keep authelia's keys in bao, seeded from the existing key files
This commit is contained in:
atlas
mara
parent
a70b25847e
commit
99fab06348
1 changed files with 557 additions and 89 deletions
145
nix/script-tests/store-seeded-secret.sh
Normal file
145
nix/script-tests/store-seeded-secret.sh
Normal file
|
|
@ -0,0 +1,145 @@
|
|||
# Cases for ./store-seeded-secret.nix. Each case sets up the store's leaf, the
|
||||
# earlier file and the stub's behaviour, runs `store_seeded` under `set -e` as
|
||||
# the callers' scripts do, and compares its exit status, its output, what the
|
||||
# store holds afterwards and whether the mint command ran.
|
||||
set -uo pipefail
|
||||
|
||||
failures=0
|
||||
count=0
|
||||
|
||||
fail() {
|
||||
echo "FAILED: $case: $*" >&2
|
||||
failures=$((failures + 1))
|
||||
}
|
||||
|
||||
leaf=secret/swarm/services/t/keys/k
|
||||
pem=$'-----BEGIN PRIVATE KEY-----\nMIIfake\nline2\n-----END PRIVATE KEY-----'
|
||||
|
||||
# setup <description>
|
||||
setup() {
|
||||
case=$1
|
||||
count=$((count + 1))
|
||||
dir=$(mktemp -d)
|
||||
mkdir "$dir/kv"
|
||||
export FAKE_BAO_KV=$dir/kv FAKE_BAO_LOG=$dir/bao.log FAKE_BAO_LOGIN_RC=0
|
||||
unset FAKE_BAO_DENY_READ FAKE_BAO_DENY_WRITE FAKE_BAO_RACE
|
||||
: >"$FAKE_BAO_LOG"
|
||||
earlier=$dir/earlier
|
||||
minted=$dir/minted
|
||||
stored=$FAKE_BAO_KV/$(printf '%s' "$leaf" | tr / _)
|
||||
}
|
||||
|
||||
mint() {
|
||||
echo run >>"$minted"
|
||||
printf 'minted-value\n'
|
||||
}
|
||||
|
||||
# run — `store_seeded` for $leaf and $earlier with the stub first on PATH.
|
||||
# Sets $rc and $got.
|
||||
run() {
|
||||
got=$(
|
||||
set -e
|
||||
PATH="$FAKE_BAO_BIN:$PATH"
|
||||
unset BAO_TOKEN
|
||||
# shellcheck source=/dev/null
|
||||
. "$HELPER"
|
||||
store_init
|
||||
store_login 2>>"$dir/err"
|
||||
store_seeded "$leaf" "$earlier" mint 2>"$dir/err"
|
||||
)
|
||||
rc=$?
|
||||
}
|
||||
|
||||
# expect <status> <output>
|
||||
expect() {
|
||||
if [ "$rc" != "$1" ]; then fail "exited $rc, wanted $1: $(cat "$dir/err")"; fi
|
||||
if [ "$got" != "$2" ]; then fail "printed '$got', wanted '$2'"; fi
|
||||
}
|
||||
|
||||
# held <value>, or held "" for a leaf the store does not have.
|
||||
held() {
|
||||
if [ -z "$1" ]; then
|
||||
if [ -e "$stored" ]; then fail "the store holds '$(cat "$stored")', wanted nothing"; fi
|
||||
elif [ "$(cat "$stored" 2>/dev/null)" != "$1" ]; then
|
||||
fail "the store holds '$(cat "$stored" 2>/dev/null)', wanted '$1'"
|
||||
fi
|
||||
}
|
||||
|
||||
ran_mint() {
|
||||
[ -s "$minted" ]
|
||||
}
|
||||
|
||||
setup "an empty store is seeded from the file, unchanged, and nothing is minted"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
run
|
||||
expect 0 old-value
|
||||
held old-value
|
||||
if ran_mint; then fail "minted although the file held a value"; fi
|
||||
if ! grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG"; then fail "no create-only write was made"; fi
|
||||
|
||||
setup "a multi-line file is seeded unchanged"
|
||||
printf '%s\n' "$pem" >"$earlier"
|
||||
run
|
||||
expect 0 "$pem"
|
||||
held "$pem"
|
||||
|
||||
setup "the store's value wins over the file and is not written over"
|
||||
printf 'stored-value' >"$stored"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
run
|
||||
expect 0 stored-value
|
||||
held stored-value
|
||||
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
|
||||
if ran_mint; then fail "minted although the store held a value"; fi
|
||||
|
||||
setup "the store's value is used when there is no file"
|
||||
printf 'stored-value' >"$stored"
|
||||
run
|
||||
expect 0 stored-value
|
||||
if ran_mint; then fail "minted although the store held a value"; fi
|
||||
|
||||
setup "a value is minted into the store when neither holds one"
|
||||
run
|
||||
expect 0 minted-value
|
||||
held minted-value
|
||||
if ! ran_mint; then fail "did not mint"; fi
|
||||
|
||||
setup "a run that loses the race takes the winner's value, not its own seed"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
export FAKE_BAO_RACE=winner-value
|
||||
run
|
||||
expect 0 winner-value
|
||||
held winner-value
|
||||
|
||||
setup "a store that grants neither read nor write leaves the file's value in use"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
|
||||
run
|
||||
expect 0 old-value
|
||||
held ""
|
||||
if ran_mint; then fail "minted although the file held a value"; fi
|
||||
|
||||
setup "a store that grants neither, and no file, gives no value and mints nothing into it"
|
||||
export FAKE_BAO_DENY_READ=1 FAKE_BAO_DENY_WRITE=1
|
||||
run
|
||||
expect 1 ""
|
||||
held ""
|
||||
|
||||
setup "a store that refuses the login leaves the file's value in use and is not called again"
|
||||
printf 'old-value\n' >"$earlier"
|
||||
export FAKE_BAO_LOGIN_RC=1
|
||||
run
|
||||
expect 0 old-value
|
||||
if grep -q '^kv' "$FAKE_BAO_LOG"; then fail "called kv after a refused login"; fi
|
||||
|
||||
setup "a store that refuses the login, and no file, gives no value"
|
||||
export FAKE_BAO_LOGIN_RC=1
|
||||
run
|
||||
expect 1 ""
|
||||
if ran_mint; then fail "minted with no store to hold the value"; fi
|
||||
|
||||
if [ "$failures" != 0 ]; then
|
||||
echo "$failures of $count cases failed" >&2
|
||||
exit 1
|
||||
fi
|
||||
echo "$count cases passed"
|
||||
Loading…
Reference in a new issue