init

2026-08-26 09:56:43 +08:00
parent 2b4974b561
commit 8e02a316fa
93 changed files with 21749 additions and 0 deletions
@@ -0,0 +1,141 @@
+package config
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadPackageConfigAppliesServerScopedIdentity(t *testing.T) {
+	path := writePackageConfig(t, PackageConfig{
+		Kind:             PackageComponentRun,
+		ServerInstanceID: "server-1",
+		PluginID:         "game.minecraft",
+		RunEndpointID:    "run-server-1",
+		TargetOS:         "linux",
+		TargetArch:       "amd64",
+		SecretRef:        "secret://runtime-keys/server-1/run/current",
+		KeyGeneration:    3,
+		AuthKey:          "opaque-runtime-key",
+	})
+
+	pkg, err := LoadPackageConfig(path)
+	if err != nil {
+		t.Fatalf("load package config: %v", err)
+	}
+	cfg := ApplyPackageConfig(Config{RunEndpointID: DefaultEndpointID, DisplayName: DefaultDisplayName}, pkg)
+	if cfg.RegistrationToken != "opaque-runtime-key" || cfg.RunEndpointID != "run-server-1" || cfg.ServerInstanceID != "server-1" || cfg.KeyGeneration != 3 {
+		t.Fatalf("expected package identity to be applied, got %+v", cfg)
+	}
+	diagnostics := pkg.RedactedDiagnostics()
+	for _, value := range diagnostics {
+		if strings.Contains(value, "opaque-runtime-key") || strings.Contains(value, "/Users/") || strings.Contains(value, "password=") {
+			t.Fatalf("diagnostics exposed sensitive value: %+v", diagnostics)
+		}
+	}
+	if diagnostics["keyFingerprint"] == "" || diagnostics["secretRef"] != "secret://runtime-keys/server-1/run/current" {
+		t.Fatalf("expected redacted key fingerprint and secret ref, got %+v", diagnostics)
+	}
+}
+
+func TestLoadPackageConfigRejectsUnsafeOrIncompletePackages(t *testing.T) {
+	valid := PackageConfig{
+		Kind:             PackageComponentRun,
+		ServerInstanceID: "server-1",
+		PluginID:         "game.scum",
+		TargetOS:         "windows",
+		TargetArch:       "amd64",
+		SecretRef:        "secret://runtime-keys/server-1/run/current",
+		KeyGeneration:    1,
+		AuthKey:          "opaque-runtime-key",
+	}
+	cases := map[string]func(PackageConfig) PackageConfig{
+		"old zero generation": func(cfg PackageConfig) PackageConfig { cfg.KeyGeneration = 0; return cfg },
+		"raw path":            func(cfg PackageConfig) PackageConfig { cfg.ServerInstanceID = "/Users/tasia/server"; return cfg },
+		"socket":              func(cfg PackageConfig) PackageConfig { cfg.SecretRef = "unix:///tmp/run.sock"; return cfg },
+		"secret auth":         func(cfg PackageConfig) PackageConfig { cfg.AuthKey = "password=raw"; return cfg },
+		"client missing key":  func(cfg PackageConfig) PackageConfig { cfg.Kind = PackageComponentClientManager; return cfg },
+	}
+	for name, mutate := range cases {
+		if err := ValidatePackageConfig(mutate(valid)); err == nil {
+			t.Fatalf("expected %s package to be rejected", name)
+		}
+	}
+}
+
+func TestAuthenticatePackageGenerationRejectsStalePackages(t *testing.T) {
+	pkg := PackageConfig{
+		Kind:             PackageComponentRun,
+		ServerInstanceID: "server-1",
+		PluginID:         "game.minecraft",
+		TargetOS:         "linux",
+		TargetArch:       "amd64",
+		SecretRef:        "secret://runtime-keys/server-1/run/current",
+		KeyGeneration:    1,
+		AuthKey:          "opaque-runtime-key",
+	}
+	err := AuthenticatePackageGeneration(pkg, ComponentAuthResult{
+		ServerInstanceID: "server-1",
+		Kind:             PackageComponentRun,
+		KeyGeneration:    2,
+		Allowed:          true,
+		Reason:           "current key accepted",
+	})
+	if err == nil || !strings.Contains(err.Error(), "generation") {
+		t.Fatalf("expected stale generation rejection, got %v", err)
+	}
+	err = AuthenticatePackageGeneration(pkg, ComponentAuthResult{
+		ServerInstanceID: "server-1",
+		Kind:             PackageComponentRun,
+		KeyGeneration:    1,
+		Allowed:          true,
+		Reason:           "current key accepted",
+	})
+	if err != nil {
+		t.Fatalf("expected current generation to authenticate: %v", err)
+	}
+}
+
+func TestLoadPackageConfigFromEnv(t *testing.T) {
+	path := writePackageConfig(t, PackageConfig{
+		Kind:             PackageComponentClientManager,
+		ServerInstanceID: "server-1",
+		PluginID:         "game.scum",
+		ProfileKey:       "scum-client-manager",
+		TargetOS:         "windows",
+		TargetArch:       "amd64",
+		SecretRef:        "secret://runtime-keys/server-1/client-manager/scum-client-manager/current",
+		KeyGeneration:    4,
+		AuthKey:          "opaque-client-key",
+	})
+	t.Setenv(PackageConfigEnv, path)
+
+	cfg, ok, err := LoadPackageConfigFromEnv()
+	if err != nil || !ok {
+		t.Fatalf("expected env package config, ok=%v err=%v", ok, err)
+	}
+	if cfg.Kind != PackageComponentClientManager || cfg.ProfileKey != "scum-client-manager" {
+		t.Fatalf("unexpected package config: %+v", cfg)
+	}
+
+	t.Setenv(PackageConfigEnv, "")
+	_, ok, err = LoadPackageConfigFromEnv()
+	if err != nil || ok {
+		t.Fatalf("expected no env package config, ok=%v err=%v", ok, err)
+	}
+}
+
+func writePackageConfig(t *testing.T, cfg PackageConfig) string {
+	t.Helper()
+	body, err := json.Marshal(cfg)
+	if err != nil {
+		t.Fatalf("marshal package config: %v", err)
+	}
+	path := filepath.Join(t.TempDir(), "run-package.json")
+	if err := os.WriteFile(path, body, 0o600); err != nil {
+		t.Fatalf("write package config: %v", err)
+	}
+	return path
+}