7da303d7bb
Inbound-API bearer credentials are no longer persisted in plaintext. ApiKey now holds a KeyHash (peppered HMAC-SHA256); the key is shown once at creation and only its hash is stored. Lookup and validation hash the presented candidate. Cross-module: Commons (ApiKey, ApiKeyHasher), ConfigurationDatabase (mapping + HashApiKeyValue migration), InboundAPI (ApiKeyValidator), ManagementService (key creation), CentralUI (ApiKeys.razor). Existing keys must be re-issued.
97 lines
3.7 KiB
C#
97 lines
3.7 KiB
C#
using NSubstitute;
|
|
using ScadaLink.Commons.Entities.InboundApi;
|
|
using ScadaLink.Commons.Interfaces.Repositories;
|
|
using ScadaLink.Commons.Types.InboundApi;
|
|
|
|
namespace ScadaLink.InboundAPI.Tests;
|
|
|
|
/// <summary>
|
|
/// ConfigurationDatabase-012: <see cref="ApiKeyValidator"/> must authenticate by
|
|
/// hashing the presented candidate with the same HMAC-SHA256 pepper used at
|
|
/// creation, then comparing against the stored <see cref="ApiKey.KeyHash"/> — never
|
|
/// against a plaintext key. The comparison stays constant-time.
|
|
/// </summary>
|
|
public class ApiKeyHashValidationTests
|
|
{
|
|
private const string Pepper = "a-sufficiently-long-server-side-pepper-value";
|
|
|
|
private readonly IInboundApiRepository _repository = Substitute.For<IInboundApiRepository>();
|
|
|
|
private static ApiKey StoredKey(ApiKeyHasher hasher, string liveKey, int id = 1, bool enabled = true)
|
|
{
|
|
var key = ApiKey.FromHash("MES-Production", hasher.Hash(liveKey));
|
|
key.Id = id;
|
|
key.IsEnabled = enabled;
|
|
return key;
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateAsync_WithPepperedHasher_AcceptsKeyHashedWithSamePepper()
|
|
{
|
|
var hasher = new ApiKeyHasher(Pepper);
|
|
var stored = StoredKey(hasher, "live-secret-key");
|
|
var method = new ApiMethod("ingest", "return 1;") { Id = 10 };
|
|
|
|
_repository.GetAllApiKeysAsync().Returns(new List<ApiKey> { stored });
|
|
_repository.GetMethodByNameAsync("ingest").Returns(method);
|
|
_repository.GetApprovedKeysForMethodAsync(10).Returns(new List<ApiKey> { stored });
|
|
|
|
var validator = new ApiKeyValidator(_repository, hasher);
|
|
|
|
var result = await validator.ValidateAsync("live-secret-key", "ingest");
|
|
|
|
Assert.True(result.IsValid);
|
|
Assert.Equal(200, result.StatusCode);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateAsync_WrongKey_FailsEvenWhenItHashesToSomethingNonNull()
|
|
{
|
|
var hasher = new ApiKeyHasher(Pepper);
|
|
var stored = StoredKey(hasher, "the-real-key");
|
|
|
|
_repository.GetAllApiKeysAsync().Returns(new List<ApiKey> { stored });
|
|
|
|
var validator = new ApiKeyValidator(_repository, hasher);
|
|
|
|
var result = await validator.ValidateAsync("a-wrong-key", "ingest");
|
|
|
|
Assert.False(result.IsValid);
|
|
Assert.Equal(401, result.StatusCode);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateAsync_StoredHashIsNotThePlaintextKey()
|
|
{
|
|
// Sanity guard: the value the validator compares against must be a hash, not
|
|
// the live secret — a DB dump must not yield a usable credential.
|
|
var hasher = new ApiKeyHasher(Pepper);
|
|
var stored = StoredKey(hasher, "live-secret-key");
|
|
|
|
Assert.NotEqual("live-secret-key", stored.KeyHash);
|
|
|
|
_repository.GetAllApiKeysAsync().Returns(new List<ApiKey> { stored });
|
|
var validator = new ApiKeyValidator(_repository, hasher);
|
|
|
|
// Presenting the stored hash itself must NOT authenticate — only the live key does.
|
|
var result = await validator.ValidateAsync(stored.KeyHash, "ingest");
|
|
Assert.False(result.IsValid);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ValidateAsync_KeyHashedUnderADifferentPepper_DoesNotAuthenticate()
|
|
{
|
|
var creationHasher = new ApiKeyHasher(Pepper);
|
|
var stored = StoredKey(creationHasher, "live-secret-key");
|
|
|
|
_repository.GetAllApiKeysAsync().Returns(new List<ApiKey> { stored });
|
|
|
|
// A validator running with a different pepper cannot recognise the key.
|
|
var otherHasher = new ApiKeyHasher("a-totally-different-server-side-pepper-val");
|
|
var validator = new ApiKeyValidator(_repository, otherHasher);
|
|
|
|
var result = await validator.ValidateAsync("live-secret-key", "ingest");
|
|
Assert.False(result.IsValid);
|
|
}
|
|
}
|