jschoubben
64c081d025
Two files with two values, two holders in the vault's ledger — the identity with the local name after it — and one rotate moves both (novox/hq ADR 0094).
504 lines
26 KiB
TypeScript
504 lines
26 KiB
TypeScript
/**
|
|
* A module's own secret, provided by the vault — and rotated like any other credential.
|
|
*
|
|
* novox/hq ADR 0085: a secret a module needs for itself is a `secret` provision from a vault module,
|
|
* and the credential of that consumer↔vault pair IS the value. So everything design 13 built for a
|
|
* database password applies to it unchanged, and this bed checks exactly what 13 checks: three
|
|
* logins against the real software, from the machine that holds the secret —
|
|
*
|
|
* 1. the delivered password authenticates against redis
|
|
* 2. after `rotate secret`, the new one authenticates
|
|
* 3. the one that was rotated away does not
|
|
*
|
|
* — plus the half that makes the vault an owner rather than a bystander: its ledger records who
|
|
* holds the secret and its fingerprint, notices the rotation, and answers over the mesh without ever
|
|
* returning a value.
|
|
*
|
|
* And the amended half of ADR 0085: the mesh has an operator key, every secret a module holds for
|
|
* itself is sealed to it as well, the vault keeps that export on its disk, and the operator — with
|
|
* the private key that never entered the mesh — recovers exactly the value the node was given.
|
|
* Checked against the value the host unsealed on the machine, and with the store out of the loop.
|
|
*
|
|
* The manifests are the catalogue's own (../mesh-catalog/modules/{mesh-vault,redis}/module.json), with
|
|
* the runtime artifact named as the image the lab built, exactly as the other assigned-* beds do.
|
|
*
|
|
* MESH_LAB_HOST_BINARY=.../mesh-host MESH_LAB_BUNDLE=.../examples/foundation-first-node.lock
|
|
* scripts/build-module-runtime.sh mesh-vault / redis build the two runtime images into the local
|
|
* daemon; scenarios/vault-node.yml stocks them.
|
|
*/
|
|
|
|
import { test, before, after } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { createHash } from "node:crypto";
|
|
import { existsSync, readFileSync } from "node:fs";
|
|
import { join } from "node:path";
|
|
import { loadScenario } from "../../src/declaration/parse.ts";
|
|
import { raise } from "../../src/lifecycle/raise.ts";
|
|
import { destroy, exec } from "../../src/lifecycle/operate.ts";
|
|
import { hostBinaryPath, HOST_PATH } from "../../src/lifecycle/place.ts";
|
|
import { labIsUsable, destroyAll, foundationBundle, onTheMachine } from "./harness.ts";
|
|
import type { HeldImage } from "../../src/pinning.ts";
|
|
|
|
const capability = await labIsUsable();
|
|
const binary = hostBinaryPath();
|
|
const bundle = process.env["MESH_LAB_BUNDLE"] ?? "";
|
|
const catalogue = process.env["MESH_LAB_CATALOG"] ?? "../mesh-catalog";
|
|
|
|
const skip = !capability.usable
|
|
? `lab not usable: ${capability.why}`
|
|
: !binary || !existsSync(binary)
|
|
? "MESH_LAB_HOST_BINARY is not set to a built mesh-host"
|
|
: !bundle || !existsSync(bundle)
|
|
? "MESH_LAB_BUNDLE is not set to a foundation bundle (mesh-host examples/)"
|
|
: !existsSync(join(catalogue, "modules/mesh-vault/module.json"))
|
|
? `no catalogue at ${catalogue} (set MESH_LAB_CATALOG)`
|
|
: false;
|
|
|
|
const SCENARIO = "vault-node";
|
|
const MACHINE = "anchor";
|
|
const SECRET_FILE = "/var/lib/redis-module/default.secret";
|
|
const LEDGER = "/var/lib/mesh-vault/ledger";
|
|
const ROOT = "/var/lib/mesh-vault/root";
|
|
// Where the operator keeps things on this machine: outside every container, bind-mounted into a
|
|
// throwaway one when the operator's own commands run. The controller's container is a scratch
|
|
// image with no writable path — the private key could not be written there even by mistake.
|
|
const OPERATOR_DIR = "/var/lib/lab-operator";
|
|
|
|
let instanceId = "";
|
|
let held: HeldImage[] = [];
|
|
|
|
function quote(s: string): string {
|
|
return `'${s.replaceAll("'", `'\\''`)}'`;
|
|
}
|
|
|
|
async function on(command: string, timeoutMs?: number): Promise<{ out: string; ok: boolean }> {
|
|
const { stdout } = await exec(instanceId, MACHINE, [
|
|
"sh", "-c", `exec 2>&1\n${command}\necho "__exit=$?"`,
|
|
], timeoutMs);
|
|
const marker = stdout.lastIndexOf("__exit=");
|
|
if (marker < 0) return { out: stdout, ok: false };
|
|
return { out: stdout.slice(0, marker), ok: stdout.slice(marker + 7).trim() === "0" };
|
|
}
|
|
|
|
async function must(command: string, timeoutMs?: number): Promise<string> {
|
|
const { out, ok } = await on(command, timeoutMs);
|
|
if (!ok) throw new Error(`${MACHINE}: ${command}\n${out}`);
|
|
return out;
|
|
}
|
|
|
|
async function mesh(command: string, timeoutMs?: number): Promise<string> {
|
|
return must(`docker exec mesh-controller /mesh-controller ${command}`, timeoutMs);
|
|
}
|
|
|
|
function pinned(reference: string): string {
|
|
return onTheMachine(reference, held);
|
|
}
|
|
|
|
function bundleFor(images: HeldImage[]): string {
|
|
return foundationBundle(bundle, images);
|
|
}
|
|
|
|
function tokenFrom(said: string): string {
|
|
const found = said.split("\n").map((l) => l.trim()).find((l) => l.length > 100 && !l.includes(" "));
|
|
assert.ok(found, `no token in:\n${said}`);
|
|
return found;
|
|
}
|
|
|
|
/** sha256:<hex>, the only form in which a secret's value is ever spoken here. */
|
|
function fingerprint(value: string): string {
|
|
return "sha256:" + createHash("sha256").update(value, "utf8").digest("hex");
|
|
}
|
|
|
|
/**
|
|
* The catalogue's own manifest, as the lab can run it: the runtime artifact becomes the image this
|
|
* scenario loaded, third-party images are pinned upstream, and `build` goes — nothing here builds.
|
|
*/
|
|
function catalogueManifest(name: string): string {
|
|
const m = JSON.parse(readFileSync(join(catalogue, `modules/${name}/module.json`), "utf8")) as {
|
|
build?: unknown;
|
|
resources: Record<string, unknown>[];
|
|
};
|
|
delete m.build;
|
|
for (const r of m.resources) {
|
|
if (r["artifact"] === "runtime") {
|
|
delete r["artifact"];
|
|
r["image"] = pinned(`mesh-runtime-${name}`);
|
|
} else if (typeof r["image"] === "string") {
|
|
r["image"] = pinned(r["image"]);
|
|
}
|
|
}
|
|
return JSON.stringify(m);
|
|
}
|
|
|
|
async function until<T>(what: string, ms: number, probe: () => Promise<T | undefined>): Promise<T> {
|
|
const deadline = Date.now() + ms;
|
|
let last: unknown;
|
|
while (Date.now() < deadline) {
|
|
try {
|
|
const got = await probe();
|
|
if (got !== undefined) return got;
|
|
} catch (err) {
|
|
last = err;
|
|
}
|
|
await new Promise((r) => setTimeout(r, 3000));
|
|
}
|
|
throw new Error(`${what} did not happen within ${Math.round(ms / 1000)}s${last ? `; last: ${String(last)}` : ""}`);
|
|
}
|
|
|
|
async function settled(withinMs = 480_000): Promise<void> {
|
|
const deadline = Date.now() + withinMs;
|
|
let last = "";
|
|
while (Date.now() < deadline) {
|
|
const asked = await on(`docker exec mesh-controller /mesh-controller status --json`);
|
|
if (asked.ok) {
|
|
try {
|
|
const state = JSON.parse(asked.out) as {
|
|
wrong: { node: string; outcome: string }[];
|
|
waiting: { node: string }[];
|
|
reported: { node: string; outcome: string; current: boolean }[];
|
|
};
|
|
const bad = state.wrong.find((w) => w.node === MACHINE);
|
|
if (bad) throw new Error(`${MACHINE} did not apply what it was sent: ${bad.outcome}\n${asked.out}`);
|
|
const word = state.reported.find((r) => r.node === MACHINE);
|
|
if (!state.waiting.some((w) => w.node === MACHINE) && word?.outcome === "applied" && word.current) return;
|
|
last = asked.out;
|
|
} catch (err) {
|
|
if (err instanceof Error && err.message.includes("did not apply")) throw err;
|
|
last = asked.out;
|
|
}
|
|
}
|
|
await new Promise((r) => setTimeout(r, 5000));
|
|
}
|
|
throw new Error(`${MACHINE} never caught up within ${Math.round(withinMs / 1000)}s. Last:\n${last}`);
|
|
}
|
|
|
|
/** redis's answer to PING as `password`, from inside its own container — PONG, or why not. */
|
|
async function pingAs(password: string): Promise<string> {
|
|
return (await on(`docker exec redis redis-cli --no-auth-warning -a ${quote(password)} ping`)).out.trim();
|
|
}
|
|
|
|
/** The operator's own commands: the controller binary in a throwaway container, with the operator's
|
|
* directory at /work and nothing of the mesh in reach — no store, no broker. What an operator runs
|
|
* on their own machine with the binary and a directory. */
|
|
async function operator(command: string): Promise<string> {
|
|
return must(
|
|
`docker run --rm -v ${OPERATOR_DIR}:/work --entrypoint /mesh-controller ${pinned("mesh-controller")} ${command}`,
|
|
120_000,
|
|
);
|
|
}
|
|
|
|
/** Invoke one of the vault's tools over the mesh, the way a caller would, and parse its answer. */
|
|
async function vaultTool(tool: string, args: Record<string, unknown> = {}): Promise<Record<string, unknown>> {
|
|
const said = await must(
|
|
`docker run --rm --network host -e MESH_BROKER_URL=amqp://guest:guest@127.0.0.1:5672/ ` +
|
|
`${pinned("mesh-runtime-mesh-vault")} invoke mesh-vault ${tool} ${quote(JSON.stringify(args))}`,
|
|
120_000,
|
|
);
|
|
const line = said.split("\n").map((l) => l.trim()).filter(Boolean).pop() ?? "";
|
|
return JSON.parse(line) as Record<string, unknown>;
|
|
}
|
|
|
|
interface Held {
|
|
as: string;
|
|
consumer: string;
|
|
fingerprint: string;
|
|
rotations: number;
|
|
history: { fingerprint: string; until: string }[];
|
|
}
|
|
|
|
before(async () => {
|
|
if (skip) return;
|
|
|
|
const raised = await raise(loadScenario(`scenarios/${SCENARIO}.yml`), {
|
|
onProgress: (m) => console.log(`raise: ${m}`),
|
|
});
|
|
instanceId = raised.instanceId;
|
|
held = raised.images;
|
|
|
|
await must(`cat > /tmp/foundation.lock <<'MESHBUNDLE'\n${bundleFor(raised.images)}\nMESHBUNDLE`);
|
|
await must(`${HOST_PATH} apply /tmp/foundation.lock`, 600_000);
|
|
const up = await must(`docker ps --format '{{.Names}}'`);
|
|
for (const c of ["mesh-store", "mesh-broker", "mesh-controller"]) {
|
|
assert.match(up, new RegExp(c), `the foundation did not raise ${c}:\n${up}`);
|
|
}
|
|
|
|
await mesh(`node add ${MACHINE}`);
|
|
const token = tokenFrom(await mesh(`token issue --node ${MACHINE}`));
|
|
await must(`${HOST_PATH} enrol --token ${quote(token)}`);
|
|
await must(`nohup ${HOST_PATH} run > /var/log/mesh-host.log 2>&1 & sleep 3`);
|
|
}, { timeout: 1_800_000 });
|
|
|
|
after(async () => {
|
|
if (instanceId) await destroy(instanceId);
|
|
await destroyAll(`${SCENARIO}-`);
|
|
}, { timeout: 600_000 });
|
|
|
|
let delivered = "";
|
|
let holder = "";
|
|
|
|
test("redis's own password is a secret the vault provides: it authenticates, and the vault holds its fingerprint", {
|
|
skip, timeout: 900_000,
|
|
}, async () => {
|
|
// The operator key first, so everything minted from here on is sealed to it as well. Made off
|
|
// the mesh — a throwaway container with the operator's directory mounted, no store in reach —
|
|
// and only the public half is given to the mesh.
|
|
await must(`mkdir -p ${OPERATOR_DIR} && chmod 777 ${OPERATOR_DIR}`);
|
|
const made = await operator(`operator key make --out /work/operator.key`);
|
|
assert.match(made, /operator key sha256:/, made);
|
|
const publicKey = made.split("\n").map((l) => l.trim()).map((l) => /^public ([A-Za-z0-9+\/]{40,}={0,2})$/.exec(l)?.[1]).find(Boolean);
|
|
assert.ok(publicKey, `no public key in:\n${made}`);
|
|
const privateKey = (await must(`cat ${OPERATOR_DIR}/operator.key`)).trim();
|
|
assert.ok(privateKey.length > 30 && !made.includes(privateKey), "the private key was printed");
|
|
const set = await mesh(`operator key set ${quote(publicKey)}`);
|
|
assert.match(set, /operator key sha256:/, set);
|
|
|
|
for (const name of ["mesh-vault", "redis"]) {
|
|
await must(`printf %s ${quote(catalogueManifest(name))} > /tmp/${name}.json && docker cp /tmp/${name}.json mesh-controller:/${name}.json`);
|
|
await mesh(`module add /${name}.json`);
|
|
const issued = await mesh(`module issue ${name} --node ${MACHINE}`);
|
|
assert.match(issued, /scoped to what it emits and consumes/, issued);
|
|
await mesh(`assign ${MACHINE} ${name}`);
|
|
}
|
|
// A consumer that needs TWO values from the vault (novox/hq ADR 0094): its `secrets` entry names
|
|
// them under local names, and each is a pair of its own. It runs no code — the delivery is what
|
|
// is under test. Synthetic, so it wears no catalogue module's name.
|
|
const twoSecrets = JSON.stringify({
|
|
module: "two-secrets", version: "1", slug: "two",
|
|
requires: ["secret"],
|
|
secrets: { secret: { first: "/var/lib/two-secrets/first", second: "/var/lib/two-secrets/second" } },
|
|
resources: [{ id: "state", type: "directory", path: "/var/lib/two-secrets", mode: "0700" }],
|
|
});
|
|
await must(`printf %s ${quote(twoSecrets)} > /tmp/two-secrets.json && docker cp /tmp/two-secrets.json mesh-controller:/two-secrets.json`);
|
|
await mesh("module add /two-secrets.json");
|
|
await mesh(`assign ${MACHINE} two-secrets`);
|
|
await mesh(`push ${MACHINE}`);
|
|
await settled();
|
|
|
|
// Two files, two values, and the vault holds two holders for one module — the identity with the
|
|
// local name after it.
|
|
const first = (await must(`cat /var/lib/two-secrets/first`)).replace(/\n$/, "");
|
|
const second = (await must(`cat /var/lib/two-secrets/second`)).replace(/\n$/, "");
|
|
assert.ok(first.length >= 20 && second.length >= 20, "a two-secrets value is empty or implausibly short");
|
|
assert.notEqual(first, second, "two local names were given one value");
|
|
for (const holderOf of ["mesh_anchor_two_first", "mesh_anchor_two_second"]) {
|
|
await until(`the vault holding ${holderOf}`, 90_000, async () =>
|
|
(await on(`test -s ${LEDGER}/${holderOf}.json`)).ok ? true : undefined);
|
|
}
|
|
|
|
const running = await must(`docker ps --format '{{.Names}}'`);
|
|
for (const c of ["mesh-vault", "redis", "mesh-redis"]) {
|
|
assert.match(running, new RegExp(`(^|\\n)${c}(\\n|$)`),
|
|
`${c} is not running:\n${running}\n---host log---\n${(await on(`tail -40 /var/log/mesh-host.log`)).out}`);
|
|
}
|
|
|
|
// 1. The pair credential the mesh minted is on redis's machine as redis's own password — and
|
|
// redis accepts it. Not because two files agree: because the login works.
|
|
delivered = (await must(`cat ${SECRET_FILE}`)).replace(/\n$/, "");
|
|
assert.ok(delivered.length >= 20, "the delivered secret is empty or implausibly short");
|
|
const mode = (await must(`stat -c %a ${SECRET_FILE}`)).trim();
|
|
assert.equal(mode, "600", `the secret file is readable by others (mode ${mode})`);
|
|
const pong = await until("redis accepting the delivered password", 120_000, async () => {
|
|
const said = await pingAs(delivered);
|
|
return said === "PONG" ? said : undefined;
|
|
});
|
|
assert.equal(pong, "PONG");
|
|
assert.notEqual(await pingAs("not-the-password"), "PONG", "redis accepted a wrong password — requirepass is not set");
|
|
|
|
// 2. The vault took custody: its ledger names the holder, with the fingerprint of exactly the
|
|
// value redis holds — and no value.
|
|
const recorded = await until("the vault recording redis's secret", 90_000, async () => {
|
|
const ls = await on(`ls ${LEDGER}`);
|
|
const name = ls.ok ? ls.out.split("\n").map((l) => l.trim()).find((l) => l.endsWith(".json")) : undefined;
|
|
if (!name) return undefined;
|
|
return JSON.parse(await must(`cat ${LEDGER}/${name}`)) as Held;
|
|
});
|
|
holder = recorded.as;
|
|
assert.equal(recorded.consumer, MACHINE);
|
|
assert.equal(recorded.fingerprint, fingerprint(delivered), "the vault recorded a fingerprint of something other than what redis holds");
|
|
assert.equal(recorded.rotations, 0);
|
|
const ledgerRaw = await must(`cat ${LEDGER}/*.json`);
|
|
assert.ok(!ledgerRaw.includes(delivered), "the vault's ledger contains the secret's value");
|
|
// The holder is the login the mesh derived for redis on this machine, as the contributions file says.
|
|
const asked = JSON.parse(await must(`cat /var/lib/mesh-vault/grants/mesh.json`)) as { given: { as: string; from?: string }[] };
|
|
assert.ok(asked.given.some((g) => g.as === holder), `the vault was not asked to serve ${holder}:\n${JSON.stringify(asked)}`);
|
|
|
|
// 3. And it answers over the mesh — who holds what, verified by fingerprint, never by value.
|
|
const holders = await until("the vault serving its tools", 90_000, async () => {
|
|
const got = await vaultTool("secret_holders");
|
|
return Array.isArray(got["holders"]) && (got["holders"] as Held[]).length > 0 ? got : undefined;
|
|
});
|
|
const mine = (holders["holders"] as (Held & { module: string | null })[]).find((h) => h.as === holder);
|
|
assert.ok(mine, `secret_holders does not list ${holder}:\n${JSON.stringify(holders)}`);
|
|
assert.equal(mine.module, "redis");
|
|
assert.ok(!JSON.stringify(holders).includes(delivered), "secret_holders returned the value");
|
|
|
|
const verified = await vaultTool("secret_verify", { as: holder, fingerprint: fingerprint(delivered) });
|
|
assert.equal(verified["ok"], true, JSON.stringify(verified));
|
|
assert.equal(verified["deliveredMatchesRecorded"], true, JSON.stringify(verified));
|
|
assert.equal(verified["givenMatchesRecorded"], true, JSON.stringify(verified));
|
|
|
|
const vaultLog = (await on(`docker logs mesh-vault 2>&1`)).out;
|
|
assert.doesNotMatch(vaultLog, /emit .*failed/, `the vault's lifecycle event was refused:\n${vaultLog}`);
|
|
assert.match(vaultLog, /granted: /, `the vault never recorded the grant:\n${vaultLog}`);
|
|
});
|
|
|
|
test("rotating the secret moves both ends: the new password works, the old one is refused, and the vault says so", {
|
|
skip, timeout: 900_000,
|
|
}, async () => {
|
|
assert.ok(delivered && holder, "the first test did not run");
|
|
const before = delivered;
|
|
|
|
const said = await mesh("rotate secret", 300_000);
|
|
assert.doesNotMatch(said, /nobody holds/i, said);
|
|
|
|
// The consumer's file moves — the rotation was delivered, not only recorded.
|
|
const after = await until("the rotated secret reaching redis's machine", 180_000, async () => {
|
|
const now = (await must(`cat ${SECRET_FILE}`)).replace(/\n$/, "");
|
|
return now !== before ? now : undefined;
|
|
});
|
|
assert.notEqual(after, before);
|
|
|
|
// Both of the two-secrets consumer's values moved too, apart from each other (ADR 0094).
|
|
const firstAfter = await until("the rotated first secret", 180_000, async () => {
|
|
const now = (await must(`cat /var/lib/two-secrets/first`)).replace(/\n$/, "");
|
|
return now !== "" ? now : undefined;
|
|
});
|
|
const secondAfter = (await must(`cat /var/lib/two-secrets/second`)).replace(/\n$/, "");
|
|
assert.notEqual(firstAfter, secondAfter, "two local names were given one value after rotation");
|
|
for (const holderOf of ["mesh_anchor_two_first", "mesh_anchor_two_second"]) {
|
|
const h = await until(`the vault recording ${holderOf}'s rotation`, 90_000, async () => {
|
|
const got = JSON.parse(await must(`cat ${LEDGER}/${holderOf}.json`)) as Held;
|
|
return got.rotations >= 1 ? got : undefined;
|
|
});
|
|
assert.equal(h.rotations, 1, holderOf);
|
|
}
|
|
|
|
// Three logins. The new one works (redis was restarted on its config — `restart-on`), the old one
|
|
// does not: that third check is what makes it a rotation rather than an addition.
|
|
await until("redis accepting the rotated password", 180_000, async () => {
|
|
return (await pingAs(after)) === "PONG" ? true : undefined;
|
|
});
|
|
assert.notEqual(await pingAs(before), "PONG", "the rotated-away password still authenticates — redis kept the credential it started with");
|
|
|
|
// The vault noticed: same holder, one rotation, new fingerprint, old one in the history.
|
|
const recorded = await until("the vault recording the rotation", 90_000, async () => {
|
|
const h = JSON.parse(await must(`cat ${LEDGER}/${holder}.json`)) as Held;
|
|
return h.rotations >= 1 ? h : undefined;
|
|
});
|
|
assert.equal(recorded.rotations, 1);
|
|
assert.equal(recorded.fingerprint, fingerprint(after));
|
|
assert.deepEqual(recorded.history.map((h) => h.fingerprint), [fingerprint(before)]);
|
|
|
|
const stale = await vaultTool("secret_verify", { as: holder, fingerprint: fingerprint(before) });
|
|
assert.equal(stale["ok"], false, JSON.stringify(stale));
|
|
assert.equal(stale["givenIsAnEarlierValue"], true, JSON.stringify(stale));
|
|
const fresh = await vaultTool("secret_verify", { as: holder, fingerprint: fingerprint(after) });
|
|
assert.equal(fresh["ok"], true, JSON.stringify(fresh));
|
|
|
|
const vaultLog = (await on(`docker logs mesh-vault 2>&1`)).out;
|
|
assert.match(vaultLog, /rotated: /, `the vault never announced the rotation:\n${vaultLog}`);
|
|
assert.doesNotMatch(vaultLog, /emit .*failed/, vaultLog);
|
|
});
|
|
|
|
test("the operator recovers a root secret with a key the mesh never held, from the vault's copy and from the store", {
|
|
skip, timeout: 900_000,
|
|
}, async () => {
|
|
assert.ok(holder, "the first test did not run");
|
|
|
|
// The vault keeps the export on its own disk, written by the mesh, ciphertext throughout.
|
|
const exported = await until("the vault holding the export", 90_000, async () => {
|
|
const got = await on(`cat ${ROOT}/export.json`);
|
|
return got.ok && /"kept"/.test(got.out) ? got.out : undefined;
|
|
});
|
|
const doc = JSON.parse(exported) as {
|
|
"operator-key": string;
|
|
kept: { node: string; module: string; name: string; origin: string; sealed: string }[];
|
|
unrecoverable?: unknown[];
|
|
};
|
|
const mode = (await must(`stat -c %a ${ROOT}/export.json`)).trim();
|
|
assert.equal(mode, "600", `the export is readable by others (mode ${mode})`);
|
|
// mesh-vault's own broker account was issued after the key existed, so it is in the export.
|
|
const ours = doc.kept.find((k) => k.node === MACHINE && k.module === "mesh-vault" && k.name === "broker");
|
|
assert.ok(ours, `the vault's own broker account is not in the export:\n${exported}`);
|
|
assert.equal(ours.origin, "accepted");
|
|
// The value the host unsealed on this machine — what the module actually runs with.
|
|
const onDisk = (await must(`cat /var/lib/mesh/mesh-vault/broker`)).replace(/\n$/, "");
|
|
assert.ok(onDisk.length > 20, "the node's own copy is empty");
|
|
assert.ok(!exported.includes(onDisk), "the export contains a plaintext value");
|
|
|
|
// 1. Recovered from the store, with the operator key: the same bytes the node holds. The key is
|
|
// handed to the running controller for this one call, readable by its own account.
|
|
await must(`chown 65534:65534 ${OPERATOR_DIR}/operator.key && docker cp -a ${OPERATOR_DIR}/operator.key mesh-controller:/operator.key`);
|
|
const fromStore = (await mesh(`secret recover ${MACHINE} mesh-vault broker --key /operator.key --out -`)).replace(/\n$/, "");
|
|
assert.equal(fromStore, onDisk, "the operator recovered a different value from the one the node was given");
|
|
|
|
// 2. Recovered from the vault's export alone, off the mesh — no store, no broker, a directory and
|
|
// the key — so a mesh whose store is gone is still a mesh whose root secrets a person can open.
|
|
await must(`cp ${ROOT}/export.json ${OPERATOR_DIR}/export.json && chmod 644 ${OPERATOR_DIR}/export.json`);
|
|
const said = await operator(`secret recover ${MACHINE} mesh-vault broker --key /work/operator.key --from-export /work/export.json --out /work/recovered`);
|
|
assert.match(said, /recovered to \/work\/recovered/, said);
|
|
assert.ok(!said.includes(onDisk), "recover printed the value");
|
|
const fromExport = (await must(`cat ${OPERATOR_DIR}/recovered`)).replace(/\n$/, "");
|
|
assert.equal(fromExport, onDisk);
|
|
const recoveredMode = (await must(`stat -c %a ${OPERATOR_DIR}/recovered`)).trim();
|
|
assert.equal(recoveredMode, "600");
|
|
|
|
// 3. Another key — made, never given to the mesh — opens nothing, and says so.
|
|
await operator(`operator key make --out /work/another.key`);
|
|
const wrong = await on(
|
|
`docker run --rm -v ${OPERATOR_DIR}:/work --entrypoint /mesh-controller ${pinned("mesh-controller")} ` +
|
|
`secret recover ${MACHINE} mesh-vault broker --key /work/another.key --from-export /work/export.json --out /work/nope`,
|
|
);
|
|
assert.equal(wrong.ok, false, `a different operator key opened the secret:\n${wrong.out}`);
|
|
assert.match(wrong.out, /does not open it/, wrong.out);
|
|
|
|
// 3b. And the secret the vault PROVIDES — redis's password, a pair credential — is recoverable
|
|
// the same way, off the mesh: the export names it by the consumer and the provision.
|
|
const redisPassword = (await must(`cat ${SECRET_FILE}`)).replace(/\n$/, "");
|
|
const pairLine = doc.kept.find((k) => k.module === "redis" && k.name === "secret");
|
|
assert.ok(pairLine, `redis's vault-provided secret is not in the export:\n${exported}`);
|
|
await must(`cp ${ROOT}/export.json ${OPERATOR_DIR}/export.json && chmod 644 ${OPERATOR_DIR}/export.json`);
|
|
await operator(`secret recover ${MACHINE} redis secret --key /work/operator.key --from-export /work/export.json --out /work/redis.secret`);
|
|
const recoveredRedis = (await must(`cat ${OPERATOR_DIR}/redis.secret`)).replace(/\n$/, "");
|
|
assert.equal(recoveredRedis, redisPassword, "the recovered pair credential is not the password redis runs with");
|
|
assert.equal(await pingAs(recoveredRedis), "PONG", "the recovered password does not open redis");
|
|
|
|
// 4. The vault serves the export over the mesh — ciphertext, plus what is NOT recoverable.
|
|
const served = await vaultTool("secret_export", { sealed: false });
|
|
assert.equal(served["available"], true, JSON.stringify(served));
|
|
assert.equal(served["operator-key"], doc["operator-key"]);
|
|
const listed = served["kept"] as { module: string; name: string }[];
|
|
assert.ok(listed.some((k) => k.module === "mesh-vault" && k.name === "broker"), JSON.stringify(served));
|
|
assert.ok(!JSON.stringify(served).includes(onDisk), "secret_export returned a plaintext value");
|
|
});
|
|
|
|
test("a seeded file is created once, and what a program grows in it survives the next push", {
|
|
skip, timeout: 600_000,
|
|
}, async () => {
|
|
// novox/hq ADR 0087, issue 035. A file that says create-once is written when absent and left
|
|
// alone when present — content, mode and owner — so an access list a program persists into is
|
|
// not restored to its seed behind the program's back on every reconcile.
|
|
const manifest = JSON.stringify({
|
|
module: "seed-test", version: "1",
|
|
resources: [
|
|
{ id: "dir", type: "directory", path: "/var/lib/seed-test", mode: "0755" },
|
|
{ id: "acl", type: "file", path: "/var/lib/seed-test/acl.conf", mode: "0600", "create-once": true,
|
|
content: "user default on\n" },
|
|
],
|
|
});
|
|
await must(`printf %s ${quote(manifest)} > /tmp/seed-test.json && docker cp /tmp/seed-test.json mesh-controller:/seed-test.json`);
|
|
await mesh("module add /seed-test.json");
|
|
await mesh(`assign ${MACHINE} seed-test`);
|
|
await mesh(`push ${MACHINE}`);
|
|
await settled();
|
|
assert.equal(await must(`cat /var/lib/seed-test/acl.conf`), "user default on\n");
|
|
|
|
// The program grows it.
|
|
await must(`printf 'user app-one on >secret\n' >> /var/lib/seed-test/acl.conf`);
|
|
// A second push: the mesh reconciles everything it declared, and leaves the seed alone.
|
|
await mesh(`push ${MACHINE}`);
|
|
await settled();
|
|
assert.equal(await must(`cat /var/lib/seed-test/acl.conf`), "user default on\nuser app-one on >secret\n",
|
|
"the seed was restored and what the program wrote into it was wiped");
|
|
});
|