Harden production workflows and agent admission

agent/internal/agentkey/agentkey_test.go

@@ -0,0 +1,75 @@
+package agentkey
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadOrCreatePersistsKey(t *testing.T) {
+	dir := t.TempDir()
+	k1, err := LoadOrCreate(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	k2, err := LoadOrCreate(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if k1 != k2 {
+		t.Fatal("key was not persisted")
+	}
+	if len(k1) != keyLen {
+		t.Fatalf("unexpected key length %d", len(k1))
+	}
+	info, err := os.Stat(filepath.Join(dir, fileName))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Fatalf("unexpected key mode %o", got)
+	}
+}
+
+func TestLoadOrCreateRejectsInvalidExistingKey(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, fileName), []byte("bad\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadOrCreate(dir); err == nil {
+		t.Fatal("expected invalid key error")
+	}
+}
+
+func TestLoadOrCreateRejectsInvalidHexExistingKey(t *testing.T) {
+	dir := t.TempDir()
+	if err := os.WriteFile(filepath.Join(dir, fileName), []byte("zzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := LoadOrCreate(dir); err == nil {
+		t.Fatal("expected invalid key error")
+	}
+}
+
+func TestLoadOrCreateRepairsKeyPermissions(t *testing.T) {
+	dir := t.TempDir()
+	key := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	path := filepath.Join(dir, fileName)
+	if err := os.WriteFile(path, []byte(key+"\n"), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	got, err := LoadOrCreate(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got != key {
+		t.Fatalf("unexpected key %q", got)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != 0o600 {
+		t.Fatalf("unexpected key mode %o", got)
+	}
+}