DodoTech-Public/DodoSSH
Public Access
2
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases 2 Wiki Activity

Sync and authenticate with SSH keys on the client

Browse Source 
Completes the client half of SSH keys: they sync alongside hosts, appear in
their own list, and can be selected to authenticate a connection instead of
typing a password.

The reconciler and the repository were Host-typed throughout, so the choice was
to generalise them or to keep a second copy per item type. Generalised, because
ItemReconciler's whole premise is that the pull and the push paths must answer
the same collision the same way — two copies would drift the first time one of
them was fixed. What is genuinely per-type now arrives through
IItemKind<TSecret>: the cipher, the merge, the plaintext columns, and the noun
to use when telling a person what happened to their item. Generic where the
server's IItemKind is not, and for the reason that reverses there — the client
needs the concrete type, because it merges field by field.

The pull filter is derived from the same registry that builds the reconcilers.
That is the specific failure being designed out: an item type that encrypts,
merges and lists perfectly and is never once requested from the server, so it
works on the machine that made it and exists nowhere else.

No client cache migration. The item table's primary key and the outbox's unique
index already carry the entity type, and AadResourceTypes already mapped SshKey
— so a host and a key may share an id and never see each other's rows, which
SshKeySyncTests now arranges deliberately.

A key hands the server nothing in plaintext. There is a public_key_fingerprint
column and it would be accepted; leaving it null is deliberate. A fingerprint is
not secret but it is a stable identifier for a key pair, so filling it would let
an operator tell which of their users hold the same key and correlate one across
vaults, for a column nothing reads. The design allows itself one plaintext
concession — the relay address, which the relay cannot work without — and this
is not that.

A key is chosen per connection rather than bound to a host, which works the way
ssh -i does. Binding one needs a field on HostSecret and therefore a payload
schema bump, which makes every host written afterwards read-only on an older
build; worth doing deliberately rather than as a side effect of adding keys.

Three things this found, all of them by being falsified rather than by review:

- Making the reconciler generic silently turned a record comparison into
  reference equality, because == on a type parameter is not value equality. The
  effect would have been a conflict recorded on every pass for an unacknowledged
  create that had in fact landed. Sabotaging the fix left all 73 tests passing —
  nothing covered that branch — so ConflictMatrixTests now has
  AnUnacknowledgedCreateThatDidLand_IsDroppedQuietly, which fails without it.

- A test asserting that a blank passphrase reaches SSH.NET as null was vacuous:
  it exercised the editor, not the credential path, and passed with the guard
  deleted. Resolved by making SshKeySecret.Passphrase normalise an empty string
  to null, so there is one spelling of one state — which also keeps two clients
  from producing different payload bytes for an identical key. That exposed a
  wider gap: SshKeySecret, its codec and its merge had no direct unit tests at
  all. They have 25 now.

- The reason first given for that normalisation was false. It claimed SSH.NET
  rejects a passphrase supplied for an unprotected key; measured against a real
  sshd it ignores it and authenticates anyway. Corrected everywhere it was
  stated and recorded in docs/platform-flags.md. The same test file also closes
  a real hole: SshPrivateKeyCredential had never been exercised against a
  server, because the existing key test builds SSH.NET's auth method directly
  and bypasses the path a vault-held key actually takes.

Only one editor may be open at a time. Both sit in the same 340-pixel column as
Auto rows and their heights together exceed it at the window's minimum size, so
two open editors put the lower one's Save and Cancel past the bottom edge — the
same failure this window already shipped once with the setup screens. Expressed
as a state rule because that is the only form of it this repository can check:
nothing here loads a .axaml. The refusal keeps what was typed, since in the key
editor that is a pasted private key the user may have nowhere else.

The end-to-end slice now carries a key as well as a host, so both item types go
through the real API, the real PostgreSQL and the real crypto in one pass — the
three hand-kept mappings between enums that do not line up are the reason that
is worth doing rather than trusting the unit suites.

735 tests green, including the container-backed SSH and end-to-end suites. Zero
warnings, dotnet format clean.
This commit is contained in:
jaap-jan
2026-07-29 20:27:23 +02:00
parent 586cb303d5
commit e3fd3e1728
26 changed files with 2804 additions and 505 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/DodoSSH.Client.App.Tests/FakeVaultServer.cs
+9 -3
View File
@@ -20,7 +20,13 @@ namespace DodoSSH.Client.App.Tests;
internal sealed class FakeVaultServer : IVaultServer, IAccountApi, ISyncApi, IKeyBindingAuthorizer
{
private readonly List<SyncChange> log = [];
private readonly Dictionary<Guid, SyncChange> rows = [];
/// <remarks>
/// Keyed on the entity type as well as the id, as the server's tables and the client's cache both are.
/// Ids are UUIDv7 so a collision between two types will not happen by accident — but a fake that would
/// treat a host and a key with one id as one row is a fake that could make a real bug pass.
/// </remarks>
private readonly Dictionary<(SyncEntityType Type, Guid EntityId), SyncChange> rows = [];
private KeyStatement? statement;
private byte[]? wrappedPrivateKey;
@@ -172,7 +178,7 @@ internal sealed class FakeVaultServer : IVaultServer, IAccountApi, ISyncApi, IKe
private SyncPushResult Apply(SyncPushOperation operation)
{
rows.TryGetValue(operation.EntityId, out var existing);
rows.TryGetValue((operation.EntityType, operation.EntityId), out var existing);
var current = existing?.Operation == SyncOperation.Delete ? null : existing;
@@ -201,7 +207,7 @@ internal sealed class FakeVaultServer : IVaultServer, IAccountApi, ISyncApi, IKe
: operation.PlaintextFields,
UpdatedAt: DateTimeOffset.FromUnixTimeSeconds(1_750_000_000 + sequence));
rows[operation.EntityId] = change;
rows[(operation.EntityType, operation.EntityId)] = change;
log.Add(change);
return new SyncPushResult(
tests/DodoSSH.Client.App.Tests/ShellFlowTests.cs
+314
View File
@@ -706,10 +706,300 @@ public sealed class ShellFlowTests : IAsyncLifetime
shell.HasLiveSessions.ShouldBeFalse("an ordinary lock must not warn about nothing");
}
// ---- SSH keys ----
[Fact]
public async Task AddingAKey_ShowsItImmediatelyAndPushesIt()
{
await UnlockedAsync();
var vault = shell.Vault!;
vault.NewKeyCommand.Execute(null);
vault.IsEditingKey.ShouldBeTrue();
vault.KeyEditorLabel = "deploy";
vault.KeyEditorPrivateKey = PrivateKey("MATERIAL");
vault.KeyEditorPassphrase = "hunter2";
await vault.SaveKeyCommand.ExecuteAsync(null);
vault.IsEditingKey.ShouldBeFalse();
var row = vault.Keys.ShouldHaveSingleItem();
row.Label.ShouldBe("deploy");
row.Description.ShouldBe("passphrase · no public half");
row.HasUnsyncedChanges.ShouldBeFalse("saving pushes, so nothing should still be pending");
vault.PendingChanges.ShouldBe(0);
server.LiveRowCount.ShouldBe(1, "a saved key should reach the server without pressing Sync");
// And the host list is untouched, so the two lists are genuinely separate.
vault.Hosts.ShouldBeEmpty();
}
[Fact]
public async Task AddingAKey_DoesNotSelectItForAuthenticationByItself()
{
// Loading or saving must not decide how the next connection authenticates. The alternative — the
// host list's habit of selecting the first row — would mean a key nobody chose being offered to a
// host, which is a credential leaving the vault by accident.
await UnlockedAsync();
var vault = shell.Vault!;
await AddKeyAsync(vault, "deploy");
vault.UseKeyAuthentication.ShouldBeFalse();
await vault.SyncCommand.ExecuteAsync(null);
vault.Keys.ShouldHaveSingleItem();
vault.SelectedKey.ShouldNotBeNull("saving selects the key it just saved, so it can be edited");
// But a reload that did not save anything leaves the selection alone rather than inventing one.
vault.SelectedKey = null;
await vault.SyncCommand.ExecuteAsync(null);
vault.SelectedKey.ShouldBeNull();
}
[Fact]
public async Task EditingAKey_RoundTripsThroughTheEditorIncludingTheMaterial()
{
await UnlockedAsync();
var vault = shell.Vault!;
await AddKeyAsync(vault, "deploy");
await vault.SyncCommand.ExecuteAsync(null);
vault.SelectedKey = vault.Keys[0];
vault.EditSelectedKeyCommand.Execute(null);
// The material has to come back into the editor. The codec has no partial update, so a save
// re-encodes every field — an editor that loaded a blank private key would erase it.
vault.KeyEditorLabel.ShouldBe("deploy");
vault.KeyEditorPrivateKey.ShouldBe(PrivateKey("MATERIAL"));
vault.KeyEditorPassphrase.ShouldBe("hunter2");
vault.KeyEditorNotes = "rotate quarterly";
await vault.SaveKeyCommand.ExecuteAsync(null);
await vault.SyncCommand.ExecuteAsync(null);
var saved = vault.Keys.ShouldHaveSingleItem().Key;
saved.Notes.ShouldBe("rotate quarterly");
saved.PrivateKeyPem.ShouldBe(PrivateKey("MATERIAL"));
saved.Passphrase.ShouldBe("hunter2");
}
[Fact]
public async Task CancellingTheKeyEditor_LeavesNoMaterialBehindInIt()
{
// The editor holds a private key in a bound property for as long as it is open. It cannot be wiped
// — see SshKeySecret — but it can stop being referenced, and an abandoned editor that kept the key
// would hand it to whatever opened next.
await UnlockedAsync();
var vault = shell.Vault!;
vault.NewKeyCommand.Execute(null);
vault.KeyEditorLabel = "deploy";
vault.KeyEditorPrivateKey = PrivateKey("ABANDONED");
vault.KeyEditorPassphrase = "hunter2";
vault.CancelKeyEditCommand.Execute(null);
vault.IsEditingKey.ShouldBeFalse();
vault.KeyEditorPrivateKey.ShouldBeEmpty();
vault.KeyEditorPassphrase.ShouldBeEmpty();
vault.KeyEditorLabel.ShouldBeEmpty();
vault.Keys.ShouldBeEmpty();
}
[Fact]
public async Task APublicKeyPastedIntoThePrivateField_NamesTheActualMistake()
{
// ssh-keygen writes two files whose names differ by four characters. The message has to say which
// one to pick, because the alternative is an authentication failure at connect time that says
// nothing about the file.
await UnlockedAsync();
var vault = shell.Vault!;
vault.NewKeyCommand.Execute(null);
vault.KeyEditorLabel = "deploy";
vault.KeyEditorPrivateKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 deploy@laptop";
await vault.SaveKeyCommand.ExecuteAsync(null);
vault.Status.ShouldContain(".pub");
vault.Keys.ShouldBeEmpty();
vault.IsEditingKey.ShouldBeTrue("the editor stays open so the paste can be corrected");
}
[Fact]
public async Task DeletingAKey_RemovesItLocallyAndPushesTheTombstone()
{
await UnlockedAsync();
var vault = shell.Vault!;
await AddKeyAsync(vault, "deploy");
vault.SelectedKey = vault.Keys[0];
await vault.DeleteKeyCommand.ExecuteAsync(null);
vault.Keys.ShouldBeEmpty();
server.LiveRowCount.ShouldBe(0);
vault.PendingChanges.ShouldBe(0);
}
/// <remarks>
/// A layout invariant expressed as a state one, because it is the only form of it this repository can
/// check: nothing here loads a <c>.axaml</c>, and both editors are <c>Auto</c> rows in the same
/// 340-pixel column whose combined height exceeds the column at the window's minimum size. Two open
/// editors put the lower one's buttons past the bottom edge — the same failure this window shipped once
/// already, with the setup screens sliced and unclickable.
/// </remarks>
[Fact]
public async Task OnlyOneEditorOpensAtATime_AndTheRefusalKeepsWhatWasTyped()
{
await UnlockedAsync();
var vault = shell.Vault!;
vault.NewKeyCommand.Execute(null);
vault.KeyEditorPrivateKey = PrivateKey("PASTED-AND-NOWHERE-ELSE");
vault.NewHostCommand.Execute(null);
vault.IsEditing.ShouldBeFalse("the host editor must not open over the key editor");
vault.IsEditingKey.ShouldBeTrue();
vault.Status.ShouldContain("SSH key");
// The refusal is worth nothing if it costs the paste.
vault.KeyEditorPrivateKey.ShouldBe(PrivateKey("PASTED-AND-NOWHERE-ELSE"));
// And it is a refusal, not a lockout.
vault.CancelKeyEditCommand.Execute(null);
vault.NewHostCommand.Execute(null);
vault.IsEditing.ShouldBeTrue();
// Symmetrically, with the host editor holding the column.
vault.EditorLabel = "half-typed";
vault.NewKeyCommand.Execute(null);
vault.IsEditingKey.ShouldBeFalse();
vault.EditorLabel.ShouldBe("half-typed");
vault.Status.ShouldContain("host");
}
[Fact]
public async Task EditingAnExistingItem_IsRefusedByTheOtherEditorToo()
{
// The Edit commands are a second door into the same column, and guarding only the Add ones would
// leave it wide open.
await UnlockedAsync();
var vault = shell.Vault!;
await AddHostAsync(vault, "prod-db");
await AddKeyAsync(vault, "deploy");
vault.SelectedHost = vault.Hosts[0];
vault.SelectedKey = vault.Keys[0];
vault.NewKeyCommand.Execute(null);
vault.EditSelectedHostCommand.Execute(null);
vault.IsEditing.ShouldBeFalse();
vault.CancelKeyEditCommand.Execute(null);
vault.NewHostCommand.Execute(null);
vault.EditSelectedKeyCommand.Execute(null);
vault.IsEditingKey.ShouldBeFalse();
}
// ---- Authenticating with a key ----
[Fact]
public async Task ConnectingWithoutKeyAuthentication_UsesThePassword()
{
var vault = await ReadyToConnectAsync();
await AddKeyAsync(vault, "deploy");
// A key exists and is even selected. Without the switch it must still be the password that is used.
vault.SelectedKey = vault.Keys[0];
vault.ConnectPassword = "typed-in";
await ConnectWithRendererAsync(vault);
var credential = ssh.Requests.ShouldHaveSingleItem().Credential;
credential.ShouldBeOfType<SshPasswordCredential>().Password.ShouldBe("typed-in");
}
[Fact]
public async Task ConnectingWithKeyAuthentication_HandsTheSshStackTheKeyAndItsPassphrase()
{
var vault = await ReadyToConnectAsync();
await AddKeyAsync(vault, "deploy");
vault.SelectedKey = vault.Keys[0];
vault.UseKeyAuthentication = true;
vault.ConnectPassword = "should-not-be-used";
await ConnectWithRendererAsync(vault);
var credential = ssh.Requests.ShouldHaveSingleItem().Credential
.ShouldBeOfType<SshPrivateKeyCredential>();
System.Text.Encoding.UTF8.GetString(credential.PrivateKeyPem)
.ShouldBe(PrivateKey("MATERIAL"));
credential.Passphrase.ShouldBe("hunter2");
}
[Fact]
public async Task AKeyWithABlankPassphraseBox_IsAKeyWithNoPassphrase()
{
// Blank and absent are one state, from the editor all the way to the credential. The list has to say
// so too, because "passphrase" against a key that has none sends someone hunting for one they never
// set — and SSH.NET will not correct them: it ignores a passphrase on an unprotected key rather than
// refusing it. See docs/platform-flags.md.
var vault = await ReadyToConnectAsync();
await AddKeyAsync(vault, "deploy", passphrase: string.Empty);
var row = vault.Keys.ShouldHaveSingleItem();
row.Description.ShouldStartWith("no passphrase");
vault.SelectedKey = row;
vault.UseKeyAuthentication = true;
await ConnectWithRendererAsync(vault);
ssh.Requests.ShouldHaveSingleItem().Credential
.ShouldBeOfType<SshPrivateKeyCredential>()
.Passphrase.ShouldBeNull();
}
[Fact]
public async Task KeyAuthenticationWithNoKeyChosen_RefusesRatherThanFallingBackToThePassword()
{
// The failure this prevents is silent: a user who asked for key authentication and got password
// authentication has sent a password to a host that was meant never to see one.
var vault = await ReadyToConnectAsync();
await AddKeyAsync(vault, "deploy");
vault.SelectedKey = null;
vault.UseKeyAuthentication = true;
vault.ConnectPassword = "must-not-be-sent";
await vault.ConnectCommand.ExecuteAsync(null);
ssh.Requests.ShouldBeEmpty("nothing should have been dialled at all");
vault.Status.ShouldContain("key");
}
// ---- Helpers ----
private static CancellationToken Token => TestContext.Current.CancellationToken;
/// <summary>Armoured material of a plausible shape, and deliberately not a usable key.</summary>
private static string PrivateKey(string body) =>
$"-----BEGIN OPENSSH PRIVATE KEY-----\n{body}\n-----END OPENSSH PRIVATE KEY-----\n";
private Task<IVaultServer> SignInAsync(Uri serverUrl, CancellationToken cancellationToken)
{
// Counted so a test can assert that a rejected URL never got this far. Reaching here means a
@@ -770,6 +1060,30 @@ public sealed class ShellFlowTests : IAsyncLifetime
await vault.SaveHostCommand.ExecuteAsync(null);
}
private static async Task AddKeyAsync(
VaultViewModel vault,
string label,
string material = "MATERIAL",
string passphrase = "hunter2")
{
vault.NewKeyCommand.Execute(null);
vault.KeyEditorLabel = label;
vault.KeyEditorPrivateKey = PrivateKey(material);
vault.KeyEditorPassphrase = passphrase;
await vault.SaveKeyCommand.ExecuteAsync(null);
}
/// <summary>Connects with a renderer attached, which the data plane requires before a session opens.</summary>
private async Task ConnectWithRendererAsync(VaultViewModel vault)
{
await using var renderer = await FakeRenderer.AttachAsync(workspace, Token);
await vault.ConnectCommand.ExecuteAsync(null);
vault.Status.ShouldContain("Connected", Case.Insensitive);
}
/// <summary>An unlocked vault with one selected host and a renderer attached.</summary>
private async Task<VaultViewModel> ReadyToConnectAsync()
{
tests/DodoSSH.Client.Domain.Tests/SshKeySecretTests.cs
+261
View File
@@ -0,0 +1,261 @@
namespace DodoSSH.Client.Domain.Tests;
/// <summary>
/// The SSH key record, its codec and its merge.
/// </summary>
/// <remarks>
/// The codec is the point at which a private key becomes bytes and comes back, so a bug here is a key that
/// either does not survive a round trip or survives it in a form SSH.NET will not load. The sync suite
/// exercises all of this through two devices and a server, which is the right place for the reconciliation
/// rules — but it cannot say which of these types was wrong when it fails.
/// </remarks>
public sealed class SshKeySecretTests
{
private const string Material =
"-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEA\n-----END OPENSSH PRIVATE KEY-----\n";
// ---- The record ----
[Fact]
public void AnEmptyPassphrase_IsTheSameAsNone()
{
// One spelling of one state. The two that follow are what it buys: identical keys encode
// identically, so they cannot produce a spurious merge conflict, and "is this key protected?" has a
// single reliable answer for the interface to read.
Key(passphrase: string.Empty).Passphrase.ShouldBeNull();
Key(passphrase: null).Passphrase.ShouldBeNull();
Key(passphrase: "hunter2").Passphrase.ShouldBe("hunter2");
}
[Fact]
public void APassphraseOfSpaces_IsKept()
{
// Whitespace is a legal passphrase, so this is deliberately not IsNullOrWhiteSpace. Trimming it
// would silently change the passphrase of a key someone can still open elsewhere.
Key(passphrase: " ").Passphrase.ShouldBe(" ");
}
[Fact]
public void AnEmptyPassphraseAndNone_AreEqual()
{
// Follows from the normalisation, and it is the property the merge depends on: it compares the two
// sides for equality to decide whether anything changed at all.
Key(passphrase: string.Empty).ShouldBe(Key(passphrase: null));
}
[Theory]
[InlineData("", Material, "needs a name")]
[InlineData(" ", Material, "needs a name")]
[InlineData("deploy", "", "private key material")]
[InlineData("deploy", "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 deploy@laptop", ".pub")]
[InlineData("deploy", "ecdsa-sha2-nistp256 AAAAE2VjZHNh deploy@laptop", ".pub")]
[InlineData("deploy", "not a key at all", "-----BEGIN")]
public void AnInvalidKey_SaysWhatIsWrongWithIt(string label, string material, string expected)
{
var key = new SshKeySecret { Label = label, PrivateKeyPem = material };
key.TryValidate(out var reason).ShouldBeFalse();
reason.ShouldNotBeNull().ShouldContain(expected);
}
[Fact]
public void AKeyWithLeadingWhitespace_IsStillRecognised()
{
// A paste out of a terminal or an editor arrives with a newline in front of it more often than not.
var key = new SshKeySecret { Label = "deploy", PrivateKeyPem = "\n " + Material };
key.TryValidate(out var reason).ShouldBeTrue(reason);
}
// ---- The codec ----
[Fact]
public void AKey_SurvivesARoundTrip()
{
var key = Key(passphrase: "hunter2") with
{
PublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 deploy@laptop",
Notes = "rotate in June",
};
var encoded = SshKeySecretCodec.Encode(key);
SshKeySecretCodec.TryDecode(encoded, out var document).ShouldBeTrue();
document.ShouldNotBeNull();
document.Key.ShouldBe(key);
document.SchemaVersion.ShouldBe(SshKeySecretCodec.CurrentSchemaVersion);
document.IsReadOnly.ShouldBeFalse();
}
[Fact]
public void TheMaterialIsNotReformatted()
{
// Verbatim, including the trailing newline. OpenSSH, PKCS#1 and PKCS#8 all round-trip untouched
// because nothing here parses them, and a client that normalised the armour would eventually
// normalise a format it did not fully understand.
var awkward = "-----BEGIN RSA PRIVATE KEY-----\r\nMIIBOgIBAAJB\r\n-----END RSA PRIVATE KEY-----";
var encoded = SshKeySecretCodec.Encode(Key() with { PrivateKeyPem = awkward });
SshKeySecretCodec.TryDecode(encoded, out var document).ShouldBeTrue();
document.ShouldNotBeNull().Key.PrivateKeyPem.ShouldBe(awkward);
}
[Fact]
public void EncodingIsDeterministic()
{
// An unchanged key must not look like a change to the sync engine, which compares ciphertext-bearing
// payloads derived from these bytes.
SshKeySecretCodec.Encode(Key(passphrase: "hunter2"))
.ShouldBe(SshKeySecretCodec.Encode(Key(passphrase: "hunter2")));
}
[Fact]
public void AnEmptyPassphraseIsNotWrittenAtAll()
{
// The normalisation reaches the wire: a key saved with a blank box is byte-identical to one saved
// with no passphrase, so the two cannot diverge into a spurious conflict on another machine.
SshKeySecretCodec.Encode(Key(passphrase: string.Empty))
.ShouldBe(SshKeySecretCodec.Encode(Key(passphrase: null)));
}
[Fact]
public void AnEmptyPassphraseWrittenByAnotherClient_DecodesAsNone()
{
var payload = System.Text.Encoding.UTF8.GetBytes(
$$"""
{"schemaVersion":1,"label":"deploy","privateKeyPem":{{System.Text.Json.JsonSerializer.Serialize(Material)}},"passphrase":""}
""");
SshKeySecretCodec.TryDecode(payload, out var document).ShouldBeTrue();
document.ShouldNotBeNull().Key.Passphrase.ShouldBeNull();
}
[Theory]
[InlineData("not json at all")]
[InlineData("{}")]
[InlineData("""{"schemaVersion":0,"label":"deploy","privateKeyPem":"x"}""")]
[InlineData("""{"schemaVersion":1,"label":"deploy"}""")]
[InlineData("""{"schemaVersion":1,"privateKeyPem":"-----BEGIN X-----"}""")]
public void APayloadThatIsNotAKey_DoesNotDecode(string json)
{
// False rather than a throw, and rather than a half-built key. A decode failure is what a rotated
// vault key and a server handing back the wrong bytes both look like from here, and neither must
// abort a sync pass.
SshKeySecretCodec
.TryDecode(System.Text.Encoding.UTF8.GetBytes(json), out var document)
.ShouldBeFalse();
document.ShouldBeNull();
}
[Fact]
public void AKeyFromANewerClient_IsReadableButNotWritable()
{
var payload = System.Text.Encoding.UTF8.GetBytes(
$$"""
{"schemaVersion":99,"label":"deploy","privateKeyPem":{{System.Text.Json.JsonSerializer.Serialize(Material)}},"certificate":"something this build has never heard of"}
""");
SshKeySecretCodec.TryDecode(payload, out var document).ShouldBeTrue();
document.ShouldNotBeNull();
document.SchemaVersion.ShouldBe(99);
document.IsReadOnly.ShouldBeTrue(
"re-encoding would drop the field, leaving a key that still decrypts and no longer works");
}
// ---- The merge ----
[Fact]
public void EachSideEditingADifferentField_KeepsBoth()
{
var ancestor = Key();
var local = ancestor with { Label = "deploy-laptop" };
var remote = ancestor with { Notes = "from the desktop" };
var merged = SshKeySecretMerge.Merge(ancestor, local, remote);
merged.HasConflicts.ShouldBeFalse();
merged.Merged.Label.ShouldBe("deploy-laptop");
merged.Merged.Notes.ShouldBe("from the desktop");
merged.Merged.PrivateKeyPem.ShouldBe(ancestor.PrivateKeyPem);
}
[Fact]
public void BothSidesReplacingTheMaterial_ReportsTheClashWithoutQuotingEitherKey()
{
var ancestor = Key();
var local = ancestor with { PrivateKeyPem = Armour("LAPTOP-SECRET") };
var remote = ancestor with { PrivateKeyPem = Armour("DESKTOP-SECRET") };
var merged = SshKeySecretMerge.Merge(ancestor, local, remote);
merged.HasConflicts.ShouldBeTrue();
var conflict = merged.Conflicts.ShouldHaveSingleItem();
conflict.Field.ShouldBe(nameof(SshKeySecret.PrivateKeyPem));
// Named, so the user knows what clashed. Not quoted, because the conflict log is stored to be read
// and is deliberately kept after acknowledgement.
conflict.Kept.ShouldNotContain("LAPTOP-SECRET");
conflict.Kept.ShouldNotContain("DESKTOP-SECRET");
conflict.Discarded.ShouldNotBeNull().ShouldNotContain("LAPTOP-SECRET");
conflict.Discarded.ShouldNotContain("DESKTOP-SECRET");
// And the surviving key is a real one — redacting the report must not redact the value.
merged.Merged.PrivateKeyPem.ShouldBeOneOf(local.PrivateKeyPem, remote.PrivateKeyPem);
}
[Fact]
public void BothSidesChangingThePassphrase_IsAlsoRedacted()
{
var ancestor = Key(passphrase: "original");
var local = ancestor with { Passphrase = "laptop-passphrase" };
var remote = ancestor with { Passphrase = "desktop-passphrase" };
var merged = SshKeySecretMerge.Merge(ancestor, local, remote);
var conflict = merged.Conflicts.ShouldHaveSingleItem();
conflict.Field.ShouldBe(nameof(SshKeySecret.Passphrase));
conflict.Kept.ShouldNotContain("passphrase-");
conflict.Kept.ShouldNotContain("laptop-passphrase");
conflict.Discarded.ShouldNotBeNull().ShouldNotContain("desktop-passphrase");
}
[Fact]
public void ALabelClash_IsShownInFull()
{
// The counterpart to the redaction: a label is not a secret, and hiding it would leave the user
// unable to tell which name was discarded.
var ancestor = Key();
var local = ancestor with { Label = "deploy-laptop" };
var remote = ancestor with { Label = "deploy-desktop" };
var merged = SshKeySecretMerge.Merge(ancestor, local, remote);
var conflict = merged.Conflicts.ShouldHaveSingleItem();
conflict.Field.ShouldBe(nameof(SshKeySecret.Label));
new[] { conflict.Kept, conflict.Discarded }
.ShouldBe(["deploy-laptop", "deploy-desktop"], ignoreOrder: true);
}
[Fact]
public void BothSidesMakingTheSameEdit_IsNotAConflict()
{
var ancestor = Key();
var edited = ancestor with { Notes = "rotate in June" };
var merged = SshKeySecretMerge.Merge(ancestor, edited, edited);
merged.HasConflicts.ShouldBeFalse();
merged.Merged.ShouldBe(edited);
}
private static string Armour(string body) =>
$"-----BEGIN OPENSSH PRIVATE KEY-----\n{body}\n-----END OPENSSH PRIVATE KEY-----\n";
private static SshKeySecret Key(string? passphrase = null) =>
new() { Label = "deploy", PrivateKeyPem = Material, Passphrase = passphrase };
}
tests/DodoSSH.Client.Session.Tests/SessionLifecycleTests.cs
+2 -2
View File
@@ -220,9 +220,9 @@ public sealed class SessionLifecycleTests : IAsyncLifetime
var listing = await session.Hosts.ListAsync(session.ActiveVaultId, Token);
var host = listing.Hosts.ShouldHaveSingleItem();
var host = listing.Items.ShouldHaveSingleItem();
host.EntityId.ShouldBe(entityId);
host.Host.Label.ShouldBe("prod-db");
host.Secret.Label.ShouldBe("prod-db");
host.HasUnsyncedChanges.ShouldBeTrue();
(await session.PendingChangeCountAsync(Token)).ShouldBe(1);
tests/DodoSSH.Client.Ssh.Tests/KeyAuthenticationTests.cs
+117
View File
@@ -0,0 +1,117 @@
using System.Security.Cryptography;
using System.Text;
using Renci.SshNet.Common;
namespace DodoSSH.Client.Ssh.Tests;
/// <summary>
/// Public-key authentication through the path the vault actually uses, against a real sshd.
/// </summary>
/// <remarks>
/// <para>
/// <c>PtyAndResizeSpikeTests</c> also authenticates with this fixture's key, and it does so by building
/// SSH.NET's <c>PrivateKeyAuthenticationMethod</c> itself — correct for a spike whose subject is the PTY,
/// and it leaves the application's own path unexercised. What runs here is what a vault-held key goes
/// through: <see cref="SshPrivateKeyCredential"/> carrying PEM bytes rather than a path, into
/// <see cref="SshNetConnectionFactory"/>, which hands them to <c>PrivateKeyFile</c> as a
/// <c>MemoryStream</c>. That indirection is the reason a key in this product never becomes a file on disk,
/// and until now nothing established that it authenticates.
/// </para>
/// <para>
/// The fixture's key is RSA because there is no BCL Ed25519, and the fixture has to render the public half
/// in <c>authorized_keys</c> form to install it. Which algorithm it is does not matter to anything under
/// test here — the client never parses the key, it forwards it.
/// </para>
/// </remarks>
[Collection(SshCollection.Name)]
public sealed class KeyAuthenticationTests(SshServerFixture fixture)
{
private static CancellationToken Token => TestContext.Current.CancellationToken;
[Fact]
public async Task AKeyHeldAsBytes_AuthenticatesAndOpensAShell()
{
await using var connection = await ConnectTrustedAsync(
new SshPrivateKeyCredential(Pkcs1(fixture.ClientKey), Passphrase: null));
connection.IsConnected.ShouldBeTrue();
// Authenticated is not the same as usable: a channel has to open on the connection too.
await using var shell = await connection.OpenShellAsync(TerminalSize.Default, Token);
shell.IsOpen.ShouldBeTrue();
}
[Fact]
public async Task TheSameKeyInPkcs8Armour_AlsoAuthenticates()
{
// SshKeySecret stores whatever armour it was given, verbatim, and declines to normalise it. This is
// the half of that claim which is about SSH.NET rather than the codec: the two commonest forms
// ssh-keygen and openssl produce both load without the client knowing which it has.
await using var connection = await ConnectTrustedAsync(
new SshPrivateKeyCredential(Pkcs8(fixture.ClientKey), Passphrase: null));
connection.IsConnected.ShouldBeTrue();
}
[Fact]
public async Task AKeyTheServerDoesNotKnow_FailsAsAnAuthenticationError()
{
// The specific failure worth pinning is a misreport. The host key is already trusted here, so the
// factory's gate must translate nothing and let the authentication error through — if it answered
// with SshHostKeyUnknownException instead, the user would be shown a fingerprint to approve for a
// problem that approving it cannot fix.
using var stranger = RSA.Create(2048);
var knownHosts = await TrustedStoreAsync();
var factory = new SshNetConnectionFactory(knownHosts);
await Should.ThrowAsync<SshAuthenticationException>(async () =>
await factory.ConnectAsync(Request(new SshPrivateKeyCredential(Pkcs1(stranger), null)), Token));
}
[Fact]
public async Task APassphraseOnAnUnprotectedKey_IsIgnoredRatherThanRefused()
{
// Written expecting the opposite, and it records what SSH.NET measurably does: PrivateKeyFile
// accepts a passphrase for a key that has none, and the connection authenticates as if it had not
// been given. See docs/platform-flags.md — the consequence is that nothing downstream will catch a
// stray passphrase, so a client that wants that caught has to notice it itself, and a client that
// does not can stop worrying about the case.
await using var connection = await ConnectTrustedAsync(
new SshPrivateKeyCredential(Pkcs1(fixture.ClientKey), "a passphrase this key does not have"));
connection.IsConnected.ShouldBeTrue();
}
private static byte[] Pkcs1(RSA key) => Encoding.UTF8.GetBytes(key.ExportRSAPrivateKeyPem());
private static byte[] Pkcs8(RSA key) => Encoding.UTF8.GetBytes(key.ExportPkcs8PrivateKeyPem());
private SshConnectionRequest Request(SshCredential credential) =>
new(fixture.Host, fixture.Port, SshServerFixture.Username, credential);
/// <summary>A store that already trusts the container's host key, so first contact is not the subject.</summary>
private async Task<InMemoryKnownHostStore> TrustedStoreAsync()
{
var knownHosts = new InMemoryKnownHostStore();
var factory = new SshNetConnectionFactory(knownHosts);
// Learned by being refused, which is the only way this client learns a host key.
var unknown = await Should.ThrowAsync<SshHostKeyUnknownException>(async () =>
await factory.ConnectAsync(
Request(new SshPasswordCredential(SshServerFixture.Password)), Token));
await knownHosts.TrustAsync(unknown.Presentation, Token);
return knownHosts;
}
private async Task<ISshConnection> ConnectTrustedAsync(SshCredential credential)
{
var knownHosts = await TrustedStoreAsync();
return await new SshNetConnectionFactory(knownHosts)
.ConnectAsync(Request(credential), Token);
}
}
tests/DodoSSH.Client.Sync.Tests/ConflictMatrixTests.cs
+56 -26
View File
@@ -36,8 +36,8 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
var seen = await harness.Second.FindAsync(entityId);
seen.Host.Label.ShouldBe("prod-db");
seen.Host.Notes.ShouldBe("primary");
seen.Secret.Label.ShouldBe("prod-db");
seen.Secret.Notes.ShouldBe("primary");
seen.HasUnsyncedChanges.ShouldBeFalse();
harness.Server.RowCount.ShouldBe(1);
}
@@ -49,7 +49,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
var entityId = await harness.First.CreateAsync(Host("prod-db"));
var local = await harness.First.FindAsync(entityId);
local.Host.Label.ShouldBe("prod-db");
local.Secret.Label.ShouldBe("prod-db");
local.HasUnsyncedChanges.ShouldBeTrue();
harness.Server.RowCount.ShouldBe(0);
@@ -64,7 +64,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.First.UpdateAsync(entityId, Host("prod-db", notes: "rotate quarterly"));
await harness.SettleAsync();
(await harness.Second.FindAsync(entityId)).Host.Notes.ShouldBe("rotate quarterly");
(await harness.Second.FindAsync(entityId)).Secret.Notes.ShouldBe("rotate quarterly");
(await harness.First.ConflictsAsync()).ShouldBeEmpty();
}
@@ -77,7 +77,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.Second.UpdateAsync(entityId, Host("prod-db", username: "postgres"));
await harness.SettleAsync();
(await harness.First.FindAsync(entityId)).Host.Username.ShouldBe("postgres");
(await harness.First.FindAsync(entityId)).Secret.Username.ShouldBe("postgres");
(await harness.First.ConflictsAsync()).ShouldBeEmpty();
}
@@ -95,11 +95,11 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
var merged = (await harness.First.FindAsync(entityId)).Host;
var merged = (await harness.First.FindAsync(entityId)).Secret;
merged.Notes.ShouldBe("from the laptop");
merged.Username.ShouldBe("postgres");
(await harness.Second.FindAsync(entityId)).Host.ShouldBe(merged);
(await harness.Second.FindAsync(entityId)).Secret.ShouldBe(merged);
(await harness.First.ConflictsAsync()).ShouldBeEmpty();
}
@@ -116,7 +116,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
var merged = (await harness.First.FindAsync(entityId)).Host;
var merged = (await harness.First.FindAsync(entityId)).Secret;
merged.Options.Count.ShouldBe(2);
merged.Options.TryGetValue("Compression", out _).ShouldBeTrue();
merged.Options.TryGetValue("ServerAliveInterval", out _).ShouldBeTrue();
@@ -135,8 +135,8 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
var first = (await harness.First.FindAsync(entityId)).Host;
var second = (await harness.Second.FindAsync(entityId)).Host;
var first = (await harness.First.FindAsync(entityId)).Secret;
var second = (await harness.Second.FindAsync(entityId)).Secret;
first.ShouldBe(second);
@@ -172,7 +172,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
(await harness.First.FindAsync(entityId)).Host.Hostname.ShouldBe("db.internal");
(await harness.First.FindAsync(entityId)).Secret.Hostname.ShouldBe("db.internal");
(await ConflictsAcrossDevicesAsync()).ShouldBeEmpty();
}
@@ -187,8 +187,8 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.First.DeleteAsync(entityId);
await harness.SettleAsync();
(await harness.First.ListAsync()).Hosts.ShouldBeEmpty();
(await harness.Second.ListAsync()).Hosts.ShouldBeEmpty();
(await harness.First.ListAsync()).Items.ShouldBeEmpty();
(await harness.Second.ListAsync()).Items.ShouldBeEmpty();
harness.Server.RowCount.ShouldBe(0);
}
@@ -203,8 +203,8 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
(await harness.First.ListAsync()).Hosts.ShouldBeEmpty();
(await harness.Second.ListAsync()).Hosts.ShouldBeEmpty();
(await harness.First.ListAsync()).Items.ShouldBeEmpty();
(await harness.Second.ListAsync()).Items.ShouldBeEmpty();
(await ConflictsAcrossDevicesAsync()).ShouldBeEmpty();
}
@@ -227,16 +227,16 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
var listing = await harness.First.ListAsync();
var restored = listing.Hosts.ShouldHaveSingleItem();
var restored = listing.Items.ShouldHaveSingleItem();
restored.EntityId.ShouldNotBe(entityId);
restored.Host.Label.ShouldBe("prod-db (restored)");
restored.Host.Notes.ShouldBe("credentials rotated, do not delete");
restored.Secret.Label.ShouldBe("prod-db (restored)");
restored.Secret.Notes.ShouldBe("credentials rotated, do not delete");
(await ConflictsAcrossDevicesAsync())
.ShouldContain(kind => kind == ConflictKind.RemoteDeleteResurrected);
// And the other machine sees it too, so the rescue is not local-only.
(await harness.Second.ListAsync()).Hosts.ShouldHaveSingleItem()
(await harness.Second.ListAsync()).Items.ShouldHaveSingleItem()
.EntityId.ShouldBe(restored.EntityId);
}
@@ -261,7 +261,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
(await harness.First.ListAsync()).Hosts.Count.ShouldBe(1);
(await harness.First.ListAsync()).Items.Count.ShouldBe(1);
harness.Server.RowCount.ShouldBe(1);
}
@@ -279,7 +279,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
var survivor = await harness.First.FindAsync(entityId);
survivor.Host.Notes.ShouldBe("still needed");
survivor.Secret.Notes.ShouldBe("still needed");
(await ConflictsAcrossDevicesAsync())
.ShouldContain(kind => kind == ConflictKind.LocalDeleteOverridden);
@@ -296,9 +296,9 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
var order = (await harness.Second.ListAsync()).Hosts
var order = (await harness.Second.ListAsync()).Items
.OrderBy(host => host.Version)
.ThenBy(host => host.Host.Label, StringComparer.Ordinal)
.ThenBy(host => host.Secret.Label, StringComparer.Ordinal)
.Select(host => host.EntityId)
.ToArray();
@@ -341,8 +341,38 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.SettleAsync();
harness.Server.RowCount.ShouldBe(1);
(await harness.First.FindAsync(entityId)).Host.Notes.ShouldBe("second");
(await harness.Second.FindAsync(entityId)).Host.Notes.ShouldBe("second");
(await harness.First.FindAsync(entityId)).Secret.Notes.ShouldBe("second");
(await harness.Second.FindAsync(entityId)).Secret.Notes.ShouldBe("second");
}
[Fact]
public async Task AnUnacknowledgedCreateThatDidLand_IsDroppedQuietly()
{
// The same lost acknowledgement as above, but with no subsequent edit — which is the common case,
// since a timeout is far more likely than a timeout followed by a change. The queued create meets
// the server's own copy of itself, and the only correct answer is to stop trying to send it. In
// particular this must not be reported as a conflict: there is nothing for a person to decide, and a
// vault that produced a conflict notice every time a push timed out would train people to ignore
// them.
//
// This is the one path that compares two decrypted items for equality, and the comparison has to go
// through EqualityComparer rather than ==, because the reconciler is generic over the secret type
// and == on a type parameter is reference equality.
var entityId = await harness.First.CreateAsync(Host("prod-db", notes: "first"));
await PushBehindTheEnginesBackAsync(entityId);
await harness.SettleAsync();
(await ConflictsAcrossDevicesAsync()).ShouldBeEmpty(
"an item that came back exactly as it was sent is not something to arbitrate");
// And the operation is gone rather than still being offered.
(await harness.First.Outbox.TakeAsync(VaultId, 100, TestContext.Current.CancellationToken))
.ShouldBeEmpty();
harness.Server.RowCount.ShouldBe(1);
(await harness.First.FindAsync(entityId)).HasUnsyncedChanges.ShouldBeFalse();
}
[Fact]
@@ -397,7 +427,7 @@ public sealed class ConflictMatrixTests : IAsyncLifetime
await harness.First.SyncAsync();
var host = await harness.First.FindAsync(entityId);
host.Host.Notes.ShouldBe("mine");
host.Secret.Notes.ShouldBe("mine");
host.IsBlocked.ShouldBeTrue();
host.HasUnsyncedChanges.ShouldBeTrue();
}
tests/DodoSSH.Client.Sync.Tests/FakeVaultServer.cs
+91 -27
View File
@@ -11,19 +11,28 @@ namespace DodoSSH.Client.Sync.Tests;
/// <para>
/// A faithful reimplementation of <c>DodoSSH.Api.Features.Sync.SyncService</c>'s decision table: the
/// version check, the tombstone-beats-late-upsert rule, idempotent deletes, operation receipts, the
/// change log, and cursors that are opaque to the client. It is not a stub that returns canned answers —
/// if it were, none of the conflict tests would mean anything, because the interesting behaviour is
/// exactly the server's refusal to apply a stale write.
/// change log, cursors that are opaque to the client, the pull filter, and the per-type rules about which
/// plaintext columns an item may carry. It is not a stub that returns canned answers — if it were, none of
/// the conflict tests would mean anything, because the interesting behaviour is exactly the server's
/// refusal to apply a stale write.
/// </para>
/// <para>
/// The duplication against the real service is deliberate and is the point of the exercise: two
/// independent expressions of the same rules, and <c>SyncEndpointTests</c> checks the other one against
/// real Postgres. A shared implementation would let a misreading of the protocol pass on both sides.
/// </para>
/// <para>
/// Rows are keyed on the entity type as well as the id, as the server's separate tables are and as the
/// client's cache is. Keying on the id alone would work for every test that uses one item type and would
/// silently make a host and a key with the same id the same row.
/// </para>
/// </remarks>
internal sealed class FakeVaultServer : ISyncApi
{
private readonly Dictionary<Guid, Row> rows = [];
/// <summary>The item types this fake knows, mirroring the server's own registry.</summary>
private static readonly SyncEntityType[] Supported = [SyncEntityType.Host, SyncEntityType.SshKey];
private readonly Dictionary<(SyncEntityType Type, Guid EntityId), Row> rows = [];
private readonly List<LogEntry> log = [];
private readonly Dictionary<Guid, Receipt> receipts = [];
@@ -49,6 +58,9 @@ internal sealed class FakeVaultServer : ISyncApi
/// <summary>Pushes received, so a test can prove a retry did or did not happen.</summary>
internal int PushCount { get; private set; }
/// <summary>The entity-type filter of the last pull, so a test can assert what was asked for.</summary>
internal IReadOnlyList<SyncEntityType>? LastPullTypes { get; private set; }
/// <summary>
/// Runs just before a push is applied, so a test can land another client's write in the window
/// between one client's pull and its push. That window is the whole subject of the cursor-gap test.
@@ -66,7 +78,16 @@ internal sealed class FakeVaultServer : ISyncApi
var after = DecodeCursor(request.Cursor);
var limit = Math.Clamp(request.Limit ?? MaxPullLimit, 1, MaxPullLimit);
var page = log.Where(entry => entry.Sequence > after).Take(limit + 1).ToList();
LastPullTypes = request.EntityTypes;
// Empty or absent means every type, as the contract says.
var wanted = request.EntityTypes is { Count: > 0 } types ? types : null;
var page = log
.Where(entry => entry.Sequence > after)
.Where(entry => wanted is null || wanted.Contains(entry.EntityType))
.Take(limit + 1)
.ToList();
var hasMore = page.Count > limit;
if (hasMore)
@@ -109,18 +130,22 @@ internal sealed class FakeVaultServer : ISyncApi
}
/// <summary>Applies a change as if another client had made it.</summary>
internal int ExternalUpsert(Guid entityId, EncryptedPayload payload, SyncPlaintextFields? fields)
internal int ExternalUpsert(
Guid entityId,
EncryptedPayload payload,
SyncPlaintextFields? fields,
SyncEntityType entityType = SyncEntityType.Host)
{
var result = Apply(new SyncPushOperation(
Guid.CreateVersion7(),
SyncEntityType.Host,
entityType,
entityId,
SyncOperation.Upsert,
rows.TryGetValue(entityId, out var existing) && !existing.IsDeleted
rows.TryGetValue((entityType, entityId), out var existing) && !existing.IsDeleted
? existing.Version
: null,
payload,
fields ?? new SyncPlaintextFields()));
fields));
if (result.Status != SyncOperationStatus.Applied)
{
@@ -132,13 +157,13 @@ internal sealed class FakeVaultServer : ISyncApi
}
/// <summary>Deletes as if another client had done it.</summary>
internal void ExternalDelete(Guid entityId)
internal void ExternalDelete(Guid entityId, SyncEntityType entityType = SyncEntityType.Host)
{
var existing = rows[entityId];
var existing = rows[(entityType, entityId)];
var result = Apply(new SyncPushOperation(
Guid.CreateVersion7(),
SyncEntityType.Host,
entityType,
entityId,
SyncOperation.Delete,
existing.Version,
@@ -151,7 +176,8 @@ internal sealed class FakeVaultServer : ISyncApi
}
}
internal Row? Find(Guid entityId) => rows.TryGetValue(entityId, out var row) ? row : null;
internal Row? Find(Guid entityId, SyncEntityType entityType = SyncEntityType.Host) =>
rows.TryGetValue((entityType, entityId), out var row) ? row : null;
private long Head => log.Count == 0 ? 0 : log[^1].Sequence;
@@ -159,7 +185,7 @@ internal sealed class FakeVaultServer : ISyncApi
private SyncPushResult Apply(SyncPushOperation operation)
{
if (operation.EntityType != SyncEntityType.Host)
if (!Supported.Contains(operation.EntityType))
{
return Invalid(operation, $"Entity type {operation.EntityType} is not yet supported.");
}
@@ -181,7 +207,7 @@ internal sealed class FakeVaultServer : ISyncApi
operation.OperationId, SyncOperationStatus.Forbidden, null, null, null, null);
}
rows.TryGetValue(operation.EntityId, out var existing);
rows.TryGetValue((operation.EntityType, operation.EntityId), out var existing);
return operation.Operation == SyncOperation.Delete
? ApplyDelete(operation, existing)
@@ -202,14 +228,9 @@ internal sealed class FakeVaultServer : ISyncApi
var fields = operation.PlaintextFields ?? new SyncPlaintextFields();
if (!fields.RelayEnabled && (fields.Hostname is not null || fields.Port is not null))
if (!ValidateFields(operation.EntityType, fields, out var fieldError))
{
return Invalid(operation, "An address may only be supplied when relay is enabled.");
}
if (fields.RelayEnabled && (string.IsNullOrWhiteSpace(fields.Hostname) || fields.Port is null))
{
return Invalid(operation, "Relay-enabled hosts require both a hostname and a port.");
return Invalid(operation, fieldError);
}
if (existing is null || existing.IsDeleted)
@@ -233,6 +254,45 @@ internal sealed class FakeVaultServer : ISyncApi
return Commit(operation, updated, SyncOperation.Upsert);
}
/// <summary>The per-type rules about which plaintext columns an item may carry.</summary>
/// <remarks>
/// A key's are stricter than a host's rather than merely different, and that asymmetry is the point:
/// the relay concession belongs to hosts alone, so a key arriving with an address is a client bug and
/// is refused with a reason instead of being quietly dropped.
/// </remarks>
private static bool ValidateFields(
SyncEntityType entityType,
SyncPlaintextFields fields,
out string error)
{
error = string.Empty;
if (entityType == SyncEntityType.SshKey)
{
if (fields.RelayEnabled || fields.Hostname is not null || fields.Port is not null)
{
error = "An SSH key has no relay target; relay fields may only be set on a host.";
return false;
}
return true;
}
if (!fields.RelayEnabled && (fields.Hostname is not null || fields.Port is not null))
{
error = "An address may only be supplied when relay is enabled.";
return false;
}
if (fields.RelayEnabled && (string.IsNullOrWhiteSpace(fields.Hostname) || fields.Port is null))
{
error = "Relay-enabled hosts require both a hostname and a port.";
return false;
}
return true;
}
private SyncPushResult Create(SyncPushOperation operation, Row? existing, SyncPlaintextFields fields)
{
// A tombstone beats a late upsert. The client is told so it can resurrect the item deliberately
@@ -248,7 +308,9 @@ internal sealed class FakeVaultServer : ISyncApi
return Conflict(operation, existing: null);
}
var created = new Row(operation.EntityId, 1, 0, operation.Payload!, fields, false);
var created = new Row(
operation.EntityType, operation.EntityId, 1, 0, operation.Payload!, fields, false);
return Commit(operation, created, SyncOperation.Upsert);
}
@@ -293,8 +355,8 @@ internal sealed class FakeVaultServer : ISyncApi
{
var sequence = Head + 1;
log.Add(new LogEntry(sequence, row.EntityId, change, row.Version, Now));
rows[row.EntityId] = row with { ChangeSequence = sequence };
log.Add(new LogEntry(sequence, row.EntityType, row.EntityId, change, row.Version, Now));
rows[(row.EntityType, row.EntityId)] = row with { ChangeSequence = sequence };
receipts[operation.OperationId] = new Receipt(row.Version, sequence);
return new SyncPushResult(
@@ -315,13 +377,13 @@ internal sealed class FakeVaultServer : ISyncApi
private SyncChange Hydrate(LogEntry entry)
{
var row = rows[entry.EntityId];
var row = rows[(entry.EntityType, entry.EntityId)];
return ToChange(row, entry.Sequence, entry.Revision, entry.OccurredAt);
}
private SyncChange ToChange(Row row, long? sequence = null, int? version = null, DateTimeOffset? at = null) =>
new(
SyncEntityType.Host,
row.EntityType,
row.EntityId,
row.IsDeleted ? SyncOperation.Delete : SyncOperation.Upsert,
version ?? row.Version,
@@ -359,6 +421,7 @@ internal sealed class FakeVaultServer : ISyncApi
}
internal sealed record Row(
SyncEntityType EntityType,
Guid EntityId,
int Version,
long ChangeSequence,
@@ -368,6 +431,7 @@ internal sealed class FakeVaultServer : ISyncApi
private sealed record LogEntry(
long Sequence,
SyncEntityType EntityType,
Guid EntityId,
SyncOperation Operation,
int Revision,
tests/DodoSSH.Client.Sync.Tests/ItemKindsTests.cs
+44
View File
@@ -0,0 +1,44 @@
using DodoSSH.Contracts;
namespace DodoSSH.Client.Sync.Tests;
/// <summary>
/// The registry of synchronised item types, and the one property that has to hold about it.
/// </summary>
/// <remarks>
/// Adding an item type touches a cipher, a codec, a merge, a repository and a view. The failure this pins is
/// the one that none of those would reveal: a type that can be created, encrypted, merged and listed
/// perfectly, and is never asked for in a pull — so it works on the machine that made it and exists nowhere
/// else. Deriving the filter from the registry is what prevents it; these tests are what notice if the
/// derivation stops holding.
/// </remarks>
public sealed class ItemKindsTests
{
[Fact]
public void ThePullFilterNamesEveryTypeThisBuildSynchronises()
{
ItemKinds.SyncedTypes.ShouldBe([SyncEntityType.Host, SyncEntityType.SshKey]);
}
[Fact]
public void ThePullFilterIsNotEmpty()
{
// Stated separately from the list above because the consequence of an empty one is quiet rather
// than loud: the contract says an empty filter means every type, so the client would ask the server
// for everything it holds and then discard most of the answer in ApplyAsync. The way it could
// actually become empty is a static initialisation order slip — SyncedTypes projects Registry, and a
// reordering of the two declarations would leave it reading an unassigned array.
ItemKinds.SyncedTypes.ShouldNotBeEmpty();
}
[Fact]
public async Task EveryTypeInThePullFilter_HasAReconciler()
{
using var harness = await SyncHarness.CreateAsync();
var reconcilers = ItemKinds.Reconcilers(
harness.First.Outbox, harness.First.Conflicts, harness.First.Keyring);
reconcilers.Keys.Order().ShouldBe(ItemKinds.SyncedTypes.Order());
}
}
tests/DodoSSH.Client.Sync.Tests/SshKeySyncTests.cs
+311
View File
@@ -0,0 +1,311 @@
using DodoSSH.Client.Storage;
using DodoSSH.Contracts;
using static DodoSSH.Client.Sync.Tests.SyncHarness;
namespace DodoSSH.Client.Sync.Tests;
/// <summary>
/// SSH keys through the same two-machine harness as hosts.
/// </summary>
/// <remarks>
/// <para>
/// Deliberately not a copy of <see cref="ConflictMatrixTests"/> with the nouns changed. The six collision
/// outcomes are decided by <c>ItemReconciler&lt;TSecret&gt;</c>, which is one implementation shared by both
/// item types, so re-asserting all of them per type would test the same code twice and grow with every type
/// added. What is tested here is what is genuinely different about a key: its cipher, its merge, the fact
/// that it hands the server nothing in plaintext, that the reconciler's messages call it a key, and that its
/// items cannot be confused with a host's.
/// </para>
/// <para>
/// The two collision cases that <em>are</em> repeated — resurrection and an abandoned delete — are here
/// because they are the two that touch key material: one re-seals it under a new id, the other decides
/// whether a private key survives a deletion.
/// </para>
/// </remarks>
public sealed class SshKeySyncTests : IAsyncLifetime
{
private SyncHarness harness = null!;
private static CancellationToken Token => TestContext.Current.CancellationToken;
/// <inheritdoc />
public async ValueTask InitializeAsync() => harness = await CreateAsync();
/// <inheritdoc />
public ValueTask DisposeAsync()
{
harness.Dispose();
return ValueTask.CompletedTask;
}
// ---- The uncontested paths ----
[Fact]
public async Task AKeyCreatedOnOneMachine_ReachesTheOther()
{
var entityId = await harness.First.CreateKeyAsync(
Key("deploy", material: "LAPTOP-MATERIAL", passphrase: "hunter2", notes: "rotate in June"));
await harness.SettleAsync();
var seen = await harness.Second.FindKeyAsync(entityId);
seen.Secret.Label.ShouldBe("deploy");
seen.Secret.PrivateKeyPem.ShouldContain("LAPTOP-MATERIAL");
seen.Secret.Passphrase.ShouldBe("hunter2");
seen.Secret.Notes.ShouldBe("rotate in June");
seen.HasUnsyncedChanges.ShouldBeFalse();
}
[Fact]
public async Task ThePull_AsksForKeysAsWellAsHosts()
{
await harness.First.SyncAsync();
var asked = harness.Server.LastPullTypes.ShouldNotBeNull();
asked.ShouldContain(SyncEntityType.Host);
asked.ShouldContain(
SyncEntityType.SshKey,
"a type the engine can reconcile but never requests would work in every unit test and never "
+ "sync");
}
[Fact]
public async Task AHostAndAKeyQueuedTogether_BothGoInOnePush()
{
var hostId = await harness.First.CreateAsync(Host("prod-db"));
var keyId = await harness.First.CreateKeyAsync(Key("deploy"));
await harness.First.SyncAsync();
harness.Server.PushCount.ShouldBe(1, "one outbox, one batch, whatever the item types in it");
await harness.Second.SyncAsync();
(await harness.Second.FindAsync(hostId)).Secret.Label.ShouldBe("prod-db");
(await harness.Second.FindKeyAsync(keyId)).Secret.Label.ShouldBe("deploy");
}
[Fact]
public async Task AKeyList_DoesNotShowHosts()
{
await harness.First.CreateAsync(Host("prod-db"));
await harness.First.CreateKeyAsync(Key("deploy"));
await harness.SettleAsync();
(await harness.Second.ListKeysAsync()).Items.ShouldHaveSingleItem()
.Secret.Label.ShouldBe("deploy");
(await harness.Second.ListAsync()).Items.ShouldHaveSingleItem()
.Secret.Label.ShouldBe("prod-db");
}
// ---- What the server is told ----
[Fact]
public async Task AKeyHandsTheServerNothingInPlaintext()
{
// The public half is supplied, which is the case where a fingerprint could have been derived and
// sent. The server has a column for one and would accept it; this client does not fill it, because a
// fingerprint is a stable identifier for a key pair and nothing in the product reads the column.
var entityId = await harness.First.CreateKeyAsync(
Key("deploy", publicKey: "ssh-ed25519 AAAAC3Nz deploy@laptop"));
var queued = await harness.First.Outbox
.FindAsync(VaultId, SyncEntityType.SshKey, entityId, Token);
queued.ShouldNotBeNull();
queued.Fields.ShouldBeNull("a key sends no plaintext fields at all, not an empty set of them");
await harness.SettleAsync();
var row = harness.Server.Find(entityId, SyncEntityType.SshKey).ShouldNotBeNull();
row.Fields.PublicKeyFingerprint.ShouldBeNull();
row.Fields.RelayEnabled.ShouldBeFalse();
row.Fields.Hostname.ShouldBeNull();
}
[Fact]
public async Task AHostAndAKeyWithTheSameId_AreDifferentItems()
{
// Not reachable through the repositories, which mint UUIDv7s, so it is arranged on the server. The
// point is that two things defend the separation independently: the item table is keyed on the type
// as well as the id, and the payload's AAD binds a resource type — so neither payload can be opened
// as the other even if a lookup did confuse them.
var sharedId = Guid.CreateVersion7();
harness.First.Keyring.TryGet(VaultId, out var vaultKey, out var generation).ShouldBeTrue();
harness.Server.ExternalUpsert(
sharedId,
HostCipher.Seal(Host("prod-db"), vaultKey.Span, sharedId, generation, itemVersion: 1),
new SyncPlaintextFields(),
SyncEntityType.Host);
harness.Server.ExternalUpsert(
sharedId,
SshKeyCipher.Seal(Key("deploy"), vaultKey.Span, sharedId, generation, itemVersion: 1),
null,
SyncEntityType.SshKey);
await harness.Second.SyncAsync();
var hosts = await harness.Second.ListAsync();
var keys = await harness.Second.ListKeysAsync();
hosts.Items.ShouldHaveSingleItem().Secret.Label.ShouldBe("prod-db");
keys.Items.ShouldHaveSingleItem().Secret.Label.ShouldBe("deploy");
hosts.Unreadable.ShouldBe(0);
keys.Unreadable.ShouldBe(0);
}
// ---- Merging ----
[Fact]
public async Task TwoMachinesEditingDifferentFieldsOfAKey_BothSurvive()
{
var entityId = await harness.First.CreateKeyAsync(Key("deploy", material: "SHARED"));
await harness.SettleAsync();
await harness.First.UpdateKeyAsync(entityId, Key("deploy-laptop", material: "SHARED"));
await harness.Second.UpdateKeyAsync(
entityId, Key("deploy", material: "SHARED", notes: "from the desktop"));
await harness.SettleAsync();
var first = (await harness.First.FindKeyAsync(entityId)).Secret;
var second = (await harness.Second.FindKeyAsync(entityId)).Secret;
first.ShouldBe(second);
first.Label.ShouldBe("deploy-laptop");
first.Notes.ShouldBe("from the desktop");
first.PrivateKeyPem.ShouldContain("SHARED");
(await ConflictKindsAsync()).ShouldBeEmpty();
}
[Fact]
public async Task BothReplacedTheKeyMaterial_NeitherKeyIsWrittenToTheConflictLog()
{
// The reason SshKeySecretMerge redacts. A host conflict records the value that lost so the user can
// put it back; doing that with a private key would copy a secret into a log that is designed to be
// read and is deliberately kept after acknowledgement.
var entityId = await harness.First.CreateKeyAsync(Key("deploy", material: "ORIGINAL"));
await harness.SettleAsync();
await harness.First.UpdateKeyAsync(entityId, Key("deploy", material: "LAPTOP-SECRET"));
await harness.Second.UpdateKeyAsync(entityId, Key("deploy", material: "DESKTOP-SECRET"));
await harness.SettleAsync();
(await ConflictKindsAsync()).ShouldContain(kind => kind == ConflictKind.FieldOverridden);
var details = await ConflictDetailsAsync();
details.ShouldContain(
detail => detail.Contains("PrivateKeyPem", StringComparison.Ordinal),
"the user still has to be told which field clashed");
foreach (var detail in details)
{
detail.ShouldNotContain("LAPTOP-SECRET");
detail.ShouldNotContain("DESKTOP-SECRET");
}
}
[Fact]
public async Task BothChangedThePassphrase_ThePassphraseIsNotInTheLogEither()
{
var entityId = await harness.First.CreateKeyAsync(Key("deploy", passphrase: "original"));
await harness.SettleAsync();
await harness.First.UpdateKeyAsync(entityId, Key("deploy", passphrase: "laptop-passphrase"));
await harness.Second.UpdateKeyAsync(entityId, Key("deploy", passphrase: "desktop-passphrase"));
await harness.SettleAsync();
foreach (var detail in await ConflictDetailsAsync())
{
detail.ShouldNotContain("laptop-passphrase");
detail.ShouldNotContain("desktop-passphrase");
}
}
// ---- Deletes, where key material can be lost ----
[Fact]
public async Task AKeyDeletedElsewhereWhileEditedHere_KeepsTheMaterialUnderANewName()
{
var entityId = await harness.First.CreateKeyAsync(Key("deploy", material: "IRREPLACEABLE"));
await harness.SettleAsync();
await harness.First.DeleteKeyAsync(entityId);
await harness.Second.UpdateKeyAsync(
entityId, Key("deploy", material: "IRREPLACEABLE", notes: "still in use"));
await harness.SettleAsync();
var restored = (await harness.First.ListKeysAsync()).Items.ShouldHaveSingleItem();
restored.EntityId.ShouldNotBe(entityId);
restored.Secret.Label.ShouldBe("deploy (restored)");
restored.Secret.Notes.ShouldBe("still in use");
restored.Secret.PrivateKeyPem.ShouldContain(
"IRREPLACEABLE", Case.Sensitive, "a resurrection that lost the key would rescue nothing");
(await ConflictKindsAsync()).ShouldContain(kind => kind == ConflictKind.RemoteDeleteResurrected);
}
[Fact]
public async Task AKeyEditedElsewhereAfterBeingDeletedHere_SurvivesAndIsCalledAKey()
{
var entityId = await harness.First.CreateKeyAsync(Key("deploy"));
await harness.SettleAsync();
await harness.First.UpdateKeyAsync(entityId, Key("deploy", notes: "still in use"));
await harness.Second.DeleteKeyAsync(entityId);
await harness.SettleAsync();
(await harness.First.FindKeyAsync(entityId)).Secret.Notes.ShouldBe("still in use");
(await ConflictKindsAsync()).ShouldContain(kind => kind == ConflictKind.LocalDeleteOverridden);
// The noun matters: someone told a host was edited elsewhere goes looking in the host list.
var details = await ConflictDetailsAsync();
details.ShouldContain(detail => detail.Contains("This SSH key was edited", StringComparison.Ordinal));
details.ShouldNotContain(detail => detail.Contains("This host was edited", StringComparison.Ordinal));
}
// ---- Helpers ----
private async Task<IReadOnlyList<ConflictKind>> ConflictKindsAsync()
{
var first = await harness.First.ConflictsAsync();
var second = await harness.Second.ConflictsAsync();
return [.. first.Concat(second).Select(conflict => conflict.Kind)];
}
/// <remarks>
/// The raw stored detail, decoded as text rather than parsed. The redaction claims are claims about what
/// is <em>absent</em> from the bytes, and reading through the JSON model would only prove the material
/// is absent from the fields the model happens to name.
/// </remarks>
private async Task<IReadOnlyList<string>> ConflictDetailsAsync()
{
var first = await harness.First.ConflictsAsync();
var second = await harness.Second.ConflictsAsync();
return
[
.. first.Concat(second)
.Select(conflict => System.Text.Encoding.UTF8.GetString(conflict.Detail)),
];
}
}
tests/DodoSSH.Client.Sync.Tests/SyncEngineTests.cs
+2 -2
View File
@@ -31,7 +31,7 @@ public sealed class SyncEngineTests
var report = await harness.Second.SyncAsync();
report.Pulled.ShouldBe(7);
(await harness.Second.ListAsync()).Hosts.Count.ShouldBe(7);
(await harness.Second.ListAsync()).Items.Count.ShouldBe(7);
}
[Fact]
@@ -133,7 +133,7 @@ public sealed class SyncEngineTests
report.ServerTimeSkewMs.ShouldBeGreaterThan(2 * 60 * 60 * 1000);
// The item still round-trips, so nothing downstream depended on the timestamp.
(await harness.First.FindAsync(entityId)).Host.Label.ShouldBe("prod-db");
(await harness.First.FindAsync(entityId)).Secret.Label.ShouldBe("prod-db");
}
[Fact]
tests/DodoSSH.Client.Sync.Tests/SyncHarness.cs
+54 -4
View File
@@ -37,6 +37,7 @@ internal sealed class SyncDevice : IDisposable
SyncState = new SyncStateStore(factory);
Conflicts = new ConflictStore(factory, protector, TimeProvider.System);
Hosts = new HostRepository(Items, Outbox, keyring);
SshKeys = new SshKeyRepository(Items, Outbox, keyring);
Engine = new SyncEngine(
server, Items, Outbox, SyncState, Conflicts, keyring, TimeProvider.System, options);
@@ -56,6 +57,8 @@ internal sealed class SyncDevice : IDisposable
internal HostRepository Hosts { get; }
internal SshKeyRepository SshKeys { get; }
internal SyncEngine Engine { get; }
internal static async Task<SyncDevice> CreateAsync(
@@ -90,21 +93,21 @@ internal sealed class SyncDevice : IDisposable
internal Task<SyncReport> SyncAsync() =>
Engine.SyncAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
internal Task<HostListing> ListAsync() =>
internal Task<ItemListing<HostSecret>> ListAsync() =>
Hosts.ListAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
internal async Task<IReadOnlyList<HostSecret>> HostsSortedAsync()
{
var listing = await ListAsync();
return [.. listing.Hosts.Select(h => h.Host).OrderBy(h => h.Label, StringComparer.Ordinal)];
return [.. listing.Items.Select(h => h.Secret).OrderBy(h => h.Label, StringComparer.Ordinal)];
}
internal async Task<VaultHost> FindAsync(Guid entityId)
internal async Task<VaultItem<HostSecret>> FindAsync(Guid entityId)
{
var listing = await ListAsync();
return listing.Hosts.SingleOrDefault(host => host.EntityId == entityId)
return listing.Items.SingleOrDefault(host => host.EntityId == entityId)
?? throw new InvalidOperationException($"{Name} cannot see host {entityId}.");
}
@@ -117,6 +120,28 @@ internal sealed class SyncDevice : IDisposable
internal Task DeleteAsync(Guid entityId) =>
Hosts.DeleteAsync(SyncHarness.VaultId, entityId, TestContext.Current.CancellationToken);
// ---- The same four operations, on SSH keys ----
internal Task<ItemListing<SshKeySecret>> ListKeysAsync() =>
SshKeys.ListAsync(SyncHarness.VaultId, TestContext.Current.CancellationToken);
internal async Task<VaultItem<SshKeySecret>> FindKeyAsync(Guid entityId)
{
var listing = await ListKeysAsync();
return listing.Items.SingleOrDefault(key => key.EntityId == entityId)
?? throw new InvalidOperationException($"{Name} cannot see key {entityId}.");
}
internal Task<Guid> CreateKeyAsync(SshKeySecret key) =>
SshKeys.CreateAsync(SyncHarness.VaultId, key, TestContext.Current.CancellationToken);
internal Task UpdateKeyAsync(Guid entityId, SshKeySecret key) =>
SshKeys.UpdateAsync(SyncHarness.VaultId, entityId, key, TestContext.Current.CancellationToken);
internal Task DeleteKeyAsync(Guid entityId) =>
SshKeys.DeleteAsync(SyncHarness.VaultId, entityId, TestContext.Current.CancellationToken);
internal Task<IReadOnlyList<StoredConflict>> ConflictsAsync() =>
Conflicts.ListAsync(SyncHarness.VaultId, false, TestContext.Current.CancellationToken);
@@ -249,4 +274,29 @@ internal sealed class SyncHarness : IDisposable
: HostOptions.Create(options.Select(o => new HostOption(o.Name, o.Value))),
RelayEnabled = relayEnabled,
};
/// <summary>
/// An SSH key whose material is a plausible shape but not a real key.
/// </summary>
/// <remarks>
/// Not a valid Ed25519 key, and deliberately so: nothing in the sync path parses the material, and a
/// real private key checked into a test repository is a real private key on the internet regardless of
/// what it was used for. <c>SshKeySecret.TryValidate</c> only requires the armour, and the tests that
/// need a key SSH.NET can actually load live in <c>DodoSSH.Client.Ssh.Tests</c> where one is generated.
/// </remarks>
internal static SshKeySecret Key(
string label,
string material = "deploy-key-material",
string? passphrase = null,
string? publicKey = null,
string? notes = null) =>
new()
{
Label = label,
PrivateKeyPem = $"-----BEGIN OPENSSH PRIVATE KEY-----\n{material}\n"
+ "-----END OPENSSH PRIVATE KEY-----\n",
Passphrase = passphrase,
PublicKey = publicKey,
Notes = notes,
};
}
tests/DodoSSH.SystemTests/M1VerticalSliceTests.cs
+76 -7
View File
@@ -74,13 +74,22 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
var host = BuildHost();
var entityId = await laptop.Hosts.CreateAsync(laptop.ActiveVaultId, host, Token);
// A second item type, in the same vault and the same outbox. Two of them is what makes this a test
// of the shared write path rather than of hosts: the server picks a table per type, the client picks
// a cipher per type, and the AAD binds a different resource type into each. All three of those are
// hand-kept mappings between enums that do not line up, and a swap between them encrypts, decrypts
// and stores perfectly on the machine that made it.
var key = BuildKey();
var keyId = await laptop.SshKeys.CreateAsync(laptop.ActiveVaultId, key, Token);
var pushed = await laptop.SyncAsync(connection.Sync, Token);
pushed.Pushed.ShouldBe(1);
pushed.Pushed.ShouldBe(2);
pushed.NeedsAttention.ShouldBeFalse();
await AssertTheServerCannotSeeTheAddressAsync(connection, entityId);
await AssertTheServerLearnsNothingAboutTheKeyAsync(connection, keyId);
var seen = await ReadOnASecondMachineAsync(connection, host, entityId);
var seen = await ReadOnASecondMachineAsync(connection, host, entityId, key, keyId);
await AssertUnlocksOfflineAsync(laptopCache);
@@ -160,10 +169,41 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
change.Payload.DataKeyId.ShouldNotBe(Guid.Empty);
}
/// <remarks>
/// The relay concession is the host's alone. A key has no address to resolve, so the server is given
/// nothing at all about it — not even the public-key fingerprint its own schema has a column for, which
/// it would have accepted. A fingerprint is not secret but it is a stable identifier for a key pair, and
/// nothing in the product reads that column; see the note on <c>SshKeyKind.Fields</c>.
/// </remarks>
private static async Task AssertTheServerLearnsNothingAboutTheKeyAsync(
ServerConnection connection,
Guid keyId)
{
var vaultId = (await connection.Account.GetMeAsync(Token)).Vaults.Single().VaultId;
var page = await connection.Sync.SyncPullAsync(
vaultId, new SyncPullRequest(null, 100, [SyncEntityType.SshKey]), Token);
// Asked for keys, and got only keys back — so the filter the client relies on is honoured by the
// real endpoint and not merely by the in-memory one the unit suites use.
page.Changes.ShouldAllBe(change => change.EntityType == SyncEntityType.SshKey);
var change = page.Changes.Single(c => c.EntityId == keyId);
change.PlaintextFields.ShouldBeNull(
"a key gives the server no plaintext columns, so it hydrates to nothing at all");
change.Payload.ShouldNotBeNull();
change.Payload.WrappedDataKey.ShouldNotBeEmpty();
change.Payload.DataKeyId.ShouldNotBe(Guid.Empty);
}
private async Task<HostSecret> ReadOnASecondMachineAsync(
ServerConnection connection,
HostSecret expected,
Guid entityId)
Guid entityId,
SshKeySecret expectedKey,
Guid keyId)
{
using var desktopCache = await OpenCacheAsync();
@@ -178,19 +218,30 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
await using var session = desktop;
var pulled = await desktop.SyncAsync(connection.Sync, Token);
pulled.Pulled.ShouldBe(1);
pulled.Pulled.ShouldBe(2, "the host and the key, in one pass");
var listing = await desktop.Hosts.ListAsync(desktop.ActiveVaultId, Token);
var seen = listing.Hosts.ShouldHaveSingleItem();
var seen = listing.Items.ShouldHaveSingleItem();
seen.EntityId.ShouldBe(entityId);
seen.HasUnsyncedChanges.ShouldBeFalse();
// The decrypted host survived a round trip through a server that could read none of it — including
// the directives, which merge per name and therefore have to come back in canonical form.
seen.Host.ShouldBe(expected);
seen.Secret.ShouldBe(expected);
return seen.Host;
var keys = await desktop.SshKeys.ListAsync(desktop.ActiveVaultId, Token);
var seenKey = keys.Items.ShouldHaveSingleItem();
seenKey.EntityId.ShouldBe(keyId);
seenKey.HasUnsyncedChanges.ShouldBeFalse();
// Including the private key itself, byte for byte and unreformatted, and the passphrase stored with
// it. This is the whole promise of a shared vault holding a key: a second machine can use it without
// the key ever having been readable to the thing that carried it.
seenKey.Secret.ShouldBe(expectedKey);
return seen.Secret;
}
private static async Task AssertUnlocksOfflineAsync(ClientCacheFactory caches)
@@ -257,6 +308,24 @@ public sealed class M1VerticalSliceTests(DevStack stack) : IClassFixture<DevStac
Options = HostOptions.Create([new HostOption("ServerAliveInterval", "30")]),
};
/// <remarks>
/// Armour of the right shape around material that is not a key. The shell at the end of this test
/// authenticates with a password, because what is under test here is the key's journey through the vault
/// — and a real private key committed to a repository is a real private key on the internet whatever it
/// was for. That SSH.NET can authenticate with a key delivered this way, as bytes rather than a file, is
/// established against a real <c>sshd</c> in <c>KeyAuthenticationTests</c>.
/// </remarks>
private static SshKeySecret BuildKey() =>
new()
{
Label = "e2e-deploy-key",
PrivateKeyPem =
"-----BEGIN OPENSSH PRIVATE KEY-----\nnot-a-real-key\n-----END OPENSSH PRIVATE KEY-----\n",
Passphrase = "an end to end key passphrase",
PublicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5 e2e@dodossh",
Notes = "created by the end-to-end slice",
};
private async Task<ClientCacheFactory> OpenCacheAsync()
{
var directory = Path.Combine(Path.GetTempPath(), $"dodossh-e2e-{Guid.CreateVersion7():N}");