feat(data-plane): add signed managed writer bindings
This commit is contained in:
Codex
@@ -0,0 +1,217 @@
|
||||
import assert from "node:assert/strict";
|
||||
import {
|
||||
generateKeyPairSync,
|
||||
randomBytes,
|
||||
sign,
|
||||
} from "node:crypto";
|
||||
import { chmod, mkdtemp, rm, symlink, writeFile } from "node:fs/promises";
|
||||
import { tmpdir } from "node:os";
|
||||
import { join } from "node:path";
|
||||
import {
|
||||
createManagedProvisionerRequestVerifier,
|
||||
loadManagedProvisionerPublicKeyFile,
|
||||
MANAGED_PROVISIONER_HEADERS,
|
||||
managedProvisionerSigningPayload,
|
||||
ManagedProvisionerReplayCache,
|
||||
sha256RawBody,
|
||||
} from "../src/managed-provisioner-auth.mjs";
|
||||
|
||||
const serviceId = "nodedc-engine";
|
||||
const keyId = "engine-edp-managed-provisioner-v1";
|
||||
const audience = "nodedc-external-data-plane.managed-provisioning.v1";
|
||||
const nowMs = Date.parse("2026-07-16T12:00:00.000Z");
|
||||
const { privateKey, publicKey } = generateKeyPairSync("ed25519");
|
||||
let nonceSequence = 0;
|
||||
|
||||
const replayCache = new ManagedProvisionerReplayCache({ maxEntries: 100 });
|
||||
const verify = createManagedProvisionerRequestVerifier({
|
||||
publicKey,
|
||||
serviceId,
|
||||
keyId,
|
||||
audience,
|
||||
maxSkewMs: 60_000,
|
||||
replayCache,
|
||||
now: () => nowMs,
|
||||
});
|
||||
|
||||
const valid = signedRequest();
|
||||
assert.deepEqual(verify(valid), { serviceId, keyId });
|
||||
assert.throws(() => verify(valid), hasCode("managed_provisioner_request_replayed", 409));
|
||||
|
||||
const whitespaceTamper = signedRequest();
|
||||
whitespaceTamper.rawBody = Buffer.from(`${whitespaceTamper.rawBody.toString("utf8")} `, "utf8");
|
||||
assert.throws(() => verify(whitespaceTamper), hasCode("managed_provisioner_body_hash_mismatch", 401));
|
||||
|
||||
const methodTamper = signedRequest();
|
||||
methodTamper.method = "POST";
|
||||
assert.throws(() => verify(methodTamper), hasCode("managed_provisioner_signature_invalid", 401));
|
||||
|
||||
const pathTamper = signedRequest();
|
||||
pathTamper.originalUrl = `${pathTamper.originalUrl}?unexpected=true`;
|
||||
assert.throws(() => verify(pathTamper), hasCode("managed_provisioner_signature_invalid", 401));
|
||||
|
||||
const audienceTamper = signedRequest();
|
||||
setHeader(audienceTamper, MANAGED_PROVISIONER_HEADERS.audience, "other-audience");
|
||||
assert.throws(() => verify(audienceTamper), hasCode("managed_provisioner_identity_mismatch", 401));
|
||||
|
||||
const serviceTamper = signedRequest();
|
||||
setHeader(serviceTamper, MANAGED_PROVISIONER_HEADERS.serviceId, "other-engine");
|
||||
assert.throws(() => verify(serviceTamper), hasCode("managed_provisioner_identity_mismatch", 401));
|
||||
const keyTamper = signedRequest();
|
||||
setHeader(keyTamper, MANAGED_PROVISIONER_HEADERS.keyId, "other-key-v1");
|
||||
assert.throws(() => verify(keyTamper), hasCode("managed_provisioner_identity_mismatch", 401));
|
||||
|
||||
const forbiddenBearer = signedRequest();
|
||||
forbiddenBearer.headers.authorization = "Bearer value-that-must-not-appear-in-errors";
|
||||
forbiddenBearer.rawHeaders.push("Authorization", forbiddenBearer.headers.authorization);
|
||||
assert.throws(
|
||||
() => verify(forbiddenBearer),
|
||||
(error) => hasCode("managed_provisioner_authorization_header_forbidden", 401)(error)
|
||||
&& !error.message.includes("value-that-must-not-appear-in-errors"),
|
||||
);
|
||||
|
||||
const stale = signedRequest({ timestamp: new Date(nowMs - 60_000).toISOString() });
|
||||
assert.throws(() => verify(stale), hasCode("managed_provisioner_timestamp_outside_window", 401));
|
||||
const future = signedRequest({ timestamp: new Date(nowMs + 60_000).toISOString() });
|
||||
assert.throws(() => verify(future), hasCode("managed_provisioner_timestamp_outside_window", 401));
|
||||
const invalidTimestamp = signedRequest();
|
||||
setHeader(invalidTimestamp, MANAGED_PROVISIONER_HEADERS.timestamp, "2026-07-16T12:00:00Z");
|
||||
assert.throws(() => verify(invalidTimestamp), hasCode("managed_provisioner_timestamp_invalid", 401));
|
||||
|
||||
const duplicateHeader = signedRequest();
|
||||
duplicateHeader.rawHeaders.push(MANAGED_PROVISIONER_HEADERS.nonce, header(duplicateHeader, MANAGED_PROVISIONER_HEADERS.nonce));
|
||||
assert.throws(() => verify(duplicateHeader), hasCode("managed_provisioner_header_invalid", 401));
|
||||
|
||||
const uncaptured = signedRequest();
|
||||
uncaptured.rawBodyCaptured = false;
|
||||
uncaptured.headers["content-length"] = String(uncaptured.rawBody.length);
|
||||
assert.throws(() => verify(uncaptured), hasCode("managed_provisioner_raw_body_unavailable", 401));
|
||||
|
||||
const badSignature = signedRequest();
|
||||
setHeader(badSignature, MANAGED_PROVISIONER_HEADERS.signature, randomBytes(64).toString("base64url"));
|
||||
assert.throws(() => verify(badSignature), hasCode("managed_provisioner_signature_invalid", 401));
|
||||
const paddedSignature = signedRequest();
|
||||
setHeader(
|
||||
paddedSignature,
|
||||
MANAGED_PROVISIONER_HEADERS.signature,
|
||||
`${header(paddedSignature, MANAGED_PROVISIONER_HEADERS.signature)}=`,
|
||||
);
|
||||
assert.throws(() => verify(paddedSignature), hasCode("managed_provisioner_signature_invalid", 401));
|
||||
const uppercaseHash = signedRequest();
|
||||
setHeader(
|
||||
uppercaseHash,
|
||||
MANAGED_PROVISIONER_HEADERS.bodySha256,
|
||||
header(uppercaseHash, MANAGED_PROVISIONER_HEADERS.bodySha256).toUpperCase(),
|
||||
);
|
||||
assert.throws(() => verify(uppercaseHash), hasCode("managed_provisioner_body_hash_invalid", 401));
|
||||
|
||||
const cache = new ManagedProvisionerReplayCache({ maxEntries: 1 });
|
||||
cache.consume("first", nowMs + 1000, nowMs);
|
||||
assert.throws(() => cache.consume("second", nowMs + 1000, nowMs), hasCode("managed_provisioner_replay_cache_exhausted", 503));
|
||||
assert.throws(() => cache.consume("first", nowMs + 1000, nowMs), hasCode("managed_provisioner_request_replayed", 409));
|
||||
cache.consume("second", nowMs + 2000, nowMs + 1000);
|
||||
|
||||
const directory = await mkdtemp(join(tmpdir(), "nodedc-edp-managed-auth-"));
|
||||
try {
|
||||
const publicKeyPath = join(directory, "engine-public-key.pem");
|
||||
const rsaPublicKeyPath = join(directory, "rsa-public-key.pem");
|
||||
const privateKeyPath = join(directory, "engine-private-key.pem");
|
||||
const symlinkPath = join(directory, "engine-public-key-link.pem");
|
||||
await writeFile(publicKeyPath, publicKey.export({ type: "spki", format: "pem" }), { mode: 0o600 });
|
||||
assert.equal(loadManagedProvisionerPublicKeyFile(publicKeyPath).asymmetricKeyType, "ed25519");
|
||||
assert.throws(
|
||||
() => loadManagedProvisionerPublicKeyFile("relative-public-key.pem"),
|
||||
/external_data_plane_managed_provisioner_public_key_file_must_be_absolute/,
|
||||
);
|
||||
assert.throws(
|
||||
() => loadManagedProvisionerPublicKeyFile(join(directory, "missing.pem")),
|
||||
/external_data_plane_managed_provisioner_public_key_file_unreadable/,
|
||||
);
|
||||
|
||||
await symlink(publicKeyPath, symlinkPath);
|
||||
assert.throws(
|
||||
() => loadManagedProvisionerPublicKeyFile(symlinkPath),
|
||||
/external_data_plane_managed_provisioner_public_key_file_must_be_regular/,
|
||||
);
|
||||
|
||||
await chmod(publicKeyPath, 0o622);
|
||||
assert.throws(
|
||||
() => loadManagedProvisionerPublicKeyFile(publicKeyPath),
|
||||
/external_data_plane_managed_provisioner_public_key_file_permissions_invalid/,
|
||||
);
|
||||
await chmod(publicKeyPath, 0o600);
|
||||
|
||||
const { publicKey: rsaPublicKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
|
||||
await writeFile(rsaPublicKeyPath, rsaPublicKey.export({ type: "spki", format: "pem" }), { mode: 0o600 });
|
||||
assert.throws(
|
||||
() => loadManagedProvisionerPublicKeyFile(rsaPublicKeyPath),
|
||||
/external_data_plane_managed_provisioner_public_key_algorithm_invalid/,
|
||||
);
|
||||
|
||||
await writeFile(privateKeyPath, privateKey.export({ type: "pkcs8", format: "pem" }), { mode: 0o600 });
|
||||
assert.throws(
|
||||
() => loadManagedProvisionerPublicKeyFile(privateKeyPath),
|
||||
/external_data_plane_managed_provisioner_public_key_file_format_invalid/,
|
||||
);
|
||||
} finally {
|
||||
await rm(directory, { recursive: true, force: true });
|
||||
}
|
||||
|
||||
console.log("external-data-plane managed provisioner auth: ok");
|
||||
|
||||
function signedRequest({
|
||||
method = "PUT",
|
||||
path = "/internal/data-plane/v1/writer-bindings/by-key/engine.test.positions",
|
||||
rawBody = Buffer.from('{"generation":1}', "utf8"),
|
||||
timestamp = new Date(nowMs).toISOString(),
|
||||
nonce = nextNonce(),
|
||||
} = {}) {
|
||||
const bodySha256 = sha256RawBody(rawBody);
|
||||
const signature = sign(null, Buffer.from(managedProvisionerSigningPayload({
|
||||
audience,
|
||||
serviceId,
|
||||
keyId,
|
||||
method,
|
||||
path,
|
||||
timestamp,
|
||||
nonce,
|
||||
bodySha256,
|
||||
}), "utf8"), privateKey).toString("base64url");
|
||||
const headers = {
|
||||
[MANAGED_PROVISIONER_HEADERS.serviceId]: serviceId,
|
||||
[MANAGED_PROVISIONER_HEADERS.keyId]: keyId,
|
||||
[MANAGED_PROVISIONER_HEADERS.audience]: audience,
|
||||
[MANAGED_PROVISIONER_HEADERS.timestamp]: timestamp,
|
||||
[MANAGED_PROVISIONER_HEADERS.nonce]: nonce,
|
||||
[MANAGED_PROVISIONER_HEADERS.bodySha256]: bodySha256,
|
||||
[MANAGED_PROVISIONER_HEADERS.signature]: signature,
|
||||
"content-length": String(rawBody.length),
|
||||
};
|
||||
return {
|
||||
method,
|
||||
originalUrl: path,
|
||||
headers,
|
||||
rawHeaders: Object.entries(headers).flat(),
|
||||
rawBody,
|
||||
rawBodyCaptured: true,
|
||||
};
|
||||
}
|
||||
|
||||
function nextNonce() {
|
||||
nonceSequence += 1;
|
||||
return Buffer.from(`managed-auth-test-${String(nonceSequence).padStart(6, "0")}`).toString("base64url");
|
||||
}
|
||||
|
||||
function header(req, name) {
|
||||
return req.headers[name];
|
||||
}
|
||||
|
||||
function setHeader(req, name, value) {
|
||||
req.headers[name] = value;
|
||||
const index = req.rawHeaders.findIndex((candidate) => String(candidate).toLowerCase() === name);
|
||||
req.rawHeaders[index + 1] = value;
|
||||
}
|
||||
|
||||
function hasCode(code, status) {
|
||||
return (error) => error?.code === code && error?.status === status;
|
||||
}
|
||||
Reference in New Issue
Block a user