96 lines
2.2 KiB
Go
96 lines
2.2 KiB
Go
package storage
|
|
|
|
import (
|
|
"fmt"
|
|
"path/filepath"
|
|
"sync"
|
|
"testing"
|
|
)
|
|
|
|
func TestAuditConcurrent100NoLoss(t *testing.T) {
|
|
dir := t.TempDir()
|
|
s, err := Open(filepath.Join(dir, "commander.db"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer s.DB.Close()
|
|
|
|
const n = 100
|
|
var wg sync.WaitGroup
|
|
errs := make(chan error, n)
|
|
wg.Add(n)
|
|
for i := 0; i < n; i++ {
|
|
go func(i int) {
|
|
defer wg.Done()
|
|
errs <- s.Audit("127.0.0.1", "local", "exec", fmt.Sprintf("echo %d", i), 0, 1, "")
|
|
}(i)
|
|
}
|
|
wg.Wait()
|
|
close(errs)
|
|
|
|
for err := range errs {
|
|
if err != nil {
|
|
t.Fatalf("audit write failed: %v", err)
|
|
}
|
|
}
|
|
|
|
var count int
|
|
if err := s.DB.QueryRow("SELECT COUNT(*) FROM audit_logs").Scan(&count); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if count != n {
|
|
t.Fatalf("audit loss: got %d rows, want %d", count, n)
|
|
}
|
|
|
|
var journal string
|
|
if err := s.DB.QueryRow("PRAGMA journal_mode").Scan(&journal); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if journal != "wal" {
|
|
t.Fatalf("journal_mode=%q, want wal", journal)
|
|
}
|
|
|
|
var busy int
|
|
if err := s.DB.QueryRow("PRAGMA busy_timeout").Scan(&busy); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if busy < 5000 {
|
|
t.Fatalf("busy_timeout=%d, want >=5000", busy)
|
|
}
|
|
}
|
|
|
|
func TestDeviceCredentialHashAndRotation(t *testing.T) {
|
|
s, err := Open(filepath.Join(t.TempDir(), "commander.db"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
defer s.DB.Close()
|
|
|
|
if err := s.SetDeviceCredential("node-1", "secret-one"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
configured, err := s.HasDeviceCredential("node-1")
|
|
if err != nil || !configured {
|
|
t.Fatalf("credential should be configured: %v", err)
|
|
}
|
|
valid, err := s.VerifyDeviceCredential("node-1", "secret-one")
|
|
if err != nil || !valid {
|
|
t.Fatalf("valid credential rejected: %v", err)
|
|
}
|
|
valid, err = s.VerifyDeviceCredential("node-1", "wrong")
|
|
if err != nil || valid {
|
|
t.Fatal("wrong credential accepted")
|
|
}
|
|
if err := s.SetDeviceCredential("node-1", "secret-two"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
valid, err = s.VerifyDeviceCredential("node-1", "secret-one")
|
|
if err != nil || valid {
|
|
t.Fatal("old credential accepted after rotation")
|
|
}
|
|
valid, err = s.VerifyDeviceCredential("node-1", "secret-two")
|
|
if err != nil || !valid {
|
|
t.Fatal("rotated credential rejected")
|
|
}
|
|
}
|