Public Access
Wire the Avalonia shell to the vault
The host list now comes from the vault instead of from a form. A fresh machine takes a server URL, signs in through the browser, enrolls, and from then on opens with the passphrase alone. DodoSSH.Client.Session is the composition layer: where a profile lives, how it unlocks, and how a machine gets one. ClientPaths picks a non-roaming per-OS directory — %LOCALAPPDATA% and never %APPDATA%, because a SQLite cache that roams between two machines is a corrupt one, and each machine's outbox is its own. SessionOpener needs no transport at all and could not reach one if it wanted to; that is the offline unlock, asserted rather than asserted about. A wrong passphrase, a stale KDF and a grant revoked by a rekey are three different answers, because the remedies are three different things and telling someone to retype a passphrase that was never the problem is worse than saying nothing. The shell's states are the onboarding story. The recovery code gets its own state that cannot be clicked past: it exists for one moment, losing it with the passphrase loses the vault, and there is no server-side reset by design. It is dropped from memory on confirmation rather than merely hidden. Sign-in is a delegate over IVaultServer, so the whole state machine runs in a test against an in-memory server — no browser, no identity provider, no toolkit. The view models are plain observable objects, which is what makes that possible. What it does not cover is whether the XAML binds to the right names; that needs a rendered tree and Avalonia.Headless, and is its own piece of work. Three things found by doing it rather than by reading it: - Pooled SQLite connections keep the database file open after the last context is disposed. On Windows that means locked, so the application could never replace its own cache — and a test could not clean up after itself, which is how it surfaced. Dispose now clears the pool. - EF's SQLite provider puts the database in WAL mode, so the cache is three files. A comment in ClientCacheFactory claimed the opposite; reading PRAGMA journal_mode off a real launch settled it. WAL is the right mode here — a sync pass writes while the interface reads — so the comment was wrong on the merits as well as on the fact. - Enrolling a device key with nowhere to keep the private half would put a wrap on the server nobody can open and make the device list claim this machine can unlock without a passphrase. Device binding is now optional and the shell declines it until the OS keystore is wired. Verified on Windows: the client created %LOCALAPPDATA%\DodoSSH\cache.db and migrated it on first launch, and msedgewebview2 held an established connection to the data plane while the unlock overlay covered it — which is the point of covering the WebView rather than collapsing it, since a NativeWebView that is never laid out is never realised. 630 tests, up from 593. The recovery-code gate and the offline unlock were each verified by breaking them and watching the right test fail. Still to do for M1's actual definition of done: the manual run against the real API and a real Keycloak. Credentials are not a synced entity type yet, so a connection still asks for a password, and the interface says so rather than implying otherwise.
This commit is contained in:
@@ -0,0 +1,311 @@
|
||||
using DodoSSH.Client.Domain;
|
||||
using DodoSSH.Client.Storage;
|
||||
using DodoSSH.Crypto;
|
||||
|
||||
namespace DodoSSH.Client.Session.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// Enrolling once, then unlocking with nothing but a passphrase and a file.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The headline property here is that the second half needs no server at all. That is asserted directly:
|
||||
/// every unlock in this suite runs against a <see cref="SessionOpener"/> that has never been given a
|
||||
/// transport and could not reach one if it wanted to.
|
||||
/// </remarks>
|
||||
public sealed class SessionLifecycleTests : IAsyncLifetime
|
||||
{
|
||||
private const string Passphrase = "correct horse battery staple";
|
||||
private const string ServerUrl = "https://dodossh.example";
|
||||
|
||||
/// <remarks>
|
||||
/// Far below the shipped 256 MiB profile. The stretching is what makes a stolen wrap expensive to
|
||||
/// attack and none of these tests attack one; paying a third of a second per derivation — and there
|
||||
/// are three per enroll-and-unlock cycle — would only encourage sharing state between tests.
|
||||
/// </remarks>
|
||||
private static readonly Argon2Profile CheapProfile =
|
||||
Argon2Profile.FromStoredParameters(memoryKibibytes: 8 * 1024, passes: 1, parallelism: 1);
|
||||
|
||||
private readonly FakeAccountServer server = new();
|
||||
private readonly StubKeyBinding keyBinding = new();
|
||||
|
||||
private ClientCacheFactory caches = null!;
|
||||
|
||||
/// <inheritdoc />
|
||||
public async ValueTask InitializeAsync()
|
||||
{
|
||||
caches = ClientCacheFactory.ForMemory($"session-{Guid.CreateVersion7():N}");
|
||||
await caches.MigrateAsync(TestContext.Current.CancellationToken);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public ValueTask DisposeAsync()
|
||||
{
|
||||
caches.Dispose();
|
||||
return ValueTask.CompletedTask;
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AFreshMachine_HasNothingToUnlock()
|
||||
{
|
||||
(await Opener().ReadProfileAsync(Token)).ShouldBeNull();
|
||||
|
||||
var outcome = await Opener().UnlockAsync(Passphrase, Token);
|
||||
|
||||
outcome.Status.ShouldBe(UnlockStatus.NotEnrolled);
|
||||
outcome.Session.ShouldBeNull();
|
||||
outcome.Message.ShouldContain("not enrolled");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task EnrollingLeavesEverythingAnOfflineUnlockNeeds()
|
||||
{
|
||||
// The property the whole storage layer exists for. After this point the passphrase alone opens
|
||||
// the vault: no salt is fetched, no grant is fetched, nothing is asked of a server.
|
||||
var provision = await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
provision.Status.ShouldBe(ProvisionStatus.Ready);
|
||||
provision.RecoveryCode.ShouldNotBeNullOrWhiteSpace();
|
||||
|
||||
await using var session = await UnlockAsync();
|
||||
|
||||
session.Profile.UserId.ShouldBe(server.UserId);
|
||||
session.Profile.ServerUrl.ShouldBe(ServerUrl);
|
||||
session.Profile.Issuer.ShouldBe(FakeAccountServer.Issuer);
|
||||
session.Vaults.ShouldHaveSingleItem().Name.ShouldBe("Personal");
|
||||
session.UnreadableVaults.ShouldBeEmpty();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TheProfileCanBeReadWithoutThePassphrase()
|
||||
{
|
||||
// So the unlock screen can say who it is asking, rather than showing an unexplained password box.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
var profile = await Opener().ReadProfileAsync(Token);
|
||||
|
||||
profile.ShouldNotBeNull();
|
||||
profile.Email.ShouldBe("alice@example.com");
|
||||
profile.DisplayName.ShouldBe("Alice");
|
||||
profile.ServerUrl.ShouldBe(ServerUrl);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TheWrongPassphrase_IsAnAnswerRatherThanAnException()
|
||||
{
|
||||
// The overwhelmingly common failure. It is also indistinguishable from a tampered wrap, which is
|
||||
// correct: the AEAD tag is the only evidence either way and no verifier is stored anywhere.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
var outcome = await Opener().UnlockAsync("not the passphrase", Token);
|
||||
|
||||
outcome.Status.ShouldBe(UnlockStatus.WrongPassphrase);
|
||||
outcome.Session.ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task NoDeviceKeyIsRegistered()
|
||||
{
|
||||
// A device wrap whose private half has nowhere to live is a row nobody can ever open, and it would
|
||||
// make the account's device list claim this machine can unlock without a passphrase. Until the OS
|
||||
// keystore is wired, not offering it is the honest answer.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
var request = server.LastEnrollment.ShouldNotBeNull();
|
||||
request.DevicePublicKey.ShouldBeNull();
|
||||
request.DeviceWrappedPrivateKey.ShouldBeNull();
|
||||
|
||||
// The recovery wrap is still registered: it is the only route back if the passphrase is lost.
|
||||
request.RecoveryWrappedPrivateKey.ShouldNotBeNull();
|
||||
request.RecoveryKdfParameters.ShouldNotBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AnAlreadyEnrolledAccount_IsNotEnrolledAgain()
|
||||
{
|
||||
// Re-enrolling would replace an identity key that other members may already have wrapped vault
|
||||
// keys to, which is a far worse outcome than asking for the existing passphrase.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
var second = await Provisioner().EnrollAsync(ServerUrl, "a different one", "desktop", "Personal", Token);
|
||||
|
||||
second.Status.ShouldBe(ProvisionStatus.Ready);
|
||||
second.RecoveryCode.ShouldBeNull();
|
||||
server.EnrollmentCount.ShouldBe(1);
|
||||
|
||||
// And the original passphrase still works, because nothing was replaced.
|
||||
await using var session = await UnlockAsync();
|
||||
session.Vaults.ShouldHaveSingleItem();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task SigningInToAnUnenrolledAccount_AsksForEnrollmentRatherThanFailing()
|
||||
{
|
||||
var outcome = await Provisioner().RefreshAsync(ServerUrl, Token);
|
||||
|
||||
outcome.Status.ShouldBe(ProvisionStatus.EnrollmentRequired);
|
||||
outcome.Me.EnrollmentRequired.ShouldBeTrue();
|
||||
|
||||
// Nothing was cached, so an unlock still reports honestly.
|
||||
(await Opener().ReadProfileAsync(Token)).ShouldBeNull();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task RefreshingAnEnrolledAccount_RepairsACacheThatLostItsVaults()
|
||||
{
|
||||
// What signing in on a machine whose cache was cleared looks like. The material comes back from
|
||||
// the server, and the passphrase — which the server never had — opens it again.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
using var replacement = ClientCacheFactory.ForMemory($"session-{Guid.CreateVersion7():N}");
|
||||
await replacement.MigrateAsync(Token);
|
||||
|
||||
var outcome = await new AccountProvisioner(
|
||||
server, keyBinding, replacement, TimeProvider.System, CheapProfile)
|
||||
.RefreshAsync(ServerUrl, Token);
|
||||
|
||||
outcome.Status.ShouldBe(ProvisionStatus.Ready);
|
||||
|
||||
var unlocked = await new SessionOpener(replacement, TimeProvider.System)
|
||||
.UnlockAsync(Passphrase, Token);
|
||||
|
||||
unlocked.IsUnlocked.ShouldBeTrue(unlocked.Message);
|
||||
await unlocked.Session!.DisposeAsync();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AVaultWhoseGrantWasRevoked_SaysSoRatherThanLookingEmpty()
|
||||
{
|
||||
// A rekey this client has not been re-issued for. Reporting a wrong passphrase here would send the
|
||||
// user to retype something that was never the problem.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
server.RevokeVaultGrant();
|
||||
await Provisioner().RefreshAsync(ServerUrl, Token);
|
||||
|
||||
var outcome = await Opener().UnlockAsync(Passphrase, Token);
|
||||
|
||||
outcome.Status.ShouldBe(UnlockStatus.NoReadableVault);
|
||||
outcome.Message.ShouldContain("rotated");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AnUnsupportedKdf_IsNamedRatherThanThrowingFromLibsodium()
|
||||
{
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
var profile = (await Opener().ReadProfileAsync(Token)).ShouldNotBeNull();
|
||||
|
||||
await new UnlockStore(caches, TimeProvider.System).SaveAsync(
|
||||
profile with
|
||||
{
|
||||
KdfParameters = profile.KdfParameters with { Algorithm = "argon2-from-the-future" },
|
||||
},
|
||||
Token);
|
||||
|
||||
var outcome = await Opener().UnlockAsync(Passphrase, Token);
|
||||
|
||||
outcome.Status.ShouldBe(UnlockStatus.UnsupportedKdf);
|
||||
outcome.Message.ShouldContain("argon2-from-the-future");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AnUnlockedSession_ReadsAndWritesHostsWithNoServer()
|
||||
{
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
await using var session = await UnlockAsync();
|
||||
|
||||
var entityId = await session.Hosts.CreateAsync(
|
||||
session.ActiveVaultId, Host("prod-db"), Token);
|
||||
|
||||
var listing = await session.Hosts.ListAsync(session.ActiveVaultId, Token);
|
||||
|
||||
var host = listing.Hosts.ShouldHaveSingleItem();
|
||||
host.EntityId.ShouldBe(entityId);
|
||||
host.Host.Label.ShouldBe("prod-db");
|
||||
host.HasUnsyncedChanges.ShouldBeTrue();
|
||||
|
||||
(await session.PendingChangeCountAsync(Token)).ShouldBe(1);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ASessionSyncsThroughWhicheverTransportItIsHanded()
|
||||
{
|
||||
// The session deliberately holds no transport: losing the network invalidates the connection, not
|
||||
// the vault.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
await using var session = await UnlockAsync();
|
||||
await session.Hosts.CreateAsync(session.ActiveVaultId, Host("prod-db"), Token);
|
||||
|
||||
var transport = new EmptySyncApi();
|
||||
var report = await session.SyncAsync(transport, Token);
|
||||
|
||||
report.Pushed.ShouldBe(1);
|
||||
transport.PushCount.ShouldBe(1);
|
||||
(await session.PendingChangeCountAsync(Token)).ShouldBe(0);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ADisposedSession_RefusesToBeUsed()
|
||||
{
|
||||
// Locking is disposing, so this is what "locked" has to mean in practice.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
var session = await UnlockAsync();
|
||||
var vaultId = session.ActiveVaultId;
|
||||
|
||||
await session.DisposeAsync();
|
||||
|
||||
await Should.ThrowAsync<ObjectDisposedException>(
|
||||
async () => await session.ReadConflictsAsync(Token));
|
||||
|
||||
await Should.ThrowAsync<ObjectDisposedException>(
|
||||
async () => await session.Hosts.ListAsync(vaultId, Token));
|
||||
|
||||
// Idempotent, because shutdown paths call it more than once.
|
||||
await session.DisposeAsync();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ASecondUnlock_ProducesAnIndependentSession()
|
||||
{
|
||||
// Two windows, or a lock followed by an unlock. Disposing one must not take the other's keys with
|
||||
// it, which it would if anything here were shared statically.
|
||||
await Provisioner().EnrollAsync(ServerUrl, Passphrase, "laptop", "Personal", Token);
|
||||
|
||||
var first = await UnlockAsync();
|
||||
await using var second = await UnlockAsync();
|
||||
|
||||
await first.DisposeAsync();
|
||||
|
||||
var listing = await second.Hosts.ListAsync(second.ActiveVaultId, Token);
|
||||
listing.Unreadable.ShouldBe(0);
|
||||
}
|
||||
|
||||
// ---- Helpers ----
|
||||
|
||||
private static CancellationToken Token => TestContext.Current.CancellationToken;
|
||||
|
||||
private SessionOpener Opener() => new(caches, TimeProvider.System);
|
||||
|
||||
private AccountProvisioner Provisioner() =>
|
||||
new(server, keyBinding, caches, TimeProvider.System, CheapProfile);
|
||||
|
||||
private async Task<VaultSession> UnlockAsync()
|
||||
{
|
||||
var outcome = await Opener().UnlockAsync(Passphrase, Token);
|
||||
|
||||
outcome.IsUnlocked.ShouldBeTrue(outcome.Message);
|
||||
return outcome.Session!;
|
||||
}
|
||||
|
||||
private static HostSecret Host(string label) =>
|
||||
new()
|
||||
{
|
||||
Label = label,
|
||||
Hostname = "db.internal",
|
||||
Port = 22,
|
||||
Username = "deploy",
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user