Refactor the multi-host salt install page.

[arvados.git] / services / keepstore / perms_test.go

diff --git a/services/keepstore/perms_test.go b/services/keepstore/perms_test.go
index 59516af85f898efd223389f42199901c6ae65862..13223747063cd79850454088d5cb5ae08823f00b 100644 (file)
--- a/services/keepstore/perms_test.go
+++ b/services/keepstore/perms_test.go
@@ -1,8 +1,15 @@
-package main
+// Copyright (C) The Arvados Authors. All rights reserved.
+//
+// SPDX-License-Identifier: AGPL-3.0
+
+package keepstore
 
 import (
-       "testing"
+       "strconv"
        "time"
+
+       "git.arvados.org/arvados.git/sdk/go/arvados"
+       check "gopkg.in/check.v1"
 )
 
 const (
@@ -16,110 +23,41 @@ const (
                "gokee3eamvjy8qq1fvy238838enjmy5wzy2md7yvsitp5vztft6j4q866efym7e6" +
                "vu5wm9fpnwjyxfldw3vbo01mgjs75rgo7qioh8z8ij7jpyp8508okhgbbex3ceei" +
                "786u5rw2a9gx743dj3fgq2irk"
-       knownSignature     = "257f3f5f5f0a4e4626a18fc74bd42ec34dcb228a"
+       knownSignatureTTL  = arvados.Duration(24 * 14 * time.Hour)
+       knownSignature     = "89118b78732c33104a4d6231e8b5a5fa1e4301e3"
        knownTimestamp     = "7fffffff"
        knownSigHint       = "+A" + knownSignature + "@" + knownTimestamp
        knownSignedLocator = knownLocator + knownSigHint
 )
 
-func TestSignLocator(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if ts, err := ParseHexTimestamp(knownTimestamp); err != nil {
-               t.Errorf("bad knownTimestamp %s", knownTimestamp)
-       } else {
-               if knownSignedLocator != SignLocator(knownLocator, knownToken, ts) {
-                       t.Fail()
-               }
-       }
-}
-
-func TestVerifySignature(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownSignedLocator, knownToken) != nil {
-               t.Fail()
-       }
-}
-
-func TestVerifySignatureExtraHints(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownLocator+"+K@xyzzy"+knownSigHint, knownToken) != nil {
-               t.Fatal("Verify cannot handle hint before permission signature")
-       }
-
-       if VerifySignature(knownLocator+knownSigHint+"+Zfoo", knownToken) != nil {
-               t.Fatal("Verify cannot handle hint after permission signature")
-       }
-
-       if VerifySignature(knownLocator+"+K@xyzzy"+knownSigHint+"+Zfoo", knownToken) != nil {
-               t.Fatal("Verify cannot handle hints around permission signature")
-       }
-}
-
-// The size hint on the locator string should not affect signature validation.
-func TestVerifySignatureWrongSize(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownHash+"+999999"+knownSigHint, knownToken) != nil {
-               t.Fatal("Verify cannot handle incorrect size hint")
-       }
-
-       if VerifySignature(knownHash+knownSigHint, knownToken) != nil {
-               t.Fatal("Verify cannot handle missing size hint")
-       }
-}
-
-func TestVerifySignatureBadSig(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       badLocator := knownLocator + "+Aaaaaaaaaaaaaaaa@" + knownTimestamp
-       if VerifySignature(badLocator, knownToken) != PermissionError {
-               t.Fail()
+func (s *HandlerSuite) TestSignLocator(c *check.C) {
+       tsInt, err := strconv.ParseInt(knownTimestamp, 16, 0)
+       if err != nil {
+               c.Fatal(err)
        }
-}
+       t0 := time.Unix(tsInt, 0)
 
-func TestVerifySignatureBadTimestamp(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       badLocator := knownLocator + "+A" + knownSignature + "@OOOOOOOl"
-       if VerifySignature(badLocator, knownToken) != PermissionError {
-               t.Fail()
+       s.cluster.Collections.BlobSigningTTL = knownSignatureTTL
+       s.cluster.Collections.BlobSigningKey = knownKey
+       if x := SignLocator(s.cluster, knownLocator, knownToken, t0); x != knownSignedLocator {
+               c.Fatalf("Got %+q, expected %+q", x, knownSignedLocator)
        }
-}
 
-func TestVerifySignatureBadSecret(t *testing.T) {
-       PermissionSecret = []byte("00000000000000000000")
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownSignedLocator, knownToken) != PermissionError {
-               t.Fail()
+       s.cluster.Collections.BlobSigningKey = "arbitrarykey"
+       if x := SignLocator(s.cluster, knownLocator, knownToken, t0); x == knownSignedLocator {
+               c.Fatalf("Got same signature %+q, even though blobSigningKey changed", x)
        }
 }
 
-func TestVerifySignatureBadToken(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
-
-       if VerifySignature(knownSignedLocator, "00000000") != PermissionError {
-               t.Fail()
+func (s *HandlerSuite) TestVerifyLocator(c *check.C) {
+       s.cluster.Collections.BlobSigningTTL = knownSignatureTTL
+       s.cluster.Collections.BlobSigningKey = knownKey
+       if err := VerifySignature(s.cluster, knownSignedLocator, knownToken); err != nil {
+               c.Fatal(err)
        }
-}
-
-func TestVerifySignatureExpired(t *testing.T) {
-       PermissionSecret = []byte(knownKey)
-       defer func() { PermissionSecret = nil }()
 
-       yesterday := time.Now().AddDate(0, 0, -1)
-       expiredLocator := SignLocator(knownHash, knownToken, yesterday)
-       if VerifySignature(expiredLocator, knownToken) != ExpiredError {
-               t.Fail()
+       s.cluster.Collections.BlobSigningKey = "arbitrarykey"
+       if err := VerifySignature(s.cluster, knownSignedLocator, knownToken); err == nil {
+               c.Fatal("Verified signature even with wrong blobSigningKey")
        }
 }