From c9a189a18e8c86b631dd2fbecc53f7b2a81cb367 Mon Sep 17 00:00:00 2001 From: Louis Ruch Date: Thu, 28 Oct 2021 09:45:58 -0700 Subject: [PATCH] test(kms): Add missing tests and fixup some log lines (#1645) --- internal/kms/immutable_fields_test.go | 571 +++++++++++++++++++++++- internal/kms/repository_database_key.go | 2 +- internal/kms/repository_oidc_key.go | 2 +- internal/kms/testing.go | 2 +- 4 files changed, 568 insertions(+), 9 deletions(-) diff --git a/internal/kms/immutable_fields_test.go b/internal/kms/immutable_fields_test.go index 4662c3fa9..12f38ed09 100644 --- a/internal/kms/immutable_fields_test.go +++ b/internal/kms/immutable_fields_test.go @@ -14,12 +14,503 @@ import ( "google.golang.org/protobuf/types/known/timestamppb" ) -// TODO (jimlambrt 8/2020) define tests for immutable fields in the remaining -// kms tables: -// kms_oplog_key -// kms_oplog_key_version -// kms_session_key -// kms_session_key_version +func TestOplogKey_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocOplogKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + new := kms.TestOplogKey(t, conn, rk.PrivateId) + + tests := []struct { + name string + update *kms.OplogKey + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.OplogKey { + k := new.Clone().(*kms.OplogKey) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.OplogKey { + k := new.Clone().(*kms.OplogKey) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "root_key_id", + update: func() *kms.OplogKey { + k := new.Clone().(*kms.OplogKey) + k.RootKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"ScopeId"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.OplogKey), after.(*kms.OplogKey))) + }) + } +} + +func TestOplogKeyVersion_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestOplogKey(t, conn, rk.PrivateId) + new := kms.TestOplogKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("oplog key")) + + tests := []struct { + name string + update *kms.OplogKeyVersion + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.OplogKeyVersion { + k := new.Clone().(*kms.OplogKeyVersion) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.OplogKeyVersion { + k := new.Clone().(*kms.OplogKeyVersion) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "oplog_key_id", + update: func() *kms.OplogKeyVersion { + k := new.Clone().(*kms.OplogKeyVersion) + k.OplogKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "root_key_version_id", + update: func() *kms.OplogKeyVersion { + k := new.Clone().(*kms.OplogKeyVersion) + k.RootKeyVersionId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "version", + update: func() *kms.OplogKeyVersion { + k := new.Clone().(*kms.OplogKeyVersion) + k.Version = uint32(22) + return k + }(), + fieldMask: []string{"Version"}, + }, + { + name: "key", + update: func() *kms.OplogKeyVersion { + k := new.Clone().(*kms.OplogKeyVersion) + k.Key = []byte("updated key") + return k + }(), + fieldMask: []string{"CtKey"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + err = tt.update.Encrypt(context.Background(), wrapper) + require.NoError(err) + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.OplogKeyVersion), after.(*kms.OplogKeyVersion))) + }) + } +} + +func TestTokenKey_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocTokenKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + new := kms.TestTokenKey(t, conn, rk.PrivateId) + + tests := []struct { + name string + update *kms.TokenKey + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.TokenKey { + k := new.Clone().(*kms.TokenKey) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.TokenKey { + k := new.Clone().(*kms.TokenKey) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "root_key_id", + update: func() *kms.TokenKey { + k := new.Clone().(*kms.TokenKey) + k.RootKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"ScopeId"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.TokenKey), after.(*kms.TokenKey))) + }) + } +} + +func TestTokenKeyVersion_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestTokenKey(t, conn, rk.PrivateId) + new := kms.TestTokenKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("token key")) + + tests := []struct { + name string + update *kms.TokenKeyVersion + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.TokenKeyVersion { + k := new.Clone().(*kms.TokenKeyVersion) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.TokenKeyVersion { + k := new.Clone().(*kms.TokenKeyVersion) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "token_key_id", + update: func() *kms.TokenKeyVersion { + k := new.Clone().(*kms.TokenKeyVersion) + k.TokenKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "root_key_version_id", + update: func() *kms.TokenKeyVersion { + k := new.Clone().(*kms.TokenKeyVersion) + k.RootKeyVersionId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "version", + update: func() *kms.TokenKeyVersion { + k := new.Clone().(*kms.TokenKeyVersion) + k.Version = uint32(22) + return k + }(), + fieldMask: []string{"Version"}, + }, + { + name: "key", + update: func() *kms.TokenKeyVersion { + k := new.Clone().(*kms.TokenKeyVersion) + k.Key = []byte("updated key") + return k + }(), + fieldMask: []string{"CtKey"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + err = tt.update.Encrypt(context.Background(), wrapper) + require.NoError(err) + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.TokenKeyVersion), after.(*kms.TokenKeyVersion))) + }) + } +} + +func TestSessionKey_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocSessionKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + new := kms.TestSessionKey(t, conn, rk.PrivateId) + + tests := []struct { + name string + update *kms.SessionKey + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.SessionKey { + k := new.Clone().(*kms.SessionKey) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.SessionKey { + k := new.Clone().(*kms.SessionKey) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "root_key_id", + update: func() *kms.SessionKey { + k := new.Clone().(*kms.SessionKey) + k.RootKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"ScopeId"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.SessionKey), after.(*kms.SessionKey))) + }) + } +} + +func TestSessionKeyVersion_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + wrapper := db.TestWrapper(t) + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + _, rkvWrapper := kms.TestRootKeyVersion(t, conn, wrapper, rk.PrivateId) + dk := kms.TestSessionKey(t, conn, rk.PrivateId) + new := kms.TestSessionKeyVersion(t, conn, rkvWrapper, dk.PrivateId, []byte("session key")) + + tests := []struct { + name string + update *kms.SessionKeyVersion + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.SessionKeyVersion { + k := new.Clone().(*kms.SessionKeyVersion) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.SessionKeyVersion { + k := new.Clone().(*kms.SessionKeyVersion) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "Session_key_id", + update: func() *kms.SessionKeyVersion { + k := new.Clone().(*kms.SessionKeyVersion) + k.SessionKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "root_key_version_id", + update: func() *kms.SessionKeyVersion { + k := new.Clone().(*kms.SessionKeyVersion) + k.RootKeyVersionId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"RootKeyId"}, + }, + { + name: "version", + update: func() *kms.SessionKeyVersion { + k := new.Clone().(*kms.SessionKeyVersion) + k.Version = uint32(22) + return k + }(), + fieldMask: []string{"Version"}, + }, + { + name: "key", + update: func() *kms.SessionKeyVersion { + k := new.Clone().(*kms.SessionKeyVersion) + k.Key = []byte("updated key") + return k + }(), + fieldMask: []string{"CtKey"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + err = tt.update.Encrypt(context.Background(), wrapper) + require.NoError(err) + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.SessionKeyVersion), after.(*kms.SessionKeyVersion))) + }) + } +} func TestRootKeyVersion_ImmutableFields(t *testing.T) { t.Parallel() @@ -341,6 +832,74 @@ func TestDatabaseKeyVersion_ImmutableFields(t *testing.T) { } } +func TestOidcKey_ImmutableFields(t *testing.T) { + t.Parallel() + conn, _ := db.TestSetup(t, "postgres") + rw := db.New(conn) + + ts := timestamp.Timestamp{Timestamp: ×tamppb.Timestamp{Seconds: 0, Nanos: 0}} + + wrapper := db.TestWrapper(t) + org, _ := iam.TestScopes(t, iam.TestRepo(t, conn, wrapper)) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocRootKey()).Error) + require.NoError(t, conn.Where("1=1").Delete(kms.AllocOidcKey()).Error) + rk := kms.TestRootKey(t, conn, org.PublicId) + new := kms.TestOidcKey(t, conn, rk.PrivateId) + + tests := []struct { + name string + update *kms.OidcKey + fieldMask []string + }{ + { + name: "private_id", + update: func() *kms.OidcKey { + k := new.Clone().(*kms.OidcKey) + k.PrivateId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"PrivateId"}, + }, + { + name: "create time", + update: func() *kms.OidcKey { + k := new.Clone().(*kms.OidcKey) + k.CreateTime = &ts + return k + }(), + fieldMask: []string{"CreateTime"}, + }, + { + name: "root_key_id", + update: func() *kms.OidcKey { + k := new.Clone().(*kms.OidcKey) + k.RootKeyId = "o_thisIsNotAValidId" + return k + }(), + fieldMask: []string{"ScopeId"}, + }, + } + for _, tt := range tests { + tt := tt + t.Run(tt.name, func(t *testing.T) { + assert, require := assert.New(t), require.New(t) + orig := new.Clone() + err := rw.LookupById(context.Background(), orig) + require.NoError(err) + + rowsUpdated, err := rw.Update(context.Background(), tt.update, tt.fieldMask, nil, db.WithSkipVetForWrite(true)) + require.Error(err) + assert.Equal(0, rowsUpdated) + + after := new.Clone() + err = rw.LookupById(context.Background(), after) + require.NoError(err) + + assert.True(proto.Equal(orig.(*kms.OidcKey), after.(*kms.OidcKey))) + }) + } +} + func TestOidcKeyVersion_ImmutableFields(t *testing.T) { t.Parallel() conn, _ := db.TestSetup(t, "postgres") diff --git a/internal/kms/repository_database_key.go b/internal/kms/repository_database_key.go index f9a27f405..94565b82c 100644 --- a/internal/kms/repository_database_key.go +++ b/internal/kms/repository_database_key.go @@ -110,7 +110,7 @@ func (r *Repository) LookupDatabaseKey(ctx context.Context, privateId string, _ // repository returning a count of the number of records deleted. All options // are ignored. func (r *Repository) DeleteDatabaseKey(ctx context.Context, privateId string, _ ...Option) (int, error) { - const op = "kms.(Repository).LookupDatabaseKey" + const op = "kms.(Repository).DeleteDatabaseKey" if privateId == "" { return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing private id") } diff --git a/internal/kms/repository_oidc_key.go b/internal/kms/repository_oidc_key.go index b43676ec5..892532401 100644 --- a/internal/kms/repository_oidc_key.go +++ b/internal/kms/repository_oidc_key.go @@ -110,7 +110,7 @@ func (r *Repository) LookupOidcKey(ctx context.Context, privateId string, _ ...O // repository returning a count of the number of records deleted. All options // are ignored. func (r *Repository) DeleteOidcKey(ctx context.Context, privateId string, _ ...Option) (int, error) { - const op = "kms.(Repository).LookupOidcKey" + const op = "kms.(Repository).DeleteOidcKey" if privateId == "" { return db.NoRowsAffected, errors.New(ctx, errors.InvalidParameter, op, "missing private id") } diff --git a/internal/kms/testing.go b/internal/kms/testing.go index 37ec6da7e..2eae274e2 100644 --- a/internal/kms/testing.go +++ b/internal/kms/testing.go @@ -220,7 +220,7 @@ func TestOidcKeyVersion(t *testing.T, conn *db.DB, rootKeyVersionWrapper wrappin require.NotEmpty(rootKeyVersionId) k, err := NewOidcKeyVersion(oidcKeyId, key, rootKeyVersionId) require.NoError(err) - id, err := newDatabaseKeyVersionId() + id, err := newOidcKeyVersionId() require.NoError(err) k.PrivateId = id err = k.Encrypt(context.Background(), rootKeyVersionWrapper)