60 lines
1.8 KiB
Go
60 lines
1.8 KiB
Go
package deviceauth
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestDirectorySecretResolverReadsPerDeviceSecretAndObservesRotation(t *testing.T) {
|
|
root := t.TempDir()
|
|
path := filepath.Join(root, "terminal-001")
|
|
first := strings.Repeat("a", 40)
|
|
if err := os.WriteFile(path, []byte(first+"\n"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
resolver, err := NewDirectorySecretResolver(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
secret, err := resolver.Resolve(context.Background(), "device-secret://terminal-001")
|
|
if err != nil || string(secret) != first {
|
|
t.Fatalf("secret=%q err=%v", secret, err)
|
|
}
|
|
second := strings.Repeat("b", 48)
|
|
if err := os.WriteFile(path, []byte(second), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
secret, err = resolver.Resolve(context.Background(), "device-secret://terminal-001")
|
|
if err != nil || string(secret) != second {
|
|
t.Fatalf("rotated secret=%q err=%v", secret, err)
|
|
}
|
|
}
|
|
|
|
func TestDirectorySecretResolverRejectsUnsafeOrInvalidReferences(t *testing.T) {
|
|
root := t.TempDir()
|
|
if err := os.WriteFile(filepath.Join(root, "short"), []byte("too-short"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
resolver, err := NewDirectorySecretResolver(root)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, reference := range []string{
|
|
"local-dev://terminal-1", "device-secret://../outside", "device-secret://nested/file", "device-secret://short", "device-secret://missing",
|
|
} {
|
|
if _, err := resolver.Resolve(context.Background(), reference); !errors.Is(err, ErrCredentialInvalid) {
|
|
t.Fatalf("Resolve(%q) error=%v", reference, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestDirectorySecretResolverRequiresExistingAbsoluteDirectory(t *testing.T) {
|
|
if _, err := NewDirectorySecretResolver("relative/secrets"); err == nil {
|
|
t.Fatal("relative directory must be rejected")
|
|
}
|
|
}
|