feat(secrets-cli): reference auditor — classify every ${secret:} the target app needs
This commit is contained in:
Joseph Doherty
+187
@@ -0,0 +1,187 @@
|
||||
using System.Security.Cryptography;
|
||||
using Microsoft.Extensions.Configuration;
|
||||
using ZB.MOM.WW.Secrets.Abstractions;
|
||||
using ZB.MOM.WW.Secrets.Cli.Interactive;
|
||||
using ZB.MOM.WW.Secrets.Crypto;
|
||||
using ZB.MOM.WW.Secrets.MasterKey;
|
||||
|
||||
namespace ZB.MOM.WW.Secrets.Tests.Cli.Interactive;
|
||||
|
||||
/// <summary>
|
||||
/// Exercises <see cref="ReferenceAuditor"/> against real temp-dir SQLite sessions: distinct-reference
|
||||
/// collation (one finding per name, every config path listed), the four full-session classifications
|
||||
/// (present/decryptable → Ok, absent → Missing, tombstoned → Tombstoned, wrong-KEK → Undecryptable),
|
||||
/// and the degraded-session presence-only downgrade (present → PresentUnverified).
|
||||
/// </summary>
|
||||
public sealed class ReferenceAuditorTests : IDisposable
|
||||
{
|
||||
private readonly string _dir =
|
||||
Path.Combine(Path.GetTempPath(), $"zb-secrets-audit-{Guid.NewGuid():N}");
|
||||
private readonly List<string> _envVars = [];
|
||||
|
||||
private string DbPath => Path.Combine(_dir, "secrets.db");
|
||||
|
||||
public ReferenceAuditorTests() => Directory.CreateDirectory(_dir);
|
||||
|
||||
public void Dispose()
|
||||
{
|
||||
foreach (string name in _envVars)
|
||||
{
|
||||
Environment.SetEnvironmentVariable(name, null);
|
||||
}
|
||||
|
||||
if (Directory.Exists(_dir))
|
||||
{
|
||||
try { Directory.Delete(_dir, recursive: true); } catch (IOException) { /* best-effort temp cleanup */ }
|
||||
}
|
||||
}
|
||||
|
||||
private string SetTempKeyEnv()
|
||||
{
|
||||
byte[] key = new byte[32];
|
||||
RandomNumberGenerator.Fill(key);
|
||||
string name = $"ZB_TEST_KEK_{Guid.NewGuid():N}";
|
||||
Environment.SetEnvironmentVariable(name, Convert.ToBase64String(key));
|
||||
_envVars.Add(name);
|
||||
return name;
|
||||
}
|
||||
|
||||
private static IConfigurationRoot Config(params (string Key, string Value)[] pairs) =>
|
||||
new ConfigurationBuilder()
|
||||
.AddInMemoryCollection(pairs.ToDictionary(p => p.Key, p => (string?)p.Value))
|
||||
.Build();
|
||||
|
||||
private StoreTarget Target(MasterKeyOptions masterKey, IConfigurationRoot config) =>
|
||||
new(
|
||||
"test",
|
||||
AppSettingsPath: null,
|
||||
new SecretsOptions { SqlitePath = DbPath, MasterKey = masterKey },
|
||||
SqlServer: null,
|
||||
config);
|
||||
|
||||
private MasterKeyOptions EnvKey() => new()
|
||||
{
|
||||
Source = MasterKeySource.Environment,
|
||||
EnvVarName = SetTempKeyEnv(),
|
||||
};
|
||||
|
||||
private static MasterKeyOptions UnsetEnvKey() => new()
|
||||
{
|
||||
Source = MasterKeySource.Environment,
|
||||
EnvVarName = $"ZB_TEST_UNSET_{Guid.NewGuid():N}",
|
||||
};
|
||||
|
||||
private Task<SecretsSession> Open(MasterKeyOptions masterKey, IConfigurationRoot config) =>
|
||||
new SecretsSessionFactory().OpenAsync(Target(masterKey, config), overrideKek: null, CancellationToken.None);
|
||||
|
||||
[Fact]
|
||||
public async Task Finds_all_distinct_secret_references_with_their_config_paths()
|
||||
{
|
||||
IConfigurationRoot config = Config(
|
||||
("Data:Primary:ConnectionString", "Server=db;Password=${secret:db/pw}"),
|
||||
("Data:Replica:ConnectionString", "Server=db2;Password=${secret:db/pw}"),
|
||||
("PlainValue", "not a reference"));
|
||||
|
||||
SecretsSession session = await Open(EnvKey(), config);
|
||||
|
||||
IReadOnlyList<ReferenceFinding> findings =
|
||||
await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
|
||||
|
||||
ReferenceFinding finding = Assert.Single(findings);
|
||||
Assert.Equal("db/pw", finding.SecretName);
|
||||
Assert.Equal(
|
||||
["Data:Primary:ConnectionString", "Data:Replica:ConnectionString"],
|
||||
finding.ConfigPaths);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Classifies_present_decryptable_secret_as_Ok()
|
||||
{
|
||||
SecretsSession session = await Open(EnvKey(), Config(("Api:Key", "${secret:api/key}")));
|
||||
|
||||
var name = new SecretName("api/key");
|
||||
await session.Store.UpsertAsync(
|
||||
session.Cipher!.Encrypt(name, "s3cret", SecretContentType.Text), CancellationToken.None);
|
||||
|
||||
IReadOnlyList<ReferenceFinding> findings =
|
||||
await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
|
||||
|
||||
Assert.Equal(ReferenceStatus.Ok, Assert.Single(findings).Status);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Classifies_absent_secret_as_Missing()
|
||||
{
|
||||
SecretsSession session = await Open(EnvKey(), Config(("Api:Key", "${secret:api/key}")));
|
||||
|
||||
IReadOnlyList<ReferenceFinding> findings =
|
||||
await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
|
||||
|
||||
Assert.Equal(ReferenceStatus.Missing, Assert.Single(findings).Status);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Classifies_tombstoned_secret_as_Tombstoned()
|
||||
{
|
||||
SecretsSession session = await Open(EnvKey(), Config(("Api:Key", "${secret:api/key}")));
|
||||
|
||||
var name = new SecretName("api/key");
|
||||
await session.Store.UpsertAsync(
|
||||
session.Cipher!.Encrypt(name, "s3cret", SecretContentType.Text), CancellationToken.None);
|
||||
Assert.True(await session.Store.DeleteAsync(name, actor: "test", CancellationToken.None));
|
||||
|
||||
IReadOnlyList<ReferenceFinding> findings =
|
||||
await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
|
||||
|
||||
Assert.Equal(ReferenceStatus.Tombstoned, Assert.Single(findings).Status);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Classifies_wrong_kek_row_as_Undecryptable()
|
||||
{
|
||||
SecretsSession session = await Open(EnvKey(), Config(("Api:Key", "${secret:api/key}")));
|
||||
|
||||
// Seal a row under a DIFFERENT KEK (KEK-A) and persist it into the session's store; the
|
||||
// session's own cipher (KEK-B) then cannot unwrap it → Undecryptable.
|
||||
byte[] keyA = new byte[32];
|
||||
RandomNumberGenerator.Fill(keyA);
|
||||
var cipherA = new AesGcmEnvelopeCipher(new LiteralMasterKeyProvider(Convert.ToBase64String(keyA)));
|
||||
|
||||
var name = new SecretName("api/key");
|
||||
await session.Store.UpsertAsync(
|
||||
cipherA.Encrypt(name, "s3cret", SecretContentType.Text), CancellationToken.None);
|
||||
|
||||
IReadOnlyList<ReferenceFinding> findings =
|
||||
await new ReferenceAuditor().AuditAsync(session, CancellationToken.None);
|
||||
|
||||
Assert.Equal(ReferenceStatus.Undecryptable, Assert.Single(findings).Status);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task Degraded_session_reports_PresenceOnly_status()
|
||||
{
|
||||
// Seed a present row and a tombstoned row through a FULL session first.
|
||||
var present = new SecretName("svc/token");
|
||||
var gone = new SecretName("old/key");
|
||||
SecretsSession seed = await Open(EnvKey(), new ConfigurationBuilder().Build());
|
||||
await seed.Store.UpsertAsync(
|
||||
seed.Cipher!.Encrypt(present, "tok", SecretContentType.Text), CancellationToken.None);
|
||||
await seed.Store.UpsertAsync(
|
||||
seed.Cipher!.Encrypt(gone, "old", SecretContentType.Text), CancellationToken.None);
|
||||
Assert.True(await seed.Store.DeleteAsync(gone, actor: "test", CancellationToken.None));
|
||||
|
||||
// Re-open the SAME store degraded (KEK unresolvable) and audit references to all three.
|
||||
SecretsSession degraded = await Open(UnsetEnvKey(), Config(
|
||||
("A:Token", "${secret:svc/token}"),
|
||||
("B:Old", "${secret:old/key}"),
|
||||
("C:Missing", "${secret:no/such}")));
|
||||
Assert.False(degraded.KekAvailable);
|
||||
|
||||
IReadOnlyList<ReferenceFinding> findings =
|
||||
await new ReferenceAuditor().AuditAsync(degraded, CancellationToken.None);
|
||||
|
||||
Assert.Equal(ReferenceStatus.PresentUnverified, findings.Single(f => f.SecretName == "svc/token").Status);
|
||||
Assert.Equal(ReferenceStatus.Tombstoned, findings.Single(f => f.SecretName == "old/key").Status);
|
||||
Assert.Equal(ReferenceStatus.Missing, findings.Single(f => f.SecretName == "no/such").Status);
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user