kyle
9444a35322
Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification is ignored. No 502. keys add writes the secret only to --out. Release binary has no -test-allow-prefix.
53 lines
1.1 KiB
Go
53 lines
1.1 KiB
Go
package auth
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestAddLookupRevoke(t *testing.T) {
|
|
dir := t.TempDir()
|
|
keys := filepath.Join(dir, "keys.toml")
|
|
out := filepath.Join(dir, "k")
|
|
if err := Add(keys, "talos", "hermes-fleet", out); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
st, err := os.Stat(out)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if st.Mode().Perm()&0o077 != 0 {
|
|
t.Fatalf("perms %v", st.Mode())
|
|
}
|
|
b, _ := os.ReadFile(out)
|
|
key := string(b)
|
|
if key[len(key)-1] == '\n' {
|
|
key = key[:len(key)-1]
|
|
}
|
|
s, err := Load(keys)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if s.LookupBearer(key) == nil || s.LookupBearer(key).Name != "talos" {
|
|
t.Fatal("lookup failed")
|
|
}
|
|
if s.LookupBearer("nope") != nil {
|
|
t.Fatal("unknown accepted")
|
|
}
|
|
if err := Add(keys, "x", "y", out); err == nil {
|
|
t.Fatal("overwrite allowed")
|
|
}
|
|
cs, err := List(keys)
|
|
if err != nil || len(cs) != 1 || cs[0].Name != "talos" {
|
|
t.Fatalf("%v %v", cs, err)
|
|
}
|
|
if err := Revoke(keys, "talos"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
s, _ = Load(keys)
|
|
if s.LookupBearer(key) != nil {
|
|
t.Fatal("revoked still valid")
|
|
}
|
|
}
|