Joseph Doherty
d82d3451e7
G-8 (KEK rotation) — built in ZB.MOM.WW.Secrets, lib 0.1.2->0.1.3: - ISecretCipher.Rewrap(row, oldKek, newKek): re-wraps the per-secret DEK only (bodies never re-encrypted; revision/timestamps preserved -> invisible to cluster LWW). Fail-closed on wrong old-KEK id, wrong key bytes, and malformed wraps; DEK zeroed on all paths. - ISecretStore.ApplyRewrapAsync(rewrappedRow, expectedCurrentWrappedDek): updates only the 4 wrap columns + kek_id, compare-and-swap on the current wrapped DEK so a concurrent set/rotate cannot corrupt a row (closes a review-caught TOCTOU). - KekRotationService.RewrapAllAsync + RewrapReport: enumerate all rows incl. tombstones, idempotent/resumable skip-already-current, bounded CAS-retry, fail-closed on unknown/identical KEK. - `secret rewrap-all` CLI verb: key material only via env-var name / file path, JSON counts report; README section + operator runbook. Verified: full offline suite green (82 core + 15 UI, 0 regressions) + end-to-end CLI smoke + adversarial crypto review (all 7 categories PASS; TOCTOU fixed). G-7 (clustered replication) — designed + planned, no code: - Fork resolved to build Option A (shared SQL-Server ISecretStore); Akka replicator ZB.MOM.WW.Secrets.Akka is a deferred phase-2. Design doc + executable plan + .tasks.json under docs/plans/2026-07-17-secrets-g7-*. Tracking: components/secrets/GAPS.md + CLAUDE.md secrets row updated.
323 lines
14 KiB
C#
323 lines
14 KiB
C#
using Microsoft.Data.Sqlite;
|
|
using ZB.MOM.WW.Secrets.Abstractions;
|
|
using ZB.MOM.WW.Secrets.Sqlite;
|
|
|
|
namespace ZB.MOM.WW.Secrets.Tests.Sqlite;
|
|
|
|
public sealed class SqliteSecretStoreTests : IAsyncLifetime, IDisposable
|
|
{
|
|
private readonly string _dbPath =
|
|
Path.Combine(Path.GetTempPath(), $"zb-secrets-store-{Guid.NewGuid():N}.db");
|
|
|
|
private readonly SecretsSqliteConnectionFactory _factory;
|
|
private readonly SqliteSecretStore _store;
|
|
|
|
public SqliteSecretStoreTests()
|
|
{
|
|
_factory = new SecretsSqliteConnectionFactory(_dbPath);
|
|
_store = new SqliteSecretStore(_factory);
|
|
}
|
|
|
|
public async Task InitializeAsync() =>
|
|
await new SqliteSecretsStoreMigrator(_factory).MigrateAsync(CancellationToken.None);
|
|
|
|
public Task DisposeAsync() => Task.CompletedTask;
|
|
|
|
private static StoredSecret MakeSecret(
|
|
string name,
|
|
long revision = 0,
|
|
byte[]? ciphertext = null,
|
|
DateTimeOffset? updatedUtc = null,
|
|
DateTimeOffset? createdUtc = null,
|
|
bool isDeleted = false,
|
|
DateTimeOffset? deletedUtc = null,
|
|
string? createdBy = "alice",
|
|
string? updatedBy = "alice") => new()
|
|
{
|
|
Name = new SecretName(name),
|
|
Description = "desc",
|
|
ContentType = SecretContentType.ConnectionString,
|
|
Ciphertext = ciphertext ?? [1, 2, 3],
|
|
Nonce = [4, 5, 6],
|
|
Tag = [7, 8, 9],
|
|
WrappedDek = [10, 11, 12],
|
|
WrapNonce = [13, 14, 15],
|
|
WrapTag = [16, 17, 18],
|
|
KekId = "kek-1",
|
|
Revision = revision,
|
|
IsDeleted = isDeleted,
|
|
DeletedUtc = deletedUtc,
|
|
CreatedUtc = createdUtc ?? DateTimeOffset.UtcNow,
|
|
UpdatedUtc = updatedUtc ?? DateTimeOffset.UtcNow,
|
|
CreatedBy = createdBy,
|
|
UpdatedBy = updatedBy,
|
|
};
|
|
|
|
[Fact]
|
|
public async Task Upsert_Then_Get_RoundTrips()
|
|
{
|
|
StoredSecret row = MakeSecret("app/db-conn");
|
|
await _store.UpsertAsync(row, CancellationToken.None);
|
|
|
|
StoredSecret? got = await _store.GetAsync(new SecretName("app/db-conn"), CancellationToken.None);
|
|
|
|
Assert.NotNull(got);
|
|
Assert.Equal("app/db-conn", got!.Name.Value);
|
|
Assert.Equal("desc", got.Description);
|
|
Assert.Equal(SecretContentType.ConnectionString, got.ContentType);
|
|
Assert.Equal(new byte[] { 1, 2, 3 }, got.Ciphertext);
|
|
Assert.Equal(new byte[] { 4, 5, 6 }, got.Nonce);
|
|
Assert.Equal(new byte[] { 7, 8, 9 }, got.Tag);
|
|
Assert.Equal(new byte[] { 10, 11, 12 }, got.WrappedDek);
|
|
Assert.Equal(new byte[] { 13, 14, 15 }, got.WrapNonce);
|
|
Assert.Equal(new byte[] { 16, 17, 18 }, got.WrapTag);
|
|
Assert.Equal("kek-1", got.KekId);
|
|
Assert.Equal(0, got.Revision);
|
|
Assert.False(got.IsDeleted);
|
|
Assert.Null(got.DeletedUtc);
|
|
Assert.Equal("alice", got.CreatedBy);
|
|
Assert.Equal("alice", got.UpdatedBy);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Get_ReturnsNull_WhenAbsent()
|
|
{
|
|
StoredSecret? got = await _store.GetAsync(new SecretName("nope"), CancellationToken.None);
|
|
Assert.Null(got);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Upsert_Existing_OverwritesInPlace_BumpsRevision()
|
|
{
|
|
StoredSecret first = MakeSecret("app/rotating", ciphertext: [1, 1, 1], createdBy: "alice", updatedBy: "alice");
|
|
await _store.UpsertAsync(first, CancellationToken.None);
|
|
|
|
StoredSecret afterFirst = (await _store.GetAsync(new SecretName("app/rotating"), CancellationToken.None))!;
|
|
Assert.Equal(0, afterFirst.Revision);
|
|
DateTimeOffset originalCreatedUtc = afterFirst.CreatedUtc;
|
|
|
|
// Second write: different crypto bytes and a different actor.
|
|
StoredSecret second = MakeSecret("app/rotating", ciphertext: [9, 9, 9], createdBy: "bob", updatedBy: "bob");
|
|
await _store.UpsertAsync(second, CancellationToken.None);
|
|
|
|
StoredSecret afterSecond = (await _store.GetAsync(new SecretName("app/rotating"), CancellationToken.None))!;
|
|
Assert.Equal(1, afterSecond.Revision);
|
|
Assert.Equal(new byte[] { 9, 9, 9 }, afterSecond.Ciphertext);
|
|
// created_utc / created_by are preserved from the original insert.
|
|
Assert.Equal(originalCreatedUtc, afterSecond.CreatedUtc);
|
|
Assert.Equal("alice", afterSecond.CreatedBy);
|
|
// updated_by reflects the second write.
|
|
Assert.Equal("bob", afterSecond.UpdatedBy);
|
|
Assert.False(afterSecond.IsDeleted);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task List_ExcludesTombstoned_ByDefault()
|
|
{
|
|
await _store.UpsertAsync(MakeSecret("keep"), CancellationToken.None);
|
|
await _store.UpsertAsync(MakeSecret("gone"), CancellationToken.None);
|
|
await _store.DeleteAsync(new SecretName("gone"), "carol", CancellationToken.None);
|
|
|
|
IReadOnlyList<SecretMetadata> visible = await _store.ListAsync(includeDeleted: false, CancellationToken.None);
|
|
Assert.DoesNotContain(visible, m => m.Name.Value == "gone");
|
|
Assert.Contains(visible, m => m.Name.Value == "keep");
|
|
|
|
IReadOnlyList<SecretMetadata> all = await _store.ListAsync(includeDeleted: true, CancellationToken.None);
|
|
Assert.Contains(all, m => m.Name.Value == "gone");
|
|
Assert.Contains(all, m => m.Name.Value == "keep");
|
|
|
|
// Compile-time proof the projection carries no byte[] members: SecretMetadata is the element type.
|
|
SecretMetadata sample = all[0];
|
|
Assert.NotNull(sample);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Delete_SetsTombstone_BumpsRevision_ReturnsFalseWhenAbsent()
|
|
{
|
|
await _store.UpsertAsync(MakeSecret("app/secret"), CancellationToken.None);
|
|
|
|
bool first = await _store.DeleteAsync(new SecretName("app/secret"), "carol", CancellationToken.None);
|
|
Assert.True(first);
|
|
|
|
StoredSecret tombstoned = (await _store.GetAsync(new SecretName("app/secret"), CancellationToken.None))!;
|
|
Assert.True(tombstoned.IsDeleted);
|
|
Assert.NotNull(tombstoned.DeletedUtc);
|
|
Assert.Equal(1, tombstoned.Revision);
|
|
Assert.Equal("carol", tombstoned.UpdatedBy);
|
|
|
|
// Deleting an already-tombstoned row returns false.
|
|
bool second = await _store.DeleteAsync(new SecretName("app/secret"), "carol", CancellationToken.None);
|
|
Assert.False(second);
|
|
|
|
// Deleting an unknown name returns false.
|
|
bool unknown = await _store.DeleteAsync(new SecretName("never-existed"), "carol", CancellationToken.None);
|
|
Assert.False(unknown);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task GetManifest_ReturnsAllRows()
|
|
{
|
|
await _store.UpsertAsync(MakeSecret("a"), CancellationToken.None);
|
|
await _store.UpsertAsync(MakeSecret("b"), CancellationToken.None);
|
|
await _store.DeleteAsync(new SecretName("b"), "carol", CancellationToken.None);
|
|
|
|
IReadOnlyList<SecretManifestEntry> manifest = await _store.GetManifestAsync(CancellationToken.None);
|
|
|
|
Assert.Equal(2, manifest.Count);
|
|
SecretManifestEntry a = manifest.Single(e => e.Name.Value == "a");
|
|
SecretManifestEntry b = manifest.Single(e => e.Name.Value == "b");
|
|
Assert.False(a.IsDeleted);
|
|
Assert.Equal(0, a.Revision);
|
|
Assert.True(b.IsDeleted);
|
|
Assert.Equal(1, b.Revision);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApplyReplicated_AppliesNewer_IgnoresStale()
|
|
{
|
|
DateTimeOffset t1 = new(2026, 1, 1, 0, 0, 0, TimeSpan.Zero);
|
|
DateTimeOffset t2 = new(2026, 1, 2, 0, 0, 0, TimeSpan.Zero);
|
|
DateTimeOffset t3 = new(2026, 1, 3, 0, 0, 0, TimeSpan.Zero);
|
|
|
|
// Seed a local row at revision 5 / T2.
|
|
StoredSecret seed = MakeSecret("repl", revision: 5, ciphertext: [5, 5, 5], updatedUtc: t2, createdUtc: t1);
|
|
await _store.ApplyReplicatedAsync(seed, CancellationToken.None);
|
|
|
|
StoredSecret afterSeed = (await _store.GetAsync(new SecretName("repl"), CancellationToken.None))!;
|
|
Assert.Equal(5, afterSeed.Revision);
|
|
|
|
// Newer row (revision 6 / T3) is applied verbatim (revision NOT bumped past 6).
|
|
StoredSecret newer = MakeSecret("repl", revision: 6, ciphertext: [6, 6, 6], updatedUtc: t3, createdUtc: t1);
|
|
await _store.ApplyReplicatedAsync(newer, CancellationToken.None);
|
|
|
|
StoredSecret afterNewer = (await _store.GetAsync(new SecretName("repl"), CancellationToken.None))!;
|
|
Assert.Equal(6, afterNewer.Revision);
|
|
Assert.Equal(new byte[] { 6, 6, 6 }, afterNewer.Ciphertext);
|
|
Assert.Equal(t3, afterNewer.UpdatedUtc);
|
|
|
|
// Stale row (revision 4 / T1) is ignored.
|
|
StoredSecret stale = MakeSecret("repl", revision: 4, ciphertext: [4, 4, 4], updatedUtc: t1, createdUtc: t1);
|
|
await _store.ApplyReplicatedAsync(stale, CancellationToken.None);
|
|
|
|
StoredSecret afterStale = (await _store.GetAsync(new SecretName("repl"), CancellationToken.None))!;
|
|
Assert.Equal(6, afterStale.Revision);
|
|
Assert.Equal(new byte[] { 6, 6, 6 }, afterStale.Ciphertext);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApplyRewrap_ChangesOnlyWrapEnvelopeAndKekId_PreservingRevisionBodyAndTimestamps()
|
|
{
|
|
DateTimeOffset created = new(2026, 1, 1, 0, 0, 0, TimeSpan.Zero);
|
|
StoredSecret seed = MakeSecret("app/rewrap", ciphertext: [1, 2, 3], createdUtc: created);
|
|
await _store.UpsertAsync(seed, CancellationToken.None);
|
|
// Bump the revision once so we can prove ApplyRewrap does NOT change it.
|
|
await _store.UpsertAsync(MakeSecret("app/rewrap", ciphertext: [1, 2, 3]), CancellationToken.None);
|
|
|
|
StoredSecret before = (await _store.GetAsync(new SecretName("app/rewrap"), CancellationToken.None))!;
|
|
Assert.Equal(1, before.Revision);
|
|
|
|
// Re-wrap: only the four wrap-related fields differ; everything else is carried from `before`.
|
|
StoredSecret rewrapped = before with
|
|
{
|
|
WrappedDek = [90, 91, 92],
|
|
WrapNonce = [93, 94, 95],
|
|
WrapTag = [96, 97, 98],
|
|
KekId = "kek-2",
|
|
};
|
|
bool applied = await _store.ApplyRewrapAsync(rewrapped, before.WrappedDek, CancellationToken.None);
|
|
Assert.True(applied);
|
|
|
|
StoredSecret after = (await _store.GetAsync(new SecretName("app/rewrap"), CancellationToken.None))!;
|
|
// Wrap envelope + kek_id changed...
|
|
Assert.Equal(new byte[] { 90, 91, 92 }, after.WrappedDek);
|
|
Assert.Equal(new byte[] { 93, 94, 95 }, after.WrapNonce);
|
|
Assert.Equal(new byte[] { 96, 97, 98 }, after.WrapTag);
|
|
Assert.Equal("kek-2", after.KekId);
|
|
// ...but revision, updated timestamp, the sealed body, and audit stamps are untouched.
|
|
Assert.Equal(before.Revision, after.Revision);
|
|
Assert.Equal(before.UpdatedUtc, after.UpdatedUtc);
|
|
Assert.Equal(before.CreatedUtc, after.CreatedUtc);
|
|
Assert.Equal(before.UpdatedBy, after.UpdatedBy);
|
|
Assert.Equal(new byte[] { 1, 2, 3 }, after.Ciphertext);
|
|
Assert.Equal(before.Nonce, after.Nonce);
|
|
Assert.Equal(before.Tag, after.Tag);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApplyRewrap_RewrapsTombstonedRows()
|
|
{
|
|
await _store.UpsertAsync(MakeSecret("app/dead"), CancellationToken.None);
|
|
await _store.DeleteAsync(new SecretName("app/dead"), "carol", CancellationToken.None);
|
|
|
|
StoredSecret tomb = (await _store.GetAsync(new SecretName("app/dead"), CancellationToken.None))!;
|
|
Assert.True(tomb.IsDeleted);
|
|
|
|
bool applied = await _store.ApplyRewrapAsync(
|
|
tomb with { WrappedDek = [1], WrapNonce = [2], WrapTag = [3], KekId = "kek-2" },
|
|
tomb.WrappedDek,
|
|
CancellationToken.None);
|
|
|
|
Assert.True(applied);
|
|
StoredSecret after = (await _store.GetAsync(new SecretName("app/dead"), CancellationToken.None))!;
|
|
Assert.Equal("kek-2", after.KekId);
|
|
// The tombstone survives the rewrap.
|
|
Assert.True(after.IsDeleted);
|
|
Assert.Equal(tomb.Revision, after.Revision);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApplyRewrap_ReturnsFalse_WhenRowAbsent()
|
|
{
|
|
StoredSecret ghost = MakeSecret("never-existed") with { KekId = "kek-2" };
|
|
bool applied = await _store.ApplyRewrapAsync(ghost, ghost.WrappedDek, CancellationToken.None);
|
|
Assert.False(applied);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ApplyRewrap_ReturnsFalse_WhenCurrentWrapChanged_UnderConcurrentWrite()
|
|
{
|
|
StoredSecret original = MakeSecret("app/cas", ciphertext: [1, 2, 3]);
|
|
await _store.UpsertAsync(original, CancellationToken.None);
|
|
StoredSecret before = (await _store.GetAsync(new SecretName("app/cas"), CancellationToken.None))!;
|
|
|
|
// Simulate a concurrent set/rotate: a fresh write changes the wrapped DEK out from under us.
|
|
await _store.UpsertAsync(
|
|
MakeSecret("app/cas", ciphertext: [9, 9, 9]) with { WrappedDek = [77, 78, 79] },
|
|
CancellationToken.None);
|
|
|
|
// A rewrap that still expects the ORIGINAL wrap must NOT apply (0 rows) — it would otherwise
|
|
// pair a stale re-wrap with the newer body and corrupt the row.
|
|
bool applied = await _store.ApplyRewrapAsync(
|
|
before with { WrappedDek = [1], WrapNonce = [2], WrapTag = [3], KekId = "kek-2" },
|
|
before.WrappedDek,
|
|
CancellationToken.None);
|
|
|
|
Assert.False(applied);
|
|
StoredSecret after = (await _store.GetAsync(new SecretName("app/cas"), CancellationToken.None))!;
|
|
// The concurrent write's wrap survived untouched; no stale re-wrap was applied.
|
|
Assert.Equal(new byte[] { 77, 78, 79 }, after.WrappedDek);
|
|
Assert.Equal("kek-1", after.KekId);
|
|
}
|
|
|
|
public void Dispose()
|
|
{
|
|
// Drop pooled connections so the WAL/-shm/-wal sidecars release before we delete.
|
|
SqliteConnection.ClearAllPools();
|
|
|
|
foreach (string path in new[] { _dbPath, _dbPath + "-wal", _dbPath + "-shm" })
|
|
{
|
|
try
|
|
{
|
|
if (File.Exists(path))
|
|
{
|
|
File.Delete(path);
|
|
}
|
|
}
|
|
catch (IOException)
|
|
{
|
|
// Best-effort temp cleanup; a leaked temp file is not a test failure.
|
|
}
|
|
}
|
|
}
|
|
}
|