
		}
	}
}

func TestForgettingTheUsersOfNoNodeIsRefused(t *testing.T) {
	inv := ForTest(t)
	if err := inv.ForgetBusUsersOf(context.Background(), ""); err == nil {
		t.Fatal("forgetting the bus users of no node was allowed")
	}
}

func TestACredentialTheMeshDidNotMintIsRecordedOnceAndNotOverwritten(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	if err := inv.SeedBusUser(ctx, BusUser{Username: "controller", Kind: BusController},
		"bootstrap"); err != nil {
		t.Fatal(err)
	}
	hash, known, err := inv.BusUserHash(ctx, "controller")
	if err != nil || !known {
		t.Fatalf("the credential was not recorded: %v %v", known, err)
	}
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte("bootstrap")); err != nil {
		t.Fatalf("what was recorded does not verify the credential given: %v", err)
	}

	// Minted since, then seeded again — which is what a restart does. The rotation must stand, or
	// every restart would put the bootstrap password back over it.
	minted, err := inv.MintBusPassword(ctx, BusUser{Username: "controller", Kind: BusController})
	if err != nil {
		t.Fatal(err)
	}
	if err := inv.SeedBusUser(ctx, BusUser{Username: "controller", Kind: BusController},
		"bootstrap"); err != nil {
		t.Fatal(err)
	}
	hash, _, err = inv.BusUserHash(ctx, "controller")
	if err != nil {
		t.Fatal(err)
	}
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(minted)); err != nil {
		t.Fatal("a restart put the bootstrap credential back over a rotated one")
	}
}