feat: complete Epic 1 production foundation
This commit is contained in:
@@ -1,5 +1,14 @@
|
||||
use std::process::{Command, Output};
|
||||
|
||||
use crank_community_auth::{hash_password, verify_password};
|
||||
use crank_core::{Secret, SecretId, SecretKind, SecretStatus, UserSessionId, WorkspaceId};
|
||||
use crank_registry::{
|
||||
CreateSecretRequest, MASTER_KEY_CIPHER_CONTRACT, MasterKeyIdentityCandidate, PostgresRegistry,
|
||||
};
|
||||
use crank_runtime::SecretCrypto;
|
||||
use serde_json::json;
|
||||
use time::{Duration as TimeDuration, OffsetDateTime, format_description::well_known::Rfc3339};
|
||||
|
||||
fn command(arguments: &[&str], database_url: Option<&str>) -> Output {
|
||||
let mut command = Command::new(env!("CARGO_BIN_EXE_crank-migrate"));
|
||||
command.args(arguments);
|
||||
@@ -16,6 +25,10 @@ fn command(arguments: &[&str], database_url: Option<&str>) -> Output {
|
||||
command.output().expect("migration command must run")
|
||||
}
|
||||
|
||||
fn timestamp(value: &str) -> OffsetDateTime {
|
||||
OffsetDateTime::parse(value, &Rfc3339).unwrap()
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn plan_is_deterministic_and_committed_contract_is_current() {
|
||||
let first = command(&["plan"], None);
|
||||
@@ -27,7 +40,7 @@ fn plan_is_deterministic_and_committed_contract_is_current() {
|
||||
);
|
||||
assert_eq!(first.stdout, second.stdout);
|
||||
let plan: serde_json::Value = serde_json::from_slice(&first.stdout).unwrap();
|
||||
assert_eq!(plan["sequence"].as_array().unwrap().len(), 3);
|
||||
assert_eq!(plan["sequence"].as_array().unwrap().len(), 11);
|
||||
|
||||
let checked = command(&["plan", "--check"], None);
|
||||
assert!(
|
||||
@@ -69,7 +82,147 @@ async fn database_only_config_can_apply_and_preflight_a_fresh_schema() {
|
||||
);
|
||||
let result: serde_json::Value = serde_json::from_slice(&preflight.stdout).unwrap();
|
||||
assert_eq!(result["status"], "current");
|
||||
assert_eq!(result["version"], 3);
|
||||
assert_eq!(result["version"], 11);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn admin_auth_bootstrap_create_outputs_bootstrap_secret_without_service_secrets() {
|
||||
let database_url =
|
||||
crank_test_support::postgres_schema_url("test_migration_admin_auth_bootstrap").await;
|
||||
assert!(command(&["apply"], Some(&database_url)).status.success());
|
||||
|
||||
let created = command(
|
||||
&[
|
||||
"admin-auth",
|
||||
"bootstrap-create",
|
||||
"--email",
|
||||
"operator@example.local",
|
||||
"--display-name",
|
||||
"Local Operator",
|
||||
"--ttl-seconds",
|
||||
"900",
|
||||
],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(
|
||||
created.status.success(),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&created.stderr)
|
||||
);
|
||||
let payload: serde_json::Value = serde_json::from_slice(&created.stdout).unwrap();
|
||||
assert_eq!(payload["status"], "bootstrap_created");
|
||||
assert!(
|
||||
payload["contract_id"]
|
||||
.as_str()
|
||||
.unwrap()
|
||||
.starts_with("boot_")
|
||||
);
|
||||
assert!(payload["bootstrap_token"].as_str().unwrap().len() >= 32);
|
||||
let stdout = String::from_utf8(created.stdout).unwrap();
|
||||
assert!(!stdout.contains("CRANK_SESSION_SECRET"));
|
||||
assert!(!stdout.contains("CRANK_PASSWORD_PEPPER"));
|
||||
|
||||
let duplicate = command(
|
||||
&[
|
||||
"admin-auth",
|
||||
"bootstrap-create",
|
||||
"--email",
|
||||
"operator@example.local",
|
||||
],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(!duplicate.status.success());
|
||||
let diagnostic: serde_json::Value = serde_json::from_slice(&duplicate.stderr).unwrap();
|
||||
assert_eq!(diagnostic["code"], "admin_bootstrap_unavailable");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn admin_auth_recovery_requires_master_key_and_revokes_sessions_without_secret_output() {
|
||||
let database_url =
|
||||
crank_test_support::postgres_schema_url("test_migration_admin_auth_recovery").await;
|
||||
assert!(command(&["apply"], Some(&database_url)).status.success());
|
||||
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||
let now = timestamp("2026-08-21T00:00:00Z");
|
||||
let master_key = "recovery-master-key-CANARY_SECRET_VALUE-000000000";
|
||||
let crypto = SecretCrypto::new(master_key).unwrap();
|
||||
registry
|
||||
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||
epoch: crypto.master_key_epoch(),
|
||||
fingerprint: crypto.master_key_fingerprint(),
|
||||
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||
observed_at: &now,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let pepper = "recovery-pepper-CANARY_SECRET_VALUE";
|
||||
let old_password = "old-recovery-password-CANARY_SECRET_VALUE";
|
||||
let old_hash = hash_password(old_password, pepper).unwrap();
|
||||
let user_id = registry
|
||||
.upsert_bootstrap_user("recover@example.local", "Recover Operator", &old_hash)
|
||||
.await
|
||||
.unwrap();
|
||||
let session_id = UserSessionId::new("session_recovery_cli");
|
||||
registry
|
||||
.create_user_session(
|
||||
&session_id,
|
||||
&user_id,
|
||||
Some(&WorkspaceId::new("ws_default")),
|
||||
"session-secret-hash",
|
||||
None,
|
||||
&(OffsetDateTime::now_utc() + TimeDuration::hours(1)),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
|
||||
let key_dir =
|
||||
std::env::temp_dir().join(format!("crank-admin-auth-recovery-{}", std::process::id()));
|
||||
std::fs::create_dir_all(&key_dir).unwrap();
|
||||
let password_path = key_dir.join("new-password.txt");
|
||||
let pepper_path = key_dir.join("pepper.txt");
|
||||
let master_key_path = key_dir.join("master.key");
|
||||
let new_password = "new-recovery-password-CANARY_SECRET_VALUE";
|
||||
std::fs::write(&password_path, format!("{new_password}\n")).unwrap();
|
||||
std::fs::write(&pepper_path, format!("{pepper}\n")).unwrap();
|
||||
std::fs::write(&master_key_path, format!("{master_key}\n")).unwrap();
|
||||
|
||||
let recovered = command(
|
||||
&[
|
||||
"admin-auth",
|
||||
"recover",
|
||||
"--email",
|
||||
"recover@example.local",
|
||||
"--password-file",
|
||||
password_path.to_str().unwrap(),
|
||||
"--password-pepper-file",
|
||||
pepper_path.to_str().unwrap(),
|
||||
"--master-key-file",
|
||||
master_key_path.to_str().unwrap(),
|
||||
],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(
|
||||
recovered.status.success(),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&recovered.stderr)
|
||||
);
|
||||
let stdout = String::from_utf8(recovered.stdout).unwrap();
|
||||
assert!(stdout.contains("\"status\":\"admin_recovered\""));
|
||||
assert!(!stdout.contains("CANARY_SECRET_VALUE"));
|
||||
assert!(
|
||||
registry
|
||||
.get_user_session(&session_id, "session-secret-hash")
|
||||
.await
|
||||
.unwrap()
|
||||
.is_none()
|
||||
);
|
||||
let user = registry
|
||||
.get_auth_user_by_email("recover@example.local")
|
||||
.await
|
||||
.unwrap()
|
||||
.unwrap();
|
||||
assert!(verify_password(new_password, pepper, &user.password_hash));
|
||||
assert!(!verify_password(old_password, pepper, &user.password_hash));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
@@ -88,3 +241,197 @@ async fn migration_error_json_preserves_affected_version() {
|
||||
assert_eq!(diagnostic["code"], "checksum_mismatch");
|
||||
assert_eq!(diagnostic["version"], 2);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn master_key_rotation_command_is_resumable_and_redacted() {
|
||||
let database_url =
|
||||
crank_test_support::postgres_schema_url("test_master_key_rotation_cli").await;
|
||||
assert!(command(&["apply"], Some(&database_url)).status.success());
|
||||
let registry = PostgresRegistry::connect(&database_url).await.unwrap();
|
||||
let now = timestamp("2026-08-21T00:00:00Z");
|
||||
let current_key = "current-master-key-cli-canary-0000000000000000";
|
||||
let target_key = "target-master-key-cli-canary-00000000000000000";
|
||||
let current_crypto = SecretCrypto::new(current_key).unwrap();
|
||||
registry
|
||||
.verify_or_register_master_key_identity(MasterKeyIdentityCandidate {
|
||||
epoch: 1,
|
||||
fingerprint: current_crypto.master_key_fingerprint(),
|
||||
cipher_contract: MASTER_KEY_CIPHER_CONTRACT,
|
||||
observed_at: &now,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
insert_secret(®istry, "cli_secret_a", ¤t_crypto, &now).await;
|
||||
insert_secret(®istry, "cli_secret_b", ¤t_crypto, &now).await;
|
||||
|
||||
let key_dir =
|
||||
std::env::temp_dir().join(format!("crank-master-key-rotation-{}", std::process::id()));
|
||||
std::fs::create_dir_all(&key_dir).unwrap();
|
||||
let current_path = key_dir.join("current.key");
|
||||
let target_path = key_dir.join("target.key");
|
||||
std::fs::write(¤t_path, current_key).unwrap();
|
||||
std::fs::write(&target_path, target_key).unwrap();
|
||||
let current_path = current_path.to_string_lossy().to_string();
|
||||
let target_path = target_path.to_string_lossy().to_string();
|
||||
|
||||
let preflight = command(
|
||||
&[
|
||||
"master-key",
|
||||
"preflight",
|
||||
"--current-key-file",
|
||||
¤t_path,
|
||||
"--target-key-file",
|
||||
&target_path,
|
||||
"--backup-ref",
|
||||
"offline-backup-ref",
|
||||
],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(
|
||||
preflight.status.success(),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&preflight.stderr)
|
||||
);
|
||||
assert_redacted(&preflight, current_key, target_key);
|
||||
let preflight_json: serde_json::Value = serde_json::from_slice(&preflight.stdout).unwrap();
|
||||
assert_eq!(preflight_json["status"], "preflight_ok");
|
||||
assert_eq!(preflight_json["affected_secret_versions"], 2);
|
||||
assert!(
|
||||
registry
|
||||
.master_key_rotation_status()
|
||||
.await
|
||||
.unwrap()
|
||||
.rotations
|
||||
.is_empty()
|
||||
);
|
||||
|
||||
let partial = command(
|
||||
&[
|
||||
"master-key",
|
||||
"rotate",
|
||||
"--current-key-file",
|
||||
¤t_path,
|
||||
"--target-key-file",
|
||||
&target_path,
|
||||
"--backup-ref",
|
||||
"offline-backup-ref",
|
||||
"--max-versions",
|
||||
"1",
|
||||
],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(
|
||||
partial.status.success(),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&partial.stderr)
|
||||
);
|
||||
assert_redacted(&partial, current_key, target_key);
|
||||
let partial_json: serde_json::Value = serde_json::from_slice(&partial.stdout).unwrap();
|
||||
assert_eq!(partial_json["status"], "running");
|
||||
assert_eq!(partial_json["processed_secret_versions"], 1);
|
||||
|
||||
let resumed = command(
|
||||
&[
|
||||
"master-key",
|
||||
"rotate",
|
||||
"--current-key-file",
|
||||
¤t_path,
|
||||
"--target-key-file",
|
||||
&target_path,
|
||||
"--backup-ref",
|
||||
"offline-backup-ref",
|
||||
],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(
|
||||
resumed.status.success(),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&resumed.stderr)
|
||||
);
|
||||
let resumed_json: serde_json::Value = serde_json::from_slice(&resumed.stdout).unwrap();
|
||||
assert_eq!(resumed_json["status"], "verifying");
|
||||
assert_eq!(resumed_json["processed_secret_versions"], 2);
|
||||
|
||||
let verified = command(
|
||||
&["master-key", "verify", "--target-key-file", &target_path],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(
|
||||
verified.status.success(),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&verified.stderr)
|
||||
);
|
||||
let verified_json: serde_json::Value = serde_json::from_slice(&verified.stdout).unwrap();
|
||||
assert_eq!(verified_json["status"], "verified");
|
||||
|
||||
let promoted = command(
|
||||
&["master-key", "promote", "--target-key-file", &target_path],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(
|
||||
promoted.status.success(),
|
||||
"{}",
|
||||
String::from_utf8_lossy(&promoted.stderr)
|
||||
);
|
||||
assert_redacted(&promoted, current_key, target_key);
|
||||
let promoted_json: serde_json::Value = serde_json::from_slice(&promoted.stdout).unwrap();
|
||||
assert_eq!(promoted_json["status"], "promoted");
|
||||
assert_eq!(promoted_json["active_epoch"], 2);
|
||||
|
||||
let old_key_rejected = command(
|
||||
&[
|
||||
"master-key",
|
||||
"preflight",
|
||||
"--current-key-file",
|
||||
¤t_path,
|
||||
"--target-key-file",
|
||||
&target_path,
|
||||
],
|
||||
Some(&database_url),
|
||||
);
|
||||
assert!(!old_key_rejected.status.success());
|
||||
assert_redacted(&old_key_rejected, current_key, target_key);
|
||||
let diagnostic: serde_json::Value = serde_json::from_slice(&old_key_rejected.stderr).unwrap();
|
||||
assert_eq!(diagnostic["code"], "master_key_identity_mismatch");
|
||||
}
|
||||
|
||||
async fn insert_secret(
|
||||
registry: &PostgresRegistry,
|
||||
id: &str,
|
||||
crypto: &SecretCrypto,
|
||||
now: &OffsetDateTime,
|
||||
) {
|
||||
let ciphertext = crypto
|
||||
.encrypt(&json!({ "token": format!("{id}_value") }))
|
||||
.unwrap();
|
||||
let secret = Secret {
|
||||
id: SecretId::new(id),
|
||||
workspace_id: WorkspaceId::new("ws_default"),
|
||||
name: id.to_owned(),
|
||||
kind: SecretKind::Token,
|
||||
status: SecretStatus::Active,
|
||||
current_version: 1,
|
||||
created_at: *now,
|
||||
updated_at: *now,
|
||||
last_used_at: None,
|
||||
};
|
||||
registry
|
||||
.create_secret(CreateSecretRequest {
|
||||
secret: &secret,
|
||||
ciphertext: &ciphertext,
|
||||
key_version: crypto.key_version(),
|
||||
master_key_epoch: crypto.master_key_epoch(),
|
||||
created_by: None,
|
||||
})
|
||||
.await
|
||||
.unwrap();
|
||||
}
|
||||
|
||||
fn assert_redacted(output: &Output, current_key: &str, target_key: &str) {
|
||||
let stdout = String::from_utf8_lossy(&output.stdout);
|
||||
let stderr = String::from_utf8_lossy(&output.stderr);
|
||||
assert!(!stdout.contains(current_key));
|
||||
assert!(!stdout.contains(target_key));
|
||||
assert!(!stderr.contains(current_key));
|
||||
assert!(!stderr.contains(target_key));
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user