| 1 |
1
|
|
defmodule OpenAgents.Machines.TokenVaultTest do
|
| 2 |
|
- |
use ExUnit.Case, async: true
|
|
2
|
+ |
# These tests rebind the vault key configuration, which is global
|
|
3
|
+ |
# application environment, so they cannot run beside async tests that read
|
|
4
|
+ |
# the same keys.
|
|
5
|
+ |
use ExUnit.Case, async: false
|
| 3 |
6
|
|
|
| 4 |
7
|
|
alias OpenAgents.Machines.TokenVault
|
| 5 |
8
|
|
|
|
9
|
+ |
@machine_key_setting :machine_token_encryption_key
|
|
10
|
+ |
@github_key_setting :github_token_encryption_key
|
|
11
|
+ |
@github_keyring_setting :github_token_decryption_keys
|
|
12
|
+ |
|
|
13
|
+ |
setup do
|
|
14
|
+ |
original = %{
|
|
15
|
+ |
@machine_key_setting => Application.get_env(:openagents, @machine_key_setting),
|
|
16
|
+ |
@github_key_setting => Application.get_env(:openagents, @github_key_setting),
|
|
17
|
+ |
@github_keyring_setting => Application.get_env(:openagents, @github_keyring_setting)
|
|
18
|
+ |
}
|
|
19
|
+ |
|
|
20
|
+ |
on_exit(fn ->
|
|
21
|
+ |
Enum.each(original, fn {setting, value} ->
|
|
22
|
+ |
Application.put_env(:openagents, setting, value)
|
|
23
|
+ |
end)
|
|
24
|
+ |
end)
|
|
25
|
+ |
|
|
26
|
+ |
:ok
|
|
27
|
+ |
end
|
|
28
|
+ |
|
| 6 |
29
|
|
test "seals new tokens with the OpenAgents version" do
|
| 7 |
30
|
|
assert {:ok, <<2, _rest::binary>> = sealed} = TokenVault.seal("smct_current")
|
| 8 |
31
|
|
assert {:ok, "smct_current"} = TokenVault.open(sealed)
|
| 9 |
32
|
|
end
|
| 10 |
33
|
|
|
|
34
|
+ |
# VAULT-001: the pairing vault reads its own key. This test turns red if
|
|
35
|
+ |
# either side of the vault quietly reaches for the GitHub key again.
|
|
36
|
+ |
test "seals and opens with the GitHub vault absent entirely" do
|
|
37
|
+ |
Application.put_env(:openagents, @github_key_setting, nil)
|
|
38
|
+ |
Application.put_env(:openagents, @github_keyring_setting, %{})
|
|
39
|
+ |
|
|
40
|
+ |
assert {:ok, sealed} = TokenVault.seal("smct_independent")
|
|
41
|
+ |
assert {:ok, "smct_independent"} = TokenVault.open(sealed)
|
|
42
|
+ |
end
|
|
43
|
+ |
|
|
44
|
+ |
test "a missing dedicated key is a typed configuration error, never a borrowed key" do
|
|
45
|
+ |
Application.put_env(:openagents, @machine_key_setting, nil)
|
|
46
|
+ |
|
|
47
|
+ |
assert {:error, :machine_token_vault_not_configured} = TokenVault.seal("smct_orphan")
|
|
48
|
+ |
|
|
49
|
+ |
assert {:error, :machine_token_vault_not_configured} =
|
|
50
|
+ |
TokenVault.open(<<2, :crypto.strong_rand_bytes(60)::binary>>)
|
|
51
|
+ |
end
|
|
52
|
+ |
|
|
53
|
+ |
# The historical population: every record sealed before #192 used the GitHub
|
|
54
|
+ |
# vault's active key. The decrypt-side fallback keeps it readable for the one
|
|
55
|
+ |
# pairing lifetime it can exist; nothing rewraps it, because the only reader
|
|
56
|
+ |
# nulls the ciphertext in the same transaction as a successful open.
|
|
57
|
+ |
test "a record sealed under the GitHub active key still opens" do
|
|
58
|
+ |
github_key = Application.fetch_env!(:openagents, @github_key_setting)
|
|
59
|
+ |
|
|
60
|
+ |
assert {:ok, "smct_historical"} =
|
|
61
|
+ |
"smct_historical" |> sealed_under(github_key) |> TokenVault.open()
|
|
62
|
+ |
end
|
|
63
|
+ |
|
|
64
|
+ |
# Rehearsal 4 of docs/forge-exit-rehearsals.md: rotating the GitHub key —
|
|
65
|
+ |
# new active key, old key moved into the decryption keyring — leaves every
|
|
66
|
+ |
# outstanding pairing record readable.
|
|
67
|
+ |
test "a GitHub key rotation leaves pairing records readable" do
|
|
68
|
+ |
retired = Application.fetch_env!(:openagents, @github_key_setting)
|
|
69
|
+ |
sealed = sealed_under("smct_survives_rotation", retired)
|
|
70
|
+ |
|
|
71
|
+ |
Application.put_env(
|
|
72
|
+ |
:openagents,
|
|
73
|
+ |
@github_key_setting,
|
|
74
|
+ |
Base.encode64(:crypto.strong_rand_bytes(32))
|
|
75
|
+ |
)
|
|
76
|
+ |
|
|
77
|
+ |
Application.put_env(:openagents, @github_keyring_setting, %{"test-prior" => retired})
|
|
78
|
+ |
|
|
79
|
+ |
assert {:ok, "smct_survives_rotation"} = TokenVault.open(sealed)
|
|
80
|
+ |
end
|
|
81
|
+ |
|
|
82
|
+ |
test "a record sealed under no known key fails closed" do
|
|
83
|
+ |
unknown = Base.encode64(:crypto.strong_rand_bytes(32))
|
|
84
|
+ |
|
|
85
|
+ |
assert {:error, :token_unsealable} =
|
|
86
|
+ |
"smct_stranger" |> sealed_under(unknown) |> TokenVault.open()
|
|
87
|
+ |
end
|
|
88
|
+ |
|
| 11 |
89
|
|
# The retired `sarah.machine_token.v1` AAD is gone, not kept as a legacy
|
| 12 |
90
|
|
# entry. Nothing seals a version-1 blob, and a sealed token cannot outlive
|
| 13 |
91
|
|
# the ten-minute pairing window that `MachinesTest` pins, so the branch had
|