Full web : clusters gérés dans l'UI, primaire et cibles, comptes pve

internal/config/config_test.go

@@ -1,44 +1,38 @@
 package config
 
 import (
-	"os"
-	"path/filepath"
+	"strings"
 	"testing"
 
 	"pve-confsync/internal/adapter"
 	"pve-confsync/internal/model"
 )
 
-func TestLoadExample(t *testing.T) {
-	c, err := Load(filepath.Join("..", "..", "examples", "confsync.example.yaml"))
-	if err != nil {
-		t.Fatal(err)
+func TestValidate(t *testing.T) {
+	c := &Config{
+		Reference: Cluster{Name: "ref"},
+		Clients:   []Client{{Cluster: Cluster{Name: "ref"}}},
+		Kinds:     []model.Kind{model.KindPassword},
+		Policies:  map[model.Kind]map[string]adapter.Policy{model.KindDatacenter: {"u2f": adapter.Sync, "x": "bogus"}},
 	}
-	a, _ := adapter.ByKind(model.KindZone)
-	cl, _ := c.Client("site-a")
-	if p := c.Policy(cl, a, "mtu"); p != adapter.Ignore {
-		t.Fatalf("site-a mtu policy = %s", p)
+	err := c.Validate()
+	if err == nil {
+		t.Fatal("expected errors")
 	}
-	if p := c.Policy(nil, a, "bridge"); p != adapter.Override {
-		t.Fatalf("bridge policy = %s", p)
-	}
-	if c.Selected(model.KindZone, "lab1") || !c.Selected(model.KindZone, "vlanz") {
-		t.Fatal("selection")
-	}
-}
-
-func TestRejects(t *testing.T) {
-	for name, body := range map[string]string{
-		"clear secret": "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret: s}\n",
-		"no secret":    "reference: {name: r, url: https://x, token_id: a@pve!b}\n",
-		"forbidden":    "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret_env: X}\npolicies: {datacenter-options: {webauthn: sync}}\n",
-		"bad policy":   "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret_env: X}\npolicies: {sdn-zone: {mtu: copy}}\n",
-		"unknown kind": "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret_env: X}\nkinds: [firewall]\n",
-	} {
-		f := filepath.Join(t.TempDir(), "c.yaml")
-		_ = os.WriteFile(f, []byte(body), 0o600)
-		if _, err := Load(f); err == nil {
-			t.Errorf("%s: expected an error", name)
+	for _, want := range []string{"duplicate name", "cannot be synchronized", "unknown policy", "pve-password needs pve-user"} {
+		if !strings.Contains(err.Error(), want) {
+			t.Errorf("missing %q in %v", want, err)
 		}
 	}
 }
+
+func TestSSHOptions(t *testing.T) {
+	cl := Cluster{URL: "https://pve1.lab:8006", Password: "p"}
+	if o := cl.SSHOptions(); o.Host != "pve1.lab" || o.User != "root" {
+		t.Fatalf("%+v", o)
+	}
+	cl.SSHHost = "10.0.0.1"
+	if o := cl.SSHOptions(); o.Host != "10.0.0.1" {
+		t.Fatalf("%+v", o)
+	}
+}

internal/service/check_test.go

@@ -0,0 +1,39 @@
+package service
+
+import (
+	"context"
+	"crypto/ed25519"
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/hex"
+	"strings"
+	"testing"
+
+	"golang.org/x/crypto/ssh"
+
+	"pve-confsync/internal/config"
+	"pve-confsync/internal/pve/pvetest"
+)
+
+// A node that presents another SSH host key than the recorded one is refused,
+// until the new key is explicitly trusted.
+func TestCheckSSHHostKeyMismatch(t *testing.T) {
+	s := pvetest.New("9.1.4")
+	defer s.Close()
+	pub, _, _ := ed25519.GenerateKey(rand.Reader)
+	other, _ := ssh.NewPublicKey(pub)
+	sum := sha256.Sum256(s.Certificate().Raw)
+	host, port := s.SSHAddr()
+	cl := config.Cluster{Name: "c", URL: s.URL, User: "root@pam", Password: pvetest.Password,
+		Fingerprint: hex.EncodeToString(sum[:]), SSHHost: host, SSHPort: port,
+		SSHHostKey: strings.TrimSpace(string(ssh.MarshalAuthorizedKey(other)))}
+
+	res := CheckCluster(context.Background(), cl, false, false)
+	if res.OK || !res.SSHMismatch || !res.API || res.SSHHostKey != "" || !strings.Contains(res.Error, "clé d'hôte") {
+		t.Fatalf("mismatch expected: %+v", res)
+	}
+	res = CheckCluster(context.Background(), cl, false, true)
+	if !res.OK || res.SSHHostKey != s.SSHHostKey() {
+		t.Fatalf("trusted key expected: %+v", res)
+	}
+}