nordisk/knut

crates/knut-popviz/tests/live_mtls.rs

//! **The population load over MUTUAL TLS, against a real FalkorDB that takes nothing else.**
//!
//! A server running `tls-auth-clients yes` + `tls-auth-clients-user CN` refuses a plain
//! connect at the handshake, and with a client certificate makes its CN the ACL user - no
//! AUTH is sent. This proves both halves through `LoadParams::tls`: a small load WITH the
//! identity reaches `done` with every row and edge in, and the same load WITHOUT it fails
//! loudly instead of loading anything.
//!
//! `#[ignore]` - it needs such a server. Point it at one:
//!
//! ```bash
//! KNUT_MTLS_URL=rediss://172.16.12.19:6379 \
//! KNUT_MTLS_CERT=kalle.crt KNUT_MTLS_KEY=kalle.key KNUT_MTLS_CA=ca-chain.crt \
//!   cargo test -p knut-popviz --test live_mtls -- --ignored --nocapture
//! ```
//!
//! Uses its own graph (`knut_mtls_proof`) and `--drop`s it first, so it never touches another.

use std::path::PathBuf;
use std::sync::{Arc, Mutex};

use graphar_falkordb::FalkorTls;
use knut_popviz::{IngestMode, LoadParams, PopvizState, Target, run_load};

fn env(k: &str) -> String {
    std::env::var(k).unwrap_or_else(|_| panic!("{k} is not set - see this file's header"))
}

fn params(tls: Option<FalkorTls>) -> (LoadParams, f64) {
    let scale = 0.00002;
    (
        LoadParams {
            url: env("KNUT_MTLS_URL"),
            graph: "knut_mtls_proof".into(),
            scale,
            drop: true,
            target: Target::Falkor,
            ingest: IngestMode::Auto,
            tls,
        },
        scale,
    )
}

#[test]
#[ignore]
fn a_load_over_mtls_reaches_done_and_a_plain_one_is_refused() {
    let ca = std::env::var("KNUT_MTLS_CA").ok().map(PathBuf::from);
    let id = FalkorTls::from_files(env("KNUT_MTLS_CERT").as_ref(), env("KNUT_MTLS_KEY").as_ref(), ca.as_deref())
        .expect("the identity files read");

    // WITH the identity: the whole population lands.
    let (p, scale) = params(Some(id.clone()));
    let state = Arc::new(Mutex::new(PopvizState::new(scale)));
    run_load(p, Arc::clone(&state), || {});
    let json = state.lock().unwrap().state_json();
    println!("with identity: {json}");
    assert_eq!(json["phase"], "done", "load over mTLS finished - {json}");
    assert!(json["error"].is_null(), "no error - {json}");
    assert_eq!(json["loaded"], json["total"], "every row loaded - {json}");
    assert!(json["total"].as_u64().unwrap() > 0, "non-empty - {json}");
    assert_eq!(json["edges_loaded"], json["edges_total"], "every edge loaded - {json}");

    // WITHOUT it: the server refuses, and the load says so rather than reporting done.
    let (p, scale) = params(None);
    let state = Arc::new(Mutex::new(PopvizState::new(scale)));
    run_load(p, Arc::clone(&state), || {});
    let json = state.lock().unwrap().state_json();
    println!("without identity: {json}");
    assert!(!json["error"].is_null(), "a plain connect to an mTLS-only server must fail - {json}");
    assert_ne!(json["phase"], "done", "and must not claim done - {json}");
}