Public Access
Spelunk: sign each device in through the browser instead of keeping Spelunk API keys in the vault
A Spelunk API key reaches one organisation, so a server elsewhere - oc-linux in Orange Climate - was refused before it reached the agent. Each device now signs in to a Spelunk once, under Settings -> Security -> Spelunk or from a Spelunk host's editor: the OAuth authorization code flow with PKCE for a native app (RFC 8252), with Spelunk as the authorization server. The browser opens Spelunk's /api/app-sign-in/authorize with a loopback redirect (the app's own scheme on Android), the person signs in there however they normally do and allows "DodoSSH on <device>", and the code is redeemed at /api/app-sign-in/token for an app session token. That token opens terminals in every organisation its person is in, with the role they have on each server at the time; tunnel tickets send no organisation. The sign-in stays on the device: sealed in the local cache under the LocalCacheKey (AAD resource type 18, bound to its row), never synced, wiped with the cache, and only ever sent to the Spelunk it came from. A 401 from Spelunk forgets it; SIGN OUT ends it there and here, and so does signing out of DodoSSH. Before every Spelunk connection DodoSSH asks its own identity provider whether its sign-in still stands (a forced refresh, at most once a minute), and an account it refuses is signed out of DodoSSH and of every Spelunk on the device. A route names no key any more: Spelunk hosts are written at host schema 11, which an older build shows read-only and asks to be updated for, and a payload that still names a key credential decodes with the id skipped. The SpelunkKey item type is gone: SyncEntityType 14, ChangeEntityType 14 and AAD type 17 are retired, the server drops spelunk_key and its change-log rows, and the client cache drops its cached items, outbox entries and conflicts of that type. A link still never starts a sign-in: from a Spelunk this device is not signed in to it opens the editor, which offers to. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
laurensandClaude Opus 5.5 committed
1 parent
902761d37b
commit
ef365f462e
62 files changed
+4327
-1945
No files matched your search
@@ -39,18 +39,14 @@ internal static class HostFactory
|
||||
BindPort = 1080,
|
||||
};
|
||||
|
||||
/// <summary>A credential holding a Spelunk API key, for the hosts reached through Spelunk.</summary>
|
||||
internal static Guid SpelunkKey { get; } = Guid.Parse("0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c");
|
||||
|
||||
/// <summary>A server's id in Spelunk.</summary>
|
||||
internal static Guid SpelunkServer { get; } = Guid.Parse("0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d");
|
||||
|
||||
/// <summary>
|
||||
/// A route to <see cref="SpelunkServer"/>, with <see cref="SpelunkKey"/> — signing in through Spelunk
|
||||
/// when <paramref name="signIn"/> says so.
|
||||
/// A route to <see cref="SpelunkServer"/> — signing in through Spelunk when <paramref name="signIn"/> says so.
|
||||
/// </summary>
|
||||
internal static SpelunkRoute ThroughSpelunk(string apiBase = "https://api.spelunk.example.com", bool signIn = false) =>
|
||||
new() { ApiBase = apiBase, ServerId = SpelunkServer, ApiKeyCredentialId = SpelunkKey, SignInThroughSpelunk = signIn };
|
||||
new() { ApiBase = apiBase, ServerId = SpelunkServer, SignInThroughSpelunk = signIn };
|
||||
|
||||
/// <remarks>
|
||||
/// <paramref name="port"/> defaults to an explicit 22 rather than to null, so a test that says nothing
|
||||
|
||||
@@ -1,131 +0,0 @@
|
||||
using System.Text;
|
||||
|
||||
namespace DodoSSH.Client.Domain.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// A Spelunk key: an API key and the one Spelunk it may be sent to.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// What these pin is that the pair is stored as it will be compared — the address in its one normal form —
|
||||
/// that an address the key could leak across a network from is refused, and that a merge never pairs one
|
||||
/// device's key with another device's address.
|
||||
/// </remarks>
|
||||
public sealed class SpelunkKeySecretTests
|
||||
{
|
||||
private const string Api = "https://api.spelunk.example.com";
|
||||
|
||||
[Fact]
|
||||
public void AKey_RoundTrips()
|
||||
{
|
||||
var key = Key();
|
||||
|
||||
SpelunkKeySecretCodec.TryDecode(SpelunkKeySecretCodec.Encode(key), out var document).ShouldBeTrue();
|
||||
|
||||
document.ShouldNotBeNull();
|
||||
document.Key.ShouldBe(key);
|
||||
document.SchemaVersion.ShouldBe(SpelunkKeySecretCodec.CurrentSchemaVersion);
|
||||
document.IsReadOnly.ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AKey_EncodesAtTheBaseVersion()
|
||||
{
|
||||
Encoding.UTF8.GetString(SpelunkKeySecretCodec.Encode(Key()))
|
||||
.ShouldBe(
|
||||
"""{"schemaVersion":1,"label":"Spelunk","apiBase":"https://api.spelunk.example.com","apiKey":"spelunk_one"}""");
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("https://api.spelunk.example.com/")]
|
||||
[InlineData("HTTPS://API.SPELUNK.EXAMPLE.COM")]
|
||||
public void AnAddressNotInItsNormalForm_IsRefused(string apiBase)
|
||||
{
|
||||
// Stored the one way or not at all: it is compared byte for byte with what a host or a link names.
|
||||
(Key() with { ApiBase = apiBase }).TryValidate(out var reason).ShouldBeFalse();
|
||||
reason.ShouldNotBeNull().ShouldContain("normal form");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void PlainHttpAcrossANetwork_IsRefused()
|
||||
{
|
||||
(Key() with { ApiBase = "http://api.spelunk.example.com" }).TryValidate(out var reason).ShouldBeFalse();
|
||||
reason.ShouldNotBeNull().ShouldContain("https");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void PlainHttpToThisMachine_IsAllowed()
|
||||
{
|
||||
(Key() with { ApiBase = "http://localhost:5080" }).TryValidate(out _).ShouldBeTrue();
|
||||
}
|
||||
|
||||
[Theory]
|
||||
[InlineData("")]
|
||||
[InlineData(" ")]
|
||||
[InlineData("spelunk_one\r\nX-Other: header")]
|
||||
public void AKeyThatIsNotAKey_IsRefused(string apiKey)
|
||||
{
|
||||
(Key() with { ApiKey = apiKey }).TryValidate(out _).ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void APayloadWithAnAddressOutOfNormalForm_DoesNotDecode()
|
||||
{
|
||||
// The address decides where the key may go, so a payload that disagrees with how every client
|
||||
// writes it is refused rather than normalised into something nobody chose.
|
||||
var payload = Encoding.UTF8.GetBytes(
|
||||
"""{"schemaVersion":1,"label":"Spelunk","apiBase":"https://api.spelunk.example.com/","apiKey":"k"}""");
|
||||
|
||||
SpelunkKeySecretCodec.TryDecode(payload, out _).ShouldBeFalse();
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AKeyChangedOnOneSide_AndAnAddressOnTheOther_IsKeptAsAPair()
|
||||
{
|
||||
// The case this merge exists for: merging field by field would send the new key to the new address,
|
||||
// a pairing neither device made.
|
||||
var ancestor = Key();
|
||||
var local = ancestor with { ApiKey = "spelunk_two" };
|
||||
var remote = ancestor with { ApiBase = "https://spelunk.other.example" };
|
||||
|
||||
var result = SpelunkKeySecretMerge.Merge(ancestor, local, remote);
|
||||
|
||||
(result.Merged.ApiBase, result.Merged.ApiKey).ShouldBeOneOf(
|
||||
(local.ApiBase, local.ApiKey),
|
||||
(remote.ApiBase, remote.ApiKey));
|
||||
|
||||
var conflict = result.Conflicts.ShouldHaveSingleItem();
|
||||
conflict.Field.ShouldBe(SpelunkKeySecretMerge.PairField);
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AKeyReplacedOnBothSides_NeverReachesTheConflictLog()
|
||||
{
|
||||
var ancestor = Key();
|
||||
var local = ancestor with { ApiKey = "spelunk_local_secret" };
|
||||
var remote = ancestor with { ApiKey = "spelunk_remote_secret" };
|
||||
|
||||
var result = SpelunkKeySecretMerge.Merge(ancestor, local, remote);
|
||||
|
||||
var conflict = result.Conflicts.ShouldHaveSingleItem();
|
||||
$"{conflict.Kept} {conflict.Discarded}".ShouldNotContain("secret");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void AKeyChangedOnOneSideOnly_IsTakenWithoutAConflict()
|
||||
{
|
||||
var ancestor = Key();
|
||||
var local = ancestor with { ApiKey = "spelunk_two", Label = "renamed" };
|
||||
|
||||
var result = SpelunkKeySecretMerge.Merge(ancestor, local, ancestor);
|
||||
|
||||
result.Merged.ShouldBe(local);
|
||||
result.HasConflicts.ShouldBeFalse();
|
||||
}
|
||||
|
||||
private static SpelunkKeySecret Key() => new()
|
||||
{
|
||||
Label = "Spelunk",
|
||||
ApiBase = Api,
|
||||
ApiKey = "spelunk_one",
|
||||
};
|
||||
}
|
||||
@@ -73,14 +73,12 @@ public sealed class SpelunkRouteTests
|
||||
|
||||
[Theory]
|
||||
[InlineData("server")]
|
||||
[InlineData("key")]
|
||||
[InlineData("api")]
|
||||
public void ARouteMissingAPart_IsRefused(string missing)
|
||||
{
|
||||
var route = missing switch
|
||||
{
|
||||
"server" => ThroughSpelunk() with { ServerId = Guid.Empty },
|
||||
"key" => ThroughSpelunk() with { ApiKeyCredentialId = Guid.Empty },
|
||||
_ => ThroughSpelunk() with { ApiBase = "https://api.spelunk.example.com/" },
|
||||
};
|
||||
|
||||
@@ -98,7 +96,7 @@ public sealed class SpelunkRouteTests
|
||||
|
||||
document.ShouldNotBeNull();
|
||||
document.Host.ShouldBe(host);
|
||||
document.SchemaVersion.ShouldBe(HostSecretCodec.SpelunkSchemaVersion);
|
||||
document.SchemaVersion.ShouldBe(HostSecretCodec.SpelunkSignedInDeviceSchemaVersion);
|
||||
document.IsReadOnly.ShouldBeFalse();
|
||||
}
|
||||
|
||||
@@ -122,7 +120,7 @@ public sealed class SpelunkRouteTests
|
||||
|
||||
Encoding.UTF8.GetString(bytes).ShouldBe(
|
||||
"""
|
||||
{"schemaVersion":9,"label":"prod-db","hostname":"db.internal","port":22,"jumpHostIds":[],"options":{},"relayEnabled":false,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c"}}
|
||||
{"schemaVersion":11,"label":"prod-db","hostname":"db.internal","port":22,"jumpHostIds":[],"options":{},"relayEnabled":false,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d"}}
|
||||
""");
|
||||
}
|
||||
|
||||
@@ -156,10 +154,10 @@ public sealed class SpelunkRouteTests
|
||||
public void ARouteWrittenByANewerClient_IsReadOnlyHere()
|
||||
{
|
||||
// The rule every version before this one relies on, checked from the far side: a build that knows
|
||||
// version 10 reads a version 11 host, shows it, and refuses to re-encode what it cannot represent.
|
||||
// version 11 reads a version 12 host, shows it, and refuses to re-encode what it cannot represent.
|
||||
var payload = Encoding.UTF8.GetBytes(
|
||||
"""
|
||||
{"schemaVersion":11,"label":"prod-db","hostname":"db.internal","port":22,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c"},"somethingNewer":true}
|
||||
{"schemaVersion":12,"label":"prod-db","hostname":"db.internal","port":22,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c"},"somethingNewer":true}
|
||||
""");
|
||||
|
||||
HostSecretCodec.TryDecode(payload, out var document).ShouldBeTrue();
|
||||
@@ -207,7 +205,7 @@ public sealed class SpelunkRouteTests
|
||||
document.ShouldNotBeNull();
|
||||
document.Host.ShouldBe(host);
|
||||
document.Host.Spelunk.ShouldNotBeNull().SignInThroughSpelunk.ShouldBeTrue();
|
||||
document.SchemaVersion.ShouldBe(HostSecretCodec.SpelunkSignInSchemaVersion);
|
||||
document.SchemaVersion.ShouldBe(HostSecretCodec.SpelunkSignedInDeviceSchemaVersion);
|
||||
document.SchemaVersion.ShouldBe(HostSecretCodec.CurrentSchemaVersion);
|
||||
document.IsReadOnly.ShouldBeFalse();
|
||||
}
|
||||
@@ -219,13 +217,15 @@ public sealed class SpelunkRouteTests
|
||||
|
||||
Encoding.UTF8.GetString(bytes).ShouldBe(
|
||||
"""
|
||||
{"schemaVersion":10,"label":"prod-db","hostname":"db.internal","port":22,"jumpHostIds":[],"options":{},"relayEnabled":false,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c","signIn":true}}
|
||||
{"schemaVersion":11,"label":"prod-db","hostname":"db.internal","port":22,"jumpHostIds":[],"options":{},"relayEnabled":false,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","signIn":true}}
|
||||
""");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public void ARouteWrittenBeforeSignIn_DecodesAsNotSigningIn_AndStaysEditable()
|
||||
public void ARouteWrittenWithAnApiKey_DecodesWithoutIt_AsNotSigningIn_AndStaysEditable()
|
||||
{
|
||||
// The API key a route used to name is an unknown member now, skipped: the host is reached as whoever
|
||||
// this device signed in to Spelunk as, and saving it writes it at version 11 without the key.
|
||||
var payload = Encoding.UTF8.GetBytes(
|
||||
"""
|
||||
{"schemaVersion":9,"label":"prod-db","hostname":"db.internal","port":22,"spelunk":{"api":"https://api.spelunk.example.com","serverId":"0192f0c8-dddd-7c3d-8e4f-5a6b7c8d9e0d","apiKeyCredentialId":"0192f0c8-cccc-7c3d-8e4f-5a6b7c8d9e0c"}}
|
||||
|
||||
Reference in new issue
Block a user