mara/hyperhive
mara/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

fetch the secrets unit's store leaves concurrently and log how long each phase takes

Browse source
This commit is contained in:
atlas 2026-11-04 17:04:35 +01:00
commit 197caa1e52
1 changed files with 268 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

52
nix/script-tests/oidc-client-secrets.sh
View file

@ -24,7 +24,7 @@ setup() {
mkdir "$dir/kv" "$dir/clients"
export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
export FAKE_AUTHELIA_LOG=$dir/authelia.log
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_AUTHELIA_EMPTY FAKE_AUTHELIA_NODIGEST
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_AUTHELIA_EMPTY FAKE_AUTHELIA_NODIGEST PREFETCH
: >"$FAKE_BAO_LOG"
: >"$FAKE_AUTHELIA_LOG"
clients=$dir/clients
@ -34,7 +34,8 @@ setup() {
}
# run <function> — the function for $id and $leaf, with the stubs first on
# PATH, after the store login the units make first. Sets $rc and $minted.
# PATH, after the store login the units make first and, when $PREFETCH is set,
# `store_prefetch` of the leaf. Sets $rc and $minted.
run() {
minted=$(
set -e
@ -45,6 +46,7 @@ run() {
clients=$dir/clients
store_init
store_login 2>>"$dir/err"
[ -z "${PREFETCH-}" ] || store_prefetch "$leaf" 2>>"$dir/err"
rc=0
"$1" "$id" "$leaf" 2>>"$dir/err" >>"$dir/out" || rc=$?
echo "${MINTED-}"
@ -262,6 +264,52 @@ if [ "$(id -u)" != 0 ]; then
digest_is ""
fi
# kv_gets: how many `kv get` calls the stub logged.
kv_gets() {
grep -c '^kv get' "$FAKE_BAO_LOG" || true
}
setup "prefetch: a client the store and the disk both hold is left alone after one read"
PREFETCH=1
printf 'old-secret' >"$stored"
printf 'old-digest\n' >"$digest"
run mint_client_secret
expect 0
held old-secret
digest_is old-digest
if ran_authelia; then fail "minted although the store held a value"; fi
if [ "$(kv_gets)" != 1 ]; then fail "$(kv_gets) reads, wanted 1"; fi
setup "prefetch: a digest whose secret is gone from the store is minted again, and the read back asks the store"
PREFETCH=1
printf 'old-digest\n' >"$digest"
run mint_client_secret
expect 0
held minted-secret
digest_is '$pbkdf2-sha512$fake'
if [ "$minted" != 1 ]; then fail "did not report the mint"; fi
if [ "$(kv_gets)" != 2 ]; then fail "$(kv_gets) reads, wanted the prefetch and the read back"; fi
setup "prefetch: a store that refuses the read leaves the digest, mints nothing and asks to retry"
PREFETCH=1
printf 'old-digest\n' >"$digest"
export FAKE_BAO_DENY_READ=1
run mint_client_secret
expect 2
digest_is old-digest
if ran_authelia; then fail "minted although the read was refused"; fi
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote although the read was refused"; fi
if ! logged "the store cannot be read; keeping its digest"; then fail "no keep line"; fi
setup "prefetch: no digest but a secret in the store gets the digest of that secret"
PREFETCH=1
printf 'old-secret' >"$stored"
run mint_client_secret
expect 0
held old-secret
digest_is digest-of-old-secret
if ran_authelia; then fail "minted over the store's secret"; fi
if [ "$failures" != 0 ]; then
echo "$failures of $count cases failed" >&2
exit 1