feat(server): activate projected authentication safely

2026-08-22 01:01:36 +02:00
parent 903c0b4de5
commit 3d9a9f0675
32 changed files with 1837 additions and 38 deletions
@@ -52,6 +52,104 @@ func TestLoadSelectsServerComposeFiles(t *testing.T) {
 	assertStringsEqual(t, installation.ComposeFiles(), want)
 }

+func TestLoadAcceptsServerRuntimeProjectionAndPlacesAutomaticOverrideBeforeCurrentImage(t *testing.T) {
+	installationPath, projectDirectory, envFile, override := writeInstallation(t, "server")
+	root := filepath.Dir(installationPath)
+	authDirectory := filepath.Join(root, "canonical-auth")
+	runtimeDirectory := filepath.Join(root, "runtime-auth")
+	automaticOverride := filepath.Join(projectDirectory, "deploy", "compose.auth-runtime-projection.yaml")
+	if err := os.WriteFile(automaticOverride, []byte("services: {}\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	candidate := Installation{Path: installationPath, ProjectDirectory: projectDirectory}
+	currentImage := candidate.CurrentImageOverridePath()
+	if err := os.MkdirAll(filepath.Dir(currentImage), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(currentImage, []byte("services: {}\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	writeRuntimeProjectionFixture(t, installationPath, envFile, "server", authDirectory, runtimeDirectory, runtimeDirectory, 10001, 10001, []string{override})
+
+	installation, err := Load(installationPath)
+	if err != nil {
+		t.Fatalf("Load() error = %v", err)
+	}
+	if !installation.HasRuntimeAuthProjection() {
+		t.Fatal("HasRuntimeAuthProjection() = false, want true")
+	}
+	projection := installation.RuntimeAuthProjection()
+	if projection == nil || projection.Directory != runtimeDirectory || projection.UID != 10001 || projection.GID != 10001 {
+		t.Fatalf("RuntimeAuthProjection() = %#v", projection)
+	}
+	projection.Directory = "mutated"
+	if got := installation.RuntimeAuthProjection(); got == nil || got.Directory != runtimeDirectory {
+		t.Fatalf("RuntimeAuthProjection() did not return an independent copy: %#v", got)
+	}
+
+	want := []string{
+		filepath.Join(projectDirectory, "compose.yaml"),
+		filepath.Join(projectDirectory, "deploy", "compose.server.yaml"),
+		override,
+		automaticOverride,
+		currentImage,
+	}
+	assertStringsEqual(t, installation.ComposeFiles(), want)
+}
+
+func TestLoadRejectsInvalidRuntimeProjection(t *testing.T) {
+	for _, test := range []struct {
+		name             string
+		profile          string
+		configDirectory  func(root string) string
+		runtimeDirectory func(root string) string
+		environmentRoot  func(root string) string
+		uid, gid         uint32
+		manualOverride   bool
+	}{
+		{name: "local profile", profile: "local", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return filepath.Join(root, "runtime-auth") }, environmentRoot: func(root string) string { return filepath.Join(root, "runtime-auth") }, uid: 10001, gid: 10001},
+		{name: "relative runtime directory", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(string) string { return "relative-runtime-auth" }, environmentRoot: func(string) string { return "relative-runtime-auth" }, uid: 10001, gid: 10001},
+		{name: "noncanonical runtime directory", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return root + "/runtime-auth/../runtime-auth" }, environmentRoot: func(root string) string { return filepath.Join(root, "runtime-auth") }, uid: 10001, gid: 10001},
+		{name: "equal canonical and runtime directories", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, environmentRoot: func(root string) string { return filepath.Join(root, "canonical-auth") }, uid: 10001, gid: 10001},
+		{name: "uid mismatch", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return filepath.Join(root, "runtime-auth") }, environmentRoot: func(root string) string { return filepath.Join(root, "runtime-auth") }, uid: 10000, gid: 10001},
+		{name: "gid mismatch", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return filepath.Join(root, "runtime-auth") }, environmentRoot: func(root string) string { return filepath.Join(root, "runtime-auth") }, uid: 10001, gid: 10000},
+		{name: "missing runtime environment", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return filepath.Join(root, "runtime-auth") }, environmentRoot: func(root string) string { return "" }, uid: 10001, gid: 10001},
+		{name: "mismatched runtime environment", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return filepath.Join(root, "runtime-auth") }, environmentRoot: func(root string) string { return filepath.Join(root, "different-runtime-auth") }, uid: 10001, gid: 10001},
+		{name: "manual automatic override", profile: "server", configDirectory: func(root string) string { return filepath.Join(root, "canonical-auth") }, runtimeDirectory: func(root string) string { return filepath.Join(root, "runtime-auth") }, environmentRoot: func(root string) string { return filepath.Join(root, "runtime-auth") }, uid: 10001, gid: 10001, manualOverride: true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			installationPath, projectDirectory, envFile, override := writeInstallation(t, test.profile)
+			root := filepath.Dir(installationPath)
+			automaticOverride := filepath.Join(projectDirectory, "deploy", "compose.auth-runtime-projection.yaml")
+			if err := os.WriteFile(automaticOverride, []byte("services: {}\n"), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			overrides := []string{override}
+			if test.manualOverride {
+				overrides = append(overrides, automaticOverride)
+			}
+			writeRuntimeProjectionFixture(t, installationPath, envFile, test.profile, test.configDirectory(root), test.runtimeDirectory(root), test.environmentRoot(root), test.uid, test.gid, overrides)
+
+			if _, err := Load(installationPath); err == nil {
+				t.Fatal("Load() unexpectedly accepted an invalid runtime authentication projection")
+			}
+		})
+	}
+}
+
+func TestLoadRejectsRuntimeProjectionEnvironmentWithoutDescriptor(t *testing.T) {
+	installationPath, _, envFile, _ := writeInstallation(t, "server")
+	authDirectory := filepath.Join(filepath.Dir(installationPath), "auth")
+	runtimeDirectory := filepath.Join(filepath.Dir(installationPath), "runtime-auth")
+	contents := "THT_AUTH_CONFIG_ROOT=" + strconv.Quote(authDirectory) + "\nTHT_AUTH_RUNTIME_ROOT=" + strconv.Quote(runtimeDirectory) + "\n"
+	if err := os.WriteFile(envFile, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Load(installationPath); err == nil {
+		t.Fatal("Load() unexpectedly accepted THT_AUTH_RUNTIME_ROOT without runtimeProjection")
+	}
+}
+
 func TestLoadRequiresAndReturnsTypedWorkspaceRepositoryForGitInstallations(t *testing.T) {
 	installationPath, projectDirectory, envFile, _ := writeInstallation(t, "local")
 	gitOverride := filepath.Join(projectDirectory, "deploy", "compose.git-ssh.yaml")
@@ -280,6 +378,25 @@ func TestParseAuthenticationDirectoryEnvironment(t *testing.T) {
 	}
 }

+func writeRuntimeProjectionFixture(t *testing.T, installationPath, envFile, profile, configDirectory, runtimeDirectory, environmentRoot string, uid, gid uint32, overrides []string) {
+	t.Helper()
+	lines := []string{"THT_AUTH_CONFIG_ROOT=" + strconv.Quote(configDirectory)}
+	if environmentRoot != "" {
+		lines = append(lines, "THT_AUTH_RUNTIME_ROOT="+strconv.Quote(environmentRoot))
+	}
+	if err := os.WriteFile(envFile, []byte(strings.Join(lines, "\n")+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	projectDirectory := filepath.Join(filepath.Dir(installationPath), "project directory with spaces")
+	contents := "profile: " + profile + "\nprojectDirectory: " + projectDirectory + "\nenvFile: " + envFile + "\nauthentication:\n  configDirectory: " + configDirectory + "\n  runtimeProjection:\n    directory: " + runtimeDirectory + "\n    uid: " + strconv.FormatUint(uint64(uid), 10) + "\n    gid: " + strconv.FormatUint(uint64(gid), 10) + "\noverrides:\n"
+	for _, override := range overrides {
+		contents += "  - " + override + "\n"
+	}
+	if err := os.WriteFile(installationPath, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func writeInstallation(t *testing.T, profile string) (string, string, string, string) {
 	t.Helper()