justme/MoShiro
1
1 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 5 Wiki Activity

test: share one operator and trust root across the trust tests; make the setup test cleanup best-effort [CI SKIP]

Browse Source
This commit is contained in:
justme committed 2026-10-08 15:30:12 +08:00
1 parent f22fdf8b68
commit 4a1e48db20
4 files changed
+91 -87
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

backend/tests/MoShiro.Backend.Tests/OwnerTests.cs
+3 -33
View File
@@ -55,42 +55,12 @@ public sealed class OwnerEndToEndTests : IDisposable
public void Dispose() => _options.RequireOwner = _before;
private static string Base64UrlOf(string statement) => Fleet.Core.Base64Url.Encode(SHA256.HashData(Encoding.UTF8.GetBytes(statement)));
/// <summary>建立信任根：一个有 passkey 的操作员给操作员集合签名。</summary>
private async Task<(HttpClient Session, SoftwarePasskey Passkey)> EstablishTrustAsync()
{
(HttpClient session, SoftwarePasskey passkey, _) = await _backend.CreateStrongSessionAsync("owner");
JsonNode state = JsonNode.Parse(await session.GetStringAsync("/api/admin/trust"))!;
if (!state["initialized"]!.GetValue<bool>())
{
string statement = state["proposal"]!["statement"]!.GetValue<string>();
JsonObject assertion = passkey.Assert(Base64UrlOf(statement));
var body = new JsonObject
{
["statement"] = statement,
["credential_id"] = assertion["credential_id"]!.DeepClone(),
["authenticator_data"] = assertion["authenticator_data"]!.DeepClone(),
["client_data_json"] = assertion["client_data_json"]!.DeepClone(),
["signature"] = assertion["signature"]!.DeepClone(),
};
using HttpResponseMessage committed = await session.PostAsync("/api/admin/trust", BackendFixture.Json(body));
Assert.Equal(HttpStatusCode.Created, committed.StatusCode);
}
return (session, passkey);
}
private async Task<JsonNode> OperatorsAsync(HttpClient session) =>
JsonNode.Parse(await session.GetStringAsync("/api/admin/trust"))!["operators"]!;
[Fact]
public async Task ANodeCannotBeAddedWithoutAnOwner()
{
(HttpClient session, SoftwarePasskey passkey) = await EstablishTrustAsync();
using HttpClient sessionScope = session;
using SoftwarePasskey passkeyScope = passkey;
string known = (await OperatorsAsync(session))[0]!.GetValue<string>();
Operator op = await SharedOperator.GetAsync(_backend); // 共享的操作员：不要释放它
HttpClient session = op.Session;
string known = op.Passkey.Id;
using HttpResponseMessage none = await session.PostAsync("/api/admin/join-tokens", BackendFixture.Json(new JsonObject { ["role"] = "agent", ["controllers"] = new JsonArray() }));
Assert.Equal(HttpStatusCode.BadRequest, none.StatusCode);
backend/tests/MoShiro.Backend.Tests/SetupTests.cs
+15 -2
View File
@@ -44,7 +44,20 @@ public sealed class SetupTests : IAsyncLifetime
await _app.StopAsync();
await _app.DisposeAsync();
Microsoft.Data.Sqlite.SqliteConnection.ClearAllPools(); // 连接池还拿着数据库文件
Directory.Delete(_directory, recursive: true);
TryDelete(_directory);
}
/// <summary>临时目录：尽力删除。SQLite 的 WAL 临时文件可能还没释放，留下一个临时目录比让测试失败好。</summary>
private static void TryDelete(string directory)
{
try
{
Directory.Delete(directory, recursive: true);
}
catch (IOException)
{
// 系统临时目录里的残留，会被清理
}
}
private Task<HttpResponseMessage> SetupAsync(string? code, string username, string password, bool returnSession = false) =>
@@ -143,7 +156,7 @@ public sealed class SetupTests : IAsyncLifetime
await generated.StopAsync();
await generated.DisposeAsync();
Microsoft.Data.Sqlite.SqliteConnection.ClearAllPools();
Directory.Delete(directory, recursive: true);
TryDelete(directory);
}
}
}
backend/tests/MoShiro.Backend.Tests/SharedOperator.cs
+70
View File
@@ -0,0 +1,70 @@
using System.Net;
using System.Runtime.CompilerServices;
using System.Security.Cryptography;
using System.Text;
using System.Text.Json.Nodes;
using Fleet.Identity;
namespace MoShiro.Backend.Tests;
/// <summary>一个已经建立了信任根的操作员：自己的用户、passkey、会话，以及创世指纹。</summary>
internal sealed record Operator(HttpClient Session, SoftwarePasskey Passkey, string Genesis);
/// <summary>
/// 共享的后端上只有一个信任根（创世只能签一次）：谁先需要，谁来建立，其余的测试用同一个操作员。
/// 信任相关的测试都从这里拿，不要各自去建立信任根，否则测试的先后顺序会决定谁失败。
/// </summary>
internal static class SharedOperator
{
private static readonly ConditionalWeakTable<BackendFixture, Operator> s_operators = [];
private static readonly SemaphoreSlim s_gate = new(1, 1);
public static async Task<Operator> GetAsync(BackendFixture backend)
{
await s_gate.WaitAsync();
try
{
if (s_operators.TryGetValue(backend, out Operator? existing))
{
return existing;
}
// 操作员：有 passkey、用 passkey 登录的会话
(HttpClient session, SoftwarePasskey passkey, _) = await backend.CreateStrongSessionAsync("operator");
// 创世：用 passkey 对集合本身签名（节点据此验链）
JsonNode state = JsonNode.Parse(await session.GetStringAsync("/api/admin/trust"))!;
Assert.False(state["initialized"]!.GetValue<bool>());
string statement = state["proposal"]!["statement"]!.GetValue<string>();
Assert.Equal(Base64UrlOf(statement), state["proposal"]!["challenge"]!.GetValue<string>());
using HttpResponseMessage genesis = await session.PostAsync("/api/admin/trust", BackendFixture.Json(Sign(passkey, statement)));
Assert.True(genesis.StatusCode == HttpStatusCode.Created, await genesis.Content.ReadAsStringAsync());
string fingerprint = JsonNode.Parse(await genesis.Content.ReadAsStringAsync())!["genesis"]!.GetValue<string>();
Assert.Equal(OperatorTrust.Fingerprint(statement), fingerprint);
var made = new Operator(session, passkey, fingerprint);
s_operators.Add(backend, made);
return made;
}
finally
{
s_gate.Release();
}
}
public static string Base64UrlOf(string statement) => Fleet.Core.Base64Url.Encode(SHA256.HashData(Encoding.UTF8.GetBytes(statement)));
/// <summary>passkey 对语句签名（挑战是语句的 SHA-256），拼成接口要的断言对象。</summary>
public static JsonObject Sign(SoftwarePasskey passkey, string statement)
{
JsonObject assertion = passkey.Assert(Base64UrlOf(statement));
return new JsonObject
{
["statement"] = statement,
["credential_id"] = assertion["credential_id"]!.DeepClone(),
["authenticator_data"] = assertion["authenticator_data"]!.DeepClone(),
["client_data_json"] = assertion["client_data_json"]!.DeepClone(),
["signature"] = assertion["signature"]!.DeepClone(),
};
}
}
backend/tests/MoShiro.Backend.Tests/TrustTests.cs
+3 -52
View File
@@ -20,9 +20,6 @@ namespace MoShiro.Backend.Tests;
[Collection("probe-e2e")]
public sealed class TrustTests
{
private static readonly ConditionalWeakTable<BackendFixture, Operator> s_operators = [];
private static readonly SemaphoreSlim s_gate = new(1, 1);
private readonly BackendFixture _backend;
public TrustTests(BackendFixture backend)
@@ -30,57 +27,11 @@ public sealed class TrustTests
_backend = backend;
}
/// <summary>一个已经建立了信任根的操作员：自己的用户、passkey、会话，以及创世指纹。</summary>
private sealed record Operator(HttpClient Session, SoftwarePasskey Passkey, string Genesis);
private Task<Operator> OperatorAsync() => SharedOperator.GetAsync(_backend);
private async Task<Operator> OperatorAsync()
{
await s_gate.WaitAsync();
try
{
if (s_operators.TryGetValue(_backend, out Operator? existing))
{
return existing;
}
private static string Base64UrlOf(string statement) => SharedOperator.Base64UrlOf(statement);
// 操作员：有 passkey、用 passkey 登录的会话
(HttpClient session, SoftwarePasskey passkey, _) = await _backend.CreateStrongSessionAsync("operator");
// 创世：用 passkey 对集合本身签名（节点据此验链）
JsonNode state = JsonNode.Parse(await session.GetStringAsync("/api/admin/trust"))!;
Assert.False(state["initialized"]!.GetValue<bool>());
string statement = state["proposal"]!["statement"]!.GetValue<string>();
Assert.Equal(Base64UrlOf(statement), state["proposal"]!["challenge"]!.GetValue<string>());
using HttpResponseMessage genesis = await session.PostAsync("/api/admin/trust", BackendFixture.Json(Sign(passkey, statement)));
Assert.True(genesis.StatusCode == HttpStatusCode.Created, await genesis.Content.ReadAsStringAsync());
string fingerprint = JsonNode.Parse(await genesis.Content.ReadAsStringAsync())!["genesis"]!.GetValue<string>();
Assert.Equal(OperatorTrust.Fingerprint(statement), fingerprint);
var made = new Operator(session, passkey, fingerprint);
s_operators.Add(_backend, made);
return made;
}
finally
{
s_gate.Release();
}
}
private static string Base64UrlOf(string statement) => Fleet.Core.Base64Url.Encode(SHA256.HashData(Encoding.UTF8.GetBytes(statement)));
/// <summary>passkey 对语句签名（挑战是语句的 SHA-256），拼成接口要的断言对象。</summary>
private static JsonObject Sign(SoftwarePasskey passkey, string statement)
{
JsonObject assertion = passkey.Assert(Base64UrlOf(statement));
return new JsonObject
{
["statement"] = statement,
["credential_id"] = assertion["credential_id"]!.DeepClone(),
["authenticator_data"] = assertion["authenticator_data"]!.DeepClone(),
["client_data_json"] = assertion["client_data_json"]!.DeepClone(),
["signature"] = assertion["signature"]!.DeepClone(),
};
}
private static JsonObject Sign(SoftwarePasskey passkey, string statement) => SharedOperator.Sign(passkey, statement);
/// <summary>创建一个加入码（普通 API key 就行，不需要 passkey），返回响应里的码和三条安装命令。</summary>
private async Task<(string Code, JsonNode Commands, HttpStatusCode Status)> CreateCodeAsync(string role = "probe", string[]? controllers = null)