feat: establish v0.70 platform milestone

internal/deviceauth/database_secret_integration_test.go

@@ -0,0 +1,89 @@
+package deviceauth
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"os"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+func TestDatabaseSecretResolverImportsEncryptedCredential(t *testing.T) {
+	databaseURL := os.Getenv("TEST_DATABASE_URL")
+	if databaseURL == "" {
+		t.Skip("TEST_DATABASE_URL is not set")
+	}
+	ctx := context.Background()
+	pool, err := pgxpool.New(ctx, databaseURL)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer pool.Close()
+
+	deviceID := uuid.NewString()
+	publicID := uuid.NewString()
+	reference := "database-test://" + publicID
+	serial := sha256.Sum256([]byte(publicID))
+	_, err = pool.Exec(ctx, `
+		INSERT INTO device(id,public_id,tenant_id,serial_digest,model,status,credential_ref)
+		VALUES($1::uuid,$2::uuid,'10000000-0000-0000-0000-000000000001'::uuid,$3,'database-credential-test','registered',$4)`,
+		deviceID, publicID, hex.EncodeToString(serial[:]), reference)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_, _ = pool.Exec(ctx, `DELETE FROM device_credential WHERE device_id=$1::uuid`, deviceID)
+		_, _ = pool.Exec(ctx, `DELETE FROM device WHERE id=$1::uuid`, deviceID)
+	}()
+
+	const masterKey = "101112131415161718191a1b1c1d1e1f202122232425262728292a2b2c2d2e2f"
+	secret := []byte("database-device-secret-at-least-32-bytes")
+	resolver, err := NewDatabaseSecretResolver(pool, masterKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := resolver.ImportMissingLegacyCredentials(ctx, map[string][]byte{reference: secret}); err != nil {
+		t.Fatal(err)
+	}
+	resolved, err := resolver.Resolve(ctx, reference)
+	if err != nil || !bytes.Equal(resolved, secret) {
+		t.Fatalf("resolved credential does not match: len=%d err=%v", len(resolved), err)
+	}
+	var encrypted []byte
+	if err := pool.QueryRow(ctx, `SELECT encrypted_secret FROM device_credential WHERE device_id=$1::uuid`, deviceID).Scan(&encrypted); err != nil {
+		t.Fatal(err)
+	}
+	if bytes.Contains(encrypted, secret) || bytes.Equal(encrypted, secret) {
+		t.Fatal("database stored plaintext device credential")
+	}
+	wrongResolver, err := NewDatabaseSecretResolver(pool, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := wrongResolver.Resolve(ctx, reference); !errors.Is(err, ErrCredentialInvalid) {
+		t.Fatalf("wrong master key error=%v", err)
+	}
+	if _, err := resolver.Provision(ctx, publicID, []byte("replacement-device-secret-at-least-32-bytes"), false); !errors.Is(err, ErrCredentialAlreadyExists) {
+		t.Fatalf("duplicate provision error=%v", err)
+	}
+	replacement := []byte("replacement-device-secret-at-least-32-bytes")
+	version, err := resolver.Provision(ctx, publicID, replacement, true)
+	if err != nil || version != 2 {
+		t.Fatalf("rotate version=%d err=%v", version, err)
+	}
+	resolved, err = resolver.Resolve(ctx, reference)
+	if err != nil || !bytes.Equal(resolved, replacement) {
+		t.Fatalf("rotated credential does not match: len=%d err=%v", len(resolved), err)
+	}
+	if err := resolver.Revoke(ctx, publicID); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := resolver.Resolve(ctx, reference); !errors.Is(err, ErrCredentialInvalid) {
+		t.Fatalf("revoked credential error=%v", err)
+	}
+}