privatae-bastion/client-go/ops_plan_test.go

//go:build linux

package main

import (
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"net/url"
	"os"
	"strconv"
	"strings"
	"testing"
	"time"
)

// planBox makes this box both the person's approval device and a machine
// that has pinned it, with the device holding this machine's key: the setup
// a real device and a real machine reach through device-init, pin-device and
// pin-machine. dcn is the pairing dir the asks come in on (its factor checks
// the code).
func planBox(t *testing.T) (dcn string) {
	t.Helper()
	dcn, _ = opTestBox(t)
	pub, err := deviceInit()
	if err != nil {
		t.Fatal(err)
	}
	if err := pinDeviceKey(pub); err != nil {
		t.Fatal(err)
	}
	line := machineKeyLine()
	f := strings.Fields(line)
	if len(f) != 4 || f[1] != "pin-machine" {
		t.Fatalf("the machine prints the pin-machine line: %q", line)
	}
	if err := pinMachineKey(f[2], f[3]); err != nil {
		t.Fatal(err)
	}
	// The code is checked against the factor on the device's OWN pairing
	// (deviceFactorDir), whatever the ask said.
	fdir, err := deviceFactorDir()
	if err != nil {
		t.Fatal(err)
	}
	enrollFactor(t, fdir)
	return dcn
}

func planCode(t *testing.T) string { return planCodeAt(0) }

// planCodeAt is the code `windows` periods from now: a code is spent once, so
// a second root plan in the same period takes the next one (inside the drift
// the check allows).
func planCodeAt(windows int64) string {
	raw, _ := b32decode(tSecret)
	return hotp(raw, time.Now().Unix()/stepupPeriod+windows)
}

func planHost() string { h, _ := os.Hostname(); return h }

var planDraftSeq int

// planDraft is a two-line ship on this machine: a build (program only) and a
// roll that takes the build's digest. Each draft differs (the device takes
// the same draft twice as the same ask).
func planDraft(root bool) map[string]any {
	planDraftSeq++
	hn := planHost()
	sha1, sha2 := strings.Repeat("a", 64), strings.Repeat("b", 64)
	roll := map[string]any{"n": 2, "step": "roll", "machine": hn, "op": "bridge-roll", "op_sha256": sha2,
		"params": `{}`, "inputs": map[string]any{"digest": "build.digest"}, "undo": true}
	if root {
		roll["verbs"] = []any{map[string]any{"verb": "unit.restart", "args": map[string]any{"unit": "x.service"}}}
	}
	return map[string]any{"kind": shipPlanKind, "plan": map[string]any{
		"pipeline": "bridge", "commit": strings.Repeat("c", 40),
		"expires": time.Now().Add(3 * time.Hour).UTC().Format(time.RFC3339),
		"lines": []any{
			map[string]any{"n": 1, "step": "build", "machine": hn, "op": "bridge-build", "op_sha256": sha1, "params": `{"x":"` + strconv.Itoa(planDraftSeq) + `"}`},
			roll,
		}}}
}

// signPlan files a draft on the device and approves it, returning the signed
// envelope as a machine receives it (base64 of the envelope's JSON).
func signPlan(t *testing.T, dcn string, details map[string]any, code string) (string, *shipPlan) {
	t.Helper()
	id, err := deviceNewPlanRequest(details)
	if err != nil {
		t.Fatal(err)
	}
	env, err := deviceApproveWithCode(id, code)
	if err != nil {
		t.Fatal(err)
	}
	var e shipPlanEnvelope
	if err := json.Unmarshal([]byte(env), &e); err != nil {
		t.Fatal(err)
	}
	p, _, err := planOpen(e)
	if err != nil {
		t.Fatal(err)
	}
	return base64.StdEncoding.EncodeToString([]byte(env)), p
}

func TestTheDeviceSignsOnlyAPlanWhoseMachinesItPinned(t *testing.T) {
	dcn := planBox(t)
	// A machine the device never pinned: refused at the ask.
	d := planDraft(false)
	d["plan"].(map[string]any)["lines"].([]any)[0].(map[string]any)["machine"] = "stranger-1"
	if _, err := deviceNewPlanRequest(d); err == nil || !strings.Contains(err.Error(), "has not pinned stranger-1") {
		t.Fatalf("an unpinned machine: %v", err)
	}
	// A pinned one: the device fills in its OWN key for the machine, never
	// one the pod sent, and the words name every step.
	d = planDraft(false)
	d["plan"].(map[string]any)["machines"] = map[string]any{planHost(): base64.StdEncoding.EncodeToString(make([]byte, 32))}
	id, err := deviceNewPlanRequest(d)
	if err != nil {
		t.Fatal(err)
	}
	words := deviceRequestsLoad()[id].Words
	for _, want := range []string{"Ship bridge at commit cccccccccccc", "1. build on " + planHost(), "2. roll on " + planHost(),
		"digest = the digest step build builds", "may be undone"} {
		if !strings.Contains(words, want) {
			t.Errorf("the words say %q:\n%s", want, words)
		}
	}
	env, err := deviceApproveWithCode(id, "")
	if err != nil {
		t.Fatal(err)
	}
	var e shipPlanEnvelope
	_ = json.Unmarshal([]byte(env), &e)
	p, _, err := planOpen(e)
	if err != nil {
		t.Fatal(err)
	}
	own, _, _ := loadOrCreateOwnerKey()
	if p.Machines[planHost()] != base64.StdEncoding.EncodeToString(own) {
		t.Fatal("the plan carries the key the device pinned, not the pod's")
	}
	// Versions only go up.
	_, p2 := signPlan(t, dcn, planDraft(false), "")
	if p2.Version != p.Version+1 {
		t.Fatalf("the next plan for the pipeline is version %d, got %d", p.Version+1, p2.Version)
	}
}

func TestARootPlanNeedsTheCodeOnTheDevice(t *testing.T) {
	planBox(t)
	id, err := deviceNewPlanRequest(planDraft(true))
	if err != nil {
		t.Fatal(err)
	}
	if !deviceRequestsLoad()[id].NeedsCode {
		t.Fatal("a plan with verbs needs the code")
	}
	if _, err := deviceApproveWithCode(id, ""); err == nil || !strings.Contains(err.Error(), "with your code") {
		t.Fatalf("no code: %v", err)
	}
	if _, err := deviceApproveWithCode(id, "000000"); err == nil || !strings.Contains(err.Error(), "code") {
		t.Fatalf("a wrong code: %v", err)
	}
	env, err := deviceApproveWithCode(id, planCode(t))
	if err != nil {
		t.Fatal(err)
	}
	var e shipPlanEnvelope
	_ = json.Unmarshal([]byte(env), &e)
	p, _, err := planOpen(e)
	if err != nil || !p.Root || !p.CodeGiven {
		t.Fatalf("signed, root, with the code: %+v %v", p, err)
	}
	// "Approve all shown" never signs a root plan.
	id2, _ := deviceNewPlanRequest(planDraft(true))
	if p, _ := deviceShownPath(); p != "" {
		raw, _ := json.Marshal([]string{id2})
		_ = atomicWrite(p, raw)
	}
	if err := cmdDeviceApprove("all"); err != nil {
		t.Fatal(err)
	}
	if deviceRequestsLoad()[id2].State != "pending" {
		t.Fatal("approve-all signed a root plan")
	}
}

// The phase 2 gate: each of these is refused by the machine.
func TestAMachineRefusesEveryPlanItShouldNot(t *testing.T) {
	dcn := planBox(t)
	b64, p := signPlan(t, dcn, planDraft(false), "")
	envOf := func(b64 string) shipPlanEnvelope {
		raw, _ := base64.StdEncoding.DecodeString(b64)
		var e shipPlanEnvelope
		_ = json.Unmarshal(raw, &e)
		return e
	}
	reseal := func(mut func(*shipPlan)) string {
		e := envOf(b64)
		body, _ := base64.StdEncoding.DecodeString(e.Payload)
		var q shipPlan
		_ = json.Unmarshal(body, &q)
		mut(&q)
		nb, _ := json.Marshal(q)
		e.Payload = base64.StdEncoding.EncodeToString(nb) // the old signature, new bytes
		raw, _ := json.Marshal(e)
		return base64.StdEncoding.EncodeToString(raw)
	}
	// A tampered line: the device's signature no longer covers it.
	for name, bad := range map[string]string{
		"a changed op":      reseal(func(q *shipPlan) { q.Lines[0].OpSHA256 = strings.Repeat("f", 64) }),
		"changed params":    reseal(func(q *shipPlan) { q.Lines[0].Params = `{"x":"changed"}` }),
		"another commit":    reseal(func(q *shipPlan) { q.Commit = strings.Repeat("d", 40) }),
		"a longer life":     reseal(func(q *shipPlan) { q.Expires = time.Now().Add(time.Hour).UTC().Format(time.RFC3339) }),
		"root claimed code": reseal(func(q *shipPlan) { q.CodeGiven = true }),
	} {
		if _, err := planRunLine(dcn, bad, "1", "", nil); err == nil || !strings.Contains(err.Error(), "signature does not verify") {
			t.Errorf("%s: %v", name, err)
		}
	}
	// The wrong machine: a line for another host.
	d := planDraft(false)
	lines := d["plan"].(map[string]any)["lines"].([]any)
	lines[0].(map[string]any)["machine"] = "elsewhere-2"
	pub2, _, _ := ed25519.GenerateKey(nil)
	_ = pinMachineKey("elsewhere-2", base64.StdEncoding.EncodeToString(pub2))
	wrong, _ := signPlan(t, dcn, d, "")
	if _, err := planRunLine(dcn, wrong, "1", "", nil); err == nil || !strings.Contains(err.Error(), "is for elsewhere-2") {
		t.Errorf("a line for another machine: %v", err)
	}
	// A key other than this machine's own: the device pinned someone else
	// under this machine's name.
	_ = unpinMachineKey(planHost())
	_ = pinMachineKey(planHost(), base64.StdEncoding.EncodeToString(pub2))
	impostor, _ := signPlan(t, dcn, planDraft(false), "")
	if _, err := planRunLine(dcn, impostor, "1", "", nil); err == nil || !strings.Contains(err.Error(), "another key for this machine") {
		t.Errorf("a key that differs from this machine's: %v", err)
	}
	_ = unpinMachineKey(planHost())
	own := strings.Fields(machineKeyLine())[3]
	_ = pinMachineKey(planHost(), own)
	// A device this machine never pinned.
	if err := unpinDeviceKey(p.Device); err != nil {
		t.Fatal(err)
	}
	if _, err := planRunLine(dcn, b64, "1", "", nil); err == nil || !strings.Contains(err.Error(), "has not pinned") {
		t.Errorf("an unpinned device: %v", err)
	}
	_ = pinDeviceKey(p.Device)
	// A missing receipt, and a foreign one: line 2 takes build's digest.
	if _, err := planRunLine(dcn, b64, "2", "", nil); err == nil || !strings.Contains(err.Error(), "no successful receipt of it came") {
		t.Errorf("a missing receipt: %v", err)
	}
	_, sha, _ := planOpen(envOf(b64))
	good := lineReceipt{Plan: p.Nonce, PlanSHA256: sha, Pipeline: p.Pipeline, Commit: p.Commit, N: 1, Step: "build",
		Machine: planHost(), OK: true, Images: []opResultImage{{Image: "forge.example.com/acme/web",
			Digest: "sha256:" + strings.Repeat("1", 64), Source: "https://forge.example.com/acme/app.git", Commit: p.Commit}}}
	fpub, fpriv, _ := ed25519.GenerateKey(nil)
	foreign := good
	foreign.V, foreign.Key = 1, base64.StdEncoding.EncodeToString(fpub)
	fraw, _ := json.Marshal(foreign)
	fs := opSignedReceipt{PayloadType: lineReceiptPayloadType, Payload: base64.StdEncoding.EncodeToString(fraw),
		Signature: base64.StdEncoding.EncodeToString(ed25519.Sign(fpriv, dssePAE(lineReceiptPayloadType, fraw)))}
	if _, err := lineReceiptVerify(fs, p, sha); err == nil || !strings.Contains(err.Error(), "does not name") {
		t.Errorf("a foreign receipt: %v", err)
	}
	// A receipt of another plan, and one of a failed build, feed nothing.
	_, p3 := signPlan(t, dcn, planDraft(false), "")
	otherPlan := good
	otherPlan.Plan = p3.Nonce
	s3, _ := lineReceiptSign(otherPlan)
	if _, err := lineReceiptVerify(s3, p, sha); err == nil || !strings.Contains(err.Error(), "another plan") {
		t.Errorf("another plan's receipt: %v", err)
	}
	failedBuild := good
	failedBuild.OK = false
	s4, _ := lineReceiptSign(failedBuild)
	if _, _, err := planInputs(p, sha, &p.Lines[1], []opSignedReceipt{s4}); err == nil || !strings.Contains(err.Error(), "succeeded") {
		t.Errorf("a failed build's receipt: %v", err)
	}
	s5, _ := lineReceiptSign(good)
	params, _, err := planInputs(p, sha, &p.Lines[1], []opSignedReceipt{s5})
	if err != nil || !strings.Contains(params, "sha256:"+strings.Repeat("1", 64)) {
		t.Fatalf("the build's receipt fills the roll's digest: %q %v", params, err)
	}
	// An expired plan.
	d = planDraft(false)
	d["plan"].(map[string]any)["expires"] = time.Now().Add(2 * time.Second).UTC().Format(time.RFC3339)
	soon, _ := signPlan(t, dcn, d, "")
	time.Sleep(3 * time.Second)
	if _, err := planRunLine(dcn, soon, "1", "", nil); err == nil || !strings.Contains(err.Error(), "expired") {
		t.Errorf("an expired plan: %v", err)
	}
	// A replayed line: spent once.
	if err := planSpend(p, "1"); err != nil {
		t.Fatal(err)
	}
	if err := planSpend(p, "1"); err == nil || !strings.Contains(err.Error(), "ran already") {
		t.Errorf("a replayed line: %v", err)
	}
	// An older plan than one this machine ran for the pipeline.
	_ = planRecordVersion(p.Pipeline, p3.Version)
	if _, err := planLineFor(p, 1); err == nil || !strings.Contains(err.Error(), "is older") {
		t.Errorf("an older version: %v", err)
	}
}

func TestAnUndoNeedsAFailedLaterLineOfThePlan(t *testing.T) {
	dcn := planBox(t)
	b64, p := signPlan(t, dcn, planDraft(false), "")
	raw, _ := base64.StdEncoding.DecodeString(b64)
	var e shipPlanEnvelope
	_ = json.Unmarshal(raw, &e)
	_, sha, _ := planOpen(e)
	rec := func(n int, ok bool, verr string) string {
		s, _ := lineReceiptSign(lineReceipt{Plan: p.Nonce, PlanSHA256: sha, Pipeline: p.Pipeline, Commit: p.Commit,
			N: n, Step: p.Lines[n-1].Step, Machine: planHost(), OK: ok, VerifyError: verr, Attempt: 1})
		b, _ := json.Marshal(s)
		return base64.StdEncoding.EncodeToString(b)
	}
	// Line 1 is not marked undoable in this plan; line 2 is.
	if _, err := planUndoLine(b64, "1", rec(2, false, "")); err == nil || !strings.Contains(err.Error(), "not one the plan lets be undone") {
		t.Errorf("an undo the plan does not allow: %v", err)
	}
	// An earlier line's failure, or any success, starts no undo of line 2.
	for name, r := range map[string]string{"an earlier failure": rec(1, false, ""), "a success": rec(1, true, ""),
		"its own success": rec(2, true, "")} {
		if _, err := planUndoLine(b64, "2", r); err == nil || !strings.Contains(err.Error(), "LATER line") {
			t.Errorf("%s: %v", name, err)
		}
	}
	// Its own failure may take back what it did — but it never ran here.
	if _, err := planUndoLine(b64, "2", rec(2, false, "")); err == nil || !strings.Contains(err.Error(), "no record of running line 2") {
		t.Errorf("its own failure, on a machine that never ran it: %v", err)
	}
	// A three-line plan: line 3's failed check undoes line 2, once, and only
	// to what this machine recorded before line 2 ran.
	d := planDraft(false)
	lines := d["plan"].(map[string]any)["lines"].([]any)
	lines = append(lines, map[string]any{"n": 3, "step": "check", "machine": planHost(), "op": "bridge-check",
		"op_sha256": strings.Repeat("e", 64), "params": `{}`})
	d["plan"].(map[string]any)["lines"] = lines
	b64, p = signPlan(t, dcn, d, "")
	raw, _ = base64.StdEncoding.DecodeString(b64)
	_ = json.Unmarshal(raw, &e)
	_, sha, _ = planOpen(e)
	if _, err := planUndoLine(b64, "2", rec(3, true, "")); err == nil || !strings.Contains(err.Error(), "LATER line") {
		t.Errorf("a later line that passed: %v", err)
	}
	// A later line whose APPLY failed (a bad credential the pod handed can
	// do that) is not a failed check, and starts nothing.
	if _, err := planUndoLine(b64, "2", rec(3, false, "")); err == nil || !strings.Contains(err.Error(), "LATER line") {
		t.Errorf("a later line whose apply failed: %v", err)
	}
	if _, err := planUndoLine(b64, "2", rec(3, true, "verify exited 1")); err == nil || !strings.Contains(err.Error(), "no record of running line 2") {
		t.Errorf("a line this machine never ran: %v", err)
	}
	path, _ := planRunPath(p.Nonce, 2)
	body, _ := json.Marshal(planRunRecord{Plan: p.Nonce, N: 2, Attempt: 1, State: planStatePassed})
	_ = os.WriteFile(path, body, 0o600)
	out, err := planUndoLine(b64, "2", rec(3, true, "verify exited 1"))
	if err != nil || out["ok"] != true {
		t.Fatalf("a failed check of a later line undoes it: %v %v", out, err)
	}
	if _, err := planUndoLine(b64, "2", rec(3, true, "logs.check failed")); err == nil || !strings.Contains(err.Error(), "undone here already") {
		t.Errorf("an undo is spent once: %v", err)
	}
}

// The device's words and the plan's form: nothing a pod writes can redraw,
// hide or reorder what the person reads, and a line shows only verbs this
// bastion runs with their own arguments.
func TestAPlanCarriesNothingThatCouldHideWhatThePersonReads(t *testing.T) {
	planBox(t)
	mut := func(f func(l map[string]any)) map[string]any {
		d := planDraft(false)
		f(d["plan"].(map[string]any)["lines"].([]any)[1].(map[string]any))
		return d
	}
	for name, d := range map[string]map[string]any{
		"an escape in an input's image": mut(func(l map[string]any) {
			l["inputs"] = map[string]any{"digest": "build.digest:x\x1b[2A\x1b[2K\r"}
		}),
		"a line break in params":         mut(func(l map[string]any) { l["params"] = "{\"a\":\"x\n   (FAKE)\"}" }),
		"a direction override in params": mut(func(l map[string]any) { l["params"] = "{\"a\":\"\u202egnp.exe\"}" }),
		"a key twice in params":          mut(func(l map[string]any) { l["params"] = `{"a":"1","a":"2"}` }),
		"a verb this bastion does not run": mut(func(l map[string]any) {
			l["verbs"] = []any{map[string]any{"verb": "shell.run\x1b[2A", "args": map[string]any{}}}
		}),
		"an argument name the verb does not take": mut(func(l map[string]any) {
			l["verbs"] = []any{map[string]any{"verb": "unit.restart", "args": map[string]any{"unit": "x.service", "note\x1b[1A": "y"}}}
		}),
		"a control character in a verb's value": mut(func(l map[string]any) {
			l["verbs"] = []any{map[string]any{"verb": "unit.restart", "args": map[string]any{"unit": "x.service\r"}}}
		}),
	} {
		if _, err := deviceNewPlanRequest(d); err == nil {
			t.Errorf("%s: filed", name)
		}
	}
	// C1 too: U+009B is a whole escape sequence's opener on its own, U+0085 a line break.
	if got := wordsSafe("a\x1b[2Ab\u202ec\nd\u009b2Ae\u0085f"); strings.ContainsAny(got, "\x1b\u202e\n\u009b\u0085") {
		t.Fatalf("the words carry no control or direction character: %q", got)
	}
	// An input that names its image reads right.
	d := planDraft(false)
	d["plan"].(map[string]any)["lines"].([]any)[1].(map[string]any)["inputs"] = map[string]any{"digest": "build.digest:forge.example.com/acme/web"}
	id, err := deviceNewPlanRequest(d)
	if err != nil {
		t.Fatal(err)
	}
	if w := deviceRequestsLoad()[id].Words; !strings.Contains(w, "digest = the digest of forge.example.com/acme/web that step build builds") {
		t.Fatalf("the words: %s", w)
	}
}

// A line runs only after every line before it succeeded, and runs at most
// as many times as the plan allows.
func TestLinesRunInOrderAndOnlyAsOftenAsThePlanAllows(t *testing.T) {
	dcn := planBox(t)
	d := planDraft(false)
	lines := d["plan"].(map[string]any)["lines"].([]any)
	lines = append(lines, map[string]any{"n": 3, "step": "check", "machine": planHost(), "op": "bridge-check",
		"op_sha256": strings.Repeat("e", 64), "params": `{}`, "attempts": 2})
	d["plan"].(map[string]any)["lines"] = lines
	b64, p := signPlan(t, dcn, d, "")
	raw, _ := base64.StdEncoding.DecodeString(b64)
	var e shipPlanEnvelope
	_ = json.Unmarshal(raw, &e)
	_, sha, _ := planOpen(e)
	sign := func(n int, ok bool) opSignedReceipt {
		s, _ := lineReceiptSign(lineReceipt{Plan: p.Nonce, PlanSHA256: sha, Pipeline: p.Pipeline, Commit: p.Commit,
			N: n, Step: p.Lines[n-1].Step, Machine: planHost(), OK: ok})
		return s
	}
	enc := func(rs ...opSignedReceipt) string {
		b, _ := json.Marshal(rs)
		return base64.StdEncoding.EncodeToString(b)
	}
	// The check before the build and the roll: refused, nothing spent.
	if _, err := planRunLine(dcn, b64, "3", "", nil); err == nil || !strings.Contains(err.Error(), "runs only after line 1") {
		t.Fatalf("a line before the ones before it: %v", err)
	}
	if _, err := planRunLine(dcn, b64, "3", enc(sign(1, true)), nil); err == nil || !strings.Contains(err.Error(), "runs only after line 2") {
		t.Fatalf("a line after only some of the ones before it: %v", err)
	}
	if _, err := planRunLine(dcn, b64, "3", enc(sign(1, true), sign(2, false)), nil); err == nil || !strings.Contains(err.Error(), "runs only after line 2") {
		t.Fatalf("a line after one that failed: %v", err)
	}
	// Attempts: line 3 may run twice, and no more.
	l := &p.Lines[2]
	for want := 1; want <= 2; want++ {
		if k, err := planSpendAttempt(p, l); err != nil || k != want {
			t.Fatalf("attempt %d: %d %v", want, k, err)
		}
	}
	if _, err := planSpendAttempt(p, l); err == nil || !strings.Contains(err.Error(), "all it may") {
		t.Fatalf("a third attempt: %v", err)
	}
}

// signPlanRaw signs any plan with this device's key, as a device that was
// changed (or a forged one holding the key) could: the machine's own checks
// must hold even then.
func signPlanRaw(t *testing.T, p *shipPlan) string {
	t.Helper()
	f, err := deviceKeyLoad()
	if err != nil {
		t.Fatal(err)
	}
	priv, _ := base64.StdEncoding.DecodeString(f.Priv)
	p.Device = f.Pub
	body, _ := json.Marshal(p)
	env := shipPlanEnvelope{PayloadType: shipPlanPayloadType, Payload: base64.StdEncoding.EncodeToString(body),
		Signature: base64.StdEncoding.EncodeToString(ed25519.Sign(ed25519.PrivateKey(priv), dssePAE(shipPlanPayloadType, body)))}
	raw, _ := json.Marshal(env)
	return base64.StdEncoding.EncodeToString(raw)
}

// A root line runs only from a plan that says the code was given, whatever
// signed it; and a line runs only with the verbs its held op declares.
func TestARootLineNeedsTheCodeAndTheOpsOwnVerbs(t *testing.T) {
	dcn := planBox(t)
	own := strings.Fields(machineKeyLine())[3]
	p := &shipPlan{V: shipPlanVersion, Kind: shipPlanKind, Pipeline: "bridge", Version: 1, Commit: strings.Repeat("c", 40),
		Nonce: strings.Repeat("9", 32), Expires: time.Now().Add(time.Hour).UTC().Format(time.RFC3339), Root: true,
		Machines: map[string]string{planHost(): own},
		Lines: []shipPlanLine{{N: 1, Step: "roll", Machine: planHost(), Op: "bridge-roll", OpSHA256: strings.Repeat("b", 64),
			Params: `{}`, Verbs: []opVerbLine{{Verb: "unit.restart", Args: map[string]string{"unit": "x.service"}}}}}}
	if _, err := planRunLine(dcn, signPlanRaw(t, p), "1", "", nil); err == nil || !strings.Contains(err.Error(), "approved with your code") {
		t.Fatalf("a root line without the code: %v", err)
	}
	// The verbs a line shows must be exactly the held op's.
	man := `name: bridge-roll
version: 1.0.0
summary: Restart the bridge.
kind: action
target: machine
privilege: root
interpreter: /bin/sh
time_limit: 30
params: {}
verbs:
  - {verb: unit.restart, unit: ceigas-governance-bridge.service}
modes: [dry_run, apply, verify]
undo: none
`
	m, err := parseOpManifest([]byte(man))
	if err != nil {
		t.Fatal(err)
	}
	l := shipPlanLine{N: 1, Step: "roll", Op: "bridge-roll", Params: `{}`}
	l.Verbs = planVerbsForShow(m, &l)
	if err := planLineMatchesOp(&l, m, `{}`); err != nil {
		t.Fatalf("the op's own verbs: %v", err)
	}
	l.Verbs = []opVerbLine{{Verb: "unit.restart", Args: map[string]string{"unit": "something-harmless.service"}}}
	if err := planLineMatchesOp(&l, m, `{}`); err == nil || !strings.Contains(err.Error(), "other verbs") {
		t.Fatalf("a line that shows other verbs than the op runs: %v", err)
	}
	l.Verbs = nil
	if err := planLineMatchesOp(&l, m, `{}`); err == nil {
		t.Fatal("a line that shows no verbs for a root op")
	}
}

// The approvals page: a root plan's card asks for the code, and "approve all
// shown" leaves it waiting, even when its id is posted.
func TestThePageAsksTheCodeForARootPlanAndNeverApprovesItWithAll(t *testing.T) {
	planBox(t)
	root, err := deviceNewPlanRequest(planDraft(true))
	if err != nil {
		t.Fatal(err)
	}
	a, _ := deviceNewPlanRequest(planDraft(false))
	b, _ := deviceNewPlanRequest(planDraft(false))
	u := uiTestServer(t)
	h := u.handler()
	cookie := uiSignedIn(t, u)
	body := uiGet(t, h, "/fragments/approvals", cookie).Body.String()
	// The card's approve form: the one posting to /device/approve with its id.
	asked := false
	for _, f := range strings.Split(body, `<form hx-post="/device/approve" `)[1:] {
		f = f[:strings.Index(f, "</form>")]
		if strings.Contains(f, `value="`+root+`"`) {
			asked = strings.Contains(f, `name="code"`)
		} else if strings.Contains(f, `name="code"`) {
			t.Error("a plan that needs no code is asked for one")
		}
	}
	if !asked {
		t.Fatal("the root plan's card asks for the code")
	}
	all := body[strings.Index(body, `class="approve-all"`):]
	all = all[:strings.Index(all, "</form>")]
	if strings.Contains(all, root) || !strings.Contains(all, a) || !strings.Contains(all, b) || !strings.Contains(all, "Approve all 2 shown") {
		t.Fatalf("approve-all holds the two plans that need no code, not the root one: %q", all)
	}
	w := uiPost(t, h, "/device/approve-shown", url.Values{"id": {a, b, root}}, cookie)
	if !strings.Contains(w.Body.String(), "wait for your code") || deviceStateOf(root) != "pending" {
		t.Fatalf("a root plan posted to approve-all stays waiting: %q", w.Body.String())
	}
	if w := uiPost(t, h, "/device/approve", url.Values{"id": {root}}, cookie); !strings.Contains(w.Body.String(), "Not approved") {
		t.Fatalf("approved without the code: %q", w.Body.String())
	}
	if w := uiPost(t, h, "/device/approve", url.Values{"id": {root}, "code": {planCode(t)}}, cookie); !strings.Contains(w.Body.String(), "Approved") ||
		deviceStateOf(root) != "approved" {
		t.Fatalf("approved with the code: %q", w.Body.String())
	}
}