mesh-controller/internal/inventory/bususers_integration_test.go

//go:build integration

package inventory

import (
	"context"
	"testing"

	"golang.org/x/crypto/bcrypt"
)

func TestABusPasswordIsReturnedOnceAndOnlyItsHashIsKept(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	password, err := inv.MintBusPassword(ctx, aBusUser("shop"))
	if err != nil {
		t.Fatal(err)
	}
	if password == "" {
		t.Fatal("no password came back, so nothing can be sealed to the module")
	}

	hash, known, err := inv.BusUserHash(ctx, "one.shop")
	if err != nil || !known {
		t.Fatalf("the user was not recorded: %v %v", known, err)
	}
	if hash == password {
		t.Fatal("the store holds the password itself")
	}
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)); err != nil {
		t.Fatalf("the recorded hash does not verify the password it was made from: %v", err)
	}
}

func TestMintingAgainRotatesRatherThanAddsAUser(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	first, err := inv.MintBusPassword(ctx, aBusUser("shop"))
	if err != nil {
		t.Fatal(err)
	}
	second, err := inv.MintBusPassword(ctx, aBusUser("shop"))
	if err != nil {
		t.Fatal(err)
	}
	if first == second {
		t.Fatal("minting twice produced the same password")
	}
	users, err := inv.BusUsers(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if len(users) != 1 {
		t.Fatalf("%d users after two mints for one name", len(users))
	}
	hash := users["one.shop"].PasswordHash
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(second)); err != nil {
		t.Fatal("the kept hash is not the newest password's")
	}
	if bcrypt.CompareHashAndPassword([]byte(hash), []byte(first)) == nil {
		t.Fatal("the previous password still verifies, so a rotation revoked nothing")
	}
}

func TestForgettingANodeTakesItsBusUsersWithIt(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	for _, u := range []BusUser{
		{Username: "node.one", Kind: BusNode, Node: "one"},
		aBusUser("shop"),
		{Username: "node.two", Kind: BusNode, Node: "two"},
		{Username: "controller", Kind: BusController},
	} {
		if _, err := inv.MintBusPassword(ctx, u); err != nil {
			t.Fatal(err)
		}
	}
	if err := inv.ForgetBusUsersOf(ctx, "one"); err != nil {
		t.Fatal(err)
	}
	users, err := inv.BusUsers(ctx)
	if err != nil {
		t.Fatal(err)
	}
	if _, still := users["node.one"]; still {
		t.Fatal("a forgotten node's host credential still works")
	}
	if _, still := users["one.shop"]; still {
		t.Fatal("a module on a forgotten node still has a credential")
	}
	// And nothing else went with it: the controller has no node, and another machine's user is
	// another machine's.
	for _, kept := range []string{"node.two", "controller"} {
		if _, ok := users[kept]; !ok {
			t.Fatalf("%s was removed with another node's users", kept)
		}
	}
}

func TestForgettingTheUsersOfNoNodeIsRefused(t *testing.T) {
	inv := ForTest(t)
	if err := inv.ForgetBusUsersOf(context.Background(), ""); err == nil {
		t.Fatal("forgetting the bus users of no node was allowed")
	}
}

func TestACredentialTheMeshDidNotMintIsRecordedOnceAndNotOverwritten(t *testing.T) {
	inv := ForTest(t)
	ctx := context.Background()

	if err := inv.SeedBusUser(ctx, BusUser{Username: "controller", Kind: BusController},
		"bootstrap"); err != nil {
		t.Fatal(err)
	}
	hash, known, err := inv.BusUserHash(ctx, "controller")
	if err != nil || !known {
		t.Fatalf("the credential was not recorded: %v %v", known, err)
	}
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte("bootstrap")); err != nil {
		t.Fatalf("what was recorded does not verify the credential given: %v", err)
	}

	// Minted since, then seeded again — which is what a restart does. The rotation must stand, or
	// every restart would put the bootstrap password back over it.
	minted, err := inv.MintBusPassword(ctx, BusUser{Username: "controller", Kind: BusController})
	if err != nil {
		t.Fatal(err)
	}
	if err := inv.SeedBusUser(ctx, BusUser{Username: "controller", Kind: BusController},
		"bootstrap"); err != nil {
		t.Fatal(err)
	}
	hash, _, err = inv.BusUserHash(ctx, "controller")
	if err != nil {
		t.Fatal(err)
	}
	if err := bcrypt.CompareHashAndPassword([]byte(hash), []byte(minted)); err != nil {
		t.Fatal("a restart put the bootstrap credential back over a rotated one")
	}
}