vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity

drop the one-time migration: seed the store from a leftover file once, leave the file

Browse source 
A leftover plaintext client secret is stored once with -cas=0 when the store holds none, so nothing rotates. A store value wins over a different file. The file is no longer read back, compared or removed, and the migration unit is gone.
This commit is contained in:
atlas 2026-10-30 16:12:37 +01:00 • committed by mara
commit fcc9c8d0ba
2 changed files with 114 additions and 350 deletions
Download patch file Download diff file Expand all files Collapse all files

3
nix/script-tests/oidc-client-secrets.nix
View file

@ -1,6 +1,5 @@
# `checks.script-test-oidc-client-secrets` — runs
# ../host-modules/lib/oidc-client-secrets.nix's `mint_client_secret` and
# `migrate_client_secret` against a stub `bao` that keeps its leaves in files
# ../host-modules/lib/oidc-client-secrets.nix's `mint_client_secret` against a stub `bao` that keeps its leaves in files
# and a stub `authelia` that prints a fixed password and digest. The cases are
# in ./oidc-client-secrets.sh.
#

142
nix/script-tests/oidc-client-secrets.sh
View file

@ -2,7 +2,7 @@
# digest and the plaintext file an earlier release left, and the stub's
# behaviour, runs the function under `set -e` as the units' scripts do, and
# compares its status, what the store holds, what is left on disk and whether
# `authelia` ran.
# `authelia` minted.
set -uo pipefail
failures=0
@ -172,27 +172,57 @@ if [ "$(stat -c %a "$digest")" != 600 ]; then fail "digest mode is $(stat -c %a
if ! logged "oidc client $id: wrote the digest from the secret in the store"; then fail "no info line"; fi
no_secret_in_argv
setup "mint: a plaintext file with its digest is left for the migration"
setup "mint: a plaintext file the store lacks seeds the store once, mints nothing and keeps the digest and the file"
printf 'old-secret\n' >"$legacy"
printf 'old-digest\n' >"$digest"
run mint_client_secret
expect 0
held old-secret
digest_is old-digest
if ran_authelia; then fail "minted although a file held the secret"; fi
if store_called; then fail "called the store"; fi
if [ "$(cat "$legacy")" != old-secret ]; then fail "changed or removed the file"; fi
if ! grep -q '^kv put -cas=0 ' "$FAKE_BAO_LOG"; then fail "no create-only write was made"; fi
no_secret_in_argv
setup "mint: a plaintext file with no digest gets the digest of the file's secret, and the file and the store are untouched"
setup "mint: a plaintext file with no digest seeds the store and gets the digest of the file's secret"
printf 'old-secret\n' >"$legacy"
run mint_client_secret
expect 0
held old-secret
digest_is digest-of-old-secret
held ""
if [ "$(cat "$legacy")" != old-secret ]; then fail "changed the file"; fi
if ran_authelia; then fail "minted over the file's secret"; fi
if store_called; then fail "called the store"; fi
if ! logged "oidc client $id: wrote the digest from the secret in $legacy"; then fail "no info line"; fi
no_secret_in_argv
setup "mint: the store's secret wins over a different file, silently, and nothing is written"
printf 'old-secret\n' >"$legacy"
printf 'other-secret' >"$stored"
printf 'old-digest\n' >"$digest"
run mint_client_secret
expect 0
held other-secret
digest_is old-digest
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
if ran_authelia; then fail "minted"; fi
setup "mint: a file with a store that refuses the login keeps the digest and mints nothing"
printf 'old-secret\n' >"$legacy"
printf 'old-digest\n' >"$digest"
export FAKE_BAO_LOGIN_RC=1
run mint_client_secret
expect 0
digest_is old-digest
if ran_authelia; then fail "minted with the store down"; fi
setup "mint: a file whose seed write is refused is a failure, and nothing is minted"
printf 'old-secret\n' >"$legacy"
printf 'old-digest\n' >"$digest"
export FAKE_BAO_DENY_WRITE=1
run mint_client_secret
expect 1
held ""
if ran_authelia; then fail "minted although the file held the secret"; fi
setup "mint: a secret whose digest cannot be computed is a failure and writes no digest"
printf 'old-secret' >"$stored"
export FAKE_AUTHELIA_NODIGEST=1
@ -232,104 +262,6 @@ if [ "$(id -u)" != 0 ]; then
digest_is ""
fi
# --- migrate_client_secret ------------------------------------------------
setup "migrate: a file the store lacks is stored, read back and removed"
printf 'old-secret\n' >"$legacy"
run migrate_client_secret
expect 0
held old-secret
if [ -e "$legacy" ]; then fail "left the file"; fi
if ! logged "stored in the store, removed the file $legacy"; then fail "no stored line"; fi
if ran_authelia; then fail "minted"; fi
no_secret_in_argv
setup "migrate: a file the store already holds is removed, and the store is not written"
printf 'old-secret\n' >"$legacy"
printf 'old-secret\n' >"$stored"
run migrate_client_secret
expect 0
held "old-secret"
if [ -e "$legacy" ]; then fail "left the file"; fi
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
if ! logged "already in the store, removed the file $legacy"; then fail "no removed line"; fi
setup "migrate: a store holding a different secret keeps both and reports an error"
printf 'old-secret\n' >"$legacy"
printf 'other-secret' >"$stored"
run migrate_client_secret
expect 3
held other-secret
if [ "$(cat "$legacy")" != old-secret ]; then fail "changed the file"; fi
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote to a leaf that held a value"; fi
if ! logged "<3>oidc client $id"; then fail "no err-priority line"; fi
setup "migrate: a store that refuses the login keeps the file and retries"
printf 'old-secret\n' >"$legacy"
export FAKE_BAO_LOGIN_RC=1
run migrate_client_secret
expect 1
if [ ! -e "$legacy" ]; then fail "removed the file"; fi
if store_called; then fail "called kv after a refused login"; fi
setup "migrate: a store that refuses the read keeps the file and retries"
printf 'old-secret\n' >"$legacy"
export FAKE_BAO_DENY_READ=1
run migrate_client_secret
expect 1
if [ ! -e "$legacy" ]; then fail "removed the file"; fi
if grep -q '^kv put' "$FAKE_BAO_LOG"; then fail "wrote although the read was refused"; fi
setup "migrate: a store that refuses the write keeps the file and retries"
printf 'old-secret\n' >"$legacy"
export FAKE_BAO_DENY_WRITE=1
run migrate_client_secret
expect 1
if [ ! -e "$legacy" ]; then fail "removed the file"; fi
held ""
setup "migrate: losing the race to a different secret keeps the file and reports an error"
printf 'old-secret\n' >"$legacy"
export FAKE_BAO_RACE=winner-secret
run migrate_client_secret
expect 3
held winner-secret
if [ ! -e "$legacy" ]; then fail "removed the file"; fi
setup "migrate: an empty file is kept and reported"
: >"$legacy"
run migrate_client_secret
expect 3
if [ ! -e "$legacy" ]; then fail "removed the file"; fi
held ""
setup "migrate: no file is nothing to do, store or no store"
export FAKE_BAO_LOGIN_RC=1
run migrate_client_secret
expect 0
if store_called; then fail "called the store"; fi
if [ "$(id -u)" != 0 ]; then
setup "migrate: a file that cannot be removed is a failure, not a move"
printf 'old-secret\n' >"$legacy"
chmod 500 "$clients"
run migrate_client_secret
chmod 700 "$clients"
expect 1
held old-secret
if ! [ -e "$legacy" ]; then fail "file vanished"; fi
if logged "removed the file"; then fail "logged a removal that did not happen"; fi
setup "migrate: a file the store already holds that cannot be removed is a failure"
printf 'old-secret\n' >"$legacy"
printf 'old-secret' >"$stored"
chmod 500 "$clients"
run migrate_client_secret
chmod 700 "$clients"
expect 1
if logged "removed the file"; then fail "logged a removal that did not happen"; fi
fi
if [ "$failures" != 0 ]; then
echo "$failures of $count cases failed" >&2
exit 1