207 lines
10 KiB
Rust
207 lines
10 KiB
Rust
use assert_cmd::cargo::CommandCargoExt as _;
|
|
use std::path::{Path, PathBuf};
|
|
use std::process::{Command, Stdio};
|
|
use tempfile::TempDir;
|
|
|
|
/// A device home + an org vault. A second device can be wired for multi-member.
|
|
struct Dev {
|
|
xdg: PathBuf,
|
|
_config: TempDir,
|
|
}
|
|
|
|
impl Dev {
|
|
fn new(name: &str) -> Self {
|
|
let config = TempDir::new().unwrap();
|
|
let xdg = config.path().to_path_buf();
|
|
let devices = xdg.join("relicario").join("devices").join(name);
|
|
std::fs::create_dir_all(&devices).unwrap();
|
|
let keyfile = devices.join("signing.key");
|
|
let st = Command::new("ssh-keygen")
|
|
.args(["-t", "ed25519", "-N", "", "-C", "relicario-test", "-f"])
|
|
.arg(&keyfile)
|
|
.stdout(Stdio::null()).stderr(Stdio::null())
|
|
.status().expect("ssh-keygen");
|
|
assert!(st.success());
|
|
std::fs::rename(devices.join("signing.key.pub"), devices.join("signing.pub")).unwrap();
|
|
std::fs::write(xdg.join("relicario").join("devices").join("current"), format!("{name}\n")).unwrap();
|
|
Dev { xdg, _config: config }
|
|
}
|
|
|
|
fn pubkey(&self, name: &str) -> String {
|
|
std::fs::read_to_string(
|
|
self.xdg.join("relicario").join("devices").join(name).join("signing.pub"),
|
|
).unwrap().trim().to_string()
|
|
}
|
|
|
|
fn run(&self, vault: &Path, args: &[&str]) -> std::process::Output {
|
|
let mut cmd = Command::cargo_bin("relicario").unwrap();
|
|
cmd.env("XDG_CONFIG_HOME", &self.xdg)
|
|
.env("RELICARIO_ORG_DIR", vault)
|
|
.args(args)
|
|
.stdin(Stdio::null()).stdout(Stdio::piped()).stderr(Stdio::piped());
|
|
cmd.output().unwrap()
|
|
}
|
|
}
|
|
|
|
fn owner_member_id(vault: &Path) -> String {
|
|
let s = std::fs::read_to_string(vault.join("members.json")).unwrap();
|
|
let v: serde_json::Value = serde_json::from_str(&s).unwrap();
|
|
v["members"][0]["member_id"].as_str().unwrap().to_string()
|
|
}
|
|
|
|
/// Set up an org with the owner granted `prod` and one login item in it.
|
|
fn setup_with_item() -> (Dev, TempDir, String) {
|
|
let dev = Dev::new("laptop");
|
|
let vault = TempDir::new().unwrap();
|
|
let v = vault.path();
|
|
assert!(dev.run(v, &["org", "init", "--dir", v.to_str().unwrap(), "--name", "Acme"]).status.success());
|
|
let owner = owner_member_id(v);
|
|
assert!(dev.run(v, &["org", "create-collection", "prod", "--name", "Prod"]).status.success());
|
|
assert!(dev.run(v, &["org", "grant", &owner, "prod"]).status.success());
|
|
assert!(dev.run(v, &[
|
|
"org", "add", "login", "--collection", "prod",
|
|
"--title", "GitHub", "--username", "alice", "--password", "hunter2",
|
|
]).status.success());
|
|
(dev, vault, owner)
|
|
}
|
|
|
|
// (b) audit --format json parses + has expected actions.
|
|
#[test]
|
|
fn audit_format_json_is_valid_and_has_actions() {
|
|
let (dev, vault, _owner) = setup_with_item();
|
|
let out = dev.run(vault.path(), &["org", "audit", "--format", "json"]);
|
|
assert!(out.status.success(), "audit json: {}", String::from_utf8_lossy(&out.stderr));
|
|
let stdout = String::from_utf8_lossy(&out.stdout);
|
|
let events: serde_json::Value = serde_json::from_str(&stdout).expect("audit json must parse");
|
|
let arr = events.as_array().expect("array");
|
|
let actions: Vec<&str> = arr.iter()
|
|
.filter_map(|e| e["action"].as_str())
|
|
.collect();
|
|
assert!(actions.contains(&"org-init"), "actions: {actions:?}");
|
|
assert!(actions.contains(&"collection-create"), "actions: {actions:?}");
|
|
assert!(actions.contains(&"item-create"), "actions: {actions:?}");
|
|
// Honest signer attribution: none of these should be TAMPERED (signer == trailer).
|
|
assert!(arr.iter().all(|e| e["tampered"] == serde_json::Value::Bool(false)));
|
|
}
|
|
|
|
// (a) a forged-trailer commit is flagged TAMPERED.
|
|
#[test]
|
|
fn forged_trailer_commit_is_flagged_tampered() {
|
|
let (dev, vault, owner) = setup_with_item();
|
|
let v = vault.path();
|
|
|
|
// Hand-craft a SIGNED commit whose trailer CLAIMS a different actor id than
|
|
// the real signer. We reuse the org repo's own signing config (set by
|
|
// `org init`), so the commit verifies — but the trailer lies.
|
|
std::fs::write(v.join("decoy.txt"), "x").unwrap();
|
|
let git = |args: &[&str]| {
|
|
Command::new("git").current_dir(v).args(args)
|
|
.env("XDG_CONFIG_HOME", &dev.xdg)
|
|
.output().unwrap()
|
|
};
|
|
assert!(git(&["add", "decoy.txt"]).status.success());
|
|
let forged_msg = format!(
|
|
"forged\n\nRelicario-Actor: impostor ffffffffffffffff\nRelicario-Action: item-update\nRelicario-Member: {owner}"
|
|
);
|
|
// commit -S uses the repo's configured signing key (the real owner key).
|
|
let c = git(&["commit", "-S", "-m", &forged_msg]);
|
|
assert!(c.status.success(), "forged commit: {}", String::from_utf8_lossy(&c.stderr));
|
|
|
|
let out = dev.run(v, &["org", "audit", "--format", "json"]);
|
|
let events: serde_json::Value =
|
|
serde_json::from_str(&String::from_utf8_lossy(&out.stdout)).unwrap();
|
|
let forged = events.as_array().unwrap().iter()
|
|
.find(|e| e["action"] == "item-update")
|
|
.expect("forged item-update event present");
|
|
// Trailer claims ffff... but the verified signer is the owner → TAMPERED.
|
|
assert_eq!(forged["tampered"], serde_json::Value::Bool(true));
|
|
assert_eq!(forged["actor_id"].as_str(), Some(owner.as_str()));
|
|
}
|
|
|
|
// (c) concurrent rotate-key aborts with the exact spec error string.
|
|
#[test]
|
|
fn concurrent_rotate_key_aborts_with_spec_string() {
|
|
let (dev, vault, _owner) = setup_with_item();
|
|
let origin = TempDir::new().unwrap();
|
|
let v = vault.path();
|
|
let git = |args: &[&str]| Command::new("git").current_dir(v).args(args)
|
|
.env("XDG_CONFIG_HOME", &dev.xdg).output().unwrap();
|
|
|
|
// Make a bare origin and push, so a divergent upstream can be simulated.
|
|
assert!(Command::new("git").args(["init", "--bare", origin.path().to_str().unwrap()])
|
|
.output().unwrap().status.success());
|
|
assert!(git(&["remote", "add", "origin", origin.path().to_str().unwrap()]).status.success());
|
|
assert!(git(&["push", "-u", "origin", "HEAD"]).status.success());
|
|
|
|
// Diverge upstream: a second clone commits + pushes, writing to a SHARED file
|
|
// so that `git pull --rebase` will hit a merge conflict (add/add or edit/edit)
|
|
// and exit non-zero — which is how run_rotate_key detects a concurrent rotation.
|
|
let clone2 = TempDir::new().unwrap();
|
|
assert!(Command::new("git")
|
|
.args(["clone", origin.path().to_str().unwrap(), clone2.path().to_str().unwrap()])
|
|
.output().unwrap().status.success());
|
|
std::fs::write(clone2.path().join("conflict.txt"), "upstream-version").unwrap();
|
|
for a in [&["add", "conflict.txt"][..], &["-c", "user.email=u@u", "-c", "user.name=u", "commit", "-m", "upstream"][..], &["push", "origin", "HEAD:master"][..], &["push", "origin", "HEAD:main"][..]] {
|
|
let _ = Command::new("git").current_dir(clone2.path()).args(a).output();
|
|
}
|
|
// Local also writes conflict.txt with different content → add/add conflict on pull.
|
|
std::fs::write(v.join("conflict.txt"), "local-version").unwrap();
|
|
assert!(git(&["add", "conflict.txt"]).status.success());
|
|
assert!(git(&["-c", "commit.gpgsign=false", "commit", "-m", "local"]).status.success());
|
|
|
|
let out = dev.run(v, &["org", "rotate-key"]);
|
|
let stderr = String::from_utf8_lossy(&out.stderr);
|
|
assert!(!out.status.success(), "rotate-key should abort on a concurrent rotation");
|
|
assert!(
|
|
stderr.contains("Concurrent key rotation detected — pull and re-run org rotate-key."),
|
|
"missing spec error string: {stderr}"
|
|
);
|
|
}
|
|
|
|
// (d) remove-member → rotate-key → old clone cannot decrypt; remaining member can.
|
|
#[test]
|
|
fn removed_member_clone_cannot_decrypt_after_rotation() {
|
|
// Owner laptop sets up the org + a second member "bob".
|
|
let (owner_dev, vault, _owner) = setup_with_item();
|
|
let v = vault.path();
|
|
let bob = Dev::new("bob-laptop");
|
|
let bob_pub = bob.pubkey("bob-laptop");
|
|
|
|
// Owner adds Bob and grants him prod.
|
|
assert!(owner_dev.run(v, &["org", "add-member", "--key", &bob_pub, "--name", "Bob", "--role", "member"]).status.success());
|
|
let members = std::fs::read_to_string(v.join("members.json")).unwrap();
|
|
let mv: serde_json::Value = serde_json::from_str(&members).unwrap();
|
|
let bob_id = mv["members"].as_array().unwrap().iter()
|
|
.find(|m| m["display_name"] == "Bob").unwrap()["member_id"].as_str().unwrap().to_string();
|
|
assert!(owner_dev.run(v, &["org", "grant", &bob_id, "prod"]).status.success());
|
|
|
|
// Bob clones the vault dir (his device, his key blob is present).
|
|
// `cp -r /vault /dst/` places contents at `/dst/<vault_basename>/` — use that
|
|
// sub-path, not the TempDir root, as the vault for Bob's commands.
|
|
let bob_clone = TempDir::new().unwrap();
|
|
let vault_basename = v.file_name().unwrap();
|
|
let cp = Command::new("cp").args(["-r", v.to_str().unwrap(), bob_clone.path().to_str().unwrap()]).output().unwrap();
|
|
assert!(cp.status.success());
|
|
let bob_vault = bob_clone.path().join(vault_basename);
|
|
// Bob can read the item BEFORE removal.
|
|
let pre = bob.run(&bob_vault, &["org", "get", "GitHub", "--show"]);
|
|
assert!(String::from_utf8_lossy(&pre.stdout).contains("hunter2"), "bob should read pre-removal");
|
|
|
|
// Owner removes Bob and rotates the key in the live vault.
|
|
assert!(owner_dev.run(v, &["org", "remove-member", &bob_id]).status.success());
|
|
assert!(owner_dev.run(v, &["org", "rotate-key"]).status.success());
|
|
|
|
// Owner (remaining member) can still decrypt in the live vault.
|
|
let owner_get = owner_dev.run(v, &["org", "get", "GitHub", "--show"]);
|
|
assert!(String::from_utf8_lossy(&owner_get.stdout).contains("hunter2"), "owner must still read");
|
|
|
|
// Copy the rotated item + manifest into Bob's stale clone (simulating a
|
|
// pull) — his OLD key blob can no longer unwrap the rotated org key.
|
|
let _ = Command::new("cp").args(["-r",
|
|
v.join("items").to_str().unwrap(), bob_vault.to_str().unwrap()]).output();
|
|
let _ = std::fs::copy(v.join("manifest.enc"), bob_vault.join("manifest.enc"));
|
|
let post = bob.run(&bob_vault, &["org", "get", "GitHub", "--show"]);
|
|
assert!(!post.status.success() || !String::from_utf8_lossy(&post.stdout).contains("hunter2"),
|
|
"removed member must NOT decrypt post-rotation: {}", String::from_utf8_lossy(&post.stdout));
|
|
}
|