|
| 1 | +package auth |
| 2 | + |
| 3 | +import ( |
| 4 | + "os" |
| 5 | + "path/filepath" |
| 6 | + "strings" |
| 7 | + "testing" |
| 8 | +) |
| 9 | + |
| 10 | +func write(t *testing.T, name, body string, mode os.FileMode) string { |
| 11 | + t.Helper() |
| 12 | + p := filepath.Join(t.TempDir(), name) |
| 13 | + if err := os.WriteFile(p, []byte(body), mode); err != nil { |
| 14 | + t.Fatal(err) |
| 15 | + } |
| 16 | + return p |
| 17 | +} |
| 18 | + |
| 19 | +// The trailing newline is the whole reason this trims. Every mechanism that |
| 20 | +// writes a credential file -- a heredoc, an editor, echo, sops -- leaves one, |
| 21 | +// and a bearer with \n on the end fails authentication in a way that reads |
| 22 | +// exactly like a wrong key. |
| 23 | +func TestFileValueTrimsWhitespace(t *testing.T) { |
| 24 | + for _, body := range []string{"sk-abc123", "sk-abc123\n", " sk-abc123 \n\n", "sk-abc123\r\n"} { |
| 25 | + f := &FileValue{Path: write(t, "k", body, 0o600)} |
| 26 | + got, ok, err := f.TryResolve() |
| 27 | + if err != nil || !ok { |
| 28 | + t.Fatalf("%q: ok=%v err=%v", body, ok, err) |
| 29 | + } |
| 30 | + if got != "sk-abc123" { |
| 31 | + t.Fatalf("%q resolved to %q", body, got) |
| 32 | + } |
| 33 | + } |
| 34 | +} |
| 35 | + |
| 36 | +// ABSENT IS NOT AN ERROR. This strategy sits in an Aggregate beside env vars |
| 37 | +// and hush; a config that names no file must fall through so a workstation |
| 38 | +// keeps using the credentials a person owns. |
| 39 | +func TestFileValueAbsentFallsThrough(t *testing.T) { |
| 40 | + for _, p := range []string{"", filepath.Join(t.TempDir(), "nope")} { |
| 41 | + f := &FileValue{Path: p} |
| 42 | + _, ok, err := f.TryResolve() |
| 43 | + if ok { |
| 44 | + t.Fatalf("%q reported a credential", p) |
| 45 | + } |
| 46 | + if err != nil { |
| 47 | + t.Fatalf("%q errored instead of falling through: %v", p, err) |
| 48 | + } |
| 49 | + } |
| 50 | +} |
| 51 | + |
| 52 | +// PRESENT BUT UNREADABLE IS AN ERROR, and must not fall through. The usual |
| 53 | +// cause is a credential mode or owner that does not match the service user, |
| 54 | +// and falling through would surface it as "no credential available" three |
| 55 | +// layers from the mistake. |
| 56 | +func TestFileValueUnreadableIsLoud(t *testing.T) { |
| 57 | + if os.Geteuid() == 0 { |
| 58 | + t.Skip("root reads everything") |
| 59 | + } |
| 60 | + p := write(t, "k", "sk-abc", 0o000) |
| 61 | + f := &FileValue{Path: p} |
| 62 | + _, ok, err := f.TryResolve() |
| 63 | + if ok { |
| 64 | + t.Fatal("an unreadable file yielded a credential") |
| 65 | + } |
| 66 | + if err == nil { |
| 67 | + t.Fatal("an unreadable credential file fell through silently") |
| 68 | + } |
| 69 | + if !strings.Contains(err.Error(), p) { |
| 70 | + t.Fatalf("error does not name the path: %v", err) |
| 71 | + } |
| 72 | +} |
| 73 | + |
| 74 | +// An empty file is a provisioning failure, not an empty credential. |
| 75 | +func TestFileValueEmptyIsAnError(t *testing.T) { |
| 76 | + f := &FileValue{Path: write(t, "k", "\n \n", 0o600)} |
| 77 | + _, ok, err := f.TryResolve() |
| 78 | + if ok || err == nil { |
| 79 | + t.Fatalf("an empty credential file was accepted: ok=%v err=%v", ok, err) |
| 80 | + } |
| 81 | +} |
| 82 | + |
| 83 | +// The file is the source of truth; this process does not get to decide it is |
| 84 | +// wrong. Rotation is the operator's job, so Invalidate must not delete it. |
| 85 | +func TestFileValueInvalidateLeavesTheFile(t *testing.T) { |
| 86 | + p := write(t, "k", "sk-abc", 0o600) |
| 87 | + f := &FileValue{Path: p} |
| 88 | + if err := f.Invalidate("sk-abc"); err != nil { |
| 89 | + t.Fatalf("Invalidate errored: %v", err) |
| 90 | + } |
| 91 | + if _, err := os.Stat(p); err != nil { |
| 92 | + t.Fatalf("Invalidate touched the credential file: %v", err) |
| 93 | + } |
| 94 | +} |
0 commit comments