34 lines
1.4 KiB
Rust
34 lines
1.4 KiB
Rust
//! Master-key startup checks use only temporary host storage and synthetic keys.
|
|
use sausage::cred::{Caller, Cred};
|
|
use std::os::unix::fs::PermissionsExt;
|
|
#[test]
|
|
fn missing_key_in_populated_store_is_not_replaced() {
|
|
let dir = tempfile::tempdir().unwrap();
|
|
let c = Cred::open(dir.path()).unwrap();
|
|
c.create_item(serde_json::from_value(serde_json::json!({"name":"stored","rules":[],"validate_js":null,"transform_js":"","fields":[]})).unwrap(), &Caller::default(), c.unlocked().unwrap()).unwrap();
|
|
drop(c);
|
|
std::fs::remove_file(dir.path().join("cred.key")).unwrap();
|
|
assert!(Cred::open(dir.path()).is_err());
|
|
assert!(!dir.path().join("cred.key").exists());
|
|
}
|
|
#[test]
|
|
fn wrong_master_key_fails_at_open_even_without_secret_fields() {
|
|
let dir = tempfile::tempdir().unwrap();
|
|
drop(Cred::open(dir.path()).unwrap());
|
|
std::fs::write(dir.path().join("cred.key"), [7u8; 32]).unwrap();
|
|
assert!(Cred::open(dir.path()).is_err());
|
|
}
|
|
#[test]
|
|
fn permissive_key_is_refused_and_new_host_directory_is_private() {
|
|
let dir = tempfile::tempdir().unwrap();
|
|
let host = dir.path().join("host");
|
|
drop(Cred::open(&host).unwrap());
|
|
assert_eq!(
|
|
std::fs::metadata(&host).unwrap().permissions().mode() & 0o777,
|
|
0o700
|
|
);
|
|
let key = host.join("cred.key");
|
|
std::fs::set_permissions(&key, std::fs::Permissions::from_mode(0o644)).unwrap();
|
|
assert!(Cred::open(&host).is_err());
|
|
}
|