derive a missing client digest from the secret that exists

A client with a secret in the store or in a leftover file but no digest gets the digest of that secret instead of stopping the unit. The password reaches authelia's prompt through a pty, not argv. A lost mint race takes the winner's secret. Also name the mint, not the publisher, in the remaining rust docs.

nix/script-tests/oidc-client-secrets.nix

@@ -55,12 +55,33 @@ let
     esac
   '';
 
-  # Prints what `authelia crypto hash generate pbkdf2 --random` prints, or
-  # nothing when `FAKE_AUTHELIA_EMPTY` is set. Every call is logged.
+  # With `--random`, prints what `authelia crypto hash generate pbkdf2 --random`
+  # prints. Without it, answers the password prompt from stdin the way the CLI
+  # does on a terminal: echo, then the digest of what was typed. Prints nothing
+  # when `FAKE_AUTHELIA_EMPTY` is set, and fails without a digest when
+  # `FAKE_AUTHELIA_NODIGEST` is set. Every call is logged.
   fakeAuthelia = pkgs.writeShellScriptBin "authelia" ''
     echo "$*" >> "$FAKE_AUTHELIA_LOG"
     [ -z "''${FAKE_AUTHELIA_EMPTY-}" ] || exit 0
-    printf 'Random Password: minted-secret\n\nDigest: $pbkdf2-sha512$fake\n'
+    case " $* " in
+      *" --random "*)
+        printf 'Random Password: minted-secret\n\nDigest: $pbkdf2-sha512$fake\n'
+        ;;
+      *)
+        [ -z "''${FAKE_AUTHELIA_NODIGEST-}" ] || exit 1
+        IFS= read -r typed
+        printf 'Enter Password: %s\r\nDigest: digest-of-%s\r\n' "$typed" "$typed"
+        ;;
+    esac
+  '';
+
+  # Runs the command it is given, as util-linux's `script -qec <cmd> /dev/null`
+  # does, without needing a pty in the build sandbox. The real pty is checked
+  # against the real authelia by hand.
+  fakeScript = pkgs.writeShellScriptBin "script" ''
+    echo "script $1 $3" >> "$FAKE_AUTHELIA_LOG"
+    [ "$1" = -qec ] || exit 99
+    exec ${pkgs.bash}/bin/bash -c "$2"
   '';
 in
 pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
@@ -75,6 +96,7 @@ pkgs.runCommand "hyperhive-script-test-oidc-client-secrets"
       paths = [
         fakeBao
         fakeAuthelia
+        fakeScript
       ];
     };
     nativeBuildInputs = [

nix/script-tests/oidc-client-secrets.sh

@@ -24,7 +24,7 @@ setup() {
   mkdir "$dir/kv" "$dir/clients"
   export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
   export FAKE_AUTHELIA_LOG=$dir/authelia.log
-  unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_AUTHELIA_EMPTY
+  unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE FAKE_AUTHELIA_EMPTY FAKE_AUTHELIA_NODIGEST
   : >"$FAKE_BAO_LOG"
   : >"$FAKE_AUTHELIA_LOG"
   clients=$dir/clients
@@ -76,8 +76,9 @@ digest_is() {
   fi
 }
 
+# Whether a new secret was minted, as opposed to a digest computed.
 ran_authelia() {
-  [ -s "$FAKE_AUTHELIA_LOG" ]
+  grep -q -e "--random" "$FAKE_AUTHELIA_LOG"
 }
 
 store_called() {
@@ -158,14 +159,18 @@ expect 1
 digest_is ""
 if ran_authelia; then fail "minted although the read was refused"; fi
 
-setup "mint: no digest but a secret in the store is for an operator, and nothing is minted"
+setup "mint: no digest but a secret in the store gets the digest of that secret, and the secret is unchanged"
 printf 'old-secret' >"$stored"
 run mint_client_secret
-expect 3
+expect 0
 held old-secret
-digest_is ""
+digest_is digest-of-old-secret
 if ran_authelia; then fail "minted over the store's secret"; fi
-if ! logged "<3>oidc client $id"; then fail "no err-priority line"; fi
+if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
+if [ "$minted" != 1 ]; then fail "did not report the new digest"; fi
+if [ "$(stat -c %a "$digest")" != 600 ]; then fail "digest mode is $(stat -c %a "$digest")"; fi
+if ! logged "oidc client $id: wrote the digest from the secret in the store"; then fail "no info line"; fi
+no_secret_in_argv
 
 setup "mint: a plaintext file with its digest is left for the migration"
 printf 'old-secret\n' >"$legacy"
@@ -176,14 +181,25 @@ digest_is old-digest
 if ran_authelia; then fail "minted although a file held the secret"; fi
 if store_called; then fail "called the store"; fi
 
-setup "mint: a plaintext file with no digest is for an operator, and nothing is minted"
+setup "mint: a plaintext file with no digest gets the digest of the file's secret, and the file and the store are untouched"
 printf 'old-secret\n' >"$legacy"
 run mint_client_secret
-expect 3
-digest_is ""
+expect 0
+digest_is digest-of-old-secret
 held ""
+if [ "$(cat "$legacy")" != old-secret ]; then fail "changed the file"; fi
 if ran_authelia; then fail "minted over the file's secret"; fi
-if ! logged "<3>oidc client $id"; then fail "no err-priority line"; fi
+if store_called; then fail "called the store"; fi
+if ! logged "oidc client $id: wrote the digest from the secret in $legacy"; then fail "no info line"; fi
+no_secret_in_argv
+
+setup "mint: a secret whose digest cannot be computed is a failure and writes no digest"
+printf 'old-secret' >"$stored"
+export FAKE_AUTHELIA_NODIGEST=1
+run mint_client_secret
+expect 1
+digest_is ""
+held old-secret
 
 setup "mint: an authelia that prints nothing writes nothing"
 export FAKE_AUTHELIA_EMPTY=1
@@ -199,12 +215,12 @@ expect 1
 held ""
 digest_is ""
 
-setup "mint: losing the race to another run writes no digest and keeps the winner's secret"
+setup "mint: losing the race to another run takes the winner's secret and writes its digest"
 export FAKE_BAO_RACE=winner-secret
 run mint_client_secret
-expect 3
+expect 0
 held winner-secret
-digest_is ""
+digest_is digest-of-winner-secret
 
 if [ "$(id -u)" != 0 ]; then
   setup "mint: a digest that cannot be written is a failure, not a mint"