feat!: probes generate their own keys and enroll with a join token; node and peer keys are separate [CI]

backend/tests/MoShiro.Backend.Tests/EnrollmentAndTaskSetTests.cs

@@ -93,6 +93,31 @@ public sealed class EnrollmentAndTaskSetTests
         Assert.DoesNotContain(tokens["items"]!.AsArray(), t => t!["id"]!.GetValue<string>() == id);
     }
 
+    [Fact]
+    public async Task Enrollment_RejectsATlsPublicKeyThatDoesNotMatchItsFingerprint_AndAnUnknownRole()
+    {
+        string token = await _backend.CreateJoinTokenAsync(role: "probe");
+        using var mine = Fleet.Identity.NodeIdentity.Generate();
+        using var tls = Fleet.Identity.NodeIdentity.Generate();
+        using var impostor = Fleet.Identity.NodeIdentity.Generate();
+        string pubkey = Convert.ToBase64String(mine.PublicKeySpki);
+        string hash = Convert.ToHexStringLower(System.Security.Cryptography.SHA256.HashData(System.Text.Encoding.UTF8.GetBytes(token)));
+        // 指纹是 tls 的，公钥却换成了别的：Agent 将来按指纹校验证书，两者必须对得上
+        using HttpResponseMessage response = await PostEnrollAsync(new JsonObject
+        {
+            ["join_token"] = token,
+            ["name"] = _backend.UniqueName("tls"),
+            ["pubkey"] = pubkey,
+            ["tls_spki"] = Convert.ToBase64String(Fleet.Identity.NodeIdentity.Fingerprint(tls.PublicKeySpki)),
+            ["tls_pubkey"] = Convert.ToBase64String(impostor.PublicKeySpki),
+            ["proof"] = Convert.ToBase64String(mine.Sign(Fleet.Identity.SignaturePurpose.Enroll, hash, pubkey)),
+        });
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+
+        using HttpResponseMessage badRole = await _backend.Admin.PostAsync("/api/admin/join-tokens", BackendFixture.Json(new JsonObject { ["role"] = "root" }));
+        Assert.True(badRole.StatusCode is HttpStatusCode.BadRequest or HttpStatusCode.UnprocessableEntity);
+    }
+
     [Fact]
     public async Task Enrollment_RejectsAProofSignedByAnotherKey()
     {
@@ -107,7 +132,8 @@ public sealed class EnrollmentAndTaskSetTests
             ["join_token"] = token,
             ["name"] = _backend.UniqueName("forged"),
             ["pubkey"] = pubkey,
-            ["tls_spki"] = Convert.ToBase64String(new byte[32]),
+            ["tls_spki"] = Convert.ToBase64String(Fleet.Identity.NodeIdentity.Fingerprint(mine.PublicKeySpki)),
+            ["tls_pubkey"] = pubkey,
             ["proof"] = forged,
         });
         Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
@@ -327,47 +353,52 @@ public sealed class EnrollmentAndTaskSetTests
     }
 
     [Fact]
-    public async Task ProbeLifecycle_CreateRotateRevokeDelete_IsReflectedInEveryAgentsPeerList()
+    public async Task ProbeLifecycle_EnrollRenameRevokeDelete_IsReflectedInEveryAgentsPeerList()
     {
         await using AgentSimulator agent = await _backend.ConnectAgentAsync();
         await agent.WaitForTaskSetAsync(s => s.Tasks.Count == Defaults.TaskCount);
 
-        using HttpResponseMessage created = await _backend.Admin.PostAsync("/api/admin/probes", BackendFixture.Json(new JsonObject { ["name"] = _backend.UniqueName("home") }));
-        Assert.Equal(HttpStatusCode.Created, created.StatusCode);
-        Assert.Equal("no-store", created.Headers.CacheControl!.ToString());
-        JsonNode identity = JsonNode.Parse(await created.Content.ReadAsStringAsync())!;
-        string id = identity["probe_id"]!.GetValue<string>();
-        using var key1 = Fleet.Identity.NodeIdentity.FromPkcs8(Convert.FromBase64String(identity["private_key"]!.GetValue<string>()));
-        Assert.True(Uri.TryCreate(identity["server"]!.GetValue<string>(), UriKind.Absolute, out _)); // Probe 直接连面板：probe.json 里是面板的地址
-        await agent.WaitForTaskSetAsync(s => s.Peers.Any(p => p.ProbeId.Value == id && p.PublicKey == Convert.ToBase64String(key1.PublicKeySpki)));
+        // 创建 Probe 就是创建一个 probe 角色的加入令牌；密钥由节点自己生成，Backend 从不接触私钥
+        string name = _backend.UniqueName("home");
+        using EnrolledProbe probe = await _backend.CreateProbeAsync(name);
+        string id = probe.ProbeId;
+        Assert.StartsWith(ProbeId.Prefix, id, StringComparison.Ordinal);
+        string peerKey = Convert.ToBase64String(probe.Identity.PeerIdentity.PublicKeySpki);
+        string backendKey = Convert.ToBase64String(probe.Identity.Identity.PublicKeySpki);
+        Assert.NotEqual(backendKey, peerKey); // 连面板的和连 Agent 的是两把独立的密钥
 
-        // The panel lists it; two probes can coexist and a duplicate name is refused
+        // Agent 的名单里放的是对等面的公钥，不是连面板的那把
+        TaskSet withProbe = await agent.WaitForTaskSetAsync(s => s.Peers.Any(p => p.ProbeId.Value == id && p.PublicKey == peerKey));
+        Assert.DoesNotContain(withProbe.Peers, p => p.PublicKey == backendKey);
+
+        // 令牌带角色；面板能列出这个 Probe；重名的注册被拒绝
+        JsonNode tokens = await _backend.GetJsonAsync(_backend.Admin, "/api/admin/join-tokens");
+        Assert.Contains(tokens["items"]!.AsArray(), t => t!["role"]!.GetValue<string>() == "probe");
         JsonNode listed = await _backend.GetJsonAsync(_backend.Admin, "/api/admin/probes");
         Assert.Contains(listed["items"]!.AsArray(), p => p!["id"]!.GetValue<string>() == id && !p["revoked"]!.GetValue<bool>());
-        string name = (await _backend.GetJsonAsync(_backend.Admin, "/api/admin/probes/" + id))["name"]!.GetValue<string>();
-        using HttpResponseMessage duplicate = await _backend.Admin.PostAsync("/api/admin/probes", BackendFixture.Json(new JsonObject { ["name"] = name }));
-        Assert.Equal(HttpStatusCode.Conflict, duplicate.StatusCode);
+        string duplicateToken = await _backend.CreateJoinTokenAsync(role: "probe");
+        using var http = new HttpClient();
+        Fleet.Core.Result<Fleet.Enrollment.Client.EnrollmentResult> duplicate = await Fleet.Enrollment.Client.EnrollmentClient.EnrollAsync(
+            http, _backend.BaseAddress, duplicateToken, name, Path.Combine(Path.GetTempPath(), "moshiro-dup-" + Guid.NewGuid().ToString("N")), "0.0.0", null, TimeProvider.System, default);
+        Assert.False(duplicate.IsSuccess);
+        Assert.Equal("fleet_name_conflict", duplicate.Error.Code.Value);
 
-        // Rename
+        // 创建身份和轮换密钥的接口已经没有了：换密钥就是吊销之后重新注册
+        using HttpResponseMessage oldCreate = await _backend.Admin.PostAsync("/api/admin/probes", BackendFixture.Json(new JsonObject { ["name"] = "x" }));
+        Assert.True(oldCreate.StatusCode is HttpStatusCode.NotFound or HttpStatusCode.MethodNotAllowed);
+        using HttpResponseMessage oldRotate = await _backend.Admin.PostAsync($"/api/admin/probes/{id}/rotate", null);
+        Assert.True(oldRotate.StatusCode is HttpStatusCode.NotFound or HttpStatusCode.MethodNotAllowed);
+
+        // 改名
         using HttpResponseMessage renamed = await _backend.Admin.PatchAsync("/api/admin/probes/" + id, BackendFixture.Json(new JsonObject { ["name"] = name + "-b" }));
         Assert.Equal(name + "-b", JsonNode.Parse(await renamed.Content.ReadAsStringAsync())!["name"]!.GetValue<string>());
 
-        // Rotate: same id, new key; the old key leaves every agent's list
-        using HttpResponseMessage rotated = await _backend.Admin.PostAsync($"/api/admin/probes/{id}/rotate", null);
-        JsonNode regenerated = JsonNode.Parse(await rotated.Content.ReadAsStringAsync())!;
-        Assert.Equal(id, regenerated["probe_id"]!.GetValue<string>());
-        Assert.NotEqual(identity["private_key"]!.GetValue<string>(), regenerated["private_key"]!.GetValue<string>());
-        using var key2 = Fleet.Identity.NodeIdentity.FromPkcs8(Convert.FromBase64String(regenerated["private_key"]!.GetValue<string>()));
-        await agent.WaitForTaskSetAsync(s => s.Peers.Any(p => p.ProbeId.Value == id && p.PublicKey == Convert.ToBase64String(key2.PublicKeySpki)));
-
-        // Revoke: gone from the peer list, kept in the panel as revoked; it cannot be rotated any more
+        // 吊销：从名单里消失，面板里留着记录
         using HttpResponseMessage revoked = await _backend.Admin.PostAsync($"/api/admin/probes/{id}/revoke", null);
         Assert.True(JsonNode.Parse(await revoked.Content.ReadAsStringAsync())!["revoked"]!.GetValue<bool>());
         await agent.WaitForTaskSetAsync(s => s.Peers.All(p => p.ProbeId.Value != id));
-        using HttpResponseMessage rotateRevoked = await _backend.Admin.PostAsync($"/api/admin/probes/{id}/rotate", null);
-        Assert.Equal(HttpStatusCode.Conflict, rotateRevoked.StatusCode);
 
-        // Delete
+        // 删除
         using HttpResponseMessage deleted = await _backend.Admin.DeleteAsync("/api/admin/probes/" + id);
         Assert.Equal(HttpStatusCode.NoContent, deleted.StatusCode);
         using HttpResponseMessage gone = await _backend.Admin.GetAsync("/api/admin/probes/" + id);