fix(auth): harden unified diagnostic execution
This commit is contained in:
@@ -49,6 +49,113 @@ func TestAuthCheckRunsOneShotCoreDiagnosticWithPristineJSON(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthCheckEmitsValidFailedReportFromRealExitError(t *testing.T) {
|
||||
installation := authInstallation(newAuthDirectory(t))
|
||||
runner := compose.NewRunner(writeAuthExecutable(t, `#!/bin/sh
|
||||
printf '%s\n' '{"ready":false,"mode":"oidc","checks":[{"level":"error","code":"oidc_secret_missing","message":"A required OIDC or group catalog secret is unavailable."}]}'
|
||||
exit 1
|
||||
`))
|
||||
var stdout, stderr bytes.Buffer
|
||||
|
||||
code := RunWithRunner(context.Background(), installation, []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
|
||||
|
||||
if code != 1 {
|
||||
t.Fatalf("auth check = %d, want diagnostic failure 1; stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
||||
}
|
||||
var report AuthDiagnostics
|
||||
if err := json.Unmarshal(stdout.Bytes(), &report); err != nil || report.Ready || report.Checks[0].Code != "oidc_secret_missing" {
|
||||
t.Fatalf("auth check stdout is not the pristine failed report: %q: %#v, %v", stdout.String(), report, err)
|
||||
}
|
||||
if stderr.Len() != 0 {
|
||||
t.Fatalf("auth check stderr = %q, want empty", stderr.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthCheckRejectsExitAndReportSemanticMismatches(t *testing.T) {
|
||||
ready := `{"ready":true,"mode":"oidc","checks":[{"level":"info","code":"auth_ready","message":"Authentication is ready."}]}`
|
||||
failed := `{"ready":false,"mode":"oidc","checks":[{"level":"error","code":"oidc_secret_missing","message":"A required OIDC or group catalog secret is unavailable."}]}`
|
||||
for _, test := range []struct {
|
||||
name string
|
||||
exit int
|
||||
report string
|
||||
}{
|
||||
{name: "zero with failed report", exit: 0, report: failed},
|
||||
{name: "one with ready report", exit: 1, report: ready},
|
||||
{name: "two with failed report", exit: 2, report: failed},
|
||||
} {
|
||||
t.Run(test.name, func(t *testing.T) {
|
||||
runner := runnerFunc(func(_ context.Context, _ []string, _ io.Reader) (compose.Result, error) {
|
||||
var err error
|
||||
if test.exit != 0 {
|
||||
err = errors.New("process exited")
|
||||
}
|
||||
return compose.Result{Stdout: test.report, ExitCode: test.exit}, err
|
||||
})
|
||||
var stdout, stderr bytes.Buffer
|
||||
code := RunWithRunner(context.Background(), authInstallation(newAuthDirectory(t)), []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
|
||||
if code != 1 || stdout.Len() != 0 || stderr.String() != "tht: authentication diagnostics could not be completed\n" {
|
||||
t.Fatalf("mismatch accepted: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthCheckRejectsCancellationEvenIfTheKilledChildReportsExitOne(t *testing.T) {
|
||||
failed := `{"ready":false,"mode":"oidc","checks":[{"level":"error","code":"oidc_secret_missing","message":"A required OIDC or group catalog secret is unavailable."}]}`
|
||||
runner := runnerFunc(func(_ context.Context, _ []string, _ io.Reader) (compose.Result, error) {
|
||||
return compose.Result{Stdout: failed, ExitCode: 1}, context.DeadlineExceeded
|
||||
})
|
||||
var stdout, stderr bytes.Buffer
|
||||
|
||||
code := RunWithRunner(context.Background(), authInstallation(newAuthDirectory(t)), []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
|
||||
|
||||
if code != 1 || stdout.Len() != 0 || stderr.String() != "tht: authentication diagnostics could not be completed\n" {
|
||||
t.Fatalf("cancelled report accepted: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthDiagnosticsContractRejectsContradictionsDuplicatesAndAttackerFields(t *testing.T) {
|
||||
field := "Configured Group"
|
||||
validFailure := AuthDiagnostics{Ready: false, Mode: "oidc", Checks: []AuthDiagnostic{{
|
||||
Level: "error", Code: "oidc_mapped_group_missing", Message: "A configured authorization group does not exist.", Field: &field,
|
||||
}}}
|
||||
if !validAuthDiagnostics(validFailure) {
|
||||
t.Fatal("valid failed report was rejected")
|
||||
}
|
||||
for _, report := range []AuthDiagnostics{
|
||||
{Ready: true, Mode: "oidc", Checks: []AuthDiagnostic{{Level: "error", Code: "oidc_secret_missing", Message: "failure"}}},
|
||||
{Ready: false, Mode: "oidc", Checks: []AuthDiagnostic{{Level: "info", Code: "auth_ready", Message: "ready"}}},
|
||||
{Ready: false, Mode: "oidc", Checks: []AuthDiagnostic{{Level: "info", Code: "auth_config_invalid", Message: "not an error"}}},
|
||||
{Ready: false, Mode: "oidc", Checks: []AuthDiagnostic{
|
||||
{Level: "error", Code: "oidc_secret_missing", Message: "failure"},
|
||||
{Level: "error", Code: "oidc_secret_missing", Message: "duplicate"},
|
||||
}},
|
||||
{Ready: false, Mode: "oidc", Checks: []AuthDiagnostic{{Level: "error", Code: "oidc_secret_missing", Message: "failure", Field: &field}}},
|
||||
{Ready: false, Mode: "oidc", Checks: []AuthDiagnostic{{Level: "error", Code: "oidc_mapped_group_missing", Message: "failure", Field: stringPointer(" attacker ")}}},
|
||||
{Ready: false, Mode: "oidc", Checks: []AuthDiagnostic{{Level: "error", Code: "oidc_mapped_group_missing", Message: "failure", Field: stringPointer("attacker\u0085field")}}},
|
||||
} {
|
||||
if validAuthDiagnostics(report) {
|
||||
t.Fatalf("invalid authentication report accepted: %#v", report)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthCheckRejectsNullAndUnexpectedDiagnosticFields(t *testing.T) {
|
||||
for _, report := range []string{
|
||||
`{"ready":false,"mode":"oidc","checks":[{"level":"error","code":"oidc_mapped_group_missing","message":"failure","field":null}]}`,
|
||||
`{"ready":false,"mode":"oidc","checks":[{"level":"error","code":"oidc_secret_missing","message":"failure","unexpected":"attacker"}]}`,
|
||||
} {
|
||||
runner := runnerFunc(func(_ context.Context, _ []string, _ io.Reader) (compose.Result, error) {
|
||||
return compose.Result{Stdout: report, ExitCode: 1}, nil
|
||||
})
|
||||
var stdout, stderr bytes.Buffer
|
||||
code := RunWithRunner(context.Background(), authInstallation(newAuthDirectory(t)), []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
|
||||
if code != 1 || stdout.Len() != 0 || stderr.String() != "tht: authentication diagnostics could not be completed\n" {
|
||||
t.Fatalf("hostile field accepted: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAuthCheckInteractiveForwardsOnlyTheValidatedDevicePrompt(t *testing.T) {
|
||||
installation := authInstallation(newAuthDirectory(t))
|
||||
var calls [][]string
|
||||
@@ -96,8 +203,8 @@ func TestAuthCheckRedactsFailedCoreOutputAndRejectsMalformedReports(t *testing.T
|
||||
}
|
||||
runner := runnerFunc(func(_ context.Context, _ []string, _ io.Reader) (compose.Result, error) {
|
||||
return compose.Result{
|
||||
Stdout: "not-json auth-check-secret token-sentinel /private/sentinel $argon2id$hash-sentinel",
|
||||
Stderr: "auth-check-secret cookie-sentinel /private/sentinel",
|
||||
Stdout: "not-json auth-check-secret token-sentinel /private/sentinel $argon2id$hash-sentinel",
|
||||
Stderr: "auth-check-secret cookie-sentinel /private/sentinel",
|
||||
ExitCode: 23,
|
||||
}, errors.New("core failed")
|
||||
})
|
||||
@@ -419,6 +526,17 @@ func writePasswordFile(t *testing.T, password string) string {
|
||||
return path
|
||||
}
|
||||
|
||||
func writeAuthExecutable(t *testing.T, contents string) string {
|
||||
t.Helper()
|
||||
path := filepath.Join(t.TempDir(), "fake-docker")
|
||||
if err := os.WriteFile(path, []byte(contents), 0o700); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return path
|
||||
}
|
||||
|
||||
func stringPointer(value string) *string { return &value }
|
||||
|
||||
func authInstallation(directory string) config.Installation {
|
||||
installation := config.Installation{}
|
||||
installation.Authentication.ConfigDirectory = directory
|
||||
|
||||
Reference in New Issue
Block a user