55 lines
2.4 KiB
TypeScript
55 lines
2.4 KiB
TypeScript
import { chmod, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
|
|
import { tmpdir } from 'node:os';
|
|
import { join } from 'node:path';
|
|
import { afterEach, describe, expect, it } from 'vitest';
|
|
import { TeaLoginStore } from './tea-login-store.js';
|
|
|
|
let root: string | undefined;
|
|
afterEach(async (): Promise<void> => {
|
|
if (root !== undefined) await rm(root, { recursive: true, force: true });
|
|
root = undefined;
|
|
});
|
|
|
|
describe('host-bound Tea login store', (): void => {
|
|
it('serializes concurrent updates and preserves the same identity on two hosts', async (): Promise<void> => {
|
|
root = await mkdtemp(join(tmpdir(), 'mosaic-tea-store-'));
|
|
const store = new TeaLoginStore(join(root, 'tea', 'config.yml'));
|
|
await Promise.all([
|
|
store.put('seat', 'git.one.invalid', new TextEncoder().encode('token-one')),
|
|
store.put('seat', 'git.two.invalid', new TextEncoder().encode('token-two')),
|
|
]);
|
|
|
|
expect(
|
|
store.matchesSecret('seat', 'git.one.invalid', new TextEncoder().encode('token-one')),
|
|
).toBe(true);
|
|
expect(
|
|
store.matchesSecret('seat', 'git.two.invalid', new TextEncoder().encode('token-two')),
|
|
).toBe(true);
|
|
await store.remove('seat', 'git.one.invalid');
|
|
expect(store.readBack('seat', 'git.one.invalid')).toBeUndefined();
|
|
expect(store.readBack('seat', 'git.two.invalid')).toEqual({
|
|
name: 'seat--git.two.invalid',
|
|
host: 'git.two.invalid',
|
|
});
|
|
});
|
|
|
|
it('preserves unrelated Tea configuration and rejects permissive secret reads', async (): Promise<void> => {
|
|
root = await mkdtemp(join(tmpdir(), 'mosaic-tea-store-'));
|
|
const configPath = join(root, 'tea', 'config.yml');
|
|
const store = new TeaLoginStore(configPath);
|
|
await store.put('seat', 'git.one.invalid', new TextEncoder().encode('token-one'));
|
|
const original = await readFile(configPath, 'utf8');
|
|
await writeFile(configPath, `preferences:\n color: true\n${original}`, { mode: 0o600 });
|
|
|
|
await store.put('seat', 'git.two.invalid', new TextEncoder().encode('token-two'));
|
|
await store.remove('seat', 'git.one.invalid');
|
|
expect(await readFile(configPath, 'utf8')).toContain('color: true');
|
|
|
|
await chmod(configPath, 0o644);
|
|
expect(() => store.resolve('seat', 'homelab', 'git.two.invalid')).toThrow(
|
|
/tea-config-insecure/,
|
|
);
|
|
expect(() => store.readBack('seat', 'git.two.invalid')).toThrow(/tea-config-insecure/);
|
|
});
|
|
});
|