Add producer-owned authenticated Go decision client and validated Forgejo profile
Assistant: codex Assistant-Model: gpt-6.1-sol Assistant-Session: 01a14bfc-9643-7872-aa12-98326dcf25e7
This commit is contained in:
parent
d328a26010
commit
ca0cb75729
24 changed files with 2980 additions and 4 deletions
211
pkg/decisionpep/client_test.go
Normal file
211
pkg/decisionpep/client_test.go
Normal file
|
|
@ -0,0 +1,211 @@
|
|||
package decisionpep
|
||||
|
||||
import (
|
||||
"context"
|
||||
"crypto/ed25519"
|
||||
"crypto/rand"
|
||||
"crypto/x509"
|
||||
"crypto/x509/pkix"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"encoding/pem"
|
||||
"io"
|
||||
"math/big"
|
||||
"net/http"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/netkingdom/access-engine/internal/sign"
|
||||
"github.com/netkingdom/access-engine/pkg/api"
|
||||
)
|
||||
|
||||
type transportFunc func(*http.Request) (*http.Response, error)
|
||||
|
||||
func (f transportFunc) RoundTrip(r *http.Request) (*http.Response, error) { return f(r) }
|
||||
func testClient(t *testing.T) (*Client, ed25519.PrivateKey, time.Time) {
|
||||
t.Helper()
|
||||
pub, key, e := ed25519.GenerateKey(rand.Reader)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
now := time.Date(2026, 10, 18, 1, 2, 3, 0, time.UTC)
|
||||
dir := t.TempDir()
|
||||
cert, e := x509.CreateCertificate(rand.Reader, &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "test-only"}, NotBefore: now.Add(-time.Hour), NotAfter: now.Add(time.Hour), IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign}, &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "test-only"}, NotBefore: now.Add(-time.Hour), NotAfter: now.Add(time.Hour), IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign}, pub, key)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
ca := filepath.Join(dir, "ca.pem")
|
||||
token := filepath.Join(dir, "token")
|
||||
if e = os.WriteFile(ca, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: cert}), 0600); e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
if e = os.WriteFile(token, []byte("synthetic-caller-token"), 0600); e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
a := Admission{Endpoint: "https://pdp.invalid/v1/check", CAFile: ca, TokenFile: token, Keys: map[string]string{"test-key": base64.RawURLEncoding.EncodeToString(pub)}, Evaluator: "flex-auth/local", PolicyPackage: "forgejo.application-access", PolicyVersion: "v1", PolicyDigest: "sha256:" + strings.Repeat("1", 64), RegistryDigest: "sha256:" + strings.Repeat("2", 64), CallerPrincipal: "system:serviceaccount:test:forgejo", CallerAudience: "access-engine", MaxTTL: "30s", MaxClockSkew: "1s"}
|
||||
c, e := New(a)
|
||||
if e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
c.now = func() time.Time { return now }
|
||||
return c, key, now
|
||||
}
|
||||
func testRequest() api.CheckRequest {
|
||||
return api.CheckRequest{Tenant: "tenant:test", Subject: api.SubjectRef{ID: "subject:test", Type: api.SubjectType("Human"), Tenant: "tenant:test", Attributes: map[string]any{"groups": []string{"engineers"}}}, Action: "application.access", Resource: api.ResourceRef{ID: "application:forgejo", Type: "application", System: "forgejo", Tenant: "tenant:test"}, Context: map[string]any{"big": json.Number("9007199254740993"), "fraction": json.Number("0.123456789123456789")}}
|
||||
}
|
||||
func envelope(c *Client, r api.CheckRequest, key ed25519.PrivateKey, now time.Time) api.DecisionEnvelope {
|
||||
e := api.DecisionEnvelope{ID: "test-decision", RequestID: r.ID, Effect: api.DecisionEffectAllow, MatchedPolicyVersion: c.admission.PolicyVersion, Subject: r.Subject, Resource: r.Resource, Binding: api.NewDecisionBindingFor(r, r), Provenance: api.DecisionProvenance{Evaluator: c.admission.Evaluator, Mode: provenanceMode, PolicyPackage: c.admission.PolicyPackage, PolicyVersion: c.admission.PolicyVersion, PolicyPackageDigest: c.admission.PolicyDigest, RegistrySnapshotDigest: c.admission.RegistryDigest, Caller: &api.CallerProvenance{Mode: "enforce", Principal: c.admission.CallerPrincipal, Audience: c.admission.CallerAudience, NotAfter: now.Add(time.Minute).Format(time.RFC3339Nano)}}}
|
||||
api.CompleteDecision(&e, r, api.DecisionCompletion{AllowTTL: "10s", Now: now})
|
||||
if sign.Sign(&e, key, "test-key") != nil {
|
||||
panic("test sign")
|
||||
}
|
||||
return e
|
||||
}
|
||||
func respond(t *testing.T, c *Client, key ed25519.PrivateKey, now time.Time, mutate func(*api.DecisionEnvelope), resign bool) {
|
||||
t.Helper()
|
||||
c.http = &http.Client{Transport: transportFunc(func(req *http.Request) (*http.Response, error) {
|
||||
if req.Header.Get("Access-Engine-JSON-Profile") != JSONProfile {
|
||||
t.Fatal("missing lossless profile")
|
||||
}
|
||||
if req.Header.Get("Authorization") != "Bearer synthetic-caller-token" {
|
||||
t.Fatal("wrong synthetic caller token")
|
||||
}
|
||||
var r api.CheckRequest
|
||||
d := json.NewDecoder(req.Body)
|
||||
d.UseNumber()
|
||||
if d.Decode(&r) != nil {
|
||||
t.Fatal("request decode")
|
||||
}
|
||||
if r.Context["big"] != json.Number("9007199254740993") || r.Context["fraction"] != json.Number("0.123456789123456789") {
|
||||
t.Fatal("request numeric precision lost")
|
||||
}
|
||||
if len(r.Context[nonceKey].(string)) != 64 || r.ID != r.Context[nonceKey] {
|
||||
t.Fatal("nonce")
|
||||
}
|
||||
e := envelope(c, r, key, now)
|
||||
if mutate != nil {
|
||||
mutate(&e)
|
||||
}
|
||||
if resign {
|
||||
if sign.Sign(&e, key, "test-key") != nil {
|
||||
t.Fatal("sign")
|
||||
}
|
||||
}
|
||||
b, err := json.Marshal(e)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(string(b))), Header: http.Header{}}, nil
|
||||
})}
|
||||
}
|
||||
func TestAuthenticDecisionProducerCanonicalPrecision(t *testing.T) {
|
||||
c, key, now := testClient(t)
|
||||
respond(t, c, key, now, nil, false)
|
||||
e, err := c.Check(context.Background(), testRequest())
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if e.Binding.Context["big"] != json.Number("9007199254740993") || e.Binding.Context["fraction"] != json.Number("0.123456789123456789") {
|
||||
t.Fatal("signed typed precision lost")
|
||||
}
|
||||
if sign.Verify(e, c.keys) != nil {
|
||||
t.Fatal("returned envelope not authentic producer bytes")
|
||||
}
|
||||
}
|
||||
func TestDecisionAdverseBindings(t *testing.T) {
|
||||
cases := map[string]func(*api.DecisionEnvelope){
|
||||
"unsigned": func(e *api.DecisionEnvelope) { e.Signature = api.UnsignedEnvelopeSignature() },
|
||||
"effect": func(e *api.DecisionEnvelope) { e.Effect = api.DecisionEffectDeny },
|
||||
"evaluator": func(e *api.DecisionEnvelope) { e.Provenance.Evaluator = "impostor" },
|
||||
"policy": func(e *api.DecisionEnvelope) { e.Provenance.PolicyPackage = "other" },
|
||||
"version": func(e *api.DecisionEnvelope) { e.Provenance.PolicyVersion = "v2" },
|
||||
"policy-digest": func(e *api.DecisionEnvelope) { e.Provenance.PolicyPackageDigest = "sha256:" + strings.Repeat("3", 64) },
|
||||
"registry": func(e *api.DecisionEnvelope) {
|
||||
e.Provenance.RegistrySnapshotDigest = "sha256:" + strings.Repeat("4", 64)
|
||||
},
|
||||
"tenant": func(e *api.DecisionEnvelope) { e.Binding.Tenant = "other" },
|
||||
"actor": func(e *api.DecisionEnvelope) { e.Binding.Subject.ID = "other" },
|
||||
"action": func(e *api.DecisionEnvelope) { e.Binding.Action = "write" },
|
||||
"resource": func(e *api.DecisionEnvelope) { e.Binding.Resource.ID = "other" },
|
||||
"purpose": func(e *api.DecisionEnvelope) { e.Binding.Purpose = "readback" },
|
||||
"submitted": func(e *api.DecisionEnvelope) { e.Binding.SubmittedRequestDigest = "wrong" },
|
||||
"context": func(e *api.DecisionEnvelope) { e.Binding.Context["fraction"] = json.Number("0.123456789123456788") },
|
||||
"legacy-numeric-profile": func(e *api.DecisionEnvelope) { e.Provenance.Mode = "standalone" },
|
||||
"caller-warn": func(e *api.DecisionEnvelope) { e.Provenance.Caller.Mode = "warn" },
|
||||
"caller-principal": func(e *api.DecisionEnvelope) { e.Provenance.Caller.Principal = "other" },
|
||||
"caller-audience": func(e *api.DecisionEnvelope) { e.Provenance.Caller.Audience = "other" },
|
||||
"caller-expired": func(e *api.DecisionEnvelope) { e.Provenance.Caller.NotAfter = "2020-01-01T00:00:00Z" },
|
||||
"stale-decision": func(e *api.DecisionEnvelope) { e.Provenance.DecisionTime = "2020-01-01T00:00:00Z" },
|
||||
"expired": func(e *api.DecisionEnvelope) { e.Lifetime.ExpiresAt = "2020-01-01T00:00:00Z" },
|
||||
"future-begin": func(e *api.DecisionEnvelope) { e.Lifetime.NotBefore = "2030-01-01T00:00:00Z" },
|
||||
"subnanosecond-expiry": func(e *api.DecisionEnvelope) { e.Lifetime.ExpiresAt = "2026-10-18T01:02:02.999999999Z" },
|
||||
"missing-TTL": func(e *api.DecisionEnvelope) { e.Lifetime = nil },
|
||||
"excess-TTL": func(e *api.DecisionEnvelope) { e.Lifetime.TTL = "1h" },
|
||||
"obligation": func(e *api.DecisionEnvelope) { e.Obligations = []api.Obligation{{Type: "unimplemented"}} },
|
||||
}
|
||||
for name, mutation := range cases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
c, key, now := testClient(t)
|
||||
respond(t, c, key, now, mutation, name != "unsigned")
|
||||
if _, err := c.Check(context.Background(), testRequest()); err == nil {
|
||||
t.Fatal("accepted wrong signed binding")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
func TestSignatureForgeryAndReplay(t *testing.T) {
|
||||
t.Run("forged-payload", func(t *testing.T) {
|
||||
c, key, now := testClient(t)
|
||||
respond(t, c, key, now, func(e *api.DecisionEnvelope) { e.Reason = "changed after signature" }, false)
|
||||
if _, e := c.Check(context.Background(), testRequest()); e == nil {
|
||||
t.Fatal("forgery accepted")
|
||||
}
|
||||
})
|
||||
t.Run("wrong-key", func(t *testing.T) {
|
||||
c, _, now := testClient(t)
|
||||
_, key, _ := ed25519.GenerateKey(rand.Reader)
|
||||
respond(t, c, key, now, nil, false)
|
||||
if _, e := c.Check(context.Background(), testRequest()); e == nil {
|
||||
t.Fatal("wrong key accepted")
|
||||
}
|
||||
})
|
||||
t.Run("replay", func(t *testing.T) {
|
||||
c, key, now := testClient(t)
|
||||
var saved []byte
|
||||
c.http = &http.Client{Transport: transportFunc(func(req *http.Request) (*http.Response, error) {
|
||||
if saved == nil {
|
||||
var r api.CheckRequest
|
||||
d := json.NewDecoder(req.Body)
|
||||
d.UseNumber()
|
||||
if d.Decode(&r) != nil {
|
||||
t.Fatal("decode")
|
||||
}
|
||||
e := envelope(c, r, key, now)
|
||||
saved, _ = json.Marshal(e)
|
||||
}
|
||||
return &http.Response{StatusCode: 200, Body: io.NopCloser(strings.NewReader(string(saved)))}, nil
|
||||
})}
|
||||
if _, e := c.Check(context.Background(), testRequest()); e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
if _, e := c.Check(context.Background(), testRequest()); e == nil {
|
||||
t.Fatal("old decision replay accepted for new nonce")
|
||||
}
|
||||
})
|
||||
}
|
||||
func TestUnavailableAndPublicTokenFileRefuse(t *testing.T) {
|
||||
c, _, _ := testClient(t)
|
||||
c.http = &http.Client{Transport: transportFunc(func(*http.Request) (*http.Response, error) { return nil, io.ErrUnexpectedEOF })}
|
||||
if _, e := c.Check(context.Background(), testRequest()); e == nil {
|
||||
t.Fatal("unavailable allowed")
|
||||
}
|
||||
if e := os.Chmod(c.admission.TokenFile, 0644); e != nil {
|
||||
t.Fatal(e)
|
||||
}
|
||||
if _, e := c.Check(context.Background(), testRequest()); e == nil {
|
||||
t.Fatal("public token file allowed")
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue