Provision instance bank credentials automatically (Refs #146)

2026-10-12 20:44:01 -04:00
parent e071e5b574
commit d14c6a7ff4
21 changed files with 634 additions and 109 deletions
@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto';
 import { afterEach, beforeEach, expect, it, vi } from 'vitest';
 import { newFixture, type Fixture } from '../helpers/fixture.js';
 import { routePermission } from '../../src/lib/server/auth/access.js';
@@ -5,20 +6,38 @@ import { routePermission } from '../../src/lib/server/auth/access.js';
 let fixture: Fixture;
 const server = 't5_zombie_theater_1';
 const other = 't6_zm_transit_1';
-const secret = 'ec_bank_' + 'a'.repeat(40);
-const otherSecret = 'ec_bank_' + 'b'.repeat(40);
+let secret: string;
+let otherSecret: string;
+let instanceId: string;
+let hostId: string;
+let hostToken: string;
 let serial = 0;

 beforeEach(async () => {
    vi.resetModules();
    fixture = await newFixture([server, other]);
-    vi.stubEnv('EC_BANK_TOKENS', JSON.stringify({ [server]: secret, [other]: otherSecret }));
    vi.stubEnv('EC_TELEMETRY_TOKEN', 'telemetry_' + 't'.repeat(40));
    vi.stubEnv('EC_BANK_MAX_BALANCE', '250000');
    const { seedServerRegistry } = await import('../../src/lib/server/fleet/servers.js');
    const { saveTelemetry } = await import('../../src/lib/server/fleet/telemetry.js');
    await seedServerRegistry();
+    const { db } = await import('../../src/lib/server/db/index.js');
+    const { bankCredential } = await import('../../src/lib/server/auth/bank.js');
+    const { createHost, createEnrollment, enrollHost } =
+        await import('../../src/lib/server/hosts/index.js');
+    hostId = createHost({ name: 'Bank host' }).id;
+    hostToken = enrollHost(createEnrollment(hostId).token, {}).credential;
    for (const source of [server, other]) {
+        const id = randomUUID();
+        db()
+            .prepare(
+                `INSERT INTO native_instances(id,server,host_id,library_id,image,port,created_at) VALUES (?,?,?,'library','image',28960,?)`
+            )
+            .run(id, source, hostId, new Date().toISOString());
+        if (source === server) {
+            instanceId = id;
+            secret = bankCredential(id);
+        } else otherSecret = bankCredential(id);
        saveTelemetry({
            server: source,
            map: source === server ? 'zombie_theater' : 'zm_transit',
@@ -84,21 +103,88 @@ it('routes only bank POSTs as machine requests, authenticating before reading bo
    });
 });

-it('fails closed for missing, duplicate, telemetry-reused and invalid credentials', async () => {
-    for (const configured of [
-        '',
-        '{}',
-        '[]',
-        '{',
-        JSON.stringify({ [server]: secret, [other]: secret }),
-        JSON.stringify({ [server]: 'short' })
-    ]) {
-        vi.stubEnv('EC_BANK_TOKENS', configured);
-        expect(await post('balance', { server, guid: 'ace' })).toMatchObject({ status: 503 });
-    }
-    vi.stubEnv('EC_BANK_TOKENS', JSON.stringify({ [server]: secret }));
-    vi.stubEnv('EC_TELEMETRY_TOKEN', secret);
-    expect(await post('balance', { server, guid: 'ace' })).toMatchObject({ status: 503 });
+it('owns generated secrets by immutable instance, preserving rebuilds and revoking retired names', async () => {
+    const { db, closeDb } = await import('../../src/lib/server/db/index.js');
+    const { bankCredential } = await import('../../src/lib/server/auth/bank.js');
+    const data = transfer();
+    await post('deposit', data);
+    expect(secret).toMatch(/^ec_bank_[A-Za-z0-9_-]{43}$/);
+    expect(otherSecret).not.toBe(secret);
+    closeDb();
+    db().prepare('UPDATE native_instances SET generation=2 WHERE id=?').run(instanceId);
+    expect(bankCredential(instanceId)).toBe(secret);
+    db()
+        .prepare('UPDATE native_instances SET retired_at=? WHERE id=?')
+        .run(new Date().toISOString(), instanceId);
+    expect(await post('balance', { server, guid: 'ace' })).toMatchObject({ status: 401 });
+    expect(() => bankCredential(instanceId)).toThrow('active native instance');
+    const next = randomUUID();
+    db()
+        .prepare(
+            `INSERT INTO native_instances(id,server,host_id,library_id,image,port,created_at) VALUES (?,?,?,'library','image',28960,?)`
+        )
+        .run(next, server, hostId, new Date().toISOString());
+    const replacement = bankCredential(next);
+    const { migrateBankCredentials } = await import('../../src/lib/server/db/bank-credentials.js');
+    migrateBankCredentials(db()); // A legacy migration rerun must not rebind old requests.
+    expect(replacement).not.toBe(secret);
+    expect(await post('commit', data, replacement)).toMatchObject({
+        status: 409,
+        code: 'request_conflict'
+    });
+    expect(await post('cancel', data, replacement)).toMatchObject({ status: 409 });
+});
+
+it('settles journals only for the host assigned to an unfinished teardown, even after retirement', async () => {
+    const { db } = await import('../../src/lib/server/db/index.js');
+    const { queueHostOperation } = await import('../../src/lib/server/hosts/index.js');
+    const { POST } = await import('../../src/routes/api/agent/bank/settle/+server.js');
+    const data = transfer();
+    await post('deposit', data);
+    const removal = queueHostOperation(
+        hostId,
+        'instance.remove',
+        {},
+        { instanceId, generation: 1 }
+    );
+    db()
+        .prepare('UPDATE native_instances SET retired_at=? WHERE id=?')
+        .run(new Date().toISOString(), instanceId);
+    const settle = (
+        action = 'commit',
+        operationId = removal.id,
+        credential = hostToken,
+        value = data
+    ) =>
+        POST({
+            request: new Request('https://test/api/agent/bank/settle', {
+                method: 'POST',
+                headers: { Authorization: `Bearer ${credential}` },
+                body: JSON.stringify({ operationId, action, transfer: value })
+            })
+        });
+    await expect(settle('commit', removal.id, secret)).rejects.toMatchObject({ status: 401 });
+    const { createHost, createEnrollment, enrollHost } =
+        await import('../../src/lib/server/hosts/index.js');
+    const stranger = createHost({ name: 'Unassigned host' });
+    const strangerToken = enrollHost(createEnrollment(stranger.id).token, {}).credential;
+    await expect(settle('commit', removal.id, strangerToken)).rejects.toMatchObject({
+        status: 403
+    });
+    await expect(settle('deposit')).rejects.toMatchObject({ status: 400 });
+    await expect(settle('commit', randomUUID())).rejects.toMatchObject({ status: 403 });
+    expect(
+        await (await settle('commit', removal.id, hostToken, { ...data, server: other })).json()
+    ).toMatchObject({ code: 'wrong_server' });
+    const first = await (await settle()).json();
+    expect(first).toMatchObject({ state: 'committed', balance: 2000 });
+    expect(await (await settle()).json()).toEqual(first);
+    const cancelled = transfer();
+    expect(await (await settle('cancel', removal.id, hostToken, cancelled)).json()).toMatchObject({
+        state: 'cancelled'
+    });
+    db().prepare("UPDATE ec_host_operations SET state='completed' WHERE id=?").run(removal.id);
+    await expect(settle()).rejects.toMatchObject({ status: 403 });
 });

 it('persists one credit and one ledger row through lost replies, retries and database reopen', async () => {