1011 lines
39 KiB
Go
1011 lines
39 KiB
Go
package rpc
|
|
|
|
import (
|
|
"context"
|
|
"encoding/binary"
|
|
"errors"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/iamxvbaba/td/clock"
|
|
"github.com/iamxvbaba/td/tg"
|
|
"github.com/iamxvbaba/td/tgerr"
|
|
"go.uber.org/zap/zaptest"
|
|
|
|
"telesrv/internal/domain"
|
|
"telesrv/internal/store"
|
|
"telesrv/internal/store/memory"
|
|
)
|
|
|
|
type unavailableResolveAuthService struct {
|
|
*captureAuthService
|
|
err error
|
|
}
|
|
|
|
func (s *unavailableResolveAuthService) ResolveAuthKey(context.Context, [8]byte) ([8]byte, bool, error) {
|
|
return [8]byte{}, false, s.err
|
|
}
|
|
|
|
type unavailableAuthKeyInfoService struct {
|
|
*captureAuthService
|
|
err error
|
|
}
|
|
|
|
func (s *unavailableAuthKeyInfoService) AuthKeyClientInfo(context.Context, [8]byte) (domain.AuthKeyClientInfo, bool, error) {
|
|
return domain.AuthKeyClientInfo{}, false, s.err
|
|
}
|
|
|
|
func TestResolveInheritedAuthKeyLayerUsesAuthKeyAuthorityOnly(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
keyLayer int
|
|
authorization int
|
|
want int
|
|
found bool
|
|
}{
|
|
{name: "auth key primary", keyLayer: 225, authorization: 227, want: 225, found: true},
|
|
{name: "authorization mirror is not protocol evidence", keyLayer: 0, authorization: 225},
|
|
{name: "unsupported primary is authoritative unknown", keyLayer: 230, authorization: 227, found: true},
|
|
}
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
authKeyID := [8]byte{byte(tt.keyLayer), 0x71}
|
|
auth := &captureAuthService{
|
|
authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
authKeyID: {Layer: tt.keyLayer},
|
|
},
|
|
authorizations: []domain.Authorization{{AuthKeyID: authKeyID, UserID: 10, Layer: tt.authorization}},
|
|
}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
got, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), authKeyID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got != tt.want || found != tt.found {
|
|
t.Fatalf("resolved layer = (%d,%v), want (%d,%v)", got, found, tt.want, tt.found)
|
|
}
|
|
got, found, err = r.ResolveInheritedAuthKeyLayer(context.Background(), authKeyID)
|
|
if err != nil || got != tt.want || found != tt.found {
|
|
t.Fatalf("cached resolved layer = (%d,%v,%v), want (%d,%v,nil)", got, found, err, tt.want, tt.found)
|
|
}
|
|
if auth.authKeyInfoLookups != 1 {
|
|
t.Fatalf("auth key info lookups = %d, want 1 after repeated resolve", auth.authKeyInfoLookups)
|
|
}
|
|
if auth.authorizationLookups != 0 {
|
|
t.Fatalf("authorization Layer mirror lookups = %d, want 0", auth.authorizationLookups)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestResolveInheritedAuthKeyLayerNormalizesBoundTempToPermanent(t *testing.T) {
|
|
rawAuthKeyID := [8]byte{0x31}
|
|
permAuthKeyID := [8]byte{0x32}
|
|
auth := &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
rawAuthKeyID: {Layer: 225}, // stale shadow
|
|
permAuthKeyID: {Layer: 227}, // canonical shared default
|
|
},
|
|
}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
|
|
layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), rawAuthKeyID)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !found || layer != 227 {
|
|
t.Fatalf("bound temp layer = (%d,%v), want (227,true)", layer, found)
|
|
}
|
|
if cached, ok := r.cachedAuthKeyLayerDefault(rawAuthKeyID); !ok || cached != 227 {
|
|
t.Fatalf("raw in-memory shadow = (%d,%v), want (227,true)", cached, ok)
|
|
}
|
|
}
|
|
|
|
func TestPositiveBindingResolutionIsSharedByLayerAndDispatchPaths(t *testing.T) {
|
|
rawAuthKeyID := [8]byte{0x31, 1}
|
|
permAuthKeyID := [8]byte{0x32, 1}
|
|
const sessionID = int64(311)
|
|
auth := &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
permAuthKeyID: {Layer: 227},
|
|
},
|
|
}
|
|
sessions := &captureSessions{}
|
|
r := New(Config{DC: 2, TempKeyResolveCacheTTL: time.Minute}, Deps{
|
|
Auth: auth, Sessions: sessions,
|
|
}, zaptest.NewLogger(t), clock.System)
|
|
|
|
if layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), rawAuthKeyID); err != nil || !found || layer != 227 {
|
|
t.Fatalf("inherited layer = (%d,%v,%v), want (227,true,nil)", layer, found, err)
|
|
}
|
|
if got, err := r.effectiveAuthKeyID(context.Background(), rawAuthKeyID, sessionID); err != nil || got != permAuthKeyID {
|
|
t.Fatalf("effective auth key = (%x,%v), want (%x,nil)", got, err, permAuthKeyID)
|
|
}
|
|
freezeAndPublishLayer(t, r, rawAuthKeyID, sessionID, 10, 1, 227)
|
|
if auth.resolveCount != 1 {
|
|
t.Fatalf("ResolveAuthKey calls across inherited/dispatch/publication = %d, want 1", auth.resolveCount)
|
|
}
|
|
}
|
|
|
|
func TestResolveInheritedAuthKeyLayerMarksOnlyAvailabilityFailures(t *testing.T) {
|
|
boom := errors.New("postgres temporarily unavailable")
|
|
for _, tt := range []struct {
|
|
name string
|
|
auth AuthService
|
|
want error
|
|
wantMarker bool
|
|
}{
|
|
{
|
|
name: "temporary binding lookup outage",
|
|
auth: &unavailableResolveAuthService{
|
|
captureAuthService: &captureAuthService{}, err: boom,
|
|
},
|
|
want: boom, wantMarker: true,
|
|
},
|
|
{
|
|
name: "auth key default lookup outage",
|
|
auth: &unavailableAuthKeyInfoService{
|
|
captureAuthService: &captureAuthService{}, err: boom,
|
|
},
|
|
want: boom, wantMarker: true,
|
|
},
|
|
{
|
|
name: "structural binding failure",
|
|
auth: &unavailableResolveAuthService{
|
|
captureAuthService: &captureAuthService{}, err: store.ErrAuthKeyBindingInvalid,
|
|
},
|
|
want: store.ErrAuthKeyBindingInvalid,
|
|
},
|
|
} {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
r := New(Config{DC: 2}, Deps{Auth: tt.auth}, zaptest.NewLogger(t), clock.System)
|
|
layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), [8]byte{0x33})
|
|
if layer != 0 || found || !errors.Is(err, tt.want) {
|
|
t.Fatalf("resolution = (%d,%v,%v), want (0,false,%v)", layer, found, err, tt.want)
|
|
}
|
|
var marker interface{ LayerEvidenceDurabilityUnavailable() }
|
|
if got := errors.As(err, &marker); got != tt.wantMarker {
|
|
t.Fatalf("availability marker=%v, want %v", got, tt.wantMarker)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestResolveInheritedDurableAuthKeyLayerIgnoresAuthorizationMirror(t *testing.T) {
|
|
authKeyID := [8]byte{0x39, 0x71}
|
|
auth := &captureAuthService{
|
|
authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
authKeyID: {},
|
|
},
|
|
authorizations: []domain.Authorization{{
|
|
AuthKeyID: authKeyID,
|
|
UserID: 10,
|
|
Layer: 227,
|
|
}},
|
|
}
|
|
r := New(Config{DC: 2}, Deps{
|
|
Auth: auth, AuthKeySessionLayers: memory.NewAuthKeyStore(),
|
|
}, zaptest.NewLogger(t), clock.System)
|
|
|
|
layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), authKeyID)
|
|
if err != nil || found || layer != 0 {
|
|
t.Fatalf("durable zero primary = (%d,%v,%v), want (0,false,nil)", layer, found, err)
|
|
}
|
|
if auth.authKeyInfoLookups != 1 || auth.authorizationLookups != 0 {
|
|
t.Fatalf("durable lookups = auth_key:%d authorization:%d, want 1/0",
|
|
auth.authKeyInfoLookups, auth.authorizationLookups)
|
|
}
|
|
}
|
|
|
|
func TestExplicitLayerCorrectionUpdatesDefaultWithoutChangingSibling(t *testing.T) {
|
|
authKeyID := [8]byte{0x41}
|
|
auth := &captureAuthService{authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo)}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
|
|
ctx1 := WithAuthKeyID(WithSessionID(WithRawAuthKeyID(context.Background(), authKeyID), 1), authKeyID)
|
|
ctx2 := WithAuthKeyID(WithSessionID(WithRawAuthKeyID(context.Background(), authKeyID), 2), authKeyID)
|
|
r.rememberClientLayer(ctx1, 225)
|
|
r.rememberClientLayer(ctx2, 225)
|
|
r.rememberClientLayer(ctx1, 227)
|
|
|
|
if layer, ok := r.NegotiatedSessionLayer(authKeyID, 1); !ok || layer != 227 {
|
|
t.Fatalf("corrected session = (%d,%v), want (227,true)", layer, ok)
|
|
}
|
|
if layer, ok := r.NegotiatedSessionLayer(authKeyID, 2); !ok || layer != 225 {
|
|
t.Fatalf("sibling session = (%d,%v), want unchanged (225,true)", layer, ok)
|
|
}
|
|
if got := auth.authKeyClientInfos[authKeyID].Layer; got != 227 {
|
|
t.Fatalf("durable shared default = %d, want 227", got)
|
|
}
|
|
layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), authKeyID)
|
|
if err != nil || !found || layer != 227 {
|
|
t.Fatalf("new session default = (%d,%v,%v), want (227,true,nil)", layer, found, err)
|
|
}
|
|
}
|
|
|
|
type inheritedLayerSeedCall struct {
|
|
rawAuthKeyID [8]byte
|
|
layer int
|
|
}
|
|
|
|
type inheritedLayerCaptureSessions struct {
|
|
captureSessions
|
|
seeds []inheritedLayerSeedCall
|
|
refreshes []inheritedLayerSeedCall
|
|
clears [][8]byte
|
|
explicitLayer int
|
|
explicitMsgID int64
|
|
}
|
|
|
|
func (s *inheritedLayerCaptureSessions) BindAuthKeyForRawAuthKey(rawAuthKeyID [8]byte, authKeyID [8]byte) int {
|
|
s.BindAuthKeyForSession(rawAuthKeyID, 0, authKeyID)
|
|
return 1
|
|
}
|
|
|
|
func (s *inheritedLayerCaptureSessions) SeedInheritedLayerForRawAuthKey(rawAuthKeyID [8]byte, layer int) int {
|
|
s.seeds = append(s.seeds, inheritedLayerSeedCall{rawAuthKeyID: rawAuthKeyID, layer: layer})
|
|
return 1
|
|
}
|
|
|
|
func (s *inheritedLayerCaptureSessions) RefreshInheritedLayerForRawAuthKey(rawAuthKeyID [8]byte, layer int) int {
|
|
s.refreshes = append(s.refreshes, inheritedLayerSeedCall{rawAuthKeyID: rawAuthKeyID, layer: layer})
|
|
return 1
|
|
}
|
|
|
|
func (s *inheritedLayerCaptureSessions) ClearInheritedLayerForRawAuthKey(rawAuthKeyID [8]byte) int {
|
|
s.clears = append(s.clears, rawAuthKeyID)
|
|
return 1
|
|
}
|
|
|
|
func (s *inheritedLayerCaptureSessions) ExplicitLayerEvidenceForAuthKey([8]byte, int64) (int, int64, bool) {
|
|
return s.explicitLayer, s.explicitMsgID, s.explicitLayer != 0
|
|
}
|
|
|
|
func TestBindTempAuthKeyLayerPrecedenceAndRawShadow(t *testing.T) {
|
|
for _, tt := range []struct {
|
|
name string
|
|
explicitLayer int
|
|
want int
|
|
}{
|
|
{name: "inherit permanent", want: 225},
|
|
{name: "current explicit wins", explicitLayer: 227, want: 227},
|
|
} {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
rawAuthKeyID := [8]byte{0x51, byte(tt.want)}
|
|
permAuthKeyID := [8]byte{0x52, byte(tt.want)}
|
|
const sessionID = int64(99)
|
|
auth := &captureAuthService{authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
permAuthKeyID: {Layer: 225},
|
|
}}
|
|
// Model the store-owned bind transaction. Bind returns the exact committed
|
|
// tuple; the router must not re-read a later permanent row or derive a winner
|
|
// from its process-local exact-session registry after Bind returns.
|
|
auth.bindTempHook = func(domain.TempAuthKeyBinding) error {
|
|
auth.authKeyClientInfos[rawAuthKeyID] = domain.AuthKeyClientInfo{Layer: tt.want, LayerObservationID: 42}
|
|
auth.authKeyClientInfos[permAuthKeyID] = domain.AuthKeyClientInfo{Layer: tt.want, LayerObservationID: 42}
|
|
return nil
|
|
}
|
|
sessions := &inheritedLayerCaptureSessions{}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth, Sessions: sessions}, zaptest.NewLogger(t), clock.System)
|
|
if tt.explicitLayer != 0 {
|
|
freezeAndPublishLayer(t, r, rawAuthKeyID, sessionID, 10, 1, tt.explicitLayer)
|
|
sessions.seeds = nil
|
|
}
|
|
ctx := WithAuthKeyID(WithSessionID(WithRawAuthKeyID(context.Background(), rawAuthKeyID), sessionID), rawAuthKeyID)
|
|
ok, err := r.onAuthBindTempAuthKey(ctx, &tg.AuthBindTempAuthKeyRequest{PermAuthKeyID: businessAuthKeyInt64(permAuthKeyID)})
|
|
if err != nil || !ok {
|
|
t.Fatalf("bind = (%v,%v), want (true,nil)", ok, err)
|
|
}
|
|
if auth.authKeyInfoLookups != 0 || auth.authorizationLookups != 0 {
|
|
t.Fatalf("bind re-read durable Layer state: key=%d authorization=%d",
|
|
auth.authKeyInfoLookups, auth.authorizationLookups)
|
|
}
|
|
if got := auth.authKeyClientInfos[rawAuthKeyID].Layer; got != tt.want {
|
|
t.Fatalf("raw shadow = %d, want %d", got, tt.want)
|
|
}
|
|
if got := auth.authKeyClientInfos[permAuthKeyID].Layer; got != tt.want {
|
|
t.Fatalf("permanent default = %d, want %d", got, tt.want)
|
|
}
|
|
if len(sessions.refreshes) != 1 || sessions.refreshes[0] != (inheritedLayerSeedCall{rawAuthKeyID: rawAuthKeyID, layer: tt.want}) {
|
|
t.Fatalf("refresh calls = %+v", sessions.refreshes)
|
|
}
|
|
if len(sessions.seeds) != 0 {
|
|
t.Fatalf("bind used ordinary seed instead of identity refresh: %+v", sessions.seeds)
|
|
}
|
|
if cached, found := r.cachedAuthKeyLayerDefault(rawAuthKeyID); !found || cached != tt.want {
|
|
t.Fatalf("raw cached default = (%d,%v), want (%d,true)", cached, found, tt.want)
|
|
}
|
|
r.clientInfoMu.RLock()
|
|
rawCached := r.authInfo[rawAuthKeyID]
|
|
permCached := r.authInfo[permAuthKeyID]
|
|
r.clientInfoMu.RUnlock()
|
|
if rawCached.layerObservationID != 42 || rawCached.layerObservationID != permCached.layerObservationID {
|
|
t.Fatalf("bound observation shadow = raw:%d perm:%d, want 42/42",
|
|
rawCached.layerObservationID, permCached.layerObservationID)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestResolveInheritedAuthKeyLayerCachesTerminalMissingRows(t *testing.T) {
|
|
authKeyID := [8]byte{0x61}
|
|
auth := &captureAuthService{authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo)}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
|
|
for i := 0; i < 2; i++ {
|
|
layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), authKeyID)
|
|
if err != nil || found || layer != 0 {
|
|
t.Fatalf("resolve %d = (%d,%v,%v), want (0,false,nil)", i, layer, found, err)
|
|
}
|
|
}
|
|
if auth.authKeyInfoLookups != 1 || auth.authorizationLookups != 0 {
|
|
t.Fatalf("terminal missing lookups = auth_key:%d authorization:%d, want 1/0", auth.authKeyInfoLookups, auth.authorizationLookups)
|
|
}
|
|
}
|
|
|
|
func TestResolveInheritedBoundTempUnsupportedPermanentBlocksRawShadow(t *testing.T) {
|
|
rawAuthKeyID := [8]byte{0x62}
|
|
permAuthKeyID := [8]byte{0x63}
|
|
auth := &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
rawAuthKeyID: {Layer: 225},
|
|
permAuthKeyID: {Layer: 230},
|
|
},
|
|
}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
|
|
layer, authoritative, err := r.ResolveInheritedAuthKeyLayer(context.Background(), rawAuthKeyID)
|
|
if err != nil || !authoritative || layer != 0 {
|
|
t.Fatalf("bound future default = (%d,%v,%v), want (0,true,nil)", layer, authoritative, err)
|
|
}
|
|
if auth.authKeyInfoLookups != 1 {
|
|
t.Fatalf("canonical auth-key lookups = %d, want 1", auth.authKeyInfoLookups)
|
|
}
|
|
}
|
|
|
|
func TestBindTempAuthKeyFuturePermanentClearsInheritedUntilFreshExplicit(t *testing.T) {
|
|
rawAuthKeyID := [8]byte{0x62, 1}
|
|
permAuthKeyID := [8]byte{0x62, 2}
|
|
const sessionID = int64(621)
|
|
auth := &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
rawAuthKeyID: {Layer: 225},
|
|
permAuthKeyID: {Layer: 230, LayerObservationID: 44},
|
|
},
|
|
}
|
|
auth.bindTempHook = func(domain.TempAuthKeyBinding) error {
|
|
auth.authKeyClientInfos[rawAuthKeyID] = domain.AuthKeyClientInfo{Layer: 230, LayerObservationID: 44}
|
|
return nil
|
|
}
|
|
sessions := &inheritedLayerCaptureSessions{}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth, Sessions: sessions}, zaptest.NewLogger(t), clock.System)
|
|
r.setAuthKeyLayerDefaults(225, rawAuthKeyID)
|
|
ctx := WithAuthKeyID(WithSessionID(WithRawAuthKeyID(context.Background(), rawAuthKeyID), sessionID), rawAuthKeyID)
|
|
ok, err := r.onAuthBindTempAuthKey(ctx, &tg.AuthBindTempAuthKeyRequest{PermAuthKeyID: businessAuthKeyInt64(permAuthKeyID)})
|
|
if err != nil || !ok {
|
|
t.Fatalf("bind to future permanent = (%v,%v)", ok, err)
|
|
}
|
|
if len(sessions.clears) != 1 || sessions.clears[0] != rawAuthKeyID {
|
|
t.Fatalf("inherited clear calls = %x", sessions.clears)
|
|
}
|
|
if len(sessions.refreshes) != 0 {
|
|
t.Fatalf("future permanent refreshed stale inherited profile: %+v", sessions.refreshes)
|
|
}
|
|
r.clientInfoMu.RLock()
|
|
blocked := r.authInfo[rawAuthKeyID]
|
|
r.clientInfoMu.RUnlock()
|
|
if blocked.layer != 0 || blocked.layerObservationID != 44 || !blocked.layerBlocked || !blocked.layerBlockedByAuthKey {
|
|
t.Fatalf("raw blocked shadow = %+v", blocked)
|
|
}
|
|
|
|
// A later in-window explicit selector is new wire evidence and may correct
|
|
// both the session and the permanent shared default.
|
|
freezeAndPublishLayer(t, r, rawAuthKeyID, sessionID, 20, 1, 225)
|
|
if got := auth.authKeyClientInfos[permAuthKeyID].Layer; got != 225 {
|
|
t.Fatalf("fresh explicit did not self-heal future default: %d", got)
|
|
}
|
|
if got, found := r.cachedAuthKeyLayerDefault(rawAuthKeyID); !found || got != 225 {
|
|
t.Fatalf("raw default after self-heal = (%d,%v)", got, found)
|
|
}
|
|
}
|
|
|
|
func TestSupportedExplicitEvidenceClearsUnsupportedCacheState(t *testing.T) {
|
|
authKeyID := [8]byte{0x63, 1}
|
|
auth := &captureAuthService{authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
authKeyID: {Layer: 230},
|
|
}}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
if layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), authKeyID); err != nil || !found || layer != 0 {
|
|
t.Fatalf("future default = (%d,%v,%v), want (0,true,nil)", layer, found, err)
|
|
}
|
|
freezeAndPublishLayer(t, r, authKeyID, 1, 10, 1, 228)
|
|
r.clientInfoMu.RLock()
|
|
info := r.authInfo[authKeyID]
|
|
r.clientInfoMu.RUnlock()
|
|
if info.layer != 228 || info.layerBlocked || info.layerBlockedByAuthKey {
|
|
t.Fatalf("supported and blocked cache state coexisted: %+v", info)
|
|
}
|
|
}
|
|
|
|
type inheritedLayerResolution struct {
|
|
layer int
|
|
found bool
|
|
err error
|
|
}
|
|
|
|
type blockingLayerReadAuthService struct {
|
|
*captureAuthService
|
|
started chan struct{}
|
|
release chan struct{}
|
|
once sync.Once
|
|
stale domain.AuthKeyClientInfo
|
|
}
|
|
|
|
func (s *blockingLayerReadAuthService) AuthKeyClientInfo(ctx context.Context, _ [8]byte) (domain.AuthKeyClientInfo, bool, error) {
|
|
s.authKeyInfoLookups++
|
|
s.once.Do(func() { close(s.started) })
|
|
select {
|
|
case <-s.release:
|
|
return s.stale, true, nil
|
|
case <-ctx.Done():
|
|
return domain.AuthKeyClientInfo{}, false, ctx.Err()
|
|
}
|
|
}
|
|
|
|
func TestResolveInheritedLayerDoesNotReturnStaleSingleflightRead(t *testing.T) {
|
|
authKeyID := [8]byte{0x64}
|
|
const sessionID = int64(640)
|
|
auth := &blockingLayerReadAuthService{
|
|
captureAuthService: &captureAuthService{authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo)},
|
|
started: make(chan struct{}),
|
|
release: make(chan struct{}),
|
|
stale: domain.AuthKeyClientInfo{Layer: 225},
|
|
}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
resolved := make(chan inheritedLayerResolution, 1)
|
|
go func() {
|
|
layer, found, err := r.ResolveInheritedAuthKeyLayer(context.Background(), authKeyID)
|
|
resolved <- inheritedLayerResolution{layer: layer, found: found, err: err}
|
|
}()
|
|
<-auth.started
|
|
|
|
freezeAndPublishLayer(t, r, authKeyID, sessionID, 100, 2, 227)
|
|
close(auth.release)
|
|
got := <-resolved
|
|
if got.err != nil || !got.found || got.layer != 227 {
|
|
t.Fatalf("resolver returned stale DB value = (%d,%v,%v), want (227,true,nil)", got.layer, got.found, got.err)
|
|
}
|
|
}
|
|
|
|
func TestBoundDurableResolveCannotProjectStalePermanentLayerOverNewObservation(t *testing.T) {
|
|
ctx := context.Background()
|
|
keys := memory.NewAuthKeyStore()
|
|
bindings := memory.NewTempAuthKeyBindingStore(keys)
|
|
rawAuthKeyID := [8]byte{0x64, 1}
|
|
permAuthKeyID := [8]byte{0x64, 2}
|
|
const (
|
|
sessionID = int64(641)
|
|
tempExpiry = 2_000_000_000
|
|
)
|
|
if err := keys.Save(ctx, store.AuthKeyData{ID: rawAuthKeyID, ExpiresAt: tempExpiry}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := keys.Save(ctx, store.AuthKeyData{
|
|
ID: permAuthKeyID, Layer: 225, LayerObservationID: 1,
|
|
}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := bindings.Save(ctx, domain.TempAuthKeyBinding{
|
|
TempAuthKeyID: rawAuthKeyID,
|
|
PermAuthKeyID: int64(binary.LittleEndian.Uint64(permAuthKeyID[:])),
|
|
ExpiresAt: tempExpiry,
|
|
}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
auth := &blockingLayerReadAuthService{
|
|
captureAuthService: &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
},
|
|
started: make(chan struct{}),
|
|
release: make(chan struct{}),
|
|
stale: domain.AuthKeyClientInfo{Layer: 225, LayerObservationID: 1},
|
|
}
|
|
sessions := &inheritedLayerCaptureSessions{}
|
|
r := New(Config{DC: 2}, Deps{
|
|
Auth: auth, Sessions: sessions, AuthKeySessionLayers: keys,
|
|
}, zaptest.NewLogger(t), clock.System)
|
|
resolved := make(chan inheritedLayerResolution, 1)
|
|
go func() {
|
|
layer, found, err := r.ResolveInheritedAuthKeyLayer(ctx, rawAuthKeyID)
|
|
resolved <- inheritedLayerResolution{layer: layer, found: found, err: err}
|
|
}()
|
|
<-auth.started
|
|
|
|
msgID := int64((uint64(time.Now().UTC().Unix()) << 32) | 4)
|
|
if layer, gotMsgID, publish, err := r.AdvanceNegotiatedSessionLayerEvidence(
|
|
ctx, rawAuthKeyID, sessionID, 227, msgID,
|
|
); err != nil || layer != 227 || gotMsgID != msgID || !publish {
|
|
t.Fatalf("advance while stale read blocked = (%d,%d,%v,%v)", layer, gotMsgID, publish, err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(ctx, rawAuthKeyID, sessionID, msgID, 2, 1, 227); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
close(auth.release)
|
|
got := <-resolved
|
|
if got.err != nil || !got.found || got.layer != 227 {
|
|
t.Fatalf("bound resolver returned stale permanent read = (%d,%v,%v)", got.layer, got.found, got.err)
|
|
}
|
|
|
|
permanent, found, err := keys.Get(ctx, permAuthKeyID)
|
|
if err != nil || !found || permanent.Layer != 227 || permanent.LayerObservationID <= 1 {
|
|
t.Fatalf("durable permanent tuple = (%+v,%v,%v)", permanent, found, err)
|
|
}
|
|
r.clientInfoMu.RLock()
|
|
rawInfo := r.authInfo[rawAuthKeyID]
|
|
permInfo := r.authInfo[permAuthKeyID]
|
|
r.clientInfoMu.RUnlock()
|
|
for id, info := range map[[8]byte]clientSessionInfo{
|
|
rawAuthKeyID: rawInfo, permAuthKeyID: permInfo,
|
|
} {
|
|
if info.layer != permanent.Layer || info.layerObservationID != permanent.LayerObservationID {
|
|
t.Fatalf("cache %x = layer/obs %d/%d, durable %d/%d",
|
|
id, info.layer, info.layerObservationID, permanent.Layer, permanent.LayerObservationID)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAdmittedLayerSequenceOrdersSharedDefaultAcrossSessions(t *testing.T) {
|
|
rawOld := [8]byte{0x65, 1}
|
|
rawNew := [8]byte{0x65, 2}
|
|
permAuthKeyID := [8]byte{0x65, 3}
|
|
auth := &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo),
|
|
}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(rawOld, 1, 225, 10); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(rawNew, 2, 227, 20); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
if err := r.PublishAdmittedLayerProfileEvidence(context.Background(), rawNew, 2, 20, 2, 1, 227); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(context.Background(), rawOld, 1, 10, 1, 1, 225); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got := auth.authKeyClientInfos[permAuthKeyID].Layer; got != 227 {
|
|
t.Fatalf("durable shared default rolled back = %d, want 227", got)
|
|
}
|
|
if got, ok := r.cachedAuthKeyLayerDefault(permAuthKeyID); !ok || got != 227 {
|
|
t.Fatalf("memory shared default = (%d,%v), want (227,true)", got, ok)
|
|
}
|
|
if got, ok := r.NegotiatedSessionLayer(rawOld, 1); !ok || got != 225 {
|
|
t.Fatalf("old live session changed = (%d,%v), want (225,true)", got, ok)
|
|
}
|
|
}
|
|
|
|
func TestDurableObservationOrdersLocalDefaultWhenAdmissionCommitsInReverse(t *testing.T) {
|
|
ctx := context.Background()
|
|
keys := memory.NewAuthKeyStore()
|
|
bindings := memory.NewTempAuthKeyBindingStore(keys)
|
|
rawEarlierAdmission := [8]byte{0x65, 0x11}
|
|
rawLaterAdmission := [8]byte{0x65, 0x12}
|
|
permAuthKeyID := [8]byte{0x65, 0x13}
|
|
const tempExpiry = 2_000_000_000
|
|
for _, key := range []store.AuthKeyData{
|
|
{ID: rawEarlierAdmission, ExpiresAt: tempExpiry},
|
|
{ID: rawLaterAdmission, ExpiresAt: tempExpiry},
|
|
{ID: permAuthKeyID},
|
|
} {
|
|
if err := keys.Save(ctx, key); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
for index, raw := range [][8]byte{rawEarlierAdmission, rawLaterAdmission} {
|
|
if err := bindings.Save(ctx, domain.TempAuthKeyBinding{
|
|
TempAuthKeyID: raw,
|
|
PermAuthKeyID: int64(binary.LittleEndian.Uint64(permAuthKeyID[:])),
|
|
Nonce: int64(index + 1),
|
|
ExpiresAt: tempExpiry,
|
|
}); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
auth := &captureAuthService{resolvedAuthKeyID: permAuthKeyID, hasResolved: true}
|
|
sessions := &inheritedLayerCaptureSessions{}
|
|
r := New(Config{DC: 2}, Deps{
|
|
Auth: auth, Sessions: sessions, AuthKeySessionLayers: keys,
|
|
}, zaptest.NewLogger(t), clock.System)
|
|
now := time.Now().UTC()
|
|
msgLaterAdmission := int64((uint64(now.Unix()) << 32) | 4)
|
|
msgEarlierAdmission := int64((uint64(now.Unix()) << 32) | 8)
|
|
|
|
// Admission sequence 2 reaches the permanent identity gate and commits
|
|
// first. It is temporarily the durable/local default.
|
|
if layer, msgID, publish, err := r.AdvanceNegotiatedSessionLayerEvidence(
|
|
ctx, rawLaterAdmission, 2, 227, msgLaterAdmission,
|
|
); err != nil || layer != 227 || msgID != msgLaterAdmission || !publish {
|
|
t.Fatalf("later admission first commit = (%d,%d,%v,%v)", layer, msgID, publish, err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(
|
|
ctx, rawLaterAdmission, 2, msgLaterAdmission, 2, 1, 227,
|
|
); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
// Admission sequence 1 was allocated earlier but commits second. Database
|
|
// observation order is authoritative, so local authInfo/session seeding must
|
|
// move to 225 despite the lower process admission sequence.
|
|
if layer, msgID, publish, err := r.AdvanceNegotiatedSessionLayerEvidence(
|
|
ctx, rawEarlierAdmission, 1, 225, msgEarlierAdmission,
|
|
); err != nil || layer != 225 || msgID != msgEarlierAdmission || !publish {
|
|
t.Fatalf("earlier admission late commit = (%d,%d,%v,%v)", layer, msgID, publish, err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(
|
|
ctx, rawEarlierAdmission, 1, msgEarlierAdmission, 1, 1, 225,
|
|
); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
permanent, found, err := keys.Get(ctx, permAuthKeyID)
|
|
if err != nil || !found || permanent.Layer != 225 || permanent.LayerObservationID <= 0 {
|
|
t.Fatalf("durable permanent default = (%+v,%v,%v)", permanent, found, err)
|
|
}
|
|
r.clientInfoMu.RLock()
|
|
local := r.authInfo[permAuthKeyID]
|
|
r.clientInfoMu.RUnlock()
|
|
if local.layer != permanent.Layer || local.layerObservationID != permanent.LayerObservationID {
|
|
t.Fatalf("local default = layer/obs %d/%d, durable %d/%d",
|
|
local.layer, local.layerObservationID, permanent.Layer, permanent.LayerObservationID)
|
|
}
|
|
lastSeed := 0
|
|
for _, seed := range sessions.seeds {
|
|
if seed.rawAuthKeyID == permAuthKeyID {
|
|
lastSeed = seed.layer
|
|
}
|
|
}
|
|
if lastSeed != 225 {
|
|
t.Fatalf("SessionManager permanent seed = %d, want 225", lastSeed)
|
|
}
|
|
}
|
|
|
|
type blockingLayerWriteAuthService struct {
|
|
*captureAuthService
|
|
mu sync.Mutex
|
|
started chan struct{}
|
|
release chan struct{}
|
|
updates int
|
|
blockFirst sync.Once
|
|
}
|
|
|
|
func (s *blockingLayerWriteAuthService) UpdateAuthKeyClientInfo(ctx context.Context, authKeyID [8]byte, info domain.AuthKeyClientInfo) error {
|
|
s.mu.Lock()
|
|
s.updates++
|
|
first := s.updates == 1
|
|
s.mu.Unlock()
|
|
if first {
|
|
s.blockFirst.Do(func() { close(s.started) })
|
|
select {
|
|
case <-s.release:
|
|
case <-ctx.Done():
|
|
return ctx.Err()
|
|
}
|
|
}
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
return s.captureAuthService.UpdateAuthKeyClientInfo(ctx, authKeyID, info)
|
|
}
|
|
|
|
func (s *blockingLayerWriteAuthService) layer(authKeyID [8]byte) int {
|
|
s.mu.Lock()
|
|
defer s.mu.Unlock()
|
|
return s.authKeyClientInfos[authKeyID].Layer
|
|
}
|
|
|
|
func TestAdmittedLayerPersistentWritesFollowAdmissionSequence(t *testing.T) {
|
|
rawOld := [8]byte{0x66, 1}
|
|
rawNew := [8]byte{0x66, 2}
|
|
permAuthKeyID := [8]byte{0x66, 3}
|
|
auth := &blockingLayerWriteAuthService{
|
|
captureAuthService: &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo),
|
|
},
|
|
started: make(chan struct{}),
|
|
release: make(chan struct{}),
|
|
}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(rawOld, 1, 225, 10); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(rawNew, 2, 227, 20); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
errs := make(chan error, 2)
|
|
go func() { errs <- r.PublishAdmittedLayerProfileEvidence(context.Background(), rawOld, 1, 10, 1, 1, 225) }()
|
|
<-auth.started
|
|
go func() { errs <- r.PublishAdmittedLayerProfileEvidence(context.Background(), rawNew, 2, 20, 2, 1, 227) }()
|
|
close(auth.release)
|
|
for i := 0; i < 2; i++ {
|
|
if err := <-errs; err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
if got := auth.layer(permAuthKeyID); got != 227 {
|
|
t.Fatalf("ordered durable default = %d, want 227", got)
|
|
}
|
|
}
|
|
|
|
func TestAuthLayerEvidenceCapacityUsesExactSafeFloor(t *testing.T) {
|
|
fill := func(r *Router) {
|
|
for i := uint64(1); i <= maxAuthLayerEvidenceEntries; i++ {
|
|
var id [8]byte
|
|
binary.LittleEndian.PutUint64(id[:], i)
|
|
r.authLayerEvidence[id] = authLayerDefaultEvidence{layer: 225, sequence: 1}
|
|
}
|
|
}
|
|
newID := [8]byte{0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff}
|
|
|
|
t.Run("retired entry is evictable", func(t *testing.T) {
|
|
r := New(Config{DC: 2}, Deps{}, zaptest.NewLogger(t), clock.System)
|
|
fill(r)
|
|
r.authLayerSafeEvictionFloor = 2
|
|
applied, err := r.claimAuthLayerDefaultEvidenceLocked(227, 2, false, newID)
|
|
if err != nil || !applied {
|
|
t.Fatalf("claim with retired capacity = (%v,%v), want (true,nil)", applied, err)
|
|
}
|
|
if len(r.authLayerEvidence) != maxAuthLayerEvidenceEntries {
|
|
t.Fatalf("evidence entries = %d, want %d", len(r.authLayerEvidence), maxAuthLayerEvidenceEntries)
|
|
}
|
|
if got := r.authLayerEvidence[newID]; got != (authLayerDefaultEvidence{layer: 227, sequence: 2}) {
|
|
t.Fatalf("new evidence = %+v", got)
|
|
}
|
|
})
|
|
|
|
t.Run("live entry is not evicted", func(t *testing.T) {
|
|
r := New(Config{DC: 2}, Deps{}, zaptest.NewLogger(t), clock.System)
|
|
fill(r)
|
|
r.authLayerSafeEvictionFloor = 1
|
|
applied, err := r.claimAuthLayerDefaultEvidenceLocked(227, 2, false, newID)
|
|
if err != nil || applied {
|
|
t.Fatalf("claim with all-live capacity = (%v,%v), want (false,nil)", applied, err)
|
|
}
|
|
if _, exists := r.authLayerEvidence[newID]; exists {
|
|
t.Fatal("capacity refusal installed new evidence")
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestAdmittedLayerSafeFloorIsMonotonic(t *testing.T) {
|
|
r := New(Config{DC: 2}, Deps{}, zaptest.NewLogger(t), clock.System)
|
|
first := [8]byte{0x67, 1}
|
|
second := [8]byte{0x67, 2}
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(first, 1, 225, 10); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(context.Background(), first, 1, 10, 2, 2, 225); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(second, 2, 227, 20); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(context.Background(), second, 2, 20, 3, 1, 227); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r.clientInfoMu.RLock()
|
|
floor := r.authLayerSafeEvictionFloor
|
|
r.clientInfoMu.RUnlock()
|
|
if floor != 2 {
|
|
t.Fatalf("safe eviction floor regressed = %d, want 2", floor)
|
|
}
|
|
}
|
|
|
|
func TestInvalidateAuthUserCachePreservesLayerEvidenceWatermark(t *testing.T) {
|
|
rawOld := [8]byte{0x68, 1}
|
|
permAuthKeyID := [8]byte{0x68, 2}
|
|
auth := &captureAuthService{
|
|
resolvedAuthKeyID: permAuthKeyID,
|
|
hasResolved: true,
|
|
authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo),
|
|
}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
freezeAndPublishLayer(t, r, permAuthKeyID, 2, 20, 2, 227)
|
|
r.invalidateAuthUserCache(permAuthKeyID)
|
|
freezeAndPublishLayer(t, r, rawOld, 1, 10, 1, 225)
|
|
if got := auth.authKeyClientInfos[permAuthKeyID].Layer; got != 227 {
|
|
t.Fatalf("authorization invalidation erased protocol order = %d, want 227", got)
|
|
}
|
|
}
|
|
|
|
func TestStaleExactCorrectionSkipsSharedPublicationWithoutFailingRPC(t *testing.T) {
|
|
authKeyID := [8]byte{0x69}
|
|
auth := &captureAuthService{authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo)}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth}, zaptest.NewLogger(t), clock.System)
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(authKeyID, 1, 225, 10); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(authKeyID, 1, 227, 20); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(context.Background(), authKeyID, 1, 10, 1, 1, 225); err != nil {
|
|
t.Fatalf("stale publication rejected immutable old RPC: %v", err)
|
|
}
|
|
if _, exists := auth.authKeyClientInfos[authKeyID]; exists {
|
|
t.Fatal("stale exact observation published durable default")
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(context.Background(), authKeyID, 1, 20, 2, 2, 227); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
|
|
func TestBindTempAuthKeyUsesLiveExplicitLayerAfterExactTTL(t *testing.T) {
|
|
clk := &exactProfileTestClock{now: time.Unix(1_700_000_000, 0)}
|
|
rawAuthKeyID := [8]byte{0x6a, 1}
|
|
permAuthKeyID := [8]byte{0x6a, 2}
|
|
const sessionID = int64(106)
|
|
auth := &captureAuthService{authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
permAuthKeyID: {Layer: 225},
|
|
}}
|
|
auth.bindTempHook = func(domain.TempAuthKeyBinding) error {
|
|
// The durable raw observation was published before the in-process exact
|
|
// registry expired. Bind merges that observation into the permanent row.
|
|
auth.authKeyClientInfos[rawAuthKeyID] = domain.AuthKeyClientInfo{Layer: 227}
|
|
auth.authKeyClientInfos[permAuthKeyID] = domain.AuthKeyClientInfo{Layer: 227}
|
|
return nil
|
|
}
|
|
sessions := &inheritedLayerCaptureSessions{explicitLayer: 227, explicitMsgID: 100}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth, Sessions: sessions}, zaptest.NewLogger(t), clk)
|
|
freezeAndPublishLayer(t, r, rawAuthKeyID, sessionID, 100, 5, 227)
|
|
sessions.seeds = nil
|
|
clk.advance(exactSessionProfileTTL + time.Second)
|
|
if _, ok := r.NegotiatedSessionLayer(rawAuthKeyID, sessionID); ok {
|
|
t.Fatal("test setup retained expired exact registry entry")
|
|
}
|
|
|
|
ctx := WithAuthKeyID(WithSessionID(WithRawAuthKeyID(context.Background(), rawAuthKeyID), sessionID), rawAuthKeyID)
|
|
ok, err := r.onAuthBindTempAuthKey(ctx, &tg.AuthBindTempAuthKeyRequest{PermAuthKeyID: businessAuthKeyInt64(permAuthKeyID)})
|
|
if err != nil || !ok {
|
|
t.Fatalf("bind after exact TTL = (%v,%v)", ok, err)
|
|
}
|
|
if got := auth.authKeyClientInfos[permAuthKeyID].Layer; got != 227 {
|
|
t.Fatalf("live explicit Layer was lost at bind = %d, want 227", got)
|
|
}
|
|
if len(sessions.refreshes) != 1 || sessions.refreshes[0].layer != 227 {
|
|
t.Fatalf("bind refresh calls = %+v", sessions.refreshes)
|
|
}
|
|
}
|
|
|
|
func TestNakedBindDoesNotRedateOlderExplicitEvidence(t *testing.T) {
|
|
rawAuthKeyID := [8]byte{0x6b, 1}
|
|
permAuthKeyID := [8]byte{0x6b, 2}
|
|
const sessionID = int64(107)
|
|
auth := &captureAuthService{authKeyClientInfos: make(map[[8]byte]domain.AuthKeyClientInfo)}
|
|
auth.bindTempHook = func(domain.TempAuthKeyBinding) error {
|
|
// The permanent observation is globally newer than the raw observation.
|
|
// Model the transaction's observation_id merge before the router reloads.
|
|
auth.authKeyClientInfos[rawAuthKeyID] = domain.AuthKeyClientInfo{Layer: 227}
|
|
auth.authKeyClientInfos[permAuthKeyID] = domain.AuthKeyClientInfo{Layer: 227}
|
|
return nil
|
|
}
|
|
sessions := &inheritedLayerCaptureSessions{explicitLayer: 225, explicitMsgID: 10}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth, Sessions: sessions}, zaptest.NewLogger(t), clock.System)
|
|
freezeAndPublishLayer(t, r, rawAuthKeyID, sessionID, 10, 1, 225)
|
|
freezeAndPublishLayer(t, r, permAuthKeyID, 2, 20, 2, 227)
|
|
|
|
ctx := WithAuthKeyID(WithSessionID(WithRawAuthKeyID(context.Background(), rawAuthKeyID), sessionID), rawAuthKeyID)
|
|
ctx = withLayerAdmissionSequence(ctx, 99) // naked bind order is not Layer evidence order.
|
|
ok, err := r.onAuthBindTempAuthKey(ctx, &tg.AuthBindTempAuthKeyRequest{PermAuthKeyID: businessAuthKeyInt64(permAuthKeyID)})
|
|
if err != nil || !ok {
|
|
t.Fatalf("naked bind = (%v,%v)", ok, err)
|
|
}
|
|
if got := auth.authKeyClientInfos[permAuthKeyID].Layer; got != 227 {
|
|
t.Fatalf("naked bind re-dated old explicit Layer = %d, want 227", got)
|
|
}
|
|
if got := auth.authKeyClientInfos[rawAuthKeyID].Layer; got != 227 {
|
|
t.Fatalf("raw inherited shadow did not normalize to permanent default = %d", got)
|
|
}
|
|
}
|
|
|
|
func TestRequestBoundBindHasNoStoreCacheOrSessionSideEffects(t *testing.T) {
|
|
rawAuthKeyID := [8]byte{0x6c, 1}
|
|
permAuthKeyID := [8]byte{0x6c, 2}
|
|
oldPermAuthKeyID := [8]byte{0x6c, 3}
|
|
const sessionID = int64(108)
|
|
auth := &captureAuthService{authKeyClientInfos: map[[8]byte]domain.AuthKeyClientInfo{
|
|
rawAuthKeyID: {Layer: 227, DeviceModel: "raw-before"},
|
|
permAuthKeyID: {Layer: 225},
|
|
}}
|
|
sessions := &inheritedLayerCaptureSessions{explicitLayer: 227, explicitMsgID: 10}
|
|
r := New(Config{DC: 2}, Deps{Auth: auth, Sessions: sessions}, zaptest.NewLogger(t), clock.System)
|
|
sessions.BindAuthKeyForSession(rawAuthKeyID, sessionID, oldPermAuthKeyID)
|
|
beforeSession := sessions.snapshot()
|
|
now := time.Now()
|
|
r.tempKeyResolveCache.Store(rawAuthKeyID, oldPermAuthKeyID, now.Add(time.Hour), now)
|
|
r.setAuthUserCache(rawAuthKeyID, 101, true)
|
|
r.setAuthUserCache(permAuthKeyID, 202, true)
|
|
r.clientInfoMu.Lock()
|
|
if r.authInfo == nil {
|
|
r.authInfo = make(map[[8]byte]clientSessionInfo)
|
|
}
|
|
r.authInfo[rawAuthKeyID] = clientSessionInfo{
|
|
layer: 227, layerAdmissionSeq: 11, authKeyInfoChecked: true,
|
|
authorizationChecked: true, hasClientInfo: true,
|
|
clientInfo: ClientInfo{DeviceModel: "raw-cache"},
|
|
}
|
|
r.authInfo[permAuthKeyID] = clientSessionInfo{
|
|
layer: 225, layerAdmissionSeq: 9, authKeyInfoChecked: true,
|
|
authorizationChecked: true, hasClientInfo: true,
|
|
clientInfo: ClientInfo{DeviceModel: "perm-cache"},
|
|
}
|
|
beforeRawInfo := r.authInfo[rawAuthKeyID]
|
|
beforePermInfo := r.authInfo[permAuthKeyID]
|
|
r.clientInfoMu.Unlock()
|
|
|
|
ctx := WithAuthKeyID(WithSessionID(WithRawAuthKeyID(context.Background(), rawAuthKeyID), sessionID), rawAuthKeyID)
|
|
ctx = r.WithLayerRPCProfileEvidenceFresh(ctx, false)
|
|
ok, err := r.onAuthBindTempAuthKey(ctx, &tg.AuthBindTempAuthKeyRequest{PermAuthKeyID: businessAuthKeyInt64(permAuthKeyID)})
|
|
if ok || !tgerr.Is(err, "TEMP_AUTH_KEY_EMPTY") {
|
|
t.Fatalf("stale request-bound bind = (%v,%v), want (false,TEMP_AUTH_KEY_EMPTY)", ok, err)
|
|
}
|
|
if auth.bindTempCalls != 0 || auth.resolveCount != 0 || auth.authKeyInfoLookups != 0 || auth.authorizationLookups != 0 {
|
|
t.Fatalf("stale bind touched auth store: bind=%d resolve=%d key=%d authorization=%d",
|
|
auth.bindTempCalls, auth.resolveCount, auth.authKeyInfoLookups, auth.authorizationLookups)
|
|
}
|
|
if got := auth.authKeyClientInfos[rawAuthKeyID]; got != (domain.AuthKeyClientInfo{Layer: 227, DeviceModel: "raw-before"}) {
|
|
t.Fatalf("stale bind changed raw durable fake: %+v", got)
|
|
}
|
|
if got := auth.authKeyClientInfos[permAuthKeyID]; got != (domain.AuthKeyClientInfo{Layer: 225}) {
|
|
t.Fatalf("stale bind changed permanent durable fake: %+v", got)
|
|
}
|
|
if got := sessions.snapshot(); got != beforeSession {
|
|
t.Fatalf("stale bind changed session binding: got %+v want %+v", got, beforeSession)
|
|
}
|
|
if len(sessions.seeds) != 0 || len(sessions.refreshes) != 0 || len(sessions.clears) != 0 {
|
|
t.Fatalf("stale bind changed inherited session state: seeds=%+v refreshes=%+v clears=%x",
|
|
sessions.seeds, sessions.refreshes, sessions.clears)
|
|
}
|
|
if got, found := r.tempKeyResolveCache.Get(rawAuthKeyID, oldPermAuthKeyID, now); !found || got != oldPermAuthKeyID {
|
|
t.Fatalf("stale bind changed temp-key cache: got=%x found=%v", got, found)
|
|
}
|
|
r.authUserMu.RLock()
|
|
rawUser := r.authUsers[rawAuthKeyID]
|
|
permUser := r.authUsers[permAuthKeyID]
|
|
r.authUserMu.RUnlock()
|
|
if rawUser != (authUserCacheEntry{userID: 101, found: true}) || permUser != (authUserCacheEntry{userID: 202, found: true}) {
|
|
t.Fatalf("stale bind changed auth-user cache: raw=%+v perm=%+v", rawUser, permUser)
|
|
}
|
|
r.clientInfoMu.RLock()
|
|
afterRawInfo := r.authInfo[rawAuthKeyID]
|
|
afterPermInfo := r.authInfo[permAuthKeyID]
|
|
r.clientInfoMu.RUnlock()
|
|
if afterRawInfo != beforeRawInfo || afterPermInfo != beforePermInfo {
|
|
t.Fatalf("stale bind changed layer cache: raw=%+v/%+v perm=%+v/%+v",
|
|
afterRawInfo, beforeRawInfo, afterPermInfo, beforePermInfo)
|
|
}
|
|
}
|
|
|
|
func freezeAndPublishLayer(t *testing.T, r *Router, rawAuthKeyID [8]byte, sessionID, msgID int64, admissionSeq uint64, layer int) {
|
|
t.Helper()
|
|
if _, err := r.FreezeNegotiatedSessionLayerAt(rawAuthKeyID, sessionID, layer, msgID); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.PublishAdmittedLayerProfileEvidence(context.Background(), rawAuthKeyID, sessionID, msgID, admissionSeq, 1, layer); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|