mirror of
https://github.com/Such-Software/smirk-backend-core.git
synced 2026-10-17 07:21:32 +02:00
jwinterm
67faf8f762
No trust-on-first-use: bootstrap mode is an explicit, MAC-protected latch
(server_config singleton), NOT inferred from "no admin keys". The latch MAC
(ADMIN_KEY_INTEGRITY_SECRET over setup_state|bootstrap_completed_at) means a
DB-write attacker who restores a pre-bootstrap backup or flips the state to
re-open TOFU produces a mismatch the boot path detects and fails closed on.
- migration 20260626000002: server_config (id=1 singleton; setup_state +
bootstrap_completed_at + integrity_mac).
- db::server_config: read_setup_state -> {Fresh,Uninitialized,Locked,Tampered}
(MAC-verified); has_any_users; init_server_config (adoption: a live upgrade
latches `locked` so it never exposes a setup window; a truly empty DB begins
uninitialized); bootstrap_admin (insert the FIRST active admin AND latch
locked + hash-chained audit, ONE tx; refuses if an active admin already
exists); reset_setup (shell recovery; recomputes MAC, preserves admin keys).
- main boot (admin enabled): adopt/await-bootstrap, and FAIL CLOSED on a tampered
latch.
- smirk-admin: `setup --pubkey` (the supported headless bootstrap) + `reset-setup
--i-understand`.
- 1 L1 test: Fresh -> locked(valid) -> wrong-secret Tampered -> raw-flip Tampered
-> reset Uninitialized -> bootstrap refused while an active admin exists.
Deferred (documented): the HTTP /setup/* wizard. Per the spec the CLI / `docker
exec` is the SUPPORTED bootstrap (pure-PaaS without shell is explicitly
unsupported), so the loopback TTY wizard is a later convenience, not load-bearing.
88 lines
2.8 KiB
Rust
88 lines
2.8 KiB
Rust
//! L1 integration: the first-run bootstrap latch (operator §3.2).
|
|
//!
|
|
//! The latch is a singleton (id=1) only this suite reads (main's boot logic does
|
|
//! not run under the harness), so this one sequential test owns it and drives the
|
|
//! state machine deterministically. The bootstrap SUCCESS path needs an empty
|
|
//! admin allowlist, which the shared test DB cannot guarantee; instead this
|
|
//! asserts bootstrap's refusal guard (with a guaranteed active admin) — the
|
|
//! success path's pieces (admin insert MAC + latch MAC) are covered elsewhere.
|
|
|
|
mod common;
|
|
|
|
use smirk_backend_core::infra::db::SetupState;
|
|
use smirk_backend_core::models::db::NewAdminKey;
|
|
use uuid::Uuid;
|
|
|
|
const SECRET: &str = "server-config-integrity-secret-0123456789ab";
|
|
|
|
#[tokio::test]
|
|
async fn latch_state_machine_and_tamper_detection() {
|
|
let app = require_app!();
|
|
let db = &app.state.db;
|
|
|
|
// Own the singleton: no row => Fresh.
|
|
sqlx::query("DELETE FROM server_config WHERE id = 1")
|
|
.execute(db.pool())
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(
|
|
db.read_setup_state(SECRET).await.unwrap(),
|
|
SetupState::Fresh
|
|
);
|
|
|
|
// Adoption path: init creates a valid locked latch.
|
|
db.init_server_config(SECRET, true).await.unwrap();
|
|
assert_eq!(
|
|
db.read_setup_state(SECRET).await.unwrap(),
|
|
SetupState::Locked
|
|
);
|
|
|
|
// Wrong secret => MAC fails => Tampered (fail-closed).
|
|
assert_eq!(
|
|
db.read_setup_state("WRONG-SECRET").await.unwrap(),
|
|
SetupState::Tampered
|
|
);
|
|
|
|
// Raw flip of state without recomputing the MAC => Tampered (the
|
|
// restore-to-pre-bootstrap attack).
|
|
sqlx::query(
|
|
"UPDATE server_config SET setup_state = 'uninitialized', bootstrap_completed_at = NULL WHERE id = 1",
|
|
)
|
|
.execute(db.pool())
|
|
.await
|
|
.unwrap();
|
|
assert_eq!(
|
|
db.read_setup_state(SECRET).await.unwrap(),
|
|
SetupState::Tampered
|
|
);
|
|
|
|
// reset-setup recomputes the MAC => verifies again as uninitialized.
|
|
db.reset_setup(SECRET).await.unwrap();
|
|
assert_eq!(
|
|
db.read_setup_state(SECRET).await.unwrap(),
|
|
SetupState::Uninitialized
|
|
);
|
|
|
|
// With an active admin present, bootstrap must refuse (no second bootstrap).
|
|
let pk = format!("{:0>64}", Uuid::new_v4().simple());
|
|
let k = db
|
|
.create_admin_key(
|
|
NewAdminKey {
|
|
pubkey: pk.clone(),
|
|
label: None,
|
|
scope: "admin".into(),
|
|
created_by_kind: "cli".into(),
|
|
activation_deadline: None,
|
|
},
|
|
SECRET,
|
|
)
|
|
.await
|
|
.unwrap();
|
|
db.activate_admin_key(k.id, SECRET).await.unwrap();
|
|
assert!(
|
|
db.bootstrap_admin(&"11".repeat(32), SECRET).await.is_err(),
|
|
"bootstrap refused while an active admin exists"
|
|
);
|
|
let _ = db.revoke_admin_key(k.id, SECRET).await;
|
|
}
|