Public Access
Fill in the Spelunk API key on the Security page, as a synced Spelunk key that goes only to its own address
Settings → Security gains a SPELUNK section: an API address and a key, saved as a new keychain item, a Spelunk key (SyncEntityType 14, AadResourceType 17, server table spelunk_key via the AddSpelunkKeyItem migration). It is ciphertext only on the server, lives in the personal vault, syncs like every secret, and holds the key together with the one address it may be sent to. The key box empties once saved; the list shows name, address and how many hosts use each key, never the key. Saving a key for an address that already has one replaces it, and deleting goes through the shared confirmation card with the hosts that would stop connecting. A host's route names a saved key where it named a credential, in the same apiKeyCredentialId field, so no host schema changes and an older build reads such a host as one whose key credential has gone. At connect a saved key is sent only to its own address; a host naming it with another Spelunk address is refused in words. Keys kept as a credential's password still work. The editor offers saved keys first and picks the one saved for an address as it is typed. A link from a Spelunk with a saved key now connects straight away, including the first one: saving the key is the user's say-so that the first-link editor used to ask for. The address and key merge as one pair, so two concurrent edits can never pair one device's key with another's address, and the key never reaches the conflict log.
This commit is contained in:
jaap-jan committed
1 parent
ee423b25ce
commit
b08f2c58e3
37 files changed
+3907
-64
No files matched your search
@@ -507,6 +507,158 @@ public sealed partial class ShellFlowTests
|
||||
vault.Status.ShouldNotBeNull().ShouldContain("Finish or cancel");
|
||||
}
|
||||
|
||||
// ---- A Spelunk key saved on the Security page ----
|
||||
|
||||
[Fact]
|
||||
public async Task AKeySavedOnTheSecurityPage_LetsTheFirstLinkConnectStraightAway()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await SaveSpelunkKeyAsync(vault, SpelunkApi + "/", SpelunkApiKey);
|
||||
|
||||
// Saved in the one form, in the personal vault, and gone from the form.
|
||||
var saved = vault.SpelunkKeys.ShouldHaveSingleItem();
|
||||
saved.ApiBase.ShouldBe(SpelunkApi);
|
||||
saved.VaultId.ShouldBe(vault.TargetVaults.Single(choice => choice.IsPersonal).VaultId);
|
||||
vault.SpelunkKeyFormKey.ShouldBeEmpty();
|
||||
|
||||
await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
|
||||
await vault.OpenSpelunkLinkAsync(Link(host: "203.0.113.10"));
|
||||
|
||||
vault.IsEditing.ShouldBeFalse("saving the key for this Spelunk is the say-so the first link used to ask for");
|
||||
|
||||
var added = vault.Hosts.ShouldHaveSingleItem();
|
||||
added.Host.Spelunk.ShouldNotBeNull().ApiKeyCredentialId.ShouldBe(saved.EntityId);
|
||||
added.Host.SignsInThroughSpelunk.ShouldBeTrue();
|
||||
|
||||
spelunkTunnels.Opened.ShouldHaveSingleItem().ShouldBe((SpelunkApi, SpelunkServer, SpelunkApiKey, 22));
|
||||
|
||||
await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ASecondKeyForTheSameSpelunk_ReplacesTheFirst_AndHostsUseTheNewOne()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await SaveSpelunkKeyAsync(vault, SpelunkApi, "spelunk_the_old_key");
|
||||
|
||||
await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
|
||||
await vault.OpenSpelunkLinkAsync(Link());
|
||||
await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
|
||||
|
||||
await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
|
||||
|
||||
vault.SpelunkKeys.ShouldHaveSingleItem().UsedBy.ShouldBe("1 host uses it");
|
||||
vault.SpelunkKeyFormNote.ShouldContain("Replaced");
|
||||
|
||||
await vault.OpenSpelunkLinkAsync(Link());
|
||||
|
||||
spelunkTunnels.Opened.Select(opened => opened.ApiKey).ShouldBe(["spelunk_the_old_key", SpelunkApiKey]);
|
||||
|
||||
await ssh.Requests[1].Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task ASavedKey_IsNeverSentToAnotherSpelunk()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
|
||||
var saved = vault.SpelunkKeys.ShouldHaveSingleItem();
|
||||
|
||||
// A host that names the key but another address — the one thing a key kept with its address refuses.
|
||||
vault.NewHostCommand.Execute(null);
|
||||
vault.EditorLabel = "web-01";
|
||||
vault.EditorHostname = "203.0.113.10";
|
||||
vault.EditorThroughSpelunk = true;
|
||||
vault.EditorSpelunkSignIn = true;
|
||||
vault.EditorSpelunkApi = "https://spelunk.somewhere-else.example";
|
||||
vault.EditorSpelunkServerId = SpelunkServer.ToString();
|
||||
vault.EditorSelectedSpelunkKey = vault.EditorSpelunkKeyChoices.Single(choice => choice.EntityId == saved.EntityId);
|
||||
await vault.SaveHostCommand.ExecuteAsync(null);
|
||||
|
||||
vault.SelectedHost = vault.Hosts.ShouldHaveSingleItem(vault.Status);
|
||||
|
||||
await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
|
||||
await vault.ConnectCommand.ExecuteAsync(null);
|
||||
|
||||
spelunkTunnels.Opened.ShouldBeEmpty();
|
||||
ssh.Requests.ShouldBeEmpty();
|
||||
vault.Status.ShouldNotBeNull().ShouldContain("never sent anywhere else");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TypingTheAddressOfASavedKey_PicksThatKey_InTheEditor()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await AddCredentialAsync(vault, "an older key", password: "spelunk_older");
|
||||
await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
|
||||
|
||||
vault.NewHostCommand.Execute(null);
|
||||
vault.EditorThroughSpelunk = true;
|
||||
vault.EditorSpelunkApi = SpelunkApi + "/";
|
||||
|
||||
var chosen = vault.EditorSelectedSpelunkKey.ShouldNotBeNull();
|
||||
chosen.EntityId.ShouldBe(vault.SpelunkKeys.Single().EntityId);
|
||||
chosen.Qualifier.ShouldBe($"Spelunk key · {SpelunkApi}");
|
||||
|
||||
// Saved keys come before credentials, which stay on offer for keys kept the older way.
|
||||
vault.EditorSpelunkKeyChoices.Select(choice => choice.Label)
|
||||
.ShouldBe(["Spelunk at api.spelunk.example.com", "an older key"]);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task AnAddressThatWouldSendTheKeyInClear_IsRefusedOnTheForm()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await SaveSpelunkKeyAsync(vault, "http://api.spelunk.example.com", SpelunkApiKey);
|
||||
|
||||
vault.SpelunkKeys.ShouldBeEmpty();
|
||||
vault.SpelunkKeyFormNote.ShouldContain("https");
|
||||
vault.SpelunkKeyFormKey.ShouldBe(SpelunkApiKey, "a refused key stays in the box to be saved once the address is fixed");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task DeletingASavedKey_SaysWhichHostsWillStopConnecting()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await SaveSpelunkKeyAsync(vault, SpelunkApi, SpelunkApiKey);
|
||||
|
||||
await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
|
||||
await vault.OpenSpelunkLinkAsync(Link());
|
||||
await ssh.Requests.ShouldHaveSingleItem().Proxy.ShouldNotBeNull().Lifetime.ShouldNotBeNull().DisposeAsync();
|
||||
|
||||
vault.DeleteSpelunkKeyRowCommand.Execute(vault.SpelunkKeys.Single());
|
||||
|
||||
var request = vault.PendingDeletion.ShouldNotBeNull();
|
||||
request.Usage.ShouldContain("web 01 reaches Spelunk with it");
|
||||
|
||||
await vault.ConfirmDeleteCommand.ExecuteAsync(null);
|
||||
|
||||
vault.SpelunkKeys.ShouldBeEmpty();
|
||||
|
||||
await vault.ConnectToRowCommand.ExecuteAsync(vault.Hosts.Single());
|
||||
vault.Status.ShouldNotBeNull().ShouldContain("not in this keychain any more");
|
||||
}
|
||||
|
||||
private static async Task SaveSpelunkKeyAsync(VaultViewModel vault, string apiBase, string apiKey)
|
||||
{
|
||||
vault.SpelunkKeyFormApi = apiBase;
|
||||
vault.SpelunkKeyFormKey = apiKey;
|
||||
|
||||
await vault.SaveSpelunkKeyCommand.ExecuteAsync(null);
|
||||
}
|
||||
|
||||
/// <summary>A saved host through Spelunk, bound to a stored SSH password, with its key in the keychain.</summary>
|
||||
private async Task<VaultViewModel> ReadyToConnectThroughSpelunkAsync()
|
||||
{
|
||||
|
||||
Reference in new issue
Block a user