source_test.go RawHistoryFolder

1package auth
2
3import (
4	"bytes"
5	"context"
6	"testing"
7	"time"
8
9	"github.com/bnema/neferafk/internal/ports"
10)
11
12func TestPINSourceValidation(t *testing.T) {
13	for _, input := range []string{"12345", "123456\n", "12345a", " 123456", "123456 ", "", "123456\r", "123456789012345678901234567890123"} {
14		if pin := ResolvePIN(context.Background(), ports.AuthBootstrap{PINSource: "env", EnvPIN: []byte(input)}); pin != nil {
15			t.Fatal("invalid env source accepted")
16		}
17	}
18	in := []byte("123456")
19	pin := ResolvePIN(context.Background(), ports.AuthBootstrap{PINSource: "env", EnvPIN: in})
20	if !bytes.Equal(pin, in) {
21		t.Fatal("valid env source rejected")
22	}
23	clear(in)
24	if string(pin) != "123456" {
25		t.Fatal("resolved PIN aliases bootstrap")
26	}
27	clear(pin)
28	for _, entry := range []string{"", "-clip", "/absolute", "a/../b", "a//b", "a/./b", "a\\b", "a\x00b"} {
29		if passEntry(entry) {
30			t.Fatal("unsafe pass entry accepted")
31		}
32	}
33	if !passEntry("locker/pin") {
34		t.Fatal("valid pass reference rejected")
35	}
36	var out fixedOutput
37	if _, err := out.Write(make([]byte, sourceLimit)); err != nil {
38		t.Fatal(err)
39	}
40	if _, err := out.Write([]byte{1}); err == nil || out.n != sourceLimit {
41		t.Fatal("source output cap not enforced")
42	}
43	clear(out.data[:])
44}
45
46func TestSourceGenericChildBoundsAndTimeout(t *testing.T) {
47	pin, err := commandPIN(context.Background(), "/bin/sh", []string{"-c", "printf '123456\\nmetadata\\n'"}, []string{"PATH=/usr/bin:/bin"})
48	if err != nil || string(pin) != "123456" {
49		t.Fatalf("first line source: %v", err)
50	}
51	clear(pin)
52	if _, err := commandPIN(context.Background(), "/bin/sh", []string{"-c", "head -c 5000 /dev/zero"}, []string{"PATH=/usr/bin:/bin"}); err == nil {
53		t.Fatal("oversize source accepted")
54	}
55	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Millisecond)
56	defer cancel()
57	start := time.Now()
58	if _, err := commandPIN(ctx, "/bin/sh", []string{"-c", "sleep 10 & wait"}, []string{"PATH=/usr/bin:/bin"}); err == nil {
59		t.Fatal("timed-out source accepted")
60	}
61	if time.Since(start) > time.Second {
62		t.Fatal("source group cancellation did not bound Wait")
63	}
64}