bastion 0.53.2

client-go/approvals_owner_test.go

@@ -0,0 +1,97 @@
+//go:build !windows
+
+// Uses withMachineAuthority, which lives behind //go:build !windows (see
+// anchor_test.go's header).
+
+package main
+
+// `approvals-owner` (approvals_owner.go): the account whose tray the pipe
+// serves is recorded with machine authority, in the service's state, and is
+// never changed silently. Every value here is invented.
+
+import (
+	"os"
+	"strings"
+	"testing"
+)
+
+const otherTestUser = "S-1-5-21-1111111111-2222222222-3333333333-1002"
+
+func ownerTestBox(t *testing.T) {
+	t.Helper()
+	uiTestConfigDir(t)
+	withMachineAuthority(t, true)
+	prevState, prevConsole := ownerServiceState, ownerConsole
+	ownerServiceState = func() string { return "" }
+	ownerConsole = func() bool { return false }
+	t.Cleanup(func() { ownerServiceState, ownerConsole = prevState, prevConsole })
+}
+
+func TestApprovalsOwnerNeedsMachineAuthorityTheServiceStateAndAPerson(t *testing.T) {
+	ownerTestBox(t)
+	withMachineAuthority(t, false)
+	if err := cmdApprovalsOwner(pipeTestUser, false); err == nil || !strings.Contains(err.Error(), "machine authority") {
+		t.Fatalf("without machine authority: %v", err)
+	}
+	withMachineAuthority(t, true)
+	ownerServiceState = func() string { return "the bastion is not installed as this machine's service yet" }
+	if err := cmdApprovalsOwner(pipeTestUser, false); err == nil || !strings.Contains(err.Error(), "system service's state") {
+		t.Fatalf("outside the service's state: %v", err)
+	}
+	ownerServiceState = func() string { return "" }
+	for _, bad := range []string{"S-1-5-18", "S-1-5-32-544", "S-1-5-21-1-2-3-1001; x", ""} {
+		if err := cmdApprovalsOwner(bad, false); err == nil {
+			t.Fatalf("%q is no person's account, yet it was recorded", bad)
+		}
+	}
+	if sid, present, _ := approvalsOwnerLoad(); present || sid != "" {
+		t.Fatal("a refused command wrote an owner")
+	}
+}
+
+func TestApprovalsOwnerIsNeverChangedSilently(t *testing.T) {
+	ownerTestBox(t)
+	if err := cmdApprovalsOwner(pipeTestUser, false); err != nil {
+		t.Fatalf("first record: %v", err)
+	}
+	// The same account again changes nothing.
+	if err := cmdApprovalsOwner(pipeTestUser, false); err != nil {
+		t.Fatalf("the same account again: %v", err)
+	}
+	// Another account's run: refused, and the first owner keeps the lane.
+	if err := cmdApprovalsOwner(otherTestUser, false); err == nil || !strings.Contains(err.Error(), "stay with it") {
+		t.Fatalf("another account must not take the approvals over: %v", err)
+	}
+	if approvalsOwner() != pipeTestUser {
+		t.Fatalf("the owner changed to %q", approvalsOwner())
+	}
+	// --replace with captured output, as an installer would run it: refused.
+	if err := cmdApprovalsOwner(otherTestUser, true); err == nil || !strings.Contains(err.Error(), "Administrator terminal") {
+		t.Fatalf("--replace off a console must be refused: %v", err)
+	}
+	if approvalsOwner() != pipeTestUser {
+		t.Fatal("a refused --replace changed the owner")
+	}
+	// At a terminal, on purpose: handed over.
+	ownerConsole = func() bool { return true }
+	if err := cmdApprovalsOwner(otherTestUser, true); err != nil {
+		t.Fatalf("--replace at a terminal: %v", err)
+	}
+	if approvalsOwner() != otherTestUser {
+		t.Fatal("--replace at a terminal did not hand the approvals over")
+	}
+}
+
+func TestADamagedOwnerRecordIsNotReplacedQuietly(t *testing.T) {
+	ownerTestBox(t)
+	p, _ := approvalsOwnerPath()
+	if err := atomicWrite(p, []byte("not json")); err != nil {
+		t.Fatal(err)
+	}
+	if err := cmdApprovalsOwner(pipeTestUser, false); err == nil || !strings.Contains(err.Error(), "stay with it") {
+		t.Fatalf("a damaged record must be replaced only with --replace: %v", err)
+	}
+	if raw, _ := os.ReadFile(p); string(raw) != "not json" {
+		t.Fatal("the damaged record was rewritten")
+	}
+}