feat(mesh): per-cluster PSK provider + central interceptor
This commit is contained in:
Joseph Doherty
+239
@@ -0,0 +1,239 @@
|
||||
using System.Diagnostics.CodeAnalysis;
|
||||
using Grpc.Core;
|
||||
using Microsoft.Extensions.Logging.Abstractions;
|
||||
using Shouldly;
|
||||
using Xunit;
|
||||
using ZB.MOM.WW.OtOpcUa.ControlPlane.Communication;
|
||||
using ZB.MOM.WW.OtOpcUa.Host.Configuration;
|
||||
|
||||
namespace ZB.MOM.WW.OtOpcUa.Host.Tests.Configuration;
|
||||
|
||||
/// <summary>
|
||||
/// ClusterClient→gRPC Phase 0 — the central-side ack endpoint's inbound gate. Mapping
|
||||
/// <c>CentralCommandService</c> onto the pipeline is a Phase 1 task; this test covers only the
|
||||
/// interceptor's own authorization behavior.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Differs from <see cref="MeshCommandAuthInterceptor"/> in the one way central differs from a
|
||||
/// node: there is no single expected key. The caller names its cluster in
|
||||
/// <c>x-otopcua-cluster</c>, the bearer is verified against <i>that</i> cluster's PSK, and a
|
||||
/// cluster with no resolvable key is denied — so a caller cannot pick a cluster to be graded
|
||||
/// against, only claim one it must then prove.
|
||||
/// </remarks>
|
||||
public sealed class CentralCommandAuthInterceptorTests
|
||||
{
|
||||
private const string ReportApplyMethod = "/mesh_transport.v1.CentralCommandService/ReportApply";
|
||||
private const string OtherMethod = "/deployment_artifact.v1.DeploymentArtifactService/Fetch";
|
||||
|
||||
private static CentralCommandAuthInterceptor CreateInterceptor(params (string Cluster, string Psk)[] keys)
|
||||
=> new(new FakeMeshPskProvider(keys), NullLogger<CentralCommandAuthInterceptor>.Instance);
|
||||
|
||||
private static ServerCallContext CreateContext(
|
||||
string method, string? authorizationHeader, string? clusterHeader)
|
||||
{
|
||||
var headers = new Metadata();
|
||||
if (authorizationHeader is not null)
|
||||
headers.Add("authorization", authorizationHeader);
|
||||
if (clusterHeader is not null)
|
||||
headers.Add("x-otopcua-cluster", clusterHeader);
|
||||
|
||||
return new FakeServerCallContext(method, headers);
|
||||
}
|
||||
|
||||
/// <summary>Invokes the interceptor's unary path (how <c>ReportApply</c> actually runs).</summary>
|
||||
private static Task Invoke(CentralCommandAuthInterceptor interceptor, ServerCallContext context)
|
||||
=> interceptor.UnaryServerHandler<string, string>(
|
||||
"request", context, (_, _) => Task.FromResult("ok"));
|
||||
|
||||
[Fact]
|
||||
public async Task NonCentralCommandMethod_PassesThrough_EvenWithNoKeysAtAll()
|
||||
{
|
||||
// The interceptor shares the AddGrpc pipeline with config-serve (and, on a fused node, sync
|
||||
// and telemetry), so it sees every call. It must be scoped strictly to its own service.
|
||||
var interceptor = CreateInterceptor();
|
||||
var context = CreateContext(OtherMethod, authorizationHeader: null, clusterHeader: null);
|
||||
|
||||
await Invoke(interceptor, context); // no throw
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_WithCorrectBearerForItsCluster_PassesThrough()
|
||||
{
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer psk-site-a", "SITE-A");
|
||||
|
||||
await Invoke(interceptor, context); // no throw
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_WithNoClusterHeader_IsDenied()
|
||||
{
|
||||
// Without the cluster there is no key to grade against. Falling back to "try them all" would
|
||||
// make one compromised site's key valid for forging every other site's acks.
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer psk-site-a", clusterHeader: null);
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_WithBlankClusterHeader_IsDenied()
|
||||
{
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer psk-site-a", " ");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_ForAClusterWithNoResolvableKey_IsDenied()
|
||||
{
|
||||
// Fail-closed on the provider's "no key" — an unseeded or unreachable key must cost the ack,
|
||||
// never authentication.
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer anything-at-all", "SITE-Z");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_WithAnotherClustersBearer_IsDenied()
|
||||
{
|
||||
// The isolation proof: SITE-B's key does not authenticate a call claiming to be SITE-A.
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"), ("SITE-B", "psk-site-b"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer psk-site-b", "SITE-A");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_WithNoBearerToken_IsDenied()
|
||||
{
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, authorizationHeader: null, clusterHeader: "SITE-A");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_WithMalformedAuthorizationHeader_IsDenied()
|
||||
{
|
||||
// No "Bearer " prefix at all — must be treated the same as a missing header.
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "psk-site-a", "SITE-A");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ReportApply_TokenComparison_IsNotAPrefixMatch()
|
||||
{
|
||||
// A prefix/StartsWith comparison would accept a truncated key and make the secret
|
||||
// recoverable one character at a time.
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer psk-site-", "SITE-A");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() => Invoke(interceptor, context));
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ServerStreamingPath_IsAlsoGated()
|
||||
{
|
||||
// ReportApply is unary today, but gating only that path would leave any future streaming
|
||||
// method on the same service open. Gate every handler shape.
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer wrong", "SITE-A");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() =>
|
||||
interceptor.ServerStreamingServerHandler<string, string>(
|
||||
"request", responseStream: null!, context, (_, _, _) => Task.CompletedTask));
|
||||
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ClientStreamingPath_IsAlsoGated()
|
||||
{
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer wrong", "SITE-A");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() =>
|
||||
interceptor.ClientStreamingServerHandler<string, string>(
|
||||
requestStream: null!, context, (_, _) => Task.FromResult("ok")));
|
||||
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task DuplexStreamingPath_IsAlsoGated()
|
||||
{
|
||||
var interceptor = CreateInterceptor(("SITE-A", "psk-site-a"));
|
||||
var context = CreateContext(ReportApplyMethod, "Bearer wrong", "SITE-A");
|
||||
|
||||
var ex = await Should.ThrowAsync<RpcException>(() =>
|
||||
interceptor.DuplexStreamingServerHandler<string, string>(
|
||||
requestStream: null!, responseStream: null!, context, (_, _, _) => Task.CompletedTask));
|
||||
|
||||
ex.StatusCode.ShouldBe(StatusCode.PermissionDenied);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void HasExactlyOnePublicConstructor()
|
||||
{
|
||||
// Grpc.AspNetCore silently stops invoking an interceptor with more than one public ctor —
|
||||
// this pins the shape so a well-meaning overload doesn't quietly disable auth in production.
|
||||
var publicCtors = typeof(CentralCommandAuthInterceptor).GetConstructors();
|
||||
|
||||
publicCtors.Length.ShouldBe(1);
|
||||
}
|
||||
|
||||
/// <summary>An <see cref="IMeshPskProvider"/> over a fixed key set; unknown clusters fail closed.</summary>
|
||||
private sealed class FakeMeshPskProvider(params (string Cluster, string Psk)[] keys) : IMeshPskProvider
|
||||
{
|
||||
private readonly Dictionary<string, string> _keys =
|
||||
keys.ToDictionary(k => k.Cluster, k => k.Psk, StringComparer.OrdinalIgnoreCase);
|
||||
|
||||
public bool TryGetPsk(string clusterId, [NotNullWhen(true)] out string? psk)
|
||||
=> _keys.TryGetValue(clusterId, out psk);
|
||||
|
||||
public void Invalidate(string clusterId) { }
|
||||
|
||||
public void InvalidateAll() { }
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Minimal <see cref="ServerCallContext"/> carrying just a method name and request headers —
|
||||
/// the only two things the interceptor reads. Hand-rolled because
|
||||
/// <c>Grpc.Core.Testing.TestServerCallContext</c> ships only in the retired native package.
|
||||
/// </summary>
|
||||
private sealed class FakeServerCallContext(string method, Metadata requestHeaders)
|
||||
: ServerCallContext
|
||||
{
|
||||
protected override string MethodCore => method;
|
||||
protected override string HostCore => "localhost";
|
||||
protected override string PeerCore => "ipv4:127.0.0.1:12345";
|
||||
protected override DateTime DeadlineCore => DateTime.UtcNow.AddMinutes(1);
|
||||
protected override Metadata RequestHeadersCore => requestHeaders;
|
||||
protected override CancellationToken CancellationTokenCore => CancellationToken.None;
|
||||
protected override Metadata ResponseTrailersCore { get; } = [];
|
||||
protected override Status StatusCore { get; set; }
|
||||
protected override WriteOptions? WriteOptionsCore { get; set; }
|
||||
|
||||
protected override AuthContext AuthContextCore { get; } =
|
||||
new(null, new Dictionary<string, List<AuthProperty>>());
|
||||
|
||||
protected override ContextPropagationToken CreatePropagationTokenCore(
|
||||
ContextPropagationOptions? options)
|
||||
=> throw new NotSupportedException();
|
||||
|
||||
protected override Task WriteResponseHeadersAsyncCore(Metadata responseHeaders)
|
||||
=> Task.CompletedTask;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user