1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
|
//! Tests for storage layers that already exist. These must PASS.
use std::path::PathBuf;
use zagan_bet::client::database as client_database;
use zagan_bet::server::database as server_database;
fn tmp_db(name: &str) -> (String, rusqlite::Connection) {
let path = PathBuf::from(env!("CARGO_TARGET_TMPDIR"))
.join(format!("storage-{name}.db"))
.to_string_lossy()
.into_owned();
let _ = std::fs::remove_file(&path);
let conn = rusqlite::Connection::open(&path).unwrap();
(path, conn)
}
#[test]
fn client_credentials_roundtrip() {
let (_, conn) = tmp_db("creds");
client_database::init_db(&conn);
let identity = "5a15c712230831cb";
assert_eq!(client_database::get_credentials(&conn, identity), None);
client_database::save_credentials(&conn, identity, "alice", "pw").unwrap();
assert_eq!(
client_database::get_credentials(&conn, identity),
Some(("alice".to_string(), "pw".to_string()))
);
// Overwrite works.
client_database::save_credentials(&conn, identity, "alice", "pw2").unwrap();
assert_eq!(
client_database::get_credentials(&conn, identity),
Some(("alice".to_string(), "pw2".to_string()))
);
}
#[test]
fn credentials_belong_to_the_certificate_not_the_address() {
let (_, conn) = tmp_db("creds-identity");
client_database::init_db(&conn);
// Two addresses for one server, one address for another.
client_database::save_host(&conn, "10.0.0.100:11525");
client_database::save_host(&conn, "127.0.0.1:11525");
client_database::save_host(&conn, "other.example:11525");
client_database::save_fingerprint(&conn, "10.0.0.100:11525", "server-a").unwrap();
client_database::save_fingerprint(&conn, "127.0.0.1:11525", "server-a").unwrap();
client_database::save_fingerprint(&conn, "other.example:11525", "server-b").unwrap();
client_database::save_credentials(&conn, "server-a", "alice", "pw").unwrap();
assert_eq!(
client_database::get_credentials(&conn, "server-a"),
Some(("alice".to_string(), "pw".to_string())),
"one login covers every address with the same key"
);
assert_eq!(
client_database::get_credentials(&conn, "server-b"),
None,
"a different key must not inherit the credentials"
);
}
#[test]
fn forgetting_one_address_keeps_the_shared_credentials() {
let (_, conn) = tmp_db("creds-forget");
client_database::init_db(&conn);
client_database::save_host(&conn, "10.0.0.100:11525");
client_database::save_host(&conn, "127.0.0.1:11525");
client_database::save_fingerprint(&conn, "10.0.0.100:11525", "server-a").unwrap();
client_database::save_fingerprint(&conn, "127.0.0.1:11525", "server-a").unwrap();
client_database::save_credentials(&conn, "server-a", "alice", "pw").unwrap();
let outcome = client_database::forget_host(&conn, "10.0.0.100:11525").unwrap();
assert!(!outcome.credentials_removed);
assert_eq!(outcome.siblings, vec!["127.0.0.1:11525".to_string()]);
assert_eq!(
client_database::get_credentials(&conn, "server-a"),
Some(("alice".to_string(), "pw".to_string())),
"the server is still reachable, so the login is still useful"
);
let outcome = client_database::forget_host(&conn, "127.0.0.1:11525").unwrap();
assert!(outcome.credentials_removed);
assert!(outcome.siblings.is_empty());
assert_eq!(client_database::get_credentials(&conn, "server-a"), None);
}
#[test]
fn legacy_host_keyed_credentials_are_rekeyed_by_fingerprint() {
let (_, conn) = tmp_db("creds-migrate");
conn.execute_batch(
"CREATE TABLE hosts (
host TEXT PRIMARY KEY,
last_used DATETIME DEFAULT CURRENT_TIMESTAMP,
fingerprint TEXT
);
CREATE TABLE credentials (
host TEXT PRIMARY KEY,
username TEXT NOT NULL,
password TEXT NOT NULL
);
INSERT INTO hosts (host, last_used, fingerprint)
VALUES ('a:1', '2020-01-01 00:00:00', 'server-a');
INSERT INTO hosts (host, last_used, fingerprint)
VALUES ('b:2', '2021-01-01 00:00:00', 'server-a');
INSERT INTO hosts (host, last_used, fingerprint)
VALUES ('c:3', '2022-01-01 00:00:00', NULL);
INSERT INTO credentials VALUES ('a:1', 'alice', 'old');
INSERT INTO credentials VALUES ('b:2', 'alice', 'recent');
INSERT INTO credentials VALUES ('c:3', 'carol', 'untrusted');",
)
.unwrap();
client_database::init_db(&conn);
assert_eq!(
client_database::get_credentials(&conn, "server-a"),
Some(("alice".to_string(), "recent".to_string())),
"the most recently used address wins when legacy rows disagree"
);
assert_eq!(
client_database::get_credentials(&conn, "carol"),
None,
"a host with no trusted key cannot be re-keyed"
);
// The old table is gone: the column set is the fingerprint schema.
let mut statement = conn.prepare("PRAGMA table_info(credentials)").unwrap();
let columns: Vec<String> = statement
.query_map([], |row| row.get(1))
.unwrap()
.filter_map(|row| row.ok())
.collect();
assert_eq!(columns, vec!["fingerprint", "username", "password"]);
}
#[test]
fn client_last_host_tracking() {
let (_, conn) = tmp_db("hosts");
client_database::init_db(&conn);
assert_eq!(client_database::get_last_host(&conn), None);
client_database::save_host(&conn, "example.com:9000");
assert_eq!(
client_database::get_last_host(&conn),
Some("example.com:9000".to_string())
);
}
#[test]
fn server_user_registration_and_auth_lookup() {
let (_, conn) = tmp_db("users");
server_database::init_db(&conn);
server_database::add_user(&conn, "bob", "cafebabe").unwrap();
assert_eq!(
server_database::get_hashed_password(&conn, "bob"),
Some("cafebabe".to_string())
);
assert_eq!(server_database::get_hashed_password(&conn, "nobody"), None);
}
|
