fix(auth): harden interactive diagnostic lifecycle

2026-08-17 17:57:10 +02:00
parent ef244ab56d
commit af16464e68
9 changed files with 576 additions and 59 deletions
@@ -9,7 +9,9 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
+	"time"

 	"github.com/aritmolab/thothii/tools/tht/internal/compose"
 	"github.com/aritmolab/thothii/tools/tht/internal/config"
@@ -49,6 +51,7 @@ func TestAuthCheckRunsOneShotCoreDiagnosticWithPristineJSON(t *testing.T) {
 func TestAuthCheckEmitsValidFailedReportFromRealExitError(t *testing.T) {
 	installation := authInstallation(newAuthDirectory(t))
 	runner := compose.NewRunner(writeAuthExecutable(t, `#!/bin/sh
+if [ "$1" = "container" ]; then exit 0; fi
 printf '%s\n' '{"ready":false,"mode":"oidc","checks":[{"level":"error","code":"oidc_secret_missing","message":"A required OIDC or group catalog secret is unavailable."}]}'
 exit 1
 `))
@@ -187,6 +190,90 @@ func TestAuthCheckInteractiveForwardsOnlyTheValidatedDevicePrompt(t *testing.T)
 	assertAuthOneShotCommand(t, installation, calls[0], true)
 }

+func TestAuthCheckInteractiveStreamsOnlyASanitizedPromptBeforePollingCompletes(t *testing.T) {
+	installation := authInstallation(newAuthDirectory(t))
+	root := filepath.Dir(installation.EnvFile)
+	secretFile := filepath.Join(root, "prompt-secret")
+	if err := os.WriteFile(secretFile, []byte("prompt-secret-sentinel"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(installation.EnvFile, []byte("PROMPT_TOKEN_FILE="+secretFile+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	started := filepath.Join(root, "started")
+	release := filepath.Join(root, "release")
+	t.Setenv("THT_AUTH_STREAM_STARTED", started)
+	t.Setenv("THT_AUTH_STREAM_RELEASE", release)
+	runner := compose.NewRunner(writeAuthExecutable(t, `#!/bin/sh
+if [ "$1" = "container" ]; then exit 0; fi
+printf '%s\n' 'untrusted prompt-secret-sentinel child output' >&2
+printf '%s' 'Open https://issuer.example.test/device?token=' >&2
+printf '%s\n' 'prompt-secret-sentinel and enter code ABCD-EFGH' >&2
+: > "$THT_AUTH_STREAM_STARTED"
+while [ ! -f "$THT_AUTH_STREAM_RELEASE" ]; do sleep 0.01; done
+printf '%s\n' '{"ready":true,"mode":"oidc","checks":[{"level":"info","code":"auth_ready","message":"Authentication is ready."}]}'
+`))
+	var stdout bytes.Buffer
+	stderr := &synchronizedBuffer{}
+	done := make(chan int, 1)
+	go func() {
+		done <- RunWithRunner(context.Background(), installation, []string{"check", "--json", "--interactive"}, strings.NewReader(""), &stdout, stderr, runner)
+	}()
+
+	if !waitForFile(started, 5*time.Second) {
+		t.Fatal("interactive diagnostic did not start")
+	}
+	deadline := time.Now().Add(2 * time.Second)
+	streamed := false
+	for time.Now().Before(deadline) {
+		if stderr.String() == "Open https://issuer.example.test/device?token=[REDACTED] and enter code ABCD-EFGH\n" {
+			streamed = true
+			break
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	if err := os.WriteFile(release, []byte("release"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	select {
+	case code := <-done:
+		if code != 0 {
+			t.Fatalf("interactive auth check = %d, stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+		}
+	case <-time.After(5 * time.Second):
+		t.Fatal("interactive diagnostic did not finish")
+	}
+	if !streamed {
+		t.Fatalf("device prompt was not streamed before polling completed: stderr=%q", stderr.String())
+	}
+	if strings.Contains(stderr.String(), "prompt-secret-sentinel") || strings.Contains(stderr.String(), "untrusted") {
+		t.Fatalf("interactive auth leaked raw child stderr: %q", stderr.String())
+	}
+	if !json.Valid(stdout.Bytes()) {
+		t.Fatalf("interactive JSON stdout is not pristine: %q", stdout.String())
+	}
+}
+
+func TestDevicePromptGrammarRejectsUnboundedAmbiguousOrUnsafeLines(t *testing.T) {
+	valid := "Open https://issuer.example.test/device?tenant=one and enter code ABCD-EFGH"
+	if got := parseDevicePromptLine(valid); got != valid {
+		t.Fatalf("valid prompt = %q, want %q", got, valid)
+	}
+	for _, line := range []string{
+		"Open http://issuer.example.test/device and enter code ABCD-EFGH",
+		"Open https://user@issuer.example.test/device and enter code ABCD-EFGH",
+		"Open https://issuer.example.test/device#fragment and enter code ABCD-EFGH",
+		"Open https://issuer.example.test/device and enter code ABCD-EFGH and enter code IJKL-MNOP",
+		"Open https://issuer.example.test/device and enter code ABCD EFGH",
+		"Open https://issuer.example.test/device\r and enter code ABCD-EFGH",
+		"Open https://issuer.example.test/" + strings.Repeat("a", maxDevicePromptLineBytes) + " and enter code ABCD-EFGH",
+	} {
+		if prompt := parseDevicePromptLine(line); prompt != "" {
+			t.Fatalf("unsafe prompt accepted: %q", prompt)
+		}
+	}
+}
+
 func TestAuthCheckFailsBeforeExecutionWhenDeclaredSecretCorpusIsIncomplete(t *testing.T) {
 	installation := authInstallation(newAuthDirectory(t))
 	installation.EnvFile = filepath.Join(t.TempDir(), "operator.env")
@@ -201,13 +288,29 @@ func TestAuthCheckFailsBeforeExecutionWhenDeclaredSecretCorpusIsIncomplete(t *te
 	})
 	var stdout, stderr bytes.Buffer

-	code := RunWithRunner(context.Background(), installation, []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
+	code := RunWithRunner(context.Background(), installation, []string{"check", "--json", "--interactive"}, strings.NewReader(""), &stdout, &stderr, runner)

 	if code != 1 || calls != 0 || stdout.Len() != 0 || stderr.String() != "tht: authentication diagnostics could not be completed\n" {
 		t.Fatalf("incomplete corpus was not refused before execution: code=%d calls=%d stdout=%q stderr=%q", code, calls, stdout.String(), stderr.String())
 	}
 }

+func TestAuthCheckRejectsAValidReportWhenOneShotCleanupFails(t *testing.T) {
+	runner := runnerFunc(func(_ context.Context, _ []string, _ io.Reader) (compose.Result, error) {
+		return compose.Result{
+			Stdout:   `{"ready":true,"mode":"oidc","checks":[{"level":"info","code":"auth_ready","message":"Authentication is ready."}]}`,
+			ExitCode: 0,
+		}, compose.ErrContainerCleanup
+	})
+	var stdout, stderr bytes.Buffer
+
+	code := RunWithRunner(context.Background(), authInstallation(newAuthDirectory(t)), []string{"check", "--json"}, strings.NewReader(""), &stdout, &stderr, runner)
+
+	if code != 1 || stdout.Len() != 0 || stderr.String() != "tht: authentication diagnostics could not be completed\n" {
+		t.Fatalf("cleanup failure accepted: code=%d stdout=%q stderr=%q", code, stdout.String(), stderr.String())
+	}
+}
+
 func TestAuthCheckRedactsFailedCoreOutputAndRejectsMalformedReports(t *testing.T) {
 	installation := authInstallation(newAuthDirectory(t))
 	secretPath := filepath.Join(t.TempDir(), "auth-check-secret")
@@ -249,6 +352,34 @@ func (run runnerFunc) Run(ctx context.Context, args []string, input io.Reader) (
 	return run(ctx, args, input)
 }

+type synchronizedBuffer struct {
+	mu     sync.Mutex
+	buffer bytes.Buffer
+}
+
+func (b *synchronizedBuffer) Write(value []byte) (int, error) {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buffer.Write(value)
+}
+
+func (b *synchronizedBuffer) String() string {
+	b.mu.Lock()
+	defer b.mu.Unlock()
+	return b.buffer.String()
+}
+
+func waitForFile(path string, timeout time.Duration) bool {
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if _, err := os.Stat(path); err == nil {
+			return true
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	return false
+}
+
 func assertAuthOneShotCommand(t *testing.T, installation config.Installation, got []string, interactive bool) {
 	t.Helper()
 	prefix := installation.ComposeArgs("run", "--rm", "--no-deps", "--no-TTY", "--name")