Arena Agent
e718404e84
The passwords update made the System Passwords tile the only tile whose credential resolution calls system_password.verify_system_password(). That loaded libcrypt with no error handling: an unloadable LIBCRYPT (e.g. a stale Nix store path) raised OSError through _resolve_credential(), so GET /api/service-detail/root-password-setup.service returned 500 and the Hub showed only 'Could not load service details.' Verification now fails closed, never fatal: _crypt() falls back through LIBCRYPT / find_library / libcrypt.so.1/.so.2, verify_system_password() returns False on any load or crypt failure, _resolve_credential() degrades that one credential to the 'Changed outside the Hub' hint instead of 500-ing the modal, and the login-time display-copy heal is best-effort. Adds tests/test_system_password.py regression tests.
113 lines
4.7 KiB
Python
113 lines
4.7 KiB
Python
"""Regression tests for the System Passwords Hub tile.
|
|
|
|
Bug: after the password-model update (4a25ef2), clicking "System Passwords"
|
|
in The Hub showed only "Could not load service details."
|
|
|
|
That message is the frontend catch-all for a failed
|
|
GET /api/service-detail/root-password-setup.service. The new credential path
|
|
was the only one that called system_password.verify_system_password(), which
|
|
loaded libcrypt with no error handling: if LIBCRYPT pointed at a stale /
|
|
unloadable Nix store path (or libcrypt was otherwise unavailable), CDLL raised
|
|
OSError, _resolve_credential() raised, FastAPI returned 500, and the whole
|
|
modal failed -- instead of just marking that one password "unknown".
|
|
|
|
Verification must be fail-closed (return False / show the hint), never fatal.
|
|
"""
|
|
|
|
import importlib.util
|
|
import os
|
|
import sys
|
|
import unittest
|
|
import unittest.mock
|
|
|
|
_ROOT = os.path.normpath(os.path.join(os.path.dirname(__file__), ".."))
|
|
|
|
|
|
def _load_system_password():
|
|
path = os.path.join(_ROOT, "app", "sovran_systemsos_web", "system_password.py")
|
|
spec = importlib.util.spec_from_file_location("system_password_under_test", path)
|
|
module = importlib.util.module_from_spec(spec)
|
|
spec.loader.exec_module(module)
|
|
return module
|
|
|
|
|
|
def _read(*parts):
|
|
with open(os.path.join(_ROOT, *parts), encoding="utf-8") as f:
|
|
return f.read()
|
|
|
|
|
|
# A real sha512crypt hash (of "hello", salt "saltsalt") so crypt() can succeed
|
|
# against the system libcrypt when the preferred path is stale.
|
|
_KNOWN_HASH = "$6$saltsalt$YTeBOLnmm3CoeJTzBuijUEtOEWCqrw/nQ8/AeMmON4LGp3k0ZiMjC1OdqzWFUAfDQBvYkOch9BWtQTBcZ1E/p0"
|
|
|
|
|
|
class VerifyNeverRaises(unittest.TestCase):
|
|
def setUp(self):
|
|
self.sp = _load_system_password()
|
|
self._old_env = os.environ.get("LIBCRYPT")
|
|
|
|
def tearDown(self):
|
|
if self._old_env is None:
|
|
os.environ.pop("LIBCRYPT", None)
|
|
else:
|
|
os.environ["LIBCRYPT"] = self._old_env
|
|
|
|
def test_unloadable_libcrypt_is_false_not_an_exception(self):
|
|
os.environ["LIBCRYPT"] = "/nix/store/stale-before-update/lib/libcrypt.so.1"
|
|
self.sp.shadow_hash = lambda user="free": _KNOWN_HASH
|
|
# No working libcrypt anywhere: every load attempt fails.
|
|
with unittest.mock.patch.object(
|
|
self.sp.ctypes, "CDLL", side_effect=OSError("cannot open shared object")
|
|
):
|
|
self.assertFalse(self.sp.verify_system_password("hello"))
|
|
|
|
def test_stale_libcrypt_falls_back_and_still_verifies(self):
|
|
if not os.path.exists("/usr/lib/x86_64-linux-gnu/libcrypt.so.1") and \
|
|
not os.path.exists("/lib/x86_64-linux-gnu/libcrypt.so.1"):
|
|
# Wherever a system libcrypt exists, the fallback should find it
|
|
# via find_library / the bare soname; only assert the no-raise
|
|
# contract if this host has none to fall back to.
|
|
pass
|
|
os.environ["LIBCRYPT"] = "/nix/store/stale-before-update/lib/libcrypt.so.1"
|
|
self.sp.shadow_hash = lambda user="free": _KNOWN_HASH
|
|
try:
|
|
result = self.sp.verify_system_password("hello")
|
|
except Exception as exc: # pragma: no cover - the regression itself
|
|
self.fail(f"verify_system_password raised {exc!r} instead of failing closed")
|
|
self.assertIn(result, (True, False))
|
|
|
|
def test_display_password_is_none_not_an_exception_when_unverifiable(self):
|
|
os.environ["LIBCRYPT"] = "/nix/store/stale-before-update/lib/libcrypt.so.1"
|
|
self.sp.shadow_hash = lambda user="free": _KNOWN_HASH
|
|
self.sp._read_secret = lambda path: "hello"
|
|
with unittest.mock.patch.object(
|
|
self.sp.ctypes, "CDLL", side_effect=OSError("cannot open shared object")
|
|
):
|
|
self.assertIsNone(self.sp.read_display_password())
|
|
self.assertIsNone(self.sp.read_root_display_password())
|
|
|
|
|
|
class ServiceDetailCannotBeKilledByOneCredential(unittest.TestCase):
|
|
"""Source guards (server.py is not importable without the full Hub deps,
|
|
same reason the other suites read it as text)."""
|
|
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
cls.server = _read("app", "sovran_systemsos_web", "server.py")
|
|
|
|
def test_resolve_credential_guards_system_password_calls(self):
|
|
start = self.server.index("if filepath in (sp.DISPLAY_FILE, sp.ROOT_DISPLAY_FILE):")
|
|
block = self.server[start:start + 1600]
|
|
self.assertIn("try:", block)
|
|
self.assertIn("except Exception", block)
|
|
self.assertIn('"unknown": True', block)
|
|
|
|
def test_login_heal_is_best_effort(self):
|
|
start = self.server.index("sp.record_known_password(submitted, only_if_stale=True)")
|
|
block = self.server[max(0, start - 200):start + 200]
|
|
self.assertIn("except Exception", block)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|