security_test.go RawHistoryFolder

1package launcher
2
3import (
4	"context"
5	"os"
6	"path/filepath"
7	"testing"
8
9	"github.com/bnema/neferwl/internal/adapters/sessionsecurity"
10	"github.com/bnema/neferwl/internal/logging"
11	portsmocks "github.com/bnema/neferwl/internal/mocks/ports"
12	"github.com/bnema/neferwl/internal/ports"
13)
14
15func TestSpawnAdmissionRequiresCurrentUnlockedEpoch(t *testing.T) {
16	var gate sessionsecurity.Gate
17	l := New(nil, logging.For(context.Background(), "launcher"))
18	l.Security = &gate
19	if !l.admitted(ports.SpawnRequest{}) {
20		t.Fatal("initial unlocked request refused")
21	}
22	protected, err := gate.Engage()
23	if err != nil {
24		t.Fatal(err)
25	}
26	if l.admitted(ports.SpawnRequest{}) || l.admitted(ports.SpawnRequest{Security: protected}) {
27		t.Fatal("protected spawn admitted")
28	}
29	unlocked, err := gate.Release(protected.Generation)
30	if err != nil {
31		t.Fatal(err)
32	}
33	if l.admitted(ports.SpawnRequest{}) || l.admitted(ports.SpawnRequest{Security: protected}) {
34		t.Fatal("old spawn admitted after release")
35	}
36	if !l.admitted(ports.SpawnRequest{Security: unlocked}) {
37		t.Fatal("current spawn refused")
38	}
39}
40
41func TestSpawnRechecksBeforeProcessStart(t *testing.T) {
42	ctx := context.Background()
43	security := portsmocks.NewMockSessionSecurity(t)
44	security.EXPECT().Snapshot().Return(ports.SecurityState{}).Once()
45	security.EXPECT().Snapshot().Return(ports.SecurityState{Generation: 1, Protected: true}).Once()
46	l := New([]string{"PATH=/bin"}, logging.For(ctx, "launcher"))
47	l.Security = security
48	result := filepath.Join(t.TempDir(), "must-not-exist")
49	requests := make(chan ports.SpawnRequest, 1)
50	requests <- ports.SpawnRequest{Argv: []string{"touch", result}}
51	close(requests)
52	if err := l.Run(ctx, requests); err != nil {
53		t.Fatal(err)
54	}
55	if _, err := os.Stat(result); !os.IsNotExist(err) {
56		t.Fatalf("stale native spawn ran: %v", err)
57	}
58}