hub v0.44.0: PBS DR tier SLICE 1 — felhom-tenantsync surface (script+client) + hub provisioning flow (consume-once host secret, pbs_dr desired-state descriptor, fail-closed + idempotent, re-issue)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-10 20:49:48 +02:00
parent 00afadc1fe
commit ce6a56691e
19 changed files with 1743 additions and 0 deletions
@@ -0,0 +1,300 @@
+package tenantsync
+
+// The tenancy SSH client against an IN-PROCESS x/crypto/ssh server (the wgsync client_test
+// pattern). Beyond the transport round-trip, these pin the package's two load-bearing contracts:
+// the typed token_exists outcome, and the secret-hygiene rule that NO error message ever embeds
+// stdout bytes (stdout is the secret channel).
+
+import (
+	"bytes"
+	"context"
+	"encoding/pem"
+	"errors"
+	"io"
+	"log"
+	"net"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"crypto/ed25519"
+	"crypto/rand"
+
+	"golang.org/x/crypto/ssh"
+)
+
+func testKeys(t *testing.T) ([]byte, ssh.Signer) {
+	t.Helper()
+	_, priv, err := ed25519.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatalf("ed25519: %v", err)
+	}
+	block, err := ssh.MarshalPrivateKey(priv, "")
+	if err != nil {
+		t.Fatalf("MarshalPrivateKey: %v", err)
+	}
+	signer, err := ssh.NewSignerFromKey(priv)
+	if err != nil {
+		t.Fatalf("NewSignerFromKey: %v", err)
+	}
+	return pem.EncodeToMemory(block), signer
+}
+
+type testServer struct {
+	addr     string
+	mu       sync.Mutex
+	captured []byte
+	cmd      string
+}
+
+func startTestServer(t *testing.T, hostSigner, clientSigner ssh.Signer,
+	stdoutResp, stderrResp string, exitStatus uint32) *testServer {
+	t.Helper()
+	cfg := &ssh.ServerConfig{
+		PublicKeyCallback: func(conn ssh.ConnMetadata, key ssh.PublicKey) (*ssh.Permissions, error) {
+			if bytes.Equal(key.Marshal(), clientSigner.PublicKey().Marshal()) {
+				return &ssh.Permissions{}, nil
+			}
+			return nil, io.EOF
+		},
+	}
+	cfg.AddHostKey(hostSigner)
+
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatalf("listen: %v", err)
+	}
+	t.Cleanup(func() { ln.Close() })
+	srv := &testServer{addr: ln.Addr().String()}
+
+	go func() {
+		conn, err := ln.Accept()
+		if err != nil {
+			return
+		}
+		sconn, chans, reqs, err := ssh.NewServerConn(conn, cfg)
+		if err != nil {
+			return
+		}
+		defer sconn.Close()
+		go ssh.DiscardRequests(reqs)
+		for newCh := range chans {
+			if newCh.ChannelType() != "session" {
+				newCh.Reject(ssh.UnknownChannelType, "unsupported")
+				continue
+			}
+			ch, chReqs, err := newCh.Accept()
+			if err != nil {
+				continue
+			}
+			go func() {
+				for req := range chReqs {
+					if req.Type == "exec" {
+						var p struct{ Command string }
+						ssh.Unmarshal(req.Payload, &p)
+						srv.mu.Lock()
+						srv.cmd = p.Command
+						srv.mu.Unlock()
+						req.Reply(true, nil)
+						data, _ := io.ReadAll(ch)
+						srv.mu.Lock()
+						srv.captured = data
+						srv.mu.Unlock()
+						if stderrResp != "" {
+							ch.Stderr().Write([]byte(stderrResp))
+						}
+						if stdoutResp != "" {
+							ch.Write([]byte(stdoutResp))
+						}
+						ch.SendRequest("exit-status", false, ssh.Marshal(struct{ Status uint32 }{exitStatus}))
+						ch.Close()
+						return
+					}
+					req.Reply(false, nil)
+				}
+			}()
+		}
+	}()
+	return srv
+}
+
+func hostKeyLine(t *testing.T, s ssh.Signer) string {
+	t.Helper()
+	return strings.TrimSpace(string(ssh.MarshalAuthorizedKey(s.PublicKey())))
+}
+
+func newTestClient(t *testing.T, addr, hostKey string, clientPEM []byte) *Client {
+	t.Helper()
+	c, err := New(Config{
+		Addr: addr, User: "felhom-peersync", PrivateKey: clientPEM,
+		HostKeyLine: hostKey, Timeout: 5 * time.Second,
+	}, log.New(io.Discard, "", 0))
+	if err != nil {
+		t.Fatalf("tenantsync.New: %v", err)
+	}
+	return c
+}
+
+const okResp = `{"status":"ok","token_id":"felhom@pbs!peti","token_secret":"s3cr3t-uuid-value",` +
+	`"fingerprint":"aa:bb","datastore":"felhom-offsite","namespace":"peti"}`
+
+func TestProvision_RoundTripParsesResult(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner, okResp, "", 0)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	res, err := c.Provision(context.Background(), "peti")
+	if err != nil {
+		t.Fatalf("Provision: %v", err)
+	}
+	if res.TokenID != "felhom@pbs!peti" || res.TokenSecret != "s3cr3t-uuid-value" ||
+		res.Fingerprint != "aa:bb" || res.Datastore != "felhom-offsite" || res.Namespace != "peti" {
+		t.Errorf("Result mis-parsed: %+v", res)
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	if want := `{"customer_id":"peti","op":"provision"}`; string(srv.captured) != want {
+		t.Errorf("server received %q, want %q", srv.captured, want)
+	}
+	if srv.cmd != "felhom-tenantsync" {
+		t.Errorf("exec command = %q, want felhom-tenantsync", srv.cmd)
+	}
+}
+
+func TestProvision_TokenExistsIsTypedError(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	// The script emits the error JSON on stdout AND exits 1 — both must map to ErrTokenExists.
+	srv := startTestServer(t, hostSigner, clientSigner,
+		`{"status":"error","code":"token_exists","error":"token felhom@pbs!peti already exists"}`, "", 1)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	_, err := c.Provision(context.Background(), "peti")
+	if !errors.Is(err, ErrTokenExists) {
+		t.Fatalf("err = %v, want ErrTokenExists", err)
+	}
+}
+
+func TestReissue_SendsReissueOp(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner, okResp, "", 0)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	if _, err := c.Reissue(context.Background(), "peti"); err != nil {
+		t.Fatalf("Reissue: %v", err)
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	if want := `{"customer_id":"peti","op":"reissue"}`; string(srv.captured) != want {
+		t.Errorf("server received %q, want %q", srv.captured, want)
+	}
+}
+
+func TestFingerprint_Op(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner, `{"status":"ok","fingerprint":"cc:dd"}`, "", 0)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	fp, err := c.Fingerprint(context.Background())
+	if err != nil {
+		t.Fatalf("Fingerprint: %v", err)
+	}
+	if fp != "cc:dd" {
+		t.Errorf("fingerprint = %q, want cc:dd", fp)
+	}
+}
+
+// TestErrors_NeverEmbedStdout is the secret-hygiene contract: stdout may carry the token secret,
+// so NO error path may quote it. A malformed-but-secret-bearing stdout must yield an error that
+// does not contain the marker bytes. (wgsync quotes stdout in its malformed error — this package
+// deliberately must not; that divergence is the point of this test.)
+func TestErrors_NeverEmbedStdout(t *testing.T) {
+	cases := []struct {
+		name       string
+		stdout     string
+		exitStatus uint32
+	}{
+		{"malformed-ok-exit", `garbage SECRET-MARKER garbage`, 0},
+		{"malformed-fail-exit", `partial {"token_secret":"SECRET-MARKER"`, 1},
+		{"wrong-status", `{"status":"weird","token_secret":"SECRET-MARKER"}`, 0},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			clientPEM, clientSigner := testKeys(t)
+			_, hostSigner := testKeys(t)
+			srv := startTestServer(t, hostSigner, clientSigner, tc.stdout, "some stderr", tc.exitStatus)
+			c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+			_, err := c.Provision(context.Background(), "peti")
+			if err == nil {
+				t.Fatal("Provision accepted a malformed response")
+			}
+			if strings.Contains(err.Error(), "SECRET-MARKER") {
+				t.Errorf("error %q embeds stdout bytes — the secret channel leaked into logs", err)
+			}
+		})
+	}
+}
+
+func TestOkResponseMissingFieldsRefused(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner,
+		`{"status":"ok","token_id":"felhom@pbs!peti"}`, "", 0) // no secret/ns/fp/ds
+	c := newTestClient(t, srv.addr, hostKeyLine(t, hostSigner), clientPEM)
+
+	if _, err := c.Provision(context.Background(), "peti"); err == nil {
+		t.Fatal("Provision accepted an ok-response with missing fields")
+	}
+}
+
+func TestWrongHostKeyRefused(t *testing.T) {
+	clientPEM, clientSigner := testKeys(t)
+	_, hostSigner := testKeys(t)
+	_, otherSigner := testKeys(t)
+	srv := startTestServer(t, hostSigner, clientSigner, okResp, "", 0)
+	c := newTestClient(t, srv.addr, hostKeyLine(t, otherSigner), clientPEM)
+
+	_, err := c.Provision(context.Background(), "peti")
+	if err == nil {
+		t.Fatal("Provision succeeded against a server with the WRONG host key — the pin is dead")
+	}
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	if len(srv.captured) != 0 {
+		t.Errorf("payload leaked to a mis-keyed server: %q", srv.captured)
+	}
+}
+
+func TestInvalidCustomerIDRefusedClientSide(t *testing.T) {
+	clientPEM, _ := testKeys(t)
+	_, hostSigner := testKeys(t)
+	// No server needed — the refusal must happen before any dial.
+	c := newTestClient(t, "127.0.0.1:1", hostKeyLine(t, hostSigner), clientPEM)
+	for _, bad := range []string{"", "-leading-dash", ".dot", "has space", strings.Repeat("x", 40)} {
+		if _, err := c.Provision(context.Background(), bad); err == nil {
+			t.Errorf("customer_id %q accepted", bad)
+		}
+	}
+}
+
+func TestNew_BadInputsFailEarly(t *testing.T) {
+	clientPEM, _ := testKeys(t)
+	_, hostSigner := testKeys(t)
+	hk := hostKeyLine(t, hostSigner)
+	logger := log.New(io.Discard, "", 0)
+
+	if _, err := New(Config{Addr: "x:22", User: "u", PrivateKey: []byte("not-a-key"), HostKeyLine: hk}, logger); err == nil {
+		t.Error("bad private key accepted")
+	}
+	if _, err := New(Config{Addr: "x:22", User: "u", PrivateKey: clientPEM, HostKeyLine: "not a key line"}, logger); err == nil {
+		t.Error("bad host key line accepted")
+	}
+	if _, err := New(Config{User: "u", PrivateKey: clientPEM, HostKeyLine: hk}, logger); err == nil {
+		t.Error("missing addr accepted")
+	}
+}