feat(auth): include authentication in workspace and tht diagnostics

2026-08-17 15:51:16 +02:00
parent cb0e873ed7
commit 3ed00ff086
19 changed files with 1050 additions and 34 deletions
@@ -5,15 +5,126 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
 	"testing"

+	"github.com/aritmolab/thothii/tools/tht/internal/compose"
 	"github.com/aritmolab/thothii/tools/tht/internal/config"
 	"github.com/aritmolab/thothii/tools/tht/internal/safeio"
 )

+func TestAuthCheckRunsOneShotCoreDiagnosticWithPristineJSON(t *testing.T) {
+	installation := authInstallation(newAuthDirectory(t))
+	var calls [][]string
+	runner := runnerFunc(func(_ context.Context, args []string, _ io.Reader) (compose.Result, error) {
+		calls = append(calls, append([]string(nil), args...))
+		return compose.Result{Stdout: `{"ready":true,"mode":"oidc","checks":[{"level":"info","code":"auth_ready","message":"Authentication is ready."}]}` + "\n"}, nil
+	})
+	var stdout, stderr bytes.Buffer
+
+	code := RunWithRunner(context.Background(), installation, []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
+
+	if code != 0 {
+		t.Fatalf("auth check = %d, stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	var report AuthDiagnostics
+	if err := json.Unmarshal(stdout.Bytes(), &report); err != nil {
+		t.Fatalf("auth check stdout is not pristine JSON: %q: %v", stdout.String(), err)
+	}
+	if !report.Ready || report.Mode != "oidc" || len(report.Checks) != 1 || report.Checks[0].Code != "auth_ready" {
+		t.Fatalf("auth check report = %#v", report)
+	}
+	if stderr.Len() != 0 {
+		t.Fatalf("auth check stderr = %q", stderr.String())
+	}
+	if len(calls) != 1 {
+		t.Fatalf("Docker calls = %#v, want one", calls)
+	}
+	want := installation.ComposeArgs("run", "--rm", "--no-deps", "--no-TTY", "core", "node", "dist/auth/diagnostic-command.js", "--json")
+	if strings.Join(calls[0], "\x00") != strings.Join(want, "\x00") {
+		t.Fatalf("auth check Docker call = %#v, want %#v", calls[0], want)
+	}
+}
+
+func TestAuthCheckInteractiveForwardsOnlyTheValidatedDevicePrompt(t *testing.T) {
+	installation := authInstallation(newAuthDirectory(t))
+	var calls [][]string
+	runner := runnerFunc(func(_ context.Context, args []string, _ io.Reader) (compose.Result, error) {
+		calls = append(calls, append([]string(nil), args...))
+		return compose.Result{
+			Stdout: `{"ready":true,"mode":"oidc","checks":[{"level":"info","code":"auth_ready","message":"Authentication is ready."}]}` + "\n",
+			Stderr: "Open https://issuer.example.test/device and enter code ABCD-EFGH\nnot-a-device-prompt secret-sentinel\n",
+		}, nil
+	})
+	var stdout, stderr bytes.Buffer
+
+	code := RunWithRunner(context.Background(), installation, []string{"check", "--interactive"}, strings.NewReader(""), &stdout, &stderr, runner)
+
+	if code != 0 {
+		t.Fatalf("interactive auth check = %d, stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+	if stdout.String() != "authentication: passed\n" {
+		t.Fatalf("interactive auth stdout = %q", stdout.String())
+	}
+	if stderr.String() != "Open https://issuer.example.test/device and enter code ABCD-EFGH\n" {
+		t.Fatalf("interactive auth stderr = %q", stderr.String())
+	}
+	if strings.Contains(stdout.String()+stderr.String(), "secret-sentinel") {
+		t.Fatalf("interactive auth output leaked untrusted stderr: stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+	if len(calls) != 1 {
+		t.Fatalf("Docker calls = %#v, want one", calls)
+	}
+	want := installation.ComposeArgs("run", "--rm", "--no-deps", "--no-TTY", "core", "node", "dist/auth/diagnostic-command.js", "--json", "--interactive")
+	if strings.Join(calls[0], "\x00") != strings.Join(want, "\x00") {
+		t.Fatalf("interactive auth command = %#v, want %#v", calls[0], want)
+	}
+}
+
+func TestAuthCheckRedactsFailedCoreOutputAndRejectsMalformedReports(t *testing.T) {
+	installation := authInstallation(newAuthDirectory(t))
+	secretPath := filepath.Join(t.TempDir(), "auth-check-secret")
+	if err := os.WriteFile(secretPath, []byte("auth-check-secret"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	installation.EnvFile = filepath.Join(t.TempDir(), "operator.env")
+	if err := os.WriteFile(installation.EnvFile, []byte("AUTH_CHECK_TOKEN_FILE="+secretPath+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	runner := runnerFunc(func(_ context.Context, _ []string, _ io.Reader) (compose.Result, error) {
+		return compose.Result{
+			Stdout: "not-json auth-check-secret token-sentinel /private/sentinel $argon2id$hash-sentinel",
+			Stderr: "auth-check-secret cookie-sentinel /private/sentinel",
+			ExitCode: 23,
+		}, errors.New("core failed")
+	})
+	var stdout, stderr bytes.Buffer
+
+	code := RunWithRunner(context.Background(), installation, []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
+
+	if code != 1 {
+		t.Fatalf("auth check = %d, want 1; stderr=%q", code, stderr.String())
+	}
+	combined := stdout.String() + stderr.String()
+	leaked := strings.Contains(combined, "auth-check-secret") ||
+		strings.Contains(combined, "token-sentinel") ||
+		strings.Contains(combined, "cookie-sentinel") ||
+		strings.Contains(combined, "/private/sentinel") ||
+		strings.Contains(combined, "$argon2id$hash-sentinel")
+	if stdout.Len() != 0 || leaked {
+		t.Fatalf("auth check leaked a core failure: stdout=%q stderr=%q", stdout.String(), stderr.String())
+	}
+}
+
+type runnerFunc func(context.Context, []string, io.Reader) (compose.Result, error)
+
+func (run runnerFunc) Run(ctx context.Context, args []string, input io.Reader) (compose.Result, error) {
+	return run(ctx, args, input)
+}
+
 func TestRunConfiguresLocalRegistryAndRedactsStatusJSON(t *testing.T) {
 	directory := newAuthDirectory(t)
 	passwordFile := writePasswordFile(t, "this is a local test password\n")