101 lines
4.0 KiB
Rust
101 lines
4.0 KiB
Rust
#[cfg(test)]
|
|
mod test {
|
|
use crate::handlers::{self, ApproveReq, PollReq, RegisterReq};
|
|
use crate::AppState;
|
|
use axum::body::to_bytes;
|
|
use axum::extract::{Json, State};
|
|
use axum::response::Response;
|
|
use base64::{engine::general_purpose::STANDARD as BASE64, Engine as _};
|
|
use ed25519_dalek::{Signer, SigningKey};
|
|
use rand::rngs::OsRng;
|
|
use rand::RngCore;
|
|
use sqlx::sqlite::SqlitePoolOptions;
|
|
use ssh_key::public::{Ed25519PublicKey, KeyData};
|
|
use ssh_key::PublicKey;
|
|
use std::str::FromStr;
|
|
|
|
async fn setup_state() -> AppState {
|
|
let pool = SqlitePoolOptions::new().connect("sqlite::memory:").await.unwrap();
|
|
sqlx::migrate!("./migrations").run(&pool).await.unwrap();
|
|
AppState {
|
|
pool,
|
|
master_key: "test_master_key".to_string(),
|
|
}
|
|
}
|
|
|
|
fn generate_keypair() -> (SigningKey, String) {
|
|
let mut bytes = [0u8; 32];
|
|
OsRng.fill_bytes(&mut bytes);
|
|
let sk = SigningKey::from_bytes(&bytes);
|
|
let vk = sk.verifying_key();
|
|
let ed_pk = Ed25519PublicKey(*vk.as_bytes());
|
|
let mut ssh_pk = PublicKey::from(KeyData::Ed25519(ed_pk));
|
|
ssh_pk.set_comment("test@test");
|
|
(sk, ssh_pk.to_string())
|
|
}
|
|
|
|
async fn get_json_body(res: Response) -> serde_json::Value {
|
|
let body_bytes = to_bytes(res.into_body(), usize::MAX).await.unwrap();
|
|
serde_json::from_slice(&body_bytes).unwrap()
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn test_full_auth_flow() {
|
|
let state = setup_state().await;
|
|
|
|
sqlx::query("INSERT INTO secrets (key_name, encrypted_value) VALUES ('TEST_SECRET', ?)")
|
|
.bind(crate::encrypt_secret(&state.master_key, "super_secret_value"))
|
|
.execute(&state.pool)
|
|
.await
|
|
.unwrap();
|
|
|
|
let (client_sk, client_pk_str) = generate_keypair();
|
|
let (admin_sk, admin_pk_str) = generate_keypair();
|
|
|
|
sqlx::query("INSERT INTO devices (hostname, os, public_key, approved_at, created_at) VALUES ('admin', 'linux', ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)")
|
|
.bind(&admin_pk_str)
|
|
.execute(&state.pool)
|
|
.await
|
|
.unwrap();
|
|
|
|
let reg_req = RegisterReq {
|
|
hostname: "client-host".to_string(),
|
|
os: "linux".to_string(),
|
|
public_key: client_pk_str.clone(),
|
|
};
|
|
let reg_res_raw = handlers::register(State(state.clone()), Json(reg_req)).await.unwrap();
|
|
let reg_res = get_json_body(reg_res_raw).await;
|
|
let user_code = reg_res["user_code"].as_str().unwrap().to_string();
|
|
let challenge_nonce = reg_res["challenge_nonce"].as_str().unwrap().to_string();
|
|
|
|
let poll_sig1 = client_sk.sign(challenge_nonce.as_bytes());
|
|
let poll_req1 = PollReq {
|
|
user_code: user_code.clone(),
|
|
signature: BASE64.encode(poll_sig1.to_bytes()),
|
|
};
|
|
let poll_err = handlers::poll(State(state.clone()), Json(poll_req1)).await.unwrap_err();
|
|
assert_eq!(poll_err.0, axum::http::StatusCode::ACCEPTED);
|
|
|
|
let admin_sig = admin_sk.sign(client_pk_str.as_bytes());
|
|
let admin_pk = PublicKey::from_str(&admin_pk_str).unwrap();
|
|
let approve_req = ApproveReq {
|
|
user_code: user_code.clone(),
|
|
approver_public_key_fingerprint: admin_pk.fingerprint(Default::default()).to_string(),
|
|
signature: BASE64.encode(admin_sig.to_bytes()),
|
|
};
|
|
let app_res = handlers::approve(State(state.clone()), Json(approve_req)).await.unwrap();
|
|
assert_eq!(app_res.status(), axum::http::StatusCode::OK);
|
|
|
|
let poll_sig2 = client_sk.sign(challenge_nonce.as_bytes());
|
|
let poll_req2 = PollReq {
|
|
user_code: user_code.clone(),
|
|
signature: BASE64.encode(poll_sig2.to_bytes()),
|
|
};
|
|
let poll_res_raw = handlers::poll(State(state.clone()), Json(poll_req2)).await.unwrap();
|
|
let poll_res = get_json_body(poll_res_raw).await;
|
|
|
|
let enc_secrets = poll_res["encrypted_secrets"].as_str().unwrap();
|
|
assert!(!enc_secrets.is_empty());
|
|
}
|
|
}
|