71 lines
3.2 KiB
C#
71 lines
3.2 KiB
C#
using System.Net;
|
|
using System.Runtime.CompilerServices;
|
|
using System.Security.Cryptography;
|
|
using System.Text;
|
|
using System.Text.Json.Nodes;
|
|
using Fleet.Identity;
|
|
|
|
namespace MoShiro.Backend.Tests;
|
|
|
|
/// <summary>一个已经建立了信任根的操作员：自己的用户、passkey、会话，以及创世指纹。</summary>
|
|
internal sealed record Operator(HttpClient Session, SoftwarePasskey Passkey, string Genesis);
|
|
|
|
/// <summary>
|
|
/// 共享的后端上只有一个信任根（创世只能签一次）：谁先需要，谁来建立，其余的测试用同一个操作员。
|
|
/// 信任相关的测试都从这里拿，不要各自去建立信任根，否则测试的先后顺序会决定谁失败。
|
|
/// </summary>
|
|
internal static class SharedOperator
|
|
{
|
|
private static readonly ConditionalWeakTable<BackendFixture, Operator> s_operators = [];
|
|
private static readonly SemaphoreSlim s_gate = new(1, 1);
|
|
|
|
public static async Task<Operator> GetAsync(BackendFixture backend)
|
|
{
|
|
await s_gate.WaitAsync();
|
|
try
|
|
{
|
|
if (s_operators.TryGetValue(backend, out Operator? existing))
|
|
{
|
|
return existing;
|
|
}
|
|
|
|
// 操作员：有 passkey、用 passkey 登录的会话
|
|
(HttpClient session, SoftwarePasskey passkey, _) = await backend.CreateStrongSessionAsync("operator");
|
|
|
|
// 创世：用 passkey 对集合本身签名（节点据此验链）
|
|
JsonNode state = JsonNode.Parse(await session.GetStringAsync("/api/admin/trust"))!;
|
|
Assert.False(state["initialized"]!.GetValue<bool>());
|
|
string statement = state["proposal"]!["statement"]!.GetValue<string>();
|
|
Assert.Equal(Base64UrlOf(statement), state["proposal"]!["challenge"]!.GetValue<string>());
|
|
using HttpResponseMessage genesis = await session.PostAsync("/api/admin/trust", BackendFixture.Json(Sign(passkey, statement)));
|
|
Assert.True(genesis.StatusCode == HttpStatusCode.Created, await genesis.Content.ReadAsStringAsync());
|
|
string fingerprint = JsonNode.Parse(await genesis.Content.ReadAsStringAsync())!["genesis"]!.GetValue<string>();
|
|
Assert.Equal(OperatorTrust.Fingerprint(statement), fingerprint);
|
|
|
|
var made = new Operator(session, passkey, fingerprint);
|
|
s_operators.Add(backend, made);
|
|
return made;
|
|
}
|
|
finally
|
|
{
|
|
s_gate.Release();
|
|
}
|
|
}
|
|
|
|
public static string Base64UrlOf(string statement) => Fleet.Core.Base64Url.Encode(SHA256.HashData(Encoding.UTF8.GetBytes(statement)));
|
|
|
|
/// <summary>passkey 对语句签名（挑战是语句的 SHA-256），拼成接口要的断言对象。</summary>
|
|
public static JsonObject Sign(SoftwarePasskey passkey, string statement)
|
|
{
|
|
JsonObject assertion = passkey.Assert(Base64UrlOf(statement));
|
|
return new JsonObject
|
|
{
|
|
["statement"] = statement,
|
|
["credential_id"] = assertion["credential_id"]!.DeepClone(),
|
|
["authenticator_data"] = assertion["authenticator_data"]!.DeepClone(),
|
|
["client_data_json"] = assertion["client_data_json"]!.DeepClone(),
|
|
["signature"] = assertion["signature"]!.DeepClone(),
|
|
};
|
|
}
|
|
}
|