feat(secrets-cli): per-target session factory with degraded-KEK mode + literal KEK provider

2026-07-19 09:01:46 -04:00
parent b8c6c7d432
commit 83af2b2eaf
5 changed files with 422 additions and 0 deletions
@@ -0,0 +1,74 @@
+using System.Security.Cryptography;
+using ZB.MOM.WW.Secrets.Abstractions;
+using ZB.MOM.WW.Secrets.Cli.Interactive;
+using ZB.MOM.WW.Secrets.MasterKey;
+
+namespace ZB.MOM.WW.Secrets.Tests.Cli.Interactive;
+
+/// <summary>
+/// Pins <see cref="LiteralMasterKeyProvider"/> — the operator-pasted-key provider used to recover a
+/// locked-out session — to the family's key contract: 32-byte enforcement and, critically, a
+/// <see cref="IMasterKeyProvider.KekId"/> derived identically to the configured providers so a key
+/// entered by hand can decrypt (and re-wrap) rows another provider kind sealed.
+/// </summary>
+public sealed class LiteralMasterKeyProviderTests
+{
+    private static string NewKeyBase64()
+    {
+        byte[] key = new byte[32];
+        RandomNumberGenerator.Fill(key);
+        return Convert.ToBase64String(key);
+    }
+
+    [Fact]
+    public void Accepts_base64_32_byte_key()
+    {
+        string b64 = NewKeyBase64();
+
+        var sut = new LiteralMasterKeyProvider(b64);
+
+        Assert.Equal(32, sut.GetMasterKey().Length);
+        Assert.StartsWith("sha256:", sut.KekId);
+    }
+
+    [Fact]
+    public void Rejects_wrong_length()
+    {
+        string sixteenBytes = Convert.ToBase64String(new byte[16]);
+
+        Assert.Throws<ArgumentException>(() => new LiteralMasterKeyProvider(sixteenBytes));
+    }
+
+    [Fact]
+    public void Derives_same_kekid_as_environment_provider_for_same_material()
+    {
+        byte[] key = new byte[32];
+        RandomNumberGenerator.Fill(key);
+        string b64 = Convert.ToBase64String(key);
+        string envVar = $"ZB_TEST_KEK_{Guid.NewGuid():N}";
+        Environment.SetEnvironmentVariable(envVar, b64);
+        try
+        {
+            IMasterKeyProvider environment = MasterKeyProviderFactory.Create(new MasterKeyOptions
+            {
+                Source = MasterKeySource.Environment,
+                EnvVarName = envVar,
+            });
+            var literal = new LiteralMasterKeyProvider(b64);
+
+            Assert.Equal(environment.KekId, literal.KekId);
+        }
+        finally
+        {
+            Environment.SetEnvironmentVariable(envVar, null);
+        }
+    }
+
+    [Fact]
+    public void Explicit_kekid_wins()
+    {
+        var sut = new LiteralMasterKeyProvider(NewKeyBase64(), "kek:operator-override");
+
+        Assert.Equal("kek:operator-override", sut.KekId);
+    }
+}