f596e34b

Pin the delegate revocation cascade and cadir push validation

a73x 2026-08-18 17:33

Commit message

Pin the delegate revocation cascade and cadir push validation

Four behavioral tests confirm the revocation properties the spec
promises fall out of per-request re-reads and Task 2's push
validation, without any production change: dropping a cadir/ entry
or a person's keydir/ entry cuts off their delegates immediately (no
restart, no KRL), an expired certificate never authenticates, and a
settings push carrying a malformed cadir/ file is refused whole with
the previous config staying live. All four passed on first run.

stage_settings_with_cas wrote into a persistent settings-work tree
but only ever added files, so a second call describing fewer
keys/CAs than the first left the earlier ones on disk — the
revocation tests would have passed for the wrong reason (the removed
entry never actually left the tree). It now clears keydir/ and
cadir/ before writing, the way stage_keydir_only already clears
conf/, so each call describes the tree in full.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/common/mod.rs

Old		New
@@ -1307,6 +1307,12 @@ impl ServerHarness {
1307	self.root.path().join("settings-work")	1307	self.root.path().join("settings-work")
1308	}	1308	}
1309		1309
		1310	/// The settings working tree, for tests that stage a change by hand
		1311	/// rather than through one of the `stage_`/`bootstrap_` helpers.
		1312	pub fn settings_work_dir(&self) -> PathBuf {
		1313	self.settings_work()
		1314	}
		1315
1310	/// Create `settings.git` and a working tree for it, the way an init	1316	/// Create `settings.git` and a working tree for it, the way an init
1311	/// container would: over the filesystem, before the server is governed.	1317	/// container would: over the filesystem, before the server is governed.
1312	fn ensure_settings_repos(&self) {	1318	fn ensure_settings_repos(&self) {
@@ -1353,6 +1359,18 @@ impl ServerHarness {
1353	std::fs::create_dir_all(conf_path.parent().unwrap()).unwrap();	1359	std::fs::create_dir_all(conf_path.parent().unwrap()).unwrap();
1354	std::fs::write(&conf_path, access_conf).unwrap();	1360	std::fs::write(&conf_path, access_conf).unwrap();
1355		1361
		1362	// Clear both dirs first: this call describes the roster and the CA
		1363	// enrolment in full, so a key or CA dropped from the arguments
		1364	// must actually disappear from the tree, not just fail to be added.
		1365	let keydir = work.join("keydir");
		1366	if keydir.exists() {
		1367	std::fs::remove_dir_all(&keydir).unwrap();
		1368	}
		1369	let cadir = work.join("cadir");
		1370	if cadir.exists() {
		1371	std::fs::remove_dir_all(&cadir).unwrap();
		1372	}
		1373
1356	for (rel, key_name) in keys {	1374	for (rel, key_name) in keys {
1357	let dest = work.join("keydir").join(rel);	1375	let dest = work.join("keydir").join(rel);
1358	std::fs::create_dir_all(dest.parent().unwrap()).unwrap();	1376	std::fs::create_dir_all(dest.parent().unwrap()).unwrap();

tests/delegate_test.rs

+        "the repository must not exist after a refused create"
+    );
+/// Removing the CA enrolment kills the delegates it minted, on their next
+/// command — no restart, no KRL, and the cert itself is still inside its
+/// validity window.
+#[test]
+fn removing_the_cadir_entry_cuts_the_delegate_off() {
+    let harness = ServerHarness::new("delegate-revoke-ca");
+    harness.push_head();
+    harness.bootstrap_settings_with_cas(
+        &access_conf(harness.repo_name()),
+        &[("alex.pub", "alex")],
+        &[("mint/alex.pub", "mint")],
+    );
+    let agent_key = harness.named_key("agent-key");
+    let ca = harness.delegate_ca("mint");
+    let cert = harness.mint_cert(&ca, &agent_key, "claude-a", "alex", "-1m:+30m");
+    let before = harness.ssh_fetch_cert(
+        harness.work_repo().dir.path(),
+        &agent_key,
+        &cert,
+        harness.repo_name(),
+    );
+    assert!(
+        before.status.success(),
+        "delegate should work before revocation"
+    );
+    // Re-bootstrap with the cadir entry gone: same conf, same keys, no CAs.
+    harness.bootstrap_settings_with_cas(
+        &access_conf(harness.repo_name()),
+        &[("alex.pub", "alex")],
+        &[],
+    );
+    let after = harness.ssh_fetch_cert(
+        harness.work_repo().dir.path(),
+        &agent_key,
+        &cert,
+        harness.repo_name(),
+    );
+    assert!(
+        !after.status.success(),
+        "the delegate outlived its CA enrolment"
+    );
+}
+/// Removing the person kills the person's delegates: cadir/ lends identity,
+/// keydir/ is what makes it exist.
+#[test]
+fn removing_the_person_kills_their_delegates() {
+    let harness = ServerHarness::new("delegate-revoke-person");
+    harness.push_head();
+    // Two people, so removing bob leaves a valid config (alex retains RW+ on
+    // settings — the lockout check requires someone does).
+    let conf = format!(
+        "repo settings\n    RW+ = alex\n\nrepo {}\n    RW+ = alex\n    RW+ = bob\n",
+        harness.repo_name()
+    );
+    harness.bootstrap_settings_with_cas(
+        &conf,
+        &[("alex.pub", "alex"), ("bob.pub", "bob")],
+        &[("mint/bob.pub", "mint")],
+    );
+    let agent_key = harness.named_key("agent-key");
+    let ca = harness.delegate_ca("mint");
+    let cert = harness.mint_cert(&ca, &agent_key, "bob-agent", "bob", "-1m:+30m");
+    let before = harness.ssh_fetch_cert(
+        harness.work_repo().dir.path(),
+        &agent_key,
+        &cert,
+        harness.repo_name(),
+    );
+    assert!(
+        before.status.success(),
+        "bob's delegate should work while bob exists"
+    );
+    // bob leaves; his cadir entry remains — and must grant nothing.
+    harness.bootstrap_settings_with_cas(
+        &conf,
+        &[("alex.pub", "alex")],
+        &[("mint/bob.pub", "mint")],
+    );
+    let after = harness.ssh_fetch_cert(
+        harness.work_repo().dir.path(),
+        &agent_key,
+        &cert,
+        harness.repo_name(),
+    );
+    assert!(!after.status.success(), "a delegate outlived its person");
+}
+/// An expired certificate is rejected at the door.
+#[test]
+fn an_expired_certificate_does_not_authenticate() {
+    let harness = ServerHarness::new("delegate-expired");
+    harness.push_head();
+    harness.bootstrap_settings_with_cas(
+        &access_conf(harness.repo_name()),
+        &[("alex.pub", "alex")],
+        &[("mint/alex.pub", "mint")],
+    );
+    let agent_key = harness.named_key("agent-key");
+    let ca = harness.delegate_ca("mint");
+    let cert = harness.mint_cert(&ca, &agent_key, "claude-a", "alex", "-30m:-1m");
+    let out = harness.ssh_fetch_cert(
+        harness.work_repo().dir.path(),
+        &agent_key,
+        &cert,
+        harness.repo_name(),
+    );
+    assert!(
+        !out.status.success(),
+        "an expired certificate authenticated"
+    );
+}
+/// A settings push carrying a malformed cadir/ file is refused whole; the
+/// previous config keeps governing.
+#[test]
+fn a_malformed_cadir_file_rejects_the_settings_push() {
+    let harness = ServerHarness::new("delegate-bad-cadir");
+    harness.push_head();
+    harness.bootstrap_settings_with_cas(
+        &access_conf(harness.repo_name()),
+        &[("alex.pub", "alex")],
+        &[("mint/alex.pub", "mint")],
+    );
+    // Stage a broken CA file in the settings work tree and push over SSH.
+    let work = harness.settings_work_dir();
+    std::fs::write(work.join("cadir").join("junk.pub"), "not a key").unwrap();
+    common::git_cmd(&work, &["add", "-A"]);
+    common::git_cmd(&work, &["commit", "-q", "-m", "break cadir"]);
+    let push = harness.push_settings_over_ssh(&harness.named_key("alex"));
+    assert!(
+        !push.status.success(),
+        "a malformed cadir file was accepted"
+    );
+    assert!(
+        stderr(&push).contains("junk.pub"),
+        "the refusal should name the file, got: {}",
+        stderr(&push)
+    );
+}