gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-10 02:25:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Align secure runtime lifecycle fixture auth

Browse Source
This commit is contained in:
Richard Courtman
2026-08-31 00:22:22 +01:00
parent f87308fb63
commit b1028a23af
1 changed files with 39 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/installtests/secure_runtime_systemd_lab_test.go
+39 -1
View File
@@ -426,6 +426,21 @@ func (f *secureRuntimeLabFixture) authorized(r *http.Request) bool {
return valid
}
func (f *secureRuntimeLabFixture) collectorLifecycleAuthorized(r *http.Request) bool {
bearer := strings.TrimSpace(r.Header.Get("Authorization"))
legacyHeader := strings.TrimSpace(r.Header.Get("X-API-Token"))
valid := bearer == "Bearer "+secureRuntimeLabToken &&
(legacyHeader == "" || legacyHeader == secureRuntimeLabToken) &&
r.URL.Query().Get("token") == ""
if !valid {
f.mu.Lock()
f.authFailures++
f.requestFailures = append(f.requestFailures, r.Method+" "+r.URL.Path+": invalid collector lifecycle credential transport")
f.mu.Unlock()
}
return valid
}
func (f *secureRuntimeLabFixture) serveArtifact(w http.ResponseWriter, r *http.Request, artifactKind string) {
if r.Method != http.MethodGet && r.Method != http.MethodHead {
http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
@@ -617,7 +632,7 @@ func (f *secureRuntimeLabFixture) handleReport(w http.ResponseWriter, r *http.Re
}
func (f *secureRuntimeLabFixture) handleLookup(w http.ResponseWriter, r *http.Request) {
if !f.authorized(r) {
if !f.collectorLifecycleAuthorized(r) {
http.Error(w, "unauthorized", http.StatusUnauthorized)
return
}
@@ -1048,6 +1063,29 @@ func TestSecureRuntimeFixtureAdmitsCollectorAndRunnerCredentialsSeparately(t *te
}
}
func TestSecureRuntimeFixtureAcceptsBearerOnlyCollectorLifecycleLookup(t *testing.T) {
fixture := newSecureRuntimeLabFixture(nil, "", nil, nil, "fixture")
defer fixture.actionServer.Shutdown()
fixture.mu.Lock()
fixture.lastSeen = time.Now().UTC()
fixture.mu.Unlock()
request := httptest.NewRequest(http.MethodGet, "/api/agents/agent/lookup?agentId="+secureRuntimeLabAgentID, nil)
request.Header.Set("Authorization", "Bearer "+secureRuntimeLabToken)
recorder := httptest.NewRecorder()
fixture.ServeHTTP(recorder, request)
if recorder.Code != http.StatusOK {
t.Fatalf("bearer-only lifecycle lookup status = %d, body=%s", recorder.Code, recorder.Body.String())
}
request = httptest.NewRequest(http.MethodGet, "/api/agents/agent/lookup?agentId="+secureRuntimeLabAgentID, nil)
recorder = httptest.NewRecorder()
fixture.ServeHTTP(recorder, request)
if recorder.Code != http.StatusUnauthorized {
t.Fatalf("unauthenticated lifecycle lookup status = %d, want %d", recorder.Code, http.StatusUnauthorized)
}
}
func TestSecureRuntimeSystemdLab(t *testing.T) {
if os.Getenv(secureRuntimeLabOptIn) != "1" {
t.Skip("set PULSE_SECURE_RUNTIME_SYSTEMD_LAB=1 only inside a disposable systemd VM")