DodoTech-Public/DodoSSH
Public Access
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Add /me and enrollment with the identity-provider key binding (M1)

Browse Source 
The last backend piece of M1. A client can now log in, discover it must
enroll, publish its identity key, and get a usable personal vault.

Enrollment is one indivisible act. One transaction writes the key, its
wraps, the device, the key log entry, the vault and the vault key grant,
because none of them is useful alone: a key with no vault leaves a user
unable to store anything, and a vault with no grant is a container nobody
can ever open -- including its owner, since only the client can wrap the
key and it has already moved on.

Two independent checks run, and neither substitutes for the other. The
Ed25519 self-signature proves possession of the private key. The
identity-provider binding proves whose key it is: the client hashed its
statement, used the hash as an OIDC nonce, and the resulting ID token is
the provider's signature over exactly those public keys. This server
cannot mint that signature, so it cannot invent a key for a user who never
enrolled -- which is the attack that would otherwise let an operator read
every vault by publishing its own key as yours.

The binding token is stored verbatim, not just summarised. Clients must
repeat the check against the provider's JWKS fetched directly, and storing
only our conclusion would ask them to trust the server about the one
question the design exists to avoid trusting it about.

Key log appends take a deployment-wide advisory lock. The falsification
matters more than the passing test: with the lock removed,
Enroll_ConcurrentEnrollmentsByDifferentUsers_LeaveAnUnbrokenChain fails
with entry 11 linked to the wrong predecessor. Different users trip no
unique index, so without serialising they all read the same head and the
chain forks -- indistinguishable from the key substitution the log exists
to make detectable, and permanent, because the log is append-only.

Enrollment is idempotent. Vault ids and keys are client-chosen, so a
client whose response was lost re-sends the identical body and gets the
identical result. Without that, a lost response leaves a user enrolled
against a vault they never learned the id of.

Contract change, breaking the v0.1 freeze deliberately. EnrollmentRequest
had DevicePublicKey but no wrap to go with it, which is unsatisfiable:
only the holder of the secret bundle can seal it, so the server could
never fill the gap. Added DeviceWrappedPrivateKey, and PersonalVault so
enrollment can be atomic rather than leaving an unopenable vault behind
two endpoints that do not exist yet. No client exists and no package is
published, which is exactly when PublicAPI.Unshipped.txt expects this.

Sync now requires the Enrolled policy, which until now was a stub whose
name promised a check it never made. The sync denial tests use enrolled
intruders instead of unenrolled ones -- an unenrolled caller is stopped
before the vault check runs, which would have left those tests passing
without exercising the thing they exist to prove.

Also fixed: omitting kdfParameters from the JSON body was a 500. A
record's non-nullable parameters are a compile-time promise, not a runtime
one.

268 tests pass, zero warnings on a clean rebuild, format clean.
This commit is contained in:
jaap-jan
2026-07-28 16:06:35 +02:00
parent d2a2ed8a29
commit a628762cd1
25 changed files with 2863 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/DodoSSH.Api.Tests/SyncEndpointTests.cs
+80 -68
View File
@@ -101,6 +101,42 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
response.StatusCode.ShouldBe(HttpStatusCode.Unauthorized);
}
// ---- Authorization: the caller must have enrolled ----
[Fact]
public async Task Pull_BeforeEnrolling_Is403WithAnActionableCode()
{
// Not a confidentiality boundary — an unenrolled user owns no vault anyway. The value is
// that the client is told what to do instead of receiving an empty 403 or, worse,
// ciphertext it has no key for.
var client = fixture.CreateClientFor(NewSubject());
var response = await client.PostAsJsonAsync(
PullUrl(Guid.CreateVersion7()),
new SyncPullRequest(null, null, null));
response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
var problem = await response.Content.ReadFromJsonAsync<JsonProblem>();
problem.ShouldNotBeNull();
problem.Code.ShouldBe(ProblemCodes.EnrollmentRequired);
}
[Fact]
public async Task Push_BeforeEnrolling_Is403AndWritesNothing()
{
var (_, vaultId) = await SeedUserWithVaultAsync();
var client = fixture.CreateClientFor(NewSubject());
var response = await client.PostAsJsonAsync(PushUrl(vaultId), NewCreateBatch());
response.StatusCode.ShouldBe(HttpStatusCode.Forbidden);
await using var scope = fixture.CreateScope();
var database = scope.ServiceProvider.GetRequiredService<DodoDbContext>();
(await database.VaultChanges.AnyAsync(c => c.VaultId == vaultId)).ShouldBeFalse();
}
// ---- Authorization: the wrong user must be denied ----
[Fact]
@@ -109,7 +145,7 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
// 404 rather than 403: a distinct "exists but forbidden" answer would let a caller
// enumerate other tenants' vault ids.
var (_, vaultId) = await SeedUserWithVaultAsync();
var intruder = fixture.CreateClientFor(NewSubject());
var intruder = fixture.CreateClientFor(await SeedEnrolledUserAsync());
var response = await intruder.PostAsJsonAsync(
PullUrl(vaultId),
@@ -122,7 +158,7 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
public async Task Push_AnotherUsersVault_Is404()
{
var (_, vaultId) = await SeedUserWithVaultAsync();
var intruder = fixture.CreateClientFor(NewSubject());
var intruder = fixture.CreateClientFor(await SeedEnrolledUserAsync());
var response = await intruder.PostAsJsonAsync(PushUrl(vaultId), NewCreateBatch());
@@ -134,7 +170,7 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
{
// A denial that still mutated state would be worse than no check at all.
var (_, vaultId) = await SeedUserWithVaultAsync();
var intruder = fixture.CreateClientFor(NewSubject());
var intruder = fixture.CreateClientFor(await SeedEnrolledUserAsync());
var batch = NewCreateBatch();
await intruder.PostAsJsonAsync(PushUrl(vaultId), batch);
@@ -149,7 +185,7 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
[Fact]
public async Task Pull_ANonexistentVault_Is404()
{
var client = fixture.CreateClientFor(NewSubject());
var client = fixture.CreateClientFor(await SeedEnrolledUserAsync());
var response = await client.PostAsJsonAsync(
PullUrl(Guid.CreateVersion7()),
@@ -163,7 +199,7 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
{
// Failing closed on an unimplemented path, rather than falling through to a default.
var vaultId = await SeedTeamVaultAsync();
var client = fixture.CreateClientFor(NewSubject());
var client = fixture.CreateClientFor(await SeedEnrolledUserAsync());
var response = await client.PostAsJsonAsync(
PullUrl(vaultId),
@@ -569,48 +605,8 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
body!.Results[0].Status.ShouldBe(SyncOperationStatus.Invalid);
}
// ---- JIT provisioning ----
[Fact]
public async Task AFirstRequest_ProvisionsTheUser()
{
var subject = NewSubject();
var email = $"{subject}@example.com";
var client = fixture.CreateClientFor(subject, email);
// Any authenticated call is enough to trigger provisioning.
await client.PostAsJsonAsync(
PullUrl(Guid.CreateVersion7()),
new SyncPullRequest(null, null, null));
await using var scope = fixture.CreateScope();
var database = scope.ServiceProvider.GetRequiredService<DodoDbContext>();
var user = await database.Users.SingleOrDefaultAsync(u => u.Subject == subject);
user.ShouldNotBeNull();
user.Issuer.ShouldBe(fixture.IdentityProvider.Authority);
user.Email.ShouldBe(email);
user.Status.ShouldBe(UserStatus.Active);
}
[Fact]
public async Task RepeatedRequests_ProvisionOnlyOnce()
{
var subject = NewSubject();
var client = fixture.CreateClientFor(subject);
for (var i = 0; i < 3; i++)
{
await client.PostAsJsonAsync(
PullUrl(Guid.CreateVersion7()),
new SyncPullRequest(null, null, null));
}
await using var scope = fixture.CreateScope();
var database = scope.ServiceProvider.GetRequiredService<DodoDbContext>();
(await database.Users.CountAsync(u => u.Subject == subject)).ShouldBe(1);
}
// Just-in-time provisioning is covered by IdentityEndpointTests, against /me — the endpoint a
// client actually calls first, and the only one reachable before enrollment.
// ---- Helpers ----
@@ -640,15 +636,7 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
await using var scope = fixture.CreateScope();
var database = scope.ServiceProvider.GetRequiredService<DodoDbContext>();
var user = new UserAccount
{
Id = Guid.CreateVersion7(),
Issuer = fixture.IdentityProvider.Authority,
Subject = subject,
Status = UserStatus.Active,
CreatedAtUtc = Now,
UpdatedAtUtc = Now,
};
var user = NewUser(subject);
var vault = new Vault
{
@@ -662,26 +650,53 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
};
database.Users.Add(user);
database.UserKeys.Add(Seed.CurrentKey(user.Id, Now));
database.Vaults.Add(vault);
await database.SaveChangesAsync();
return (subject, vault.Id);
}
/// <summary>
/// An enrolled user with no vault of their own: the realistic intruder.
/// </summary>
/// <remarks>
/// The denial tests use one of these rather than an unenrolled caller. An unenrolled caller is
/// stopped by the enrolled policy before the vault check runs at all, which would leave the
/// authorization tests passing without ever exercising the thing they exist to prove.
/// </remarks>
private async Task<string> SeedEnrolledUserAsync()
{
var subject = NewSubject();
await using var scope = fixture.CreateScope();
var database = scope.ServiceProvider.GetRequiredService<DodoDbContext>();
var user = NewUser(subject);
database.Users.Add(user);
database.UserKeys.Add(Seed.CurrentKey(user.Id, Now));
await database.SaveChangesAsync();
return subject;
}
private UserAccount NewUser(string subject) =>
new()
{
Id = Guid.CreateVersion7(),
Issuer = fixture.IdentityProvider.Authority,
Subject = subject,
Status = UserStatus.Active,
CreatedAtUtc = Now,
UpdatedAtUtc = Now,
};
private async Task<Guid> SeedTeamVaultAsync()
{
await using var scope = fixture.CreateScope();
var database = scope.ServiceProvider.GetRequiredService<DodoDbContext>();
var owner = new UserAccount
{
Id = Guid.CreateVersion7(),
Issuer = fixture.IdentityProvider.Authority,
Subject = NewSubject(),
Status = UserStatus.Active,
CreatedAtUtc = Now,
UpdatedAtUtc = Now,
};
var owner = NewUser(NewSubject());
var team = new Team
{
@@ -710,7 +725,4 @@ public sealed class SyncEndpointTests(ApiFixture fixture)
return vault.Id;
}
/// <summary>Minimal ProblemDetails shape, for asserting on the code extension.</summary>
private sealed record JsonProblem(string? Type, string? Detail, string? Code);
}