admin
6ab1e7c56c
gates / gates (push) Successful in 20s
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS
32 lines
1.2 KiB
Go
32 lines
1.2 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"io"
|
|
"log/slog"
|
|
"testing"
|
|
|
|
"gitea.dooplex.hu/admin/felhom-agent/internal/config"
|
|
)
|
|
|
|
// R-861 (agent v0.146.0): the root escrow ceremony builds a file path from the storage id; an id that is a path is
|
|
// refused before anything is read. RED-PROOF: drop the pbsStorageIDRe check → the "../" ids reach the key stat and
|
|
// come back as a "setup" error instead of "usage".
|
|
func TestEscrowCeremony_StorageIDIsNeverAPath(t *testing.T) {
|
|
lg := slog.New(slog.NewTextHandler(io.Discard, nil))
|
|
for _, id := range []string{"../../../etc/shadow", "a/b", "/etc/pve/priv/x", ".hidden", ""} {
|
|
cfg := config.Default()
|
|
cfg.Escrow.PBSStorageID = "" // the flag decides here
|
|
_, e := escrowCeremony(context.Background(), cfg, lg, escrowCeremonyOpts{storage: id})
|
|
if e == nil || e.kind != "usage" {
|
|
t.Errorf("storage id %q was not refused as usage (got %+v)", id, e)
|
|
}
|
|
}
|
|
cfg := config.Default()
|
|
cfg.Backup.PBSSecretDir = t.TempDir()
|
|
_, e := escrowCeremony(context.Background(), cfg, lg, escrowCeremonyOpts{storage: "felhom-pbs"})
|
|
if e == nil || e.kind != "setup" {
|
|
t.Fatalf("control: a plain id must pass the check and fail later on the missing key (setup), got %+v", e)
|
|
}
|
|
}
|