71 lines
2.3 KiB
C#
71 lines
2.3 KiB
C#
using Fleet.Core;
|
|
using Fleet.Hosting;
|
|
using Fleet.Identity;
|
|
|
|
namespace Fleet.Tests;
|
|
|
|
/// <summary>节点自己要求有属主（passkey）：Agent 和 Probe 共用这一份，没有属主就不运行。</summary>
|
|
public sealed class OwnerGuardTests : IDisposable
|
|
{
|
|
private readonly TestAuthenticator _alice = new();
|
|
private readonly string _directory = Path.Combine(Path.GetTempPath(), "moshiro-owner-" + Guid.NewGuid().ToString("N"));
|
|
|
|
public OwnerGuardTests()
|
|
{
|
|
Directory.CreateDirectory(_directory);
|
|
}
|
|
|
|
public void Dispose()
|
|
{
|
|
_alice.Dispose();
|
|
Directory.Delete(_directory, recursive: true);
|
|
}
|
|
|
|
private void Pin(params string[] controllers)
|
|
{
|
|
var set = new OperatorSet(1, OperatorTrust.Genesis, TestAuthenticator.RpId, [TestAuthenticator.Origin], [_alice.Key]);
|
|
SignedStatement genesis = _alice.Sign(OperatorTrust.Encode(set));
|
|
TrustAnchor.Pin(_directory, OperatorTrust.Fingerprint(genesis.Statement), [genesis.ToDto()], controllers);
|
|
}
|
|
|
|
[Fact]
|
|
public void ANodeEnrolledWithoutATrustRoot_HasNoOwner_AndDoesNotRun()
|
|
{
|
|
TrustAnchor none = TrustAnchor.Load(_directory, NullNodeLog.Instance);
|
|
|
|
Assert.NotNull(OwnerGuard.Problem(none, require: true));
|
|
Assert.False(OwnerGuard.Check(_directory, require: true, NullNodeLog.Instance));
|
|
}
|
|
|
|
[Fact]
|
|
public void ANodePinnedToAnOwnerPasskey_Runs()
|
|
{
|
|
Pin(_alice.CredentialId);
|
|
|
|
TrustAnchor pinned = TrustAnchor.Load(_directory, NullNodeLog.Instance);
|
|
|
|
Assert.Null(OwnerGuard.Problem(pinned, require: true));
|
|
Assert.True(OwnerGuard.Check(_directory, require: true, NullNodeLog.Instance));
|
|
Assert.Equal([_alice.CredentialId], pinned.Controllers);
|
|
}
|
|
|
|
[Fact]
|
|
public void APinnedNodeWhoseOwnerIsNoLongerInTheOperatorSet_DoesNotRun()
|
|
{
|
|
Pin("some-passkey-that-is-not-in-the-set");
|
|
|
|
TrustAnchor pinned = TrustAnchor.Load(_directory, NullNodeLog.Instance);
|
|
|
|
Assert.Empty(pinned.Controllers);
|
|
Assert.NotNull(OwnerGuard.Problem(pinned, require: true));
|
|
}
|
|
|
|
[Fact]
|
|
public void TheRequirementCanBeTurnedOff_ForAPanelWithoutATrustRoot()
|
|
{
|
|
TrustAnchor none = TrustAnchor.Load(_directory, NullNodeLog.Instance);
|
|
|
|
Assert.Null(OwnerGuard.Problem(none, require: false));
|
|
}
|
|
}
|