feat: add cluster token encryption

2026-06-11 08:39:30 +02:00
parent 452d4c5f71
commit 82600bdf82
10 changed files with 542 additions and 0 deletions
@@ -0,0 +1,126 @@
+package cluster
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"testing"
+	"time"
+
+	"proxui/backend/internal/encryption"
+)
+
+func TestRepositoryEncryptsStoredTokenAndDecryptsOnLoad(t *testing.T) {
+	cipher := testCipher(t, 1)
+	storage := newMemoryStorage()
+	repository := NewRepositoryWithStorage(storage, cipher)
+
+	saved, err := repository.UpsertCluster(context.Background(), Cluster{
+		ID:             "cluster-1",
+		Name:           "Lab",
+		APIEndpoint:    "https://pve.example.test:8006",
+		TLSFingerprint: "AA:BB",
+		TokenID:        "root@pam!proxui",
+		TokenSecret:    "secret-token",
+	})
+	if err != nil {
+		t.Fatalf("UpsertCluster() error = %v", err)
+	}
+
+	stored := storage.records[saved.ID]
+	if bytes.Contains(stored.EncryptedToken, []byte("secret-token")) {
+		t.Fatal("stored encrypted token contains plaintext")
+	}
+
+	got, found, err := repository.GetCluster(context.Background(), saved.ID)
+	if err != nil {
+		t.Fatalf("GetCluster() error = %v", err)
+	}
+	if !found {
+		t.Fatal("GetCluster() found = false, want true")
+	}
+	if got.TokenSecret != "secret-token" {
+		t.Fatalf("TokenSecret = %q, want secret-token", got.TokenSecret)
+	}
+	if got.TokenID != "root@pam!proxui" {
+		t.Fatalf("TokenID = %q, want root@pam!proxui", got.TokenID)
+	}
+}
+
+func TestRepositoryRejectsMissingTokenSecret(t *testing.T) {
+	repository := NewRepositoryWithStorage(newMemoryStorage(), testCipher(t, 1))
+
+	_, err := repository.UpsertCluster(context.Background(), Cluster{
+		ID:          "cluster-1",
+		Name:        "Lab",
+		APIEndpoint: "https://pve.example.test:8006",
+		TokenID:     "root@pam!proxui",
+	})
+	if err == nil {
+		t.Fatal("UpsertCluster() error = nil, want error")
+	}
+}
+
+func TestRepositoryReturnsErrorWhenStoredTokenUsesWrongKey(t *testing.T) {
+	storage := newMemoryStorage()
+	writer := NewRepositoryWithStorage(storage, testCipher(t, 1))
+	reader := NewRepositoryWithStorage(storage, testCipher(t, 2))
+
+	saved, err := writer.UpsertCluster(context.Background(), Cluster{
+		ID:             "cluster-1",
+		Name:           "Lab",
+		APIEndpoint:    "https://pve.example.test:8006",
+		TLSFingerprint: "AA:BB",
+		TokenID:        "root@pam!proxui",
+		TokenSecret:    "secret-token",
+	})
+	if err != nil {
+		t.Fatalf("UpsertCluster() error = %v", err)
+	}
+
+	if _, _, err := reader.GetCluster(context.Background(), saved.ID); err == nil {
+		t.Fatal("GetCluster() error = nil, want error")
+	}
+}
+
+func testCipher(t *testing.T, value byte) encryption.Cipher {
+	t.Helper()
+
+	cipher, err := encryption.New(bytes.Repeat([]byte{value}, 32))
+	if err != nil {
+		t.Fatalf("encryption.New() error = %v", err)
+	}
+	return cipher
+}
+
+type memoryStorage struct {
+	records map[string]StoredCluster
+	nextID  int
+}
+
+func newMemoryStorage() *memoryStorage {
+	return &memoryStorage{
+		records: make(map[string]StoredCluster),
+	}
+}
+
+func (s *memoryStorage) Get(_ context.Context, id string) (StoredCluster, bool, error) {
+	cluster, ok := s.records[id]
+	return cluster, ok, nil
+}
+
+func (s *memoryStorage) Upsert(_ context.Context, cluster StoredCluster) (StoredCluster, error) {
+	if cluster.ID == "" {
+		s.nextID++
+		cluster.ID = fmt.Sprintf("cluster-%d", s.nextID)
+	}
+	if cluster.Status == "" {
+		cluster.Status = "active"
+	}
+	if cluster.CreatedAt.IsZero() {
+		cluster.CreatedAt = time.Now()
+	}
+
+	s.records[cluster.ID] = cluster
+	return cluster, nil
+}