<?phpnamespace Tests;use App\Feature\Organize\Organizer;use App\Form\ConfirmForm;use App\Form\FolderForm;use App\Form\MainForm;use App\Form\MasterPasswordForm;use App\Form\PropertiesForm;use App\Form\TagsForm;use App\Model\Connection;use App\Model\Keyring;use App\Model\ServerProfile;use App\Model\Session;use JumPHP\Kernel\Engine;use JumPHP\Save\Storage;use JumPHP\Testing\GameTestCase;/** Folders and tags (the Organization views) through the window, and the saved passwords' keyring. */final class OrganizeKeyringTest extends GameTestCase{ private const SECRET = 'Sup3r-Secret!pw'; private MainForm $form; protected function tearDown(): void { // the next tests (XenCenterTest) start with no keyring and no saved server foreach (['servers.json', Keyring::STATE, Keyring::KEY_FILE] as $file) { Engine::get()->storage->delete($file); } Session::$current?->reset(); parent::tearDown(); } private function fresh(array $params = []): MainForm { foreach (['servers.json', Keyring::STATE, Keyring::KEY_FILE] as $file) { Engine::get()->storage->delete($file); } $this->game->start(MainForm::class); /** @var MainForm $form */ $form = $this->game->scene(); $form->session->reset(); $this->game->start(MainForm::class, $params); $this->form = $form; return $form; } private function connectDemo(): Connection { $form = $this->fresh(['connectDemo' => true]); $this->game->run(10); $c = $form->session->connections[0]; self::assertTrue($c->isConnected(), 'the demo pool connects: ' . $c->error); return $c; } private function ref(Connection $c, string $class, string $name): string { return (string)$c->cache->byName($class, $name); } private function until(callable $condition, int $frames = 600): void { for ($i = 0; $i < $frames && !$condition(); $i++) { $this->game->run(1); } self::assertTrue((bool)$condition(), 'still waiting after ' . $frames . ' frames'); } /** XenCenter starting again: the session forgets everything it holds in memory and reads var/ again. */ private function restart(): MainForm { $session = $this->form->session; $session->reset(); (new \ReflectionProperty(Session::class, 'loaded'))->setValue($session, false); $this->game->start(MainForm::class); return $this->form; } // folders and tags -------------------------------------------------------------------------------------------------------- public function testTheFoldersViewShowsTheFoldersOfThePoolAndTheirObjects(): void { $c = $this->connectDemo(); $this->form->click($this->form->navFolders); $this->game->run(2); $ids = $this->form->tree->visibleIds(); foreach (['folder:/Production', 'folder:/Production/Web', 'folder:/Production/Databases', 'folder:/Lab', 'folder:/Archive'] as $folder) { self::assertContains($folder, $ids); } self::assertContains($this->ref($c, 'vm', 'web-01'), $ids); self::assertContains($this->ref($c, 'sr', 'NFS storage'), $ids, 'storage goes in folders too'); self::assertNotContains($this->ref($c, 'vm', 'gitlab'), $ids, 'an object in no folder is not in this view'); $this->form->tree->select('folder:/Production/Web'); $this->game->run(2); self::assertSame('Web', $this->form->banner->text); self::assertSame(['web-01', 'web-02'], array_map(fn ($row) => $row['cells'][0], $this->form->grid->rows), 'the folder page lists what is in it'); $this->game->shot('folders'); } public function testTheTagsViewListsEachTagAndTheObjectsHavingIt(): void { $c = $this->connectDemo(); $this->form->command('view.tags'); $this->game->run(2); $ad = $this->ref($c, 'vm', 'ad-dc01'); $win = $this->ref($c, 'vm', 'test-win11'); $ids = $this->form->tree->visibleIds(); self::assertContains('tag:windows', $ids); self::assertContains('tag:windows|' . $ad, $ids); self::assertContains('tag:test|' . $win, $ids); self::assertContains('tag:windows|' . $win, $ids, 'an object with two tags is under both'); $this->form->tree->select('tag:windows|' . $ad); $this->game->run(2); self::assertSame('ad-dc01', $this->form->banner->text, 'an object under a tag is that object'); self::assertSame([$c, $ad, 'vm'], $this->form->selection()); $this->game->shot('tags'); } public function testTheSearchBoxAlsoMatchesTags(): void { $c = $this->connectDemo(); $this->form->search->text = 'shared-storage'; $this->form->refresh(true); $ids = $this->form->tree->visibleIds(); self::assertContains($this->ref($c, 'sr', 'NFS storage'), $ids); self::assertNotContains($this->ref($c, 'vm', 'web-01'), $ids); $this->form->search->text = ''; $this->form->refresh(true); } public function testAVmIsMovedToANewFolderFromTheRightClick(): void { $c = $this->connectDemo(); $vm = $this->ref($c, 'vm', 'gitlab'); $this->form->tree->select($vm); $this->game->run(2); $this->form->onTreeMenu($this->form->tree, 300, 300); $texts = array_column(array_filter($this->form->tree->popup->items, 'is_array'), 'text'); self::assertContains('Move to Folder…', $texts); self::assertContains('Edit Tags…', $texts); $this->form->command('organize.move', $vm); $this->game->run(1); $dialog = $this->game->scene(); self::assertInstanceOf(FolderForm::class, $dialog); self::assertContains('/Production/Web', $dialog->folders->items); $dialog->click($dialog->value); $dialog->type('Tools/CI'); $this->game->run(1); $this->game->shot('move-dialog'); $dialog->click($dialog->ok); $this->game->run(1); $this->until(fn () => Organizer::folderOf($c->cache, $vm) === '/Tools/CI'); $this->form->command('view.folders'); $this->game->run(20); self::assertContains('folder:/Tools/CI', $this->form->tree->visibleIds()); self::assertContains($vm, $this->form->tree->visibleIds()); } public function testEditTagsAddsAndRemovesTags(): void { $c = $this->connectDemo(); $vm = $this->ref($c, 'vm', 'web-01'); $this->form->command('organize.tags', $vm); $this->game->run(1); $dialog = $this->game->scene(); self::assertInstanceOf(TagsForm::class, $dialog); self::assertSame(['production', 'linux'], $dialog->tags->items); $dialog->click($dialog->newTag); $dialog->type('frontend, nginx'); $dialog->click($dialog->add); $dialog->tags->selected = 1; // linux $dialog->click($dialog->remove); self::assertSame(['production', 'frontend', 'nginx'], $dialog->tags->items); $this->game->run(1); $this->game->shot('tags-dialog'); $dialog->click($dialog->ok); $this->game->run(1); $this->until(fn () => Organizer::tagsOf($c->cache, $vm) === ['production', 'frontend', 'nginx']); } public function testRenamingAFolderMovesItsObjectsAndDeletingOneSendsThemToTheTop(): void { $c = $this->connectDemo(); $web = $this->ref($c, 'vm', 'web-01'); $db = $this->ref($c, 'vm', 'db-primary'); $nfs = $this->ref($c, 'sr', 'NFS storage'); $this->form->command('view.folders'); $this->form->navigate('folder:/Production'); $this->form->command('organize.renameFolder', 'folder:/Production'); $this->game->run(1); $dialog = $this->game->scene(); self::assertInstanceOf(FolderForm::class, $dialog); self::assertSame('Production', $dialog->value->text); $dialog->value->text = 'Prod'; $dialog->click($dialog->ok); $this->game->run(1); $this->until(fn () => Organizer::folderOf($c->cache, $web) === '/Prod/Web' && Organizer::folderOf($c->cache, $db) === '/Prod/Databases' && Organizer::folderOf($c->cache, $nfs) === '/Prod'); $this->form->command('organize.deleteFolder', 'folder:/Prod/Databases'); $this->game->run(1); $confirm = $this->game->scene(); self::assertInstanceOf(ConfirmForm::class, $confirm); $confirm->click($confirm->ok); $this->game->run(1); $this->until(fn () => Organizer::folderOf($c->cache, $db) === ''); self::assertSame('/Prod/Web', Organizer::folderOf($c->cache, $web), 'the other folders stay'); $this->game->run(20); self::assertNotContains('folder:/Prod/Databases', $this->form->tree->visibleIds()); } public function testANewFolderIsKeptEmptyInThePool(): void { $c = $this->connectDemo(); $this->form->command('organize.newFolder', 'folder:/Lab'); $this->game->run(1); $dialog = $this->game->scene(); self::assertInstanceOf(FolderForm::class, $dialog); $dialog->click($dialog->value); $dialog->type("Sandbox\n"); $this->game->run(1); $this->until(fn () => in_array('/Lab/Sandbox', Organizer::emptyFolders($c->cache), true)); self::assertContains('/Archive', Organizer::emptyFolders($c->cache), 'the other empty folders stay'); } public function testThePropertiesDialogChangesTagsAndFolder(): void { $c = $this->connectDemo(); $vm = $this->ref($c, 'vm', 'monitoring'); $this->form->command('object.properties', $vm); $this->game->run(1); $dialog = $this->game->scene(); self::assertInstanceOf(PropertiesForm::class, $dialog); self::assertSame('production', $dialog->tags->text); self::assertSame('(top level)', $dialog->folder->value()); $dialog->tags->text = 'production, metrics'; $dialog->folder->selected = (int)array_search('/Lab', $dialog->folder->items, true); $this->game->run(1); $this->game->shot('properties'); $dialog->click($dialog->ok); $this->game->run(1); $this->until(fn () => Organizer::tagsOf($c->cache, $vm) === ['production', 'metrics'] && Organizer::folderOf($c->cache, $vm) === '/Lab'); } // the keyring ------------------------------------------------------------------------------------------------------------- public function testEveryCipherSealsAndOpensAndRefusesATamperedTextOrAnotherKey(): void { foreach (Keyring::CIPHERS as $cipher) { if (($cipher === 'sodium' && !function_exists('sodium_crypto_secretbox')) || ($cipher === 'gcm' && !function_exists('openssl_encrypt'))) { continue; } $dir = sys_get_temp_dir() . '/kr-' . bin2hex(random_bytes(4)); @mkdir($dir); $keyring = new Keyring(new Storage($dir), $cipher); $sealed = (string)$keyring->seal(self::SECRET); self::assertTrue(Keyring::isSealed($sealed), $cipher); self::assertStringNotContainsString(self::SECRET, $sealed); self::assertSame(self::SECRET, $keyring->open($sealed), $cipher); self::assertSame(self::SECRET, (new Keyring(new Storage($dir), $cipher))->open($sealed), "$cipher: the key file is read again"); self::assertSame('0600', substr(sprintf('%o', fileperms($dir . '/' . Keyring::KEY_FILE)), -4), 'the key file is private'); $raw = (string)base64_decode(substr($sealed, (int)strpos($sealed, ':') + 1)); $raw[strlen($raw) - 1] = chr(ord($raw[strlen($raw) - 1]) ^ 1); self::assertNull($keyring->open(substr($sealed, 0, (int)strpos($sealed, ':') + 1) . base64_encode($raw)), "$cipher: a changed text is refused"); $other = sys_get_temp_dir() . '/kr-' . bin2hex(random_bytes(4)); @mkdir($other); $stranger = new Keyring(new Storage($other), $cipher); $stranger->seal('x'); self::assertNull($stranger->open($sealed), "$cipher: another key opens nothing"); } } public function testAWrongMasterPasswordIsRefusedAndTheRightOneOpens(): void { foreach (['sodium', 'hmac'] as $cipher) { if ($cipher === 'sodium' && !function_exists('sodium_crypto_pwhash')) { continue; } $dir = sys_get_temp_dir() . '/kr-' . bin2hex(random_bytes(4)); @mkdir($dir); $keyring = new Keyring(new Storage($dir), $cipher); $keyring->setMaster('correct horse'); $sealed = (string)$keyring->seal(self::SECRET); self::assertFileDoesNotExist($dir . '/' . Keyring::KEY_FILE, 'no random key with a master password'); $again = new Keyring(new Storage($dir), $cipher); self::assertTrue($again->hasMaster()); self::assertFalse($again->isUnlocked()); self::assertNull($again->open($sealed), 'locked'); self::assertFalse($again->unlock('wrong horse')); self::assertFalse($again->isUnlocked()); self::assertTrue($again->unlock('correct horse')); self::assertSame(self::SECRET, $again->open($sealed)); self::assertStringNotContainsString('correct horse', (string)file_get_contents($dir . '/' . Keyring::STATE)); } } public function testAServersFileWithClearPasswordsIsRewrittenSealed(): void { $this->fresh(); $storage = Engine::get()->storage; $storage->writeJson('servers.json', [['host' => '10.9.9.9', 'user' => 'root', 'password' => self::SECRET, 'method' => 'http', 'remember' => true]]); $form = $this->restart(); self::assertSame(self::SECRET, $form->session->connections[0]->profile->password, 'still usable'); $raw = (string)$storage->read('servers.json'); self::assertStringNotContainsString(self::SECRET, $raw, 'no clear password left in servers.json'); self::assertStringNotContainsString('"password"', $raw); self::assertTrue(Keyring::isSealed((string)$storage->readJson('servers.json')[0]['secret'])); self::assertTrue($storage->exists(Keyring::KEY_FILE), 'sealed with the random key of var/keyring.key'); $form = $this->restart(); self::assertSame(self::SECRET, $form->session->connections[0]->profile->password, 'opened again at the next start'); } public function testTheMasterPasswordIsAskedAtStartAWrongOneIsRefusedAndTheServersReconnect(): void { $this->connectDemo(); $this->form->session->add(new ServerProfile('10.9.9.9', 'root', self::SECRET, 'http', 0, true)); $this->form->command('tools.masterPassword'); $this->game->run(1); $dialog = $this->game->scene(); self::assertInstanceOf(MasterPasswordForm::class, $dialog); self::assertFalse($dialog->currentPanel->visible, 'no master password yet'); self::assertStringContainsString('casual reading', $dialog->note->text); $dialog->click($dialog->newPassword); $dialog->type('open sesame'); $dialog->click($dialog->confirm); $dialog->type('open sesam'); $dialog->click($dialog->ok); self::assertSame('The two new passwords are not the same.', $dialog->error->text); $dialog->click($dialog->confirm); $dialog->type("open sesame\n"); $this->game->run(1); self::assertSame($this->form, $this->game->scene()); $storage = Engine::get()->storage; self::assertStringNotContainsString(self::SECRET, (string)$storage->read('servers.json')); self::assertTrue($this->form->session->keyring()->hasMaster()); // XenCenter starts again: the master password is asked before the saved servers reconnect $form = $this->restart(); $ask = $this->game->scene(); self::assertInstanceOf(MasterPasswordForm::class, $ask); self::assertSame('Unlock', $ask->ok->text); self::assertSame(Connection::DISCONNECTED, $form->session->connections[0]->state, 'not reconnected while locked'); $ask->click($ask->current); $ask->type("wrong\n"); self::assertStringContainsString('wrong', $ask->error->text); self::assertSame('', $ask->current->text, 'the field is emptied'); self::assertSame($ask, $this->game->scene(), 'asked again'); $this->game->run(1); $this->game->shot('master-wrong'); $ask->click($ask->current); $ask->type("open sesame\n"); $this->game->run(1); self::assertSame($form, $this->game->scene()); self::assertSame(self::SECRET, $form->session->connections[1]->profile->password); $this->until(fn () => $form->session->connections[0]->isConnected()); // and once more: Forget Saved Passwords $form = $this->restart(); $ask = $this->game->scene(); self::assertInstanceOf(MasterPasswordForm::class, $ask); $ask->click($ask->forget); $this->game->run(1); self::assertSame($form, $this->game->scene()); self::assertFalse($storage->exists(Keyring::STATE)); self::assertSame('', $form->session->connections[1]->profile->password); self::assertSame('', $storage->readJson('servers.json')[1]['secret'], 'nothing kept for it'); }}