internal/agent/state/hostkey_test.go

Ref: main v0.0.5   Size: 2.4 KiB   History

package state

import (
	"os"
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestLoadOrCreateHostKeyIsStableAndPrivate(t *testing.T) {
	s, err := Open(t.TempDir())
	require.NoError(t, err)
	path := s.HostKeyPath("vm1")

	first, err := LoadOrCreateHostKey(path)
	require.NoError(t, err)
	assert.Contains(t, first.PrivatePEM, "OPENSSH PRIVATE KEY")
	assert.True(t, strings.HasPrefix(first.PublicLine, "ssh-ed25519 "), "got %q", first.PublicLine)
	assert.NotContains(t, first.PublicLine, "\n", "an authorized_keys line is one line")

	fi, err := os.Stat(path)
	require.NoError(t, err)
	assert.Equal(t, os.FileMode(0o600), fi.Mode().Perm())

	// Load-or-create: the second call must return the key the first one wrote,
	// or a certificate signed for the first key would be for nothing.
	second, err := LoadOrCreateHostKey(path)
	require.NoError(t, err)
	assert.Equal(t, first, second)
}

func TestLoadOrCreateHostKeyIsPerVM(t *testing.T) {
	s, err := Open(t.TempDir())
	require.NoError(t, err)
	a, err := LoadOrCreateHostKey(s.HostKeyPath("vm1"))
	require.NoError(t, err)
	b, err := LoadOrCreateHostKey(s.HostKeyPath("vm2"))
	require.NoError(t, err)
	assert.NotEqual(t, a.PublicLine, b.PublicLine)
}

func TestLoadOrCreateHostKeyRefusesGarbage(t *testing.T) {
	s, err := Open(t.TempDir())
	require.NoError(t, err)
	path := s.HostKeyPath("vm1")
	require.NoError(t, os.MkdirAll(s.VMDir("vm1"), 0o700))
	require.NoError(t, os.WriteFile(path, []byte("not a key"), 0o600))

	_, err = LoadOrCreateHostKey(path)
	require.Error(t, err, "an unreadable key must be reported, never silently replaced")
}

func TestDeleteVMTakesTheHostKeyWithIt(t *testing.T) {
	s, err := Open(t.TempDir())
	require.NoError(t, err)
	require.NoError(t, s.SaveVM(Record{Spec: VMSpec{VMID: "vm1"}}))
	_, err = LoadOrCreateHostKey(s.HostKeyPath("vm1"))
	require.NoError(t, err)

	require.NoError(t, s.DeleteVM("vm1"))
	_, err = os.Stat(s.HostKeyPath("vm1"))
	assert.True(t, os.IsNotExist(err))
}

func TestHostPubKeyRoundTripsThroughARecord(t *testing.T) {
	s, err := Open(t.TempDir())
	require.NoError(t, err)
	hk, err := LoadOrCreateHostKey(s.HostKeyPath("vm1"))
	require.NoError(t, err)
	require.NoError(t, s.SaveVM(Record{Spec: VMSpec{VMID: "vm1"}, HostPubKey: hk.PublicLine}))

	rec, ok, err := s.Get("vm1")
	require.NoError(t, err)
	require.True(t, ok)
	assert.Equal(t, hk.PublicLine, rec.HostPubKey)
}