tegwick
ec21518e25
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
64 lines
2.1 KiB
Go
64 lines
2.1 KiB
Go
package decision_test
|
|
|
|
import (
|
|
"context"
|
|
"crypto/ed25519"
|
|
"path/filepath"
|
|
"reflect"
|
|
"testing"
|
|
|
|
"github.com/netkingdom/access-engine/internal/sign"
|
|
"github.com/netkingdom/access-engine/pkg/api"
|
|
)
|
|
|
|
type signingRecorder struct{ records []api.DecisionEnvelope }
|
|
|
|
func (r *signingRecorder) Append(e api.DecisionEnvelope) error {
|
|
r.records = append(r.records, e)
|
|
return nil
|
|
}
|
|
|
|
func TestSignerAuthenticatesReturnedAndRecordedEnvelope(t *testing.T) {
|
|
engine := newTestEngine(t)
|
|
var request api.CheckRequest
|
|
loadYAML(t, filepath.Join("..", "..", "examples", "caring", "check_request.yaml"), &request)
|
|
unsigned, err := engine.Check(context.Background(), request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Synthetic deterministic seed only; no estate credential is read.
|
|
key := ed25519.NewKeyFromSeed(make([]byte, ed25519.SeedSize))
|
|
public := append(ed25519.PublicKey(nil), key.Public().(ed25519.PublicKey)...)
|
|
if err := engine.SetEnvelopeSigningKey(key, "synthetic-current"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
key[0] ^= 1 // Setter must not retain the caller's mutable key slice.
|
|
recorder := &signingRecorder{}
|
|
engine.SetDecisionLog(recorder)
|
|
signed, err := engine.Check(context.Background(), request)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := sign.Verify(signed, map[string]ed25519.PublicKey{"synthetic-current": public}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(recorder.records) != 1 || !reflect.DeepEqual(signed, recorder.records[0]) {
|
|
t.Fatal("recorded envelope differs from authenticated return")
|
|
}
|
|
if signed.Binding.RequestDigest != unsigned.Binding.RequestDigest {
|
|
t.Fatal("signing changed request digest")
|
|
}
|
|
signed.Provenance.PolicyVersion = "altered"
|
|
if sign.Verify(signed, map[string]ed25519.PublicKey{"synthetic-current": public}) == nil {
|
|
t.Fatal("altered provenance verified")
|
|
}
|
|
}
|
|
func TestSignerRejectsInvalidConfiguration(t *testing.T) {
|
|
engine := newTestEngine(t)
|
|
if engine.SetEnvelopeSigningKey(nil, "kid") == nil {
|
|
t.Fatal("missing key accepted")
|
|
}
|
|
if engine.SetEnvelopeSigningKey(ed25519.NewKeyFromSeed(make([]byte, 32)), "") == nil {
|
|
t.Fatal("missing kid accepted")
|
|
}
|
|
}
|