-
Notifications
You must be signed in to change notification settings - Fork 228
Expand file tree
/
Copy pathssh-env.test.mjs
More file actions
102 lines (94 loc) · 3.6 KB
/
Copy pathssh-env.test.mjs
File metadata and controls
102 lines (94 loc) · 3.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
import assert from "node:assert/strict";
import test from "node:test";
import { EnvFile } from "./lib/env-file.mjs";
import { ensureSshEnv } from "./lib/ssh-env.mjs";
// NOTE: that the minted TERMINATOR_HOST_KEY actually parses with ssh2 (which
// rejects PKCS#8 ed25519 — the whole reason for the openssh-key-v1 encoder)
// is cross-checked in apps/ssh-terminator's vitest, where ssh2 is a dep and
// the real terminator handshake exercises it.
let counter = 0;
// A path that does not exist → EnvFile starts empty; we never save it.
const inMemoryEnv = () =>
new EnvFile(`/tmp/ssh-env-test-${process.pid}-${(counter += 1)}.env`, {
label: "test",
});
test("provisions the full coupled set on a fresh env (with an explicit port)", () => {
const env = inMemoryEnv();
const minted = ensureSshEnv(env, {}, {
hostname: "host.example",
sshPort: "10257",
});
assert.deepEqual(
[...minted].sort(),
[
"SSH_CA_PRIVATE_KEY",
"SSH_HOST",
"SSH_PORT",
"TERMINATOR_CA_PUBLIC_KEY",
"TERMINATOR_HOST_KEY",
].sort(),
);
assert.match(env.get("SSH_CA_PRIVATE_KEY"), /BEGIN PRIVATE KEY/);
assert.match(env.get("TERMINATOR_HOST_KEY"), /BEGIN OPENSSH PRIVATE KEY/);
assert.match(env.get("TERMINATOR_CA_PUBLIC_KEY"), /^ssh-ed25519 /);
assert.equal(env.get("SSH_HOST"), "host.example");
assert.equal(env.get("SSH_PORT"), "10257");
});
test("omits SSH_PORT when no port is given (the compose doors' single-knob law)", () => {
const env = inMemoryEnv();
const minted = ensureSshEnv(env, {}, { hostname: "host.example" });
assert.ok(!minted.includes("SSH_PORT"));
assert.equal(env.get("SSH_PORT"), undefined);
});
test("is idempotent — an existing value is never rewritten", () => {
const env = inMemoryEnv();
ensureSshEnv(env, {}, { hostname: "host.example" });
const firstCa = env.get("SSH_CA_PRIVATE_KEY");
const firstHost = env.get("SSH_HOST");
// Second pass over the now-populated env mints nothing.
const resolved = {
SSH_CA_PRIVATE_KEY: firstCa,
TERMINATOR_CA_PUBLIC_KEY: env.get("TERMINATOR_CA_PUBLIC_KEY"),
TERMINATOR_HOST_KEY: env.get("TERMINATOR_HOST_KEY"),
SSH_HOST: firstHost,
SSH_PORT: env.get("SSH_PORT"),
};
const minted = ensureSshEnv(env, resolved, { hostname: "other.example" });
assert.deepEqual(minted, []);
assert.equal(env.get("SSH_CA_PRIVATE_KEY"), firstCa);
assert.equal(env.get("SSH_HOST"), firstHost);
});
test("re-derives only the public line when just the private key exists", () => {
const env = inMemoryEnv();
// Seed a real CA private key, everything else absent.
ensureSshEnv(env, {}, { hostname: "host.example" });
const ca = env.get("SSH_CA_PRIVATE_KEY");
const fresh = inMemoryEnv();
const minted = ensureSshEnv(
fresh,
{ SSH_CA_PRIVATE_KEY: ca },
{ hostname: "host.example" },
);
assert.ok(minted.includes("TERMINATOR_CA_PUBLIC_KEY"));
assert.ok(!minted.includes("SSH_CA_PRIVATE_KEY"));
// The derived line matches the one the first pass produced from the same key.
assert.equal(
fresh.get("TERMINATOR_CA_PUBLIC_KEY"),
env.get("TERMINATOR_CA_PUBLIC_KEY"),
);
});
test("no-ops entirely on the cloud edition (never shadows KMS)", () => {
const env = inMemoryEnv();
const minted = ensureSshEnv(env, { EDITION: "cloud" }, { hostname: "h" });
assert.deepEqual(minted, []);
assert.equal(env.get("SSH_CA_PRIVATE_KEY"), undefined);
});
test("a shell-set value shadows generation", () => {
const env = inMemoryEnv();
const minted = ensureSshEnv(
env,
{ SSH_HOST: "operator-set.example" },
{ hostname: "derived.example" },
);
assert.ok(!minted.includes("SSH_HOST"));
});