Files
DodoSSH/tests/DodoSSH.Client.Domain.Tests/ValueSemanticsTests.cs
T
jaap-jan e24012b039 Sync credentials as a vault item type, and bind one to a host
Closes the largest remaining M1 gap in the data layer: a username and password
can live in the vault, sync between machines, and be named by a host as how it
authenticates. What is not here is the interface for creating one — see the end
of this message.

The third item type, and the first one that cost almost nothing to add. Server:
a VaultCredential row, an EF configuration, a migration, and a CredentialKind.
Client: a secret, a codec, a merge, a cipher, a kind, a repository facade and a
session property. No new reconciliation logic, no change to the sync engine, no
client cache migration. That was the whole point of the item-kind seam, and this
is the evidence it holds.

The narrowest type of the three on plaintext, and not for symmetry. A host has a
deliberate concession — the relay needs an address it can resolve. A key has a
fingerprint, public by nature, which this client still declines to send. A
password has no part that is safe to expose: not its length, not a hash, not a
hint. So CredentialKind refuses every plaintext field there is, hydrates none,
and the table has no column to put one in.

HostSecret.CredentialId is the password counterpart of SshKeyId, and the two are
mutually exclusive. SSH itself would happily try a key and fall back to a
password, but a host naming both leaves "how does this authenticate?" without a
single answer — the interface, the connect path and the user would each be free
to guess differently. TryValidate refuses it. One consequence was not
anticipated: "a full host" stops being a coherent idea, which is what broke
AFullHost_RoundTrips and is now written into that test.

The schema version became a ladder rather than a maximum: credential-bound is 3,
key-bound is 2, neither is still 1. Adding credentials therefore does not drag
every key-bound host in every vault onto a version that clients understanding
keys perfectly well would refuse to edit. A test pins exactly that, because it is
the property the whole content-dependent-version rule exists to provide, and the
obvious implementation would quietly lose it.

Two tests had become false and said so:

- Push_AnUnsupportedEntityType_IsInvalidNotAFailedBatch used Credential as its
  example of a type this server does not implement. It now asks the server's own
  registry what is still missing, so it cannot go stale again, and skips with a
  reason if that set ever empties.
- ThePullFilterNamesEveryTypeThisBuildSynchronises pinned the exact list, which
  is what it is for.

Also fixes ten nullable warnings — eight in SyncEndpointTests, two in a test file
added earlier today. Neither set was introduced here; both were invisible until
an unrelated change forced their project to recompile, which means the
zero-warning claims made earlier in this work only ever covered what happened to
be rebuilt.

777 tests green. Zero warnings, dotnet format clean.

Not done, and deliberately: the credential interface. The vault column is 340
pixels wide and already holds two lists and two editors, kept from clipping its
own buttons at the window's minimum height only by the one-editor-at-a-time rule
added earlier today. A third list and a third editor would recreate that defect
rather than avoid it, so the column needs a shape decision first. Credentials
sync; they cannot yet be created in the interface.
2026-07-29 21:09:08 +02:00

179 lines
7.1 KiB
C#

using static DodoSSH.Client.Domain.Tests.HostFactory;
namespace DodoSSH.Client.Domain.Tests;
/// <summary>
/// Equality of the collection types, and of the host that holds them.
/// </summary>
/// <remarks>
/// This suite guards a failure that would be invisible rather than loud. If any of these compared by
/// reference, the merge would report every host as changed on every sync pass, two identical edits
/// would register as a conflict, and the engine would push spurious updates forever. Nothing would
/// throw and no test elsewhere would obviously fail — which is exactly why these are asserted here.
/// </remarks>
public sealed class ValueSemanticsTests
{
[Fact]
public void TwoHostsWithEqualContents_AreEqual()
{
var one = Host(jumps: [Bastion, Relay], options: [("Compression", "yes")]);
var other = Host(jumps: [Bastion, Relay], options: [("Compression", "yes")]);
one.ShouldBe(other);
one.GetHashCode().ShouldBe(other.GetHashCode());
}
[Fact]
public void AHostDifferingOnlyInACollection_IsNotEqual()
{
Host(jumps: [Bastion]).ShouldNotBe(Host(jumps: [Relay]));
Host(options: [("Compression", "yes")]).ShouldNotBe(Host(options: [("Compression", "no")]));
}
// Note on the assertion style below: these call Equals and the operators directly rather than
// going through ShouldBe. Both of these types implement IReadOnlyList, and Shouldly compares
// enumerables element by element — so ShouldBe would pass whatever Equals did, which is the one
// thing this suite exists to check.
[Fact]
public void AJumpChain_ComparesByContentsAndOrder()
{
JumpChain.Create([Bastion, Relay]).Equals(JumpChain.Create([Bastion, Relay])).ShouldBeTrue();
(JumpChain.Create([Bastion, Relay]) == JumpChain.Create([Bastion, Relay])).ShouldBeTrue();
JumpChain.Create([Bastion, Relay]).Equals(JumpChain.Create([Relay, Bastion])).ShouldBeFalse();
JumpChain.Create([Bastion]).Equals(JumpChain.Create([Bastion, Relay])).ShouldBeFalse();
JumpChain.Create([]).Equals(JumpChain.Empty).ShouldBeTrue();
JumpChain.Create([Bastion]).Equals(null).ShouldBeFalse();
}
[Fact]
public void AJumpChain_HashesByContents()
{
JumpChain.Create([Bastion, Relay]).GetHashCode()
.ShouldBe(JumpChain.Create([Bastion, Relay]).GetHashCode());
}
[Fact]
public void AJumpChain_ComparesEqualAcrossTheSpanAndSequenceFactories()
{
Guid[] hops = [Bastion, Relay];
JumpChain.Create(hops.AsSpan()).Equals(JumpChain.Create(hops.AsEnumerable())).ShouldBeTrue();
}
[Fact]
public void Directives_CompareIgnoringNameCaseAndInputOrder()
{
// Both halves matter. Case, because a merge picks whichever spelling it saw first and two
// clients must still agree. Order, because the collection canonicalises and a user typing
// the same two directives in the other order has not changed anything.
var one = HostOptions.Create([new HostOption("Compression", "yes"), new HostOption("Port", "22")]);
var other = HostOptions.Create([new HostOption("port", "22"), new HostOption("compression", "yes")]);
one.Equals(other).ShouldBeTrue();
(one == other).ShouldBeTrue();
one.GetHashCode().ShouldBe(other.GetHashCode());
}
[Fact]
public void Directives_CompareValuesCaseSensitively()
{
// Keywords are case-insensitive in SSH; values are not. "yes" and "YES" happen to mean the
// same to sshd, but this layer must not decide that for every directive that exists.
HostOptions.Create([new HostOption("Compression", "yes")])
.Equals(HostOptions.Create([new HostOption("Compression", "YES")]))
.ShouldBeFalse();
}
[Fact]
public void Directives_CompareUnequalWhenOneSideHasMore()
{
var one = HostOptions.Create([new HostOption("Compression", "yes")]);
var other = HostOptions.Create(
[new HostOption("Compression", "yes"), new HostOption("Port", "22")]);
one.Equals(other).ShouldBeFalse();
HostOptions.Empty.Equals(one).ShouldBeFalse();
one.Equals(null).ShouldBeFalse();
}
[Fact]
public void Directives_AreHeldInNameOrder()
{
var options = HostOptions.Create(
[
new HostOption("ServerAliveInterval", "30"),
new HostOption("Compression", "yes"),
]);
options[0].Name.ShouldBe("Compression");
options[1].Name.ShouldBe("ServerAliveInterval");
}
[Fact]
public void ARepeatedDirectiveName_IsRefused()
{
// A repeated keyword has no merge key, so M1 cannot represent it. Refusing is the honest
// answer; silently keeping one of the two would lose data without saying so.
var duplicate = new[]
{
new HostOption("Compression", "yes"),
new HostOption("compression", "no"),
};
HostOptions.TryCreate(duplicate, out _, out var error).ShouldBeFalse();
error.ShouldNotBeNull();
error.Contains("more than once", StringComparison.Ordinal).ShouldBeTrue();
Should.Throw<ArgumentException>(() => HostOptions.Create(duplicate));
}
[Fact]
public void ABlankDirectiveName_IsRefused()
{
HostOptions.TryCreate([new HostOption(" ", "x")], out _, out _).ShouldBeFalse();
}
[Fact]
public void AHostBuiltWithWith_KeepsCollectionEquality()
{
// `with` copies the collection references, so this would pass even under reference equality.
// It is here because the merge builds its result with an object initialiser rather than
// `with`, and both paths have to agree.
var host = Host(options: [("Compression", "yes")]);
var copy = host with { Notes = "changed" };
copy.Options.Equals(host.Options).ShouldBeTrue();
(copy with { Notes = host.Notes }).ShouldBe(host);
}
[Fact]
public void TryValidate_RejectsWhatCannotBeStored()
{
Host(label: "").TryValidate(out _).ShouldBeFalse();
Host(hostname: " ").TryValidate(out _).ShouldBeFalse();
Host(port: 65536).TryValidate(out _).ShouldBeFalse();
Host(jumps: [Guid.Empty]).TryValidate(out _).ShouldBeFalse();
Host(sshKeyId: Guid.Empty).TryValidate(out _).ShouldBeFalse();
Host(credentialId: Guid.Empty).TryValidate(out _).ShouldBeFalse();
Host().TryValidate(out _).ShouldBeTrue();
}
[Fact]
public void AHostAuthenticatesOneWay_NotTwo()
{
// SSH would happily try a key and fall back to a password, and a host that named both would leave
// "how does this authenticate?" without a single answer — so the interface, the connect path and the
// user would each be free to guess differently. Refused at the type instead.
var both = Host(sshKeyId: DeployKey, credentialId: Guid.CreateVersion7());
both.TryValidate(out var reason).ShouldBeFalse();
reason.ShouldNotBeNull().ShouldContain("not both");
Host(sshKeyId: DeployKey).TryValidate(out _).ShouldBeTrue();
Host(credentialId: Guid.CreateVersion7()).TryValidate(out _).ShouldBeTrue();
}
}