Files
minstrel/internal/acquire/store_test.go
T
bvandeusenandClaude Opus 5.5 a8a2d20307
release / govulncheck (push) Successful in 28s
release / web (push) Successful in 1m18s
release / go (push) Successful in 1m35s
release / android (push) Successful in 4m45s
release / Build signed APK (push) Successful in 4m57s
release / integration (push) Successful in 5m3s
release / Attach APK to the Release (tag releases only) (push) Skipped
release / Build + push container image (push) Successful in 1m14s
release / Verify release artifacts (tag releases only) (push) Skipped
feat: stored credentials are sealed at rest, so a copy of the database alone reveals none of them (#6767)
Minstrel keeps credentials it has to read back: indexer, Prowlarr and
download-client keys and passwords, the AcoustID key, cover-art and tag
provider keys, the SMTP password, and each user's ListenBrainz token and
Subsonic password. They were stored in the clear; they are now sealed with
AES-256-GCM under a per-column HKDF key derived from the stream secret, each
value bound to its row.

- internal/secret: Seal/Open/Reveal, and Columns, the one list of sealed
  columns (a backup will leave them out). Install takes the master key at
  startup; SealStored seals any value still in the clear, so an existing
  database is brought over in place on the first boot.
- Every write seals and every read opens: acquire (one read path, getService
  / usableServices), acoustid settings, SMTP, ListenBrainz, Subsonic auth and
  password generation, cover-art and tag provider settings.
- A value that does not open (the stream secret changed) is logged and reads
  as unset, to be entered again in Settings. docs/security.md says so.
- Tests: secret unit tests (wrong owner/purpose/key, malformed, no key), a
  SealStored integration test over all eight columns plus a schema check that
  each listed column exists, and the existing tests now assert sealed storage.
  dbtest installs a test key for integration tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-02 13:23:19 -05:00

119 lines
3.7 KiB
Go

package acquire
import (
"context"
"errors"
"io"
"log/slog"
"os"
"testing"
"github.com/jackc/pgx/v5/pgxpool"
"git.fabledsword.com/bvandeusen/minstrel/internal/db"
"git.fabledsword.com/bvandeusen/minstrel/internal/dbtest"
"git.fabledsword.com/bvandeusen/minstrel/internal/secret"
)
func newPool(t *testing.T) *pgxpool.Pool {
t.Helper()
if testing.Short() {
t.Skip("skipping integration test in -short mode")
}
dsn := os.Getenv("MINSTREL_TEST_DATABASE_URL")
if dsn == "" {
t.Skip("MINSTREL_TEST_DATABASE_URL not set")
}
if err := db.Migrate(dsn, slog.New(slog.NewTextHandler(io.Discard, nil))); err != nil {
t.Fatalf("migrate: %v", err)
}
pool, err := pgxpool.New(context.Background(), dsn)
if err != nil {
t.Fatalf("pool: %v", err)
}
t.Cleanup(pool.Close)
dbtest.ResetDB(t, pool)
return pool
}
func TestStore_AddsConfiguresAndRemoves_Integration(t *testing.T) {
ctx := context.Background()
s := NewStore(newPool(t))
first, err := s.Create(ctx, ProtocolExchange)
if err != nil {
t.Fatalf("create: %v", err)
}
second, err := s.Create(ctx, ProtocolExchange)
if err != nil {
t.Fatalf("create a second: %v", err)
}
if first.Code != "exchange" || second.Code != "exchange-2" || second.Label != "FabledExchange 2" {
t.Errorf("codes = %q, %q (%q); want exchange, exchange-2", first.Code, second.Code, second.Label)
}
// A new exchange is off, does every job, files under minstrel and is
// unpaced.
if first.Enabled || first.Kind != KindDownload || !first.ServesSearch || !first.ServesDownloads ||
!first.ServesEnrichment || first.Category != DefaultCategory || first.SearchesPerHour != 0 || first.LocalPath != "/downloads" {
t.Errorf("a new exchange = %+v", first)
}
if _, err := s.Create(ctx, "transmission"); !errors.As(err, new(*InvalidError)) {
t.Errorf("an unknown protocol: err = %v", err)
}
u := Update{
Label: "Exchange", Enabled: true, BaseURL: "http://exchange:8080", Category: "minstrel",
TimeoutMs: 20000, ServesSearch: true, LocalPath: "/downloads", RemotePath: "/data/torrents",
}
saved, err := s.Save(ctx, first.Code, u)
if err != nil {
t.Fatalf("save: %v", err)
}
if !saved.Enabled || saved.ServesDownloads || saved.RemotePath != "/data/torrents" {
t.Errorf("saved = %+v", saved)
}
if _, err := s.Save(ctx, "nope", u); !errors.Is(err, ErrNotFound) {
t.Errorf("saving a missing row: err = %v", err)
}
// Secrets are write-only: the list says whether one is set, never what.
if err := s.SetAPIKey(ctx, first.Code, " key "); err != nil {
t.Fatalf("set key: %v", err)
}
full, err := s.Get(ctx, first.Code)
if err != nil || full.ApiKey != "key" {
t.Errorf("stored key = %q (err %v), want it trimmed", full.ApiKey, err)
}
// The column holds the key sealed, never the key.
var raw string
if err := s.pool.QueryRow(ctx,
"SELECT api_key FROM acquisition_services WHERE code = $1", first.Code).Scan(&raw); err != nil {
t.Fatalf("read api_key: %v", err)
}
if raw == "key" || !secret.IsSealed(raw) {
t.Errorf("api_key column = %q, want it sealed", raw)
}
rows, err := s.List(ctx)
if err != nil || len(rows) != 2 {
t.Fatalf("list: %d rows, err %v", len(rows), err)
}
for _, r := range rows {
if r.Code == first.Code && !r.HasApiKey {
t.Error("the list should say a key is set")
}
}
// Only the exchange with search switched on is a search source.
srcs, err := Sources(ctx, s.pool)
if err != nil || len(srcs) != 1 || srcs[0].Code != first.Code {
t.Errorf("sources = %+v, err %v; want only the enabled exchange", srcs, err)
}
if err := s.Delete(ctx, second.Code); err != nil {
t.Fatalf("delete: %v", err)
}
if err := s.Delete(ctx, second.Code); !errors.Is(err, ErrNotFound) {
t.Errorf("deleting twice: err = %v", err)
}
}