76 lines
2.9 KiB
C#
76 lines
2.9 KiB
C#
using Microsoft.Extensions.Configuration;
|
|
using PostgresService.WebApi;
|
|
|
|
namespace PostgresService.Tests;
|
|
|
|
public sealed class PostgresServiceSecurityTests : IDisposable
|
|
{
|
|
private readonly string _dataRoot = Path.Combine(Path.GetTempPath(), $"postgres-service-tests-{Guid.NewGuid():N}");
|
|
|
|
[Fact]
|
|
public void SecretStore_PromotesSeedsAndUsesIndependentHashes()
|
|
{
|
|
Directory.CreateDirectory(_dataRoot);
|
|
File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
|
|
File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
|
|
var configuration = new ConfigurationBuilder()
|
|
.AddInMemoryCollection(new Dictionary<string, string?>
|
|
{
|
|
["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
|
|
})
|
|
.Build();
|
|
|
|
var store = new SecretStore(configuration);
|
|
store.EnsureInitialized();
|
|
|
|
Assert.True(store.VerifyAdminPassword("Admin-Password-For-Tests!"));
|
|
Assert.False(store.VerifyAdminPassword("Enrollment-Token-For-Tests-2026!"));
|
|
Assert.True(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
|
|
Assert.False(File.Exists(Path.Combine(_dataRoot, "admin-password.seed")));
|
|
Assert.False(File.Exists(Path.Combine(_dataRoot, "enrollment-token.seed")));
|
|
Assert.StartsWith("pbkdf2-sha256$", File.ReadAllText(Path.Combine(_dataRoot, "admin-password.hash")));
|
|
}
|
|
|
|
[Fact]
|
|
public void SecretStore_RotatedEnrollmentTokenInvalidatesOldToken()
|
|
{
|
|
Directory.CreateDirectory(_dataRoot);
|
|
File.WriteAllText(Path.Combine(_dataRoot, "admin-password.seed"), "Admin-Password-For-Tests!\n");
|
|
File.WriteAllText(Path.Combine(_dataRoot, "enrollment-token.seed"), "Enrollment-Token-For-Tests-2026!\n");
|
|
var configuration = new ConfigurationBuilder()
|
|
.AddInMemoryCollection(new Dictionary<string, string?>
|
|
{
|
|
["POSTGRES_SERVICE_DATA_ROOT"] = _dataRoot
|
|
})
|
|
.Build();
|
|
var store = new SecretStore(configuration);
|
|
store.EnsureInitialized();
|
|
|
|
var replacement = store.RotateEnrollmentToken();
|
|
|
|
Assert.Equal(64, replacement.Length);
|
|
Assert.True(store.VerifyEnrollmentToken(replacement));
|
|
Assert.False(store.VerifyEnrollmentToken("Enrollment-Token-For-Tests-2026!"));
|
|
}
|
|
|
|
[Fact]
|
|
public void AdminSessionStore_CreatesValidAndRevocableSession()
|
|
{
|
|
var sessions = new AdminSessionStore();
|
|
var token = sessions.Create();
|
|
|
|
Assert.True(sessions.Validate(token));
|
|
sessions.Revoke(token);
|
|
Assert.False(sessions.Validate(token));
|
|
Assert.False(sessions.Validate("unknown"));
|
|
}
|
|
|
|
public void Dispose()
|
|
{
|
|
if (Directory.Exists(_dataRoot))
|
|
{
|
|
Directory.Delete(_dataRoot, recursive: true);
|
|
}
|
|
}
|
|
}
|