1. 1//! `PUT /config/bus` keeps the bus's secrets in the secret store, never in a
2. 2//! file (docs/plans/data-architecture-plan.md, M0): the NATS URL goes to the
3. 3//! project config, the credentials JWT and nkey seed to the project secret
4. 4//! scope, GET never returns them, and DELETE removes both.
5. 5
6. 6#![allow(clippy::unwrap_used, clippy::expect_used, clippy::panic)]
7. 7
8. 8use std::path::Path;
9. 9
10. 10use vak_core::Core;
11. 11
12. 12fn files_containing(root: &Path, needle: &str) -> Vec<std::path::PathBuf> {
13. 13 let mut found = Vec::new();
14. 14 let mut stack = vec![root.to_path_buf()];
15. 15 while let Some(dir) = stack.pop() {
16. 16 let Ok(entries) = std::fs::read_dir(&dir) else {
17. 17 continue;
18. 18 };
19. 19 for entry in entries.flatten() {
20. 20 let path = entry.path();
21. 21 if path.is_dir() {
22. 22 stack.push(path);
23. 23 } else if std::fs::read(&path).is_ok_and(|bytes| {
24. 24 bytes
25. 25 .windows(needle.len())
26. 26 .any(|window| window == needle.as_bytes())
27. 27 }) {
28. 28 found.push(path);
29. 29 }
30. 30 }
31. 31 }
32. 32 found
33. 33}
34. 34
35. 35#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
36. 36async fn bus_credentials_never_written_to_a_file() {
37. 37 let isolated = vak_config::paths::isolate_home_for_tests();
38. 38 let dir = tempfile::tempdir().unwrap();
39. 39 let (ws, home) = (dir.path().join("ws"), dir.path().join("home"));
40. 40 std::fs::create_dir_all(&ws).unwrap();
41. 41 let core = Core::new_with_trust(ws.clone(), true).unwrap();
42. 42 core.set_sessions_home(home.clone());
43. 43 let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
44. 44 let addr = listener.local_addr().unwrap();
45. 45 let app = vak_server::router(core.clone());
46. 46 tokio::spawn(async move { axum::serve(listener, app).await.unwrap() });
47. 47 let client = reqwest::Client::new();
48. 48 let base = format!("http://{addr}");
49. 49
50. 50 let jwt = format!("jwt-secret-{}", uuid::Uuid::now_v7().simple());
51. 51 let seed = format!("SUSEED{}", uuid::Uuid::now_v7().simple());
52. 52 let response = client
53. 53 .put(format!("{base}/config/bus"))
54. 54 .json(&serde_json::json!({
55. 55 "nats_url": "nats://127.0.0.1:1",
56. 56 "nats_credentials_jwt": jwt,
57. 57 "nats_nkey_seed": seed,
58. 58 }))
59. 59 .send()
60. 60 .await
61. 61 .unwrap();
62. 62 assert_eq!(response.status(), 200, "{}", response.text().await.unwrap());
63. 63
64. 64 for secret in [&jwt, &seed] {
65. 65 for root in [&ws, &home, &isolated] {
66. 66 assert!(
67. 67 files_containing(root, secret).is_empty(),
68. 68 "a secret was written to a file under {}",
69. 69 root.display()
70. 70 );
71. 71 }
72. 72 }
73. 73 assert_eq!(
74. 74 core.bus_secret(vak_config::BUS_NATS_JWT_VAR),
75. 75 Some(jwt.clone())
76. 76 );
77. 77 assert_eq!(
78. 78 core.bus_secret(vak_config::BUS_NATS_NKEY_SEED_VAR),
79. 79 Some(seed.clone())
80. 80 );
81. 81 let settings = std::fs::read_to_string(ws.join(".vak/config.toml")).unwrap();
82. 82 assert!(settings.contains("nats://127.0.0.1:1"), "{settings}");
83. 83 assert!(!ws.join(".vak/env").exists());
84. 84
85. 85 let shown = client
86. 86 .get(format!("{base}/config/bus"))
87. 87 .send()
88. 88 .await
89. 89 .unwrap()
90. 90 .text()
91. 91 .await
92. 92 .unwrap();
93. 93 assert!(!shown.contains(&jwt) && !shown.contains(&seed), "{shown}");
94. 94
95. 95 let removed = client
96. 96 .delete(format!("{base}/config/bus"))
97. 97 .send()
98. 98 .await
99. 99 .unwrap();
100. 100 assert_eq!(removed.status(), 200);
101. 101 assert_eq!(core.bus_secret(vak_config::BUS_NATS_JWT_VAR), None);
102. 102 assert_eq!(core.bus_secret(vak_config::BUS_NATS_NKEY_SEED_VAR), None);
103. 103 let settings = std::fs::read_to_string(ws.join(".vak/config.toml")).unwrap();
104. 104 assert!(!settings.contains("nats_url"), "{settings}");
105. 105}
106. 106