mirror of
https://github.com/hanzoai/ingress.git
synced 2026-10-26 02:47:15 +00:00
zeekay
859df34b98
The ACME store holds the account key and every leaf private key the edge has been issued. It was JSON at mode 0600 on a node, which protects it from another UID on that node and from nothing else. It is now sealed under a key fetched from KMS at startup and held only in memory, so the file on the node is inert. pkg/kms speaks the same luxfi/kms contract the gateway's routes loader does, so the estate has one KMS conversation rather than two.
88 lines
1.7 KiB
Go
88 lines
1.7 KiB
Go
package acme
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"github.com/hanzoai/ingress/pkg/safe"
|
|
)
|
|
|
|
func TestLocalStore_GetAccount(t *testing.T) {
|
|
acmeFile := filepath.Join(t.TempDir(), "acme.json")
|
|
|
|
email := "[email protected]"
|
|
filePayload := fmt.Sprintf(`{
|
|
"test": {
|
|
"Account": {
|
|
"Email": "%s"
|
|
}
|
|
}
|
|
}`, email)
|
|
|
|
err := os.WriteFile(acmeFile, []byte(filePayload), 0o600)
|
|
require.NoError(t, err)
|
|
|
|
testCases := []struct {
|
|
desc string
|
|
filename string
|
|
expected *Account
|
|
}{
|
|
{
|
|
desc: "empty file",
|
|
filename: filepath.Join(t.TempDir(), "acme-empty.json"),
|
|
expected: nil,
|
|
},
|
|
{
|
|
desc: "file with data",
|
|
filename: acmeFile,
|
|
expected: &Account{Email: "[email protected]"},
|
|
},
|
|
}
|
|
|
|
for _, test := range testCases {
|
|
t.Run(test.desc, func(t *testing.T) {
|
|
s := NewLocalStore(test.filename, safe.NewPool(t.Context()), Plain())
|
|
|
|
account, err := s.GetAccount("test")
|
|
require.NoError(t, err)
|
|
|
|
assert.Equal(t, test.expected, account)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestLocalStore_SaveAccount(t *testing.T) {
|
|
acmeFile := filepath.Join(t.TempDir(), "acme.json")
|
|
|
|
s := NewLocalStore(acmeFile, safe.NewPool(t.Context()), Plain())
|
|
|
|
email := "[email protected]"
|
|
|
|
err := s.SaveAccount("test", &Account{Email: email})
|
|
require.NoError(t, err)
|
|
|
|
time.Sleep(100 * time.Millisecond)
|
|
|
|
file, err := os.ReadFile(acmeFile)
|
|
require.NoError(t, err)
|
|
|
|
expected := `{
|
|
"test": {
|
|
"Account": {
|
|
"Email": "[email protected]",
|
|
"Registration": null,
|
|
"PrivateKey": null,
|
|
"KeyType": ""
|
|
},
|
|
"Certificates": null
|
|
}
|
|
}`
|
|
|
|
assert.Equal(t, expected, string(file))
|
|
}
|