| 1 | package cli |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "os" |
| 6 | "path/filepath" |
| 7 | "runtime" |
| 8 | "strings" |
| 9 | "testing" |
| 10 | "time" |
| 11 | |
| 12 | "reasonix/internal/config" |
| 13 | "reasonix/internal/control" |
| 14 | "reasonix/internal/serve" |
| 15 | "reasonix/internal/stats" |
| 16 | ) |
| 17 | |
| 18 | func TestAuthDisabledServeKeepsLaunchTokenOffTheTerminal(t *testing.T) { |
| 19 | // serve.New starts the process-wide usage catalog under REASONIX_HOME; it |
| 20 | // must be closed before the home is removed, or Windows refuses the delete. |
| 21 | closeUsage := func() { |
| 22 | ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) |
| 23 | defer cancel() |
| 24 | if err := stats.CloseUsageCatalogs(ctx); err != nil { |
| 25 | t.Fatalf("close usage catalog: %v", err) |
| 26 | } |
| 27 | } |
| 28 | closeUsage() |
| 29 | t.Setenv("REASONIX_HOME", t.TempDir()) |
| 30 | t.Cleanup(closeUsage) |
| 31 | ctrl := newOwnedTestController(t, control.Options{SessionDir: t.TempDir()}) |
| 32 | t.Cleanup(ctrl.Close) |
| 33 | srv := serve.New(ctrl, serve.NewBroadcaster(), config.ServeConfig{AuthMode: "none"}) |
| 34 | resources := &serveFrontendResources{} |
| 35 | opts := serveFrontendOptions{command: "serve"} |
| 36 | path, err := launchTokenLocation(srv.AuthToken(), opts, resources) |
| 37 | if err != nil { |
| 38 | t.Fatal(err) |
| 39 | } |
| 40 | defer resources.release(false) |
| 41 | if filepath.Dir(path) != config.RemoteStateDir() { |
| 42 | t.Fatalf("launch token file %s is outside the sandbox-denied %s", path, config.RemoteStateDir()) |
| 43 | } |
| 44 | data, err := os.ReadFile(path) |
| 45 | if err != nil || strings.TrimSpace(string(data)) != srv.AuthToken() { |
| 46 | t.Fatalf("launch token file = %q, %v", data, err) |
| 47 | } |
| 48 | if info, err := os.Stat(path); err != nil || (runtime.GOOS != "windows" && info.Mode().Perm() != 0o600) { |
| 49 | t.Fatalf("launch token file mode = %v, %v; want 0600", info.Mode().Perm(), err) |
| 50 | } |
| 51 | opts.launchTokenPath = path |
| 52 | var report strings.Builder |
| 53 | reportServeAuth(&report, srv, "127.0.0.1:8787", opts) |
| 54 | out := report.String() |
| 55 | if strings.Contains(out, srv.AuthToken()) || !strings.Contains(out, path) { |
| 56 | t.Fatalf("serve report printed the token or omitted its file:\n%s", out) |
| 57 | } |
| 58 | resources.release(false) |
| 59 | if _, err := os.Stat(path); !os.IsNotExist(err) { |
| 60 | t.Fatalf("launch token file outlived the serve: %v", err) |
| 61 | } |
| 62 | } |
| 63 | |
| 64 | func TestManagedAuthDisabledServePointsAtItsTokenFile(t *testing.T) { |
| 65 | resources := &serveFrontendResources{} |
| 66 | path, err := launchTokenLocation("secret", serveFrontendOptions{tokenFile: "/run/serve.token"}, resources) |
| 67 | if err != nil || path != "/run/serve.token" || len(resources.artifacts) != 0 { |
| 68 | t.Fatalf("managed launch token location = %q %v artifacts=%v", path, err, resources.artifacts) |
| 69 | } |
| 70 | } |
| 71 |