release / govulncheck (push) Successful in 28s
release / web (push) Successful in 1m18s
release / go (push) Successful in 1m35s
release / android (push) Successful in 4m45s
release / Build signed APK (push) Successful in 4m57s
release / integration (push) Successful in 5m3s
release / Attach APK to the Release (tag releases only) (push) Skipped
release / Build + push container image (push) Successful in 1m14s
release / Verify release artifacts (tag releases only) (push) Skipped
Minstrel keeps credentials it has to read back: indexer, Prowlarr and download-client keys and passwords, the AcoustID key, cover-art and tag provider keys, the SMTP password, and each user's ListenBrainz token and Subsonic password. They were stored in the clear; they are now sealed with AES-256-GCM under a per-column HKDF key derived from the stream secret, each value bound to its row. - internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed columns (a backup will leave them out). Install takes the master key at startup; SealStored seals any value still in the clear, so an existing database is brought over in place on the first boot. - Every write seals and every read opens: acquire (one read path, getService / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and password generation, cover-art and tag provider settings. - A value that does not open (the stream secret changed) is logged and reads as unset, to be entered again in Settings. docs/security.md says so. - Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a SealStored integration test over all eight columns plus a schema check that each listed column exists, and the existing tests now assert sealed storage. dbtest installs a test key for integration tests. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
119 lines
3.7 KiB
Go
119 lines
3.7 KiB
Go
package acquire
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"io"
|
|
"log/slog"
|
|
"os"
|
|
"testing"
|
|
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/db"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/dbtest"
|
|
"git.fabledsword.com/bvandeusen/minstrel/internal/secret"
|
|
)
|
|
|
|
func newPool(t *testing.T) *pgxpool.Pool {
|
|
t.Helper()
|
|
if testing.Short() {
|
|
t.Skip("skipping integration test in -short mode")
|
|
}
|
|
dsn := os.Getenv("MINSTREL_TEST_DATABASE_URL")
|
|
if dsn == "" {
|
|
t.Skip("MINSTREL_TEST_DATABASE_URL not set")
|
|
}
|
|
if err := db.Migrate(dsn, slog.New(slog.NewTextHandler(io.Discard, nil))); err != nil {
|
|
t.Fatalf("migrate: %v", err)
|
|
}
|
|
pool, err := pgxpool.New(context.Background(), dsn)
|
|
if err != nil {
|
|
t.Fatalf("pool: %v", err)
|
|
}
|
|
t.Cleanup(pool.Close)
|
|
dbtest.ResetDB(t, pool)
|
|
return pool
|
|
}
|
|
|
|
func TestStore_AddsConfiguresAndRemoves_Integration(t *testing.T) {
|
|
ctx := context.Background()
|
|
s := NewStore(newPool(t))
|
|
|
|
first, err := s.Create(ctx, ProtocolExchange)
|
|
if err != nil {
|
|
t.Fatalf("create: %v", err)
|
|
}
|
|
second, err := s.Create(ctx, ProtocolExchange)
|
|
if err != nil {
|
|
t.Fatalf("create a second: %v", err)
|
|
}
|
|
if first.Code != "exchange" || second.Code != "exchange-2" || second.Label != "FabledExchange 2" {
|
|
t.Errorf("codes = %q, %q (%q); want exchange, exchange-2", first.Code, second.Code, second.Label)
|
|
}
|
|
// A new exchange is off, does every job, files under minstrel and is
|
|
// unpaced.
|
|
if first.Enabled || first.Kind != KindDownload || !first.ServesSearch || !first.ServesDownloads ||
|
|
!first.ServesEnrichment || first.Category != DefaultCategory || first.SearchesPerHour != 0 || first.LocalPath != "/downloads" {
|
|
t.Errorf("a new exchange = %+v", first)
|
|
}
|
|
if _, err := s.Create(ctx, "transmission"); !errors.As(err, new(*InvalidError)) {
|
|
t.Errorf("an unknown protocol: err = %v", err)
|
|
}
|
|
|
|
u := Update{
|
|
Label: "Exchange", Enabled: true, BaseURL: "http://exchange:8080", Category: "minstrel",
|
|
TimeoutMs: 20000, ServesSearch: true, LocalPath: "/downloads", RemotePath: "/data/torrents",
|
|
}
|
|
saved, err := s.Save(ctx, first.Code, u)
|
|
if err != nil {
|
|
t.Fatalf("save: %v", err)
|
|
}
|
|
if !saved.Enabled || saved.ServesDownloads || saved.RemotePath != "/data/torrents" {
|
|
t.Errorf("saved = %+v", saved)
|
|
}
|
|
if _, err := s.Save(ctx, "nope", u); !errors.Is(err, ErrNotFound) {
|
|
t.Errorf("saving a missing row: err = %v", err)
|
|
}
|
|
|
|
// Secrets are write-only: the list says whether one is set, never what.
|
|
if err := s.SetAPIKey(ctx, first.Code, " key "); err != nil {
|
|
t.Fatalf("set key: %v", err)
|
|
}
|
|
full, err := s.Get(ctx, first.Code)
|
|
if err != nil || full.ApiKey != "key" {
|
|
t.Errorf("stored key = %q (err %v), want it trimmed", full.ApiKey, err)
|
|
}
|
|
// The column holds the key sealed, never the key.
|
|
var raw string
|
|
if err := s.pool.QueryRow(ctx,
|
|
"SELECT api_key FROM acquisition_services WHERE code = $1", first.Code).Scan(&raw); err != nil {
|
|
t.Fatalf("read api_key: %v", err)
|
|
}
|
|
if raw == "key" || !secret.IsSealed(raw) {
|
|
t.Errorf("api_key column = %q, want it sealed", raw)
|
|
}
|
|
rows, err := s.List(ctx)
|
|
if err != nil || len(rows) != 2 {
|
|
t.Fatalf("list: %d rows, err %v", len(rows), err)
|
|
}
|
|
for _, r := range rows {
|
|
if r.Code == first.Code && !r.HasApiKey {
|
|
t.Error("the list should say a key is set")
|
|
}
|
|
}
|
|
|
|
// Only the exchange with search switched on is a search source.
|
|
srcs, err := Sources(ctx, s.pool)
|
|
if err != nil || len(srcs) != 1 || srcs[0].Code != first.Code {
|
|
t.Errorf("sources = %+v, err %v; want only the enabled exchange", srcs, err)
|
|
}
|
|
|
|
if err := s.Delete(ctx, second.Code); err != nil {
|
|
t.Fatalf("delete: %v", err)
|
|
}
|
|
if err := s.Delete(ctx, second.Code); !errors.Is(err, ErrNotFound) {
|
|
t.Errorf("deleting twice: err = %v", err)
|
|
}
|
|
}
|