519 lines
19 KiB
C#
519 lines
19 KiB
C#
using EntKube.Secrets.Crypto;
|
|
using EntKube.Secrets.Domain;
|
|
using EntKube.Secrets.Infrastructure;
|
|
using FluentAssertions;
|
|
|
|
namespace EntKube.Secrets.Tests.Domain;
|
|
|
|
/// <summary>
|
|
/// Tests for the multi-tenant Vault aggregate. Each tenant gets their own
|
|
/// master encryption key (MEK) for cryptographic isolation.
|
|
///
|
|
/// The vault manages per-tenant MEKs — initialization, auto-unseal, and
|
|
/// secret operations are all scoped to a specific tenant.
|
|
/// </summary>
|
|
public class VaultTests
|
|
{
|
|
private readonly InMemoryVaultRepository repository = new();
|
|
private readonly byte[] kek = AesGcmEncryptor.GenerateKey();
|
|
private readonly Guid tenantId = Guid.NewGuid();
|
|
|
|
private Vault CreateVault() => new(repository);
|
|
|
|
// ─── Initialization ──────────────────────────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task Initialize_GeneratesMasterKeyAndAutoUnseals()
|
|
{
|
|
// Arrange — A fresh vault backed by an empty repository.
|
|
|
|
Vault vault = CreateVault();
|
|
|
|
// Act — Initialize a tenant with KEK, 5 Shamir shares, threshold of 3.
|
|
|
|
InitializationResult result = await vault.InitializeAsync(tenantId, kek, totalShares: 5, threshold: 3);
|
|
|
|
// Assert — Shares returned for DR, tenant's vault is immediately unsealed.
|
|
|
|
result.Shares.Should().HaveCount(5);
|
|
result.Threshold.Should().Be(3);
|
|
vault.IsTenantInitialized(tenantId).Should().BeTrue();
|
|
vault.IsTenantSealed(tenantId).Should().BeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Initialize_WhenAlreadyInitialized_Fails()
|
|
{
|
|
// A tenant's vault can only be initialized once.
|
|
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 3, threshold: 2);
|
|
|
|
Func<Task> act = () => vault.InitializeAsync(tenantId, kek, totalShares: 3, threshold: 2);
|
|
await act.Should().ThrowAsync<InvalidOperationException>()
|
|
.WithMessage("*already initialized*");
|
|
}
|
|
|
|
// ─── Auto-Unseal (Normal K8s Startup) ────────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task AutoUnseal_WithCorrectKek_UnsealsAllTenants()
|
|
{
|
|
// Arrange — Initialize two tenants, then seal both.
|
|
|
|
Guid tenant1 = Guid.NewGuid();
|
|
Guid tenant2 = Guid.NewGuid();
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenant1, kek, totalShares: 1, threshold: 1);
|
|
await vault.InitializeAsync(tenant2, kek, totalShares: 1, threshold: 1);
|
|
await vault.SealAsync();
|
|
|
|
// Act — A new vault instance auto-unseals all tenants.
|
|
|
|
Vault vault2 = CreateVault();
|
|
await vault2.AutoUnsealAsync(kek);
|
|
|
|
// Assert — Both tenants unsealed.
|
|
|
|
vault2.IsTenantSealed(tenant1).Should().BeFalse();
|
|
vault2.IsTenantSealed(tenant2).Should().BeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task AutoUnseal_WithWrongKek_Fails()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
await vault.SealAsync();
|
|
|
|
byte[] wrongKek = AesGcmEncryptor.GenerateKey();
|
|
Vault vault2 = CreateVault();
|
|
|
|
Func<Task> act = () => vault2.AutoUnsealAsync(wrongKek);
|
|
|
|
await act.Should().ThrowAsync<InvalidOperationException>()
|
|
.WithMessage("*KEK*");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task AutoUnseal_WhenNotInitialized_Fails()
|
|
{
|
|
Vault vault = CreateVault();
|
|
|
|
Func<Task> act = () => vault.AutoUnsealAsync(kek);
|
|
|
|
await act.Should().ThrowAsync<InvalidOperationException>()
|
|
.WithMessage("*not initialized*");
|
|
}
|
|
|
|
// ─── Manual Unseal (Disaster Recovery) ───────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task ManualUnseal_WithEnoughShares_UnsealsVault()
|
|
{
|
|
Vault vault = CreateVault();
|
|
InitializationResult initResult = await vault.InitializeAsync(tenantId, kek, totalShares: 5, threshold: 3);
|
|
await vault.SealAsync(tenantId);
|
|
vault.IsTenantSealed(tenantId).Should().BeTrue();
|
|
|
|
// Act — Provide 3 of 5 shares.
|
|
|
|
await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[0]);
|
|
await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[2]);
|
|
UnsealResult unsealResult = await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[4]);
|
|
|
|
unsealResult.IsUnsealed.Should().BeTrue();
|
|
vault.IsTenantSealed(tenantId).Should().BeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ManualUnseal_WithInsufficientShares_RemainsSealed()
|
|
{
|
|
Vault vault = CreateVault();
|
|
InitializationResult initResult = await vault.InitializeAsync(tenantId, kek, totalShares: 5, threshold: 3);
|
|
await vault.SealAsync(tenantId);
|
|
|
|
UnsealResult result1 = await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[0]);
|
|
UnsealResult result2 = await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[1]);
|
|
|
|
result1.IsUnsealed.Should().BeFalse();
|
|
result1.SharesProvided.Should().Be(1);
|
|
result1.SharesRequired.Should().Be(3);
|
|
|
|
result2.IsUnsealed.Should().BeFalse();
|
|
result2.SharesProvided.Should().Be(2);
|
|
|
|
vault.IsTenantSealed(tenantId).Should().BeTrue();
|
|
}
|
|
|
|
// ─── Multi-Instance (Simulating K8s Pods) ────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task MultiInstance_BothPodsCanAutoUnseal()
|
|
{
|
|
Vault pod1 = CreateVault();
|
|
await pod1.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
Vault pod2 = CreateVault();
|
|
await pod2.AutoUnsealAsync(kek);
|
|
|
|
pod1.IsTenantSealed(tenantId).Should().BeFalse();
|
|
pod2.IsTenantSealed(tenantId).Should().BeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task MultiInstance_SecretWrittenByOnePodReadableByAnother()
|
|
{
|
|
Vault pod1 = CreateVault();
|
|
await pod1.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
Vault pod2 = CreateVault();
|
|
await pod2.AutoUnsealAsync(kek);
|
|
|
|
await pod1.PutSecretAsync(tenantId, "clusters/prod/dns-cred", "cloudflare-api-token");
|
|
|
|
string? value = await pod2.GetSecretAsync(tenantId, "clusters/prod/dns-cred");
|
|
value.Should().Be("cloudflare-api-token");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task MultiInstance_SealingOnePodDoesNotAffectOther()
|
|
{
|
|
Vault pod1 = CreateVault();
|
|
await pod1.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
await pod1.PutSecretAsync(tenantId, "shared/secret", "hello");
|
|
|
|
Vault pod2 = CreateVault();
|
|
await pod2.AutoUnsealAsync(kek);
|
|
|
|
await pod1.SealAsync(tenantId);
|
|
|
|
pod1.IsTenantSealed(tenantId).Should().BeTrue();
|
|
pod2.IsTenantSealed(tenantId).Should().BeFalse();
|
|
|
|
string? value = await pod2.GetSecretAsync(tenantId, "shared/secret");
|
|
value.Should().Be("hello");
|
|
}
|
|
|
|
// ─── Multi-Tenant Isolation ──────────────────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task MultiTenant_SecretsAreCryptographicallyIsolated()
|
|
{
|
|
// Each tenant has their own MEK. A secret written for tenant A
|
|
// cannot be decrypted by tenant B's MEK.
|
|
|
|
Guid tenantA = Guid.NewGuid();
|
|
Guid tenantB = Guid.NewGuid();
|
|
Vault vault = CreateVault();
|
|
|
|
await vault.InitializeAsync(tenantA, kek, totalShares: 1, threshold: 1);
|
|
await vault.InitializeAsync(tenantB, kek, totalShares: 1, threshold: 1);
|
|
|
|
// Each tenant writes a secret at the same logical key but different paths.
|
|
|
|
await vault.PutSecretAsync(tenantA, "tenants/a/config/api-key", "tenant-a-secret");
|
|
await vault.PutSecretAsync(tenantB, "tenants/b/config/api-key", "tenant-b-secret");
|
|
|
|
// Each tenant can only read their own secrets.
|
|
|
|
string? valueA = await vault.GetSecretAsync(tenantA, "tenants/a/config/api-key");
|
|
string? valueB = await vault.GetSecretAsync(tenantB, "tenants/b/config/api-key");
|
|
|
|
valueA.Should().Be("tenant-a-secret");
|
|
valueB.Should().Be("tenant-b-secret");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task MultiTenant_SealingOneTenantDoesNotAffectAnother()
|
|
{
|
|
Guid tenantA = Guid.NewGuid();
|
|
Guid tenantB = Guid.NewGuid();
|
|
Vault vault = CreateVault();
|
|
|
|
await vault.InitializeAsync(tenantA, kek, totalShares: 1, threshold: 1);
|
|
await vault.InitializeAsync(tenantB, kek, totalShares: 1, threshold: 1);
|
|
|
|
// Seal only tenant A.
|
|
|
|
await vault.SealAsync(tenantA);
|
|
|
|
vault.IsTenantSealed(tenantA).Should().BeTrue();
|
|
vault.IsTenantSealed(tenantB).Should().BeFalse();
|
|
}
|
|
|
|
// ─── Seal / Unseal Lifecycle ─────────────────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task Seal_ClearsMasterKeyFromMemory()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
vault.IsTenantSealed(tenantId).Should().BeFalse();
|
|
|
|
await vault.SealAsync(tenantId);
|
|
|
|
vault.IsTenantSealed(tenantId).Should().BeTrue();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task SealThenAutoUnseal_Works()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 3, threshold: 2);
|
|
|
|
await vault.SealAsync();
|
|
vault.IsSealed.Should().BeTrue();
|
|
|
|
await vault.AutoUnsealAsync(kek);
|
|
vault.IsTenantSealed(tenantId).Should().BeFalse();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task RepeatedSealUnsealCycles_Work()
|
|
{
|
|
Vault vault = CreateVault();
|
|
InitializationResult initResult = await vault.InitializeAsync(tenantId, kek, totalShares: 3, threshold: 2);
|
|
|
|
await vault.SealAsync();
|
|
await vault.AutoUnsealAsync(kek);
|
|
vault.IsTenantSealed(tenantId).Should().BeFalse();
|
|
|
|
await vault.SealAsync(tenantId);
|
|
await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[0]);
|
|
await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[1]);
|
|
vault.IsTenantSealed(tenantId).Should().BeFalse();
|
|
}
|
|
|
|
// ─── KEK Rotation ────────────────────────────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task ReWrapMasterKey_AllowsAutoUnsealWithNewKek()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
await vault.PutSecretAsync(tenantId, "test/secret", "original-value");
|
|
|
|
byte[] newKek = AesGcmEncryptor.GenerateKey();
|
|
|
|
await vault.ReWrapMasterKeyAsync(tenantId, newKek);
|
|
|
|
await vault.SealAsync();
|
|
await vault.AutoUnsealAsync(newKek);
|
|
|
|
string? value = await vault.GetSecretAsync(tenantId, "test/secret");
|
|
value.Should().Be("original-value");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ReWrapMasterKey_OldKekNoLongerWorks()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
byte[] newKek = AesGcmEncryptor.GenerateKey();
|
|
await vault.ReWrapMasterKeyAsync(tenantId, newKek);
|
|
await vault.SealAsync();
|
|
|
|
Vault vault2 = CreateVault();
|
|
|
|
Func<Task> act = () => vault2.AutoUnsealAsync(kek);
|
|
|
|
await act.Should().ThrowAsync<InvalidOperationException>();
|
|
}
|
|
|
|
// ─── Secret Operations ───────────────────────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task PutSecret_WhenUnsealed_StoresEncryptedSecret()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
await vault.PutSecretAsync(tenantId, "clusters/prod/letsencrypt/dns-credential", "cloudflare-api-token-value");
|
|
|
|
string? retrieved = await vault.GetSecretAsync(tenantId, "clusters/prod/letsencrypt/dns-credential");
|
|
retrieved.Should().Be("cloudflare-api-token-value");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PutSecret_WhenSealed_ThrowsVaultSealedException()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
await vault.SealAsync(tenantId);
|
|
|
|
Func<Task> act = () => vault.PutSecretAsync(tenantId, "path/to/secret", "value");
|
|
await act.Should().ThrowAsync<VaultSealedException>();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task GetSecret_WhenSealed_ThrowsVaultSealedException()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
await vault.PutSecretAsync(tenantId, "my/secret", "value");
|
|
await vault.SealAsync(tenantId);
|
|
|
|
Func<Task> act = () => vault.GetSecretAsync(tenantId, "my/secret");
|
|
await act.Should().ThrowAsync<VaultSealedException>();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task GetSecret_NonExistentPath_ReturnsNull()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
string? result = await vault.GetSecretAsync(tenantId, "does/not/exist");
|
|
|
|
result.Should().BeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PutSecret_OverwritesExistingSecret()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "old-value");
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "new-value");
|
|
|
|
string? result = await vault.GetSecretAsync(tenantId, "config/api-key");
|
|
|
|
result.Should().Be("new-value");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task PutSecret_CreatesVersionHistory()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "v1");
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "v2");
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "v3");
|
|
|
|
string? current = await vault.GetSecretAsync(tenantId, "config/api-key");
|
|
int versionCount = await vault.GetSecretVersionCountAsync(tenantId, "config/api-key");
|
|
|
|
current.Should().Be("v3");
|
|
versionCount.Should().Be(3);
|
|
}
|
|
|
|
[Fact]
|
|
public async Task GetSecretVersion_RetrievesSpecificVersion()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "version-one");
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "version-two");
|
|
await vault.PutSecretAsync(tenantId, "config/api-key", "version-three");
|
|
|
|
string? v1 = await vault.GetSecretVersionAsync(tenantId, "config/api-key", version: 1);
|
|
string? v2 = await vault.GetSecretVersionAsync(tenantId, "config/api-key", version: 2);
|
|
string? v3 = await vault.GetSecretVersionAsync(tenantId, "config/api-key", version: 3);
|
|
|
|
v1.Should().Be("version-one");
|
|
v2.Should().Be("version-two");
|
|
v3.Should().Be("version-three");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task DeleteSecret_SoftDeletesAndPreventsRetrieval()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
await vault.PutSecretAsync(tenantId, "temp/secret", "temporary-value");
|
|
|
|
await vault.DeleteSecretAsync(tenantId, "temp/secret");
|
|
|
|
string? result = await vault.GetSecretAsync(tenantId, "temp/secret");
|
|
result.Should().BeNull();
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ListSecrets_ReturnsPathsWithoutValues()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
await vault.PutSecretAsync(tenantId, "clusters/prod/dns-cred", "value1");
|
|
await vault.PutSecretAsync(tenantId, "clusters/prod/tls-key", "value2");
|
|
await vault.PutSecretAsync(tenantId, "clusters/staging/dns-cred", "value3");
|
|
|
|
List<string> paths = await vault.ListSecretsAsync(tenantId, "clusters/prod/");
|
|
|
|
paths.Should().HaveCount(2);
|
|
paths.Should().Contain("clusters/prod/dns-cred");
|
|
paths.Should().Contain("clusters/prod/tls-key");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task ListSecrets_WhenSealed_ThrowsVaultSealedException()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
await vault.SealAsync(tenantId);
|
|
|
|
Func<Task> act = () => vault.ListSecretsAsync(tenantId, "any/");
|
|
await act.Should().ThrowAsync<VaultSealedException>();
|
|
}
|
|
|
|
// ─── Secrets Persist Across Seal/Unseal ──────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task Secrets_SurviveSealAutoUnsealCycle()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 3, threshold: 2);
|
|
|
|
await vault.PutSecretAsync(tenantId, "persistent/secret", "survive-seal-unseal");
|
|
|
|
await vault.SealAsync();
|
|
|
|
await vault.AutoUnsealAsync(kek);
|
|
|
|
string? recovered = await vault.GetSecretAsync(tenantId, "persistent/secret");
|
|
recovered.Should().Be("survive-seal-unseal");
|
|
}
|
|
|
|
[Fact]
|
|
public async Task Secrets_SurviveManualShamirUnseal()
|
|
{
|
|
Vault vault = CreateVault();
|
|
InitializationResult initResult = await vault.InitializeAsync(tenantId, kek, totalShares: 3, threshold: 2);
|
|
|
|
await vault.PutSecretAsync(tenantId, "dr/secret", "disaster-recovery-value");
|
|
|
|
await vault.SealAsync(tenantId);
|
|
|
|
await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[0]);
|
|
await vault.ProvideUnsealShareAsync(tenantId, initResult.Shares[1]);
|
|
|
|
string? recovered = await vault.GetSecretAsync(tenantId, "dr/secret");
|
|
recovered.Should().Be("disaster-recovery-value");
|
|
}
|
|
|
|
// ─── Audit ───────────────────────────────────────────────────────────
|
|
|
|
[Fact]
|
|
public async Task Operations_AreAuditLogged()
|
|
{
|
|
Vault vault = CreateVault();
|
|
await vault.InitializeAsync(tenantId, kek, totalShares: 1, threshold: 1);
|
|
|
|
await vault.PutSecretAsync(tenantId, "audit/test", "value");
|
|
await vault.GetSecretAsync(tenantId, "audit/test");
|
|
await vault.DeleteSecretAsync(tenantId, "audit/test");
|
|
|
|
List<AuditEntry> entries = await vault.GetAuditLogAsync();
|
|
|
|
entries.Should().Contain(e => e.Operation == "initialize");
|
|
entries.Should().Contain(e => e.Operation == "put" && e.Path == "audit/test");
|
|
entries.Should().Contain(e => e.Operation == "get" && e.Path == "audit/test");
|
|
entries.Should().Contain(e => e.Operation == "delete" && e.Path == "audit/test");
|
|
}
|
|
}
|