feat: add native fnOS PostgreSQL shared service

2026-08-02 19:57:24 +08:00
commit 01976310e7
38 changed files with 4659 additions and 0 deletions
@@ -0,0 +1,20 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <TargetFramework>net8.0</TargetFramework>
+    <ImplicitUsings>enable</ImplicitUsings>
+    <Nullable>enable</Nullable>
+    <IsPackable>false</IsPackable>
+    <IsTestProject>true</IsTestProject>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="Microsoft.NET.Test.Sdk" Version="17.11.1" />
+    <PackageReference Include="xunit" Version="2.9.2" />
+    <PackageReference Include="xunit.runner.visualstudio" Version="2.8.2">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="../../src/PostgresService.WebApi/PostgresService.WebApi.csproj" />
+  </ItemGroup>
+</Project>
@@ -0,0 +1,75 @@
+using Microsoft.Extensions.Configuration;
+using PostgresService.WebApi;
+
+namespace PostgresService.Tests;
+
+public sealed class PostgresServiceSecurityTests : IDisposable
+{
+    private readonly string _dataRoot = Path.Combine(Path.GetTempPath(), $"postgres-service-tests-{Guid.NewGuid():N}");
+
+    [Fact]
+    public void SecretStore_PromotesSeedsAndUsesIndependentHashes()
+    {
+        Directory.CreateDirectory(_dataRoot);
+        File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
+        File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
+            })
+            .Build();
+
+        var store = new SecretStore(configuration);
+        store.EnsureInitialized();
+
+        Assert.True(store.VerifyAdminPassword("Admin-Password-For-Tests!"));
+        Assert.False(store.VerifyAdminPassword("Enrollment-Token-For-Tests-2026!"));
+        Assert.True(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
+        Assert.False(File.Exists(Path.Combine(_dataRoot, "admin-password.seed")));
+        Assert.False(File.Exists(Path.Combine(_dataRoot, "enrollment-token.seed")));
+        Assert.StartsWith("pbkdf2-sha256$", File.ReadAllText(Path.Combine(_dataRoot, "admin-password.hash")));
+    }
+
+    [Fact]
+    public void SecretStore_RotatedEnrollmentTokenInvalidatesOldToken()
+    {
+        Directory.CreateDirectory(_dataRoot);
+        File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
+        File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
+        var configuration = new ConfigurationBuilder()
+            .AddInMemoryCollection(new Dictionary<string, string?>
+            {
+                ["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
+            })
+            .Build();
+        var store = new SecretStore(configuration);
+        store.EnsureInitialized();
+
+        var replacement = store.RotateEnrollmentToken();
+
+        Assert.Equal(64, replacement.Length);
+        Assert.True(store.VerifyEnrollmentToken(replacement));
+        Assert.False(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
+    }
+
+    [Fact]
+    public void AdminSessionStore_CreatesValidAndRevocableSession()
+    {
+        var sessions = new AdminSessionStore();
+        var token = sessions.Create();
+
+        Assert.True(sessions.Validate(token));
+        sessions.Revoke(token);
+        Assert.False(sessions.Validate(token));
+        Assert.False(sessions.Validate("unknown"));
+    }
+
+    public void Dispose()
+    {
+        if (Directory.Exists(_dataRoot))
+        {
+            Directory.Delete(_dataRoot, recursive: true);
+        }
+    }
+}
@@ -0,0 +1 @@
+global using Xunit;