nordisk/monetize

crates/monetize-ui-server/tests/pinned_control.rs

//! **The ONE monetize reached over TLS, pinned** — a console outside the ONE
//! box (`--control https://…`). It is the only monetize there is: no estate
//! runs its own, so this is the console's one dial. Its certificate is the
//! only trust: a different certificate under the same name, or the right
//! certificate under another name, is no monetize at all.

#[path = "../../../uitest/src/fixture.rs"]
mod fixture;
#[path = "../../../uitest/src/mock.rs"]
mod mock;

use monetize_ui_server::grpc::Monetize;

const BEARER: &str = "the-estates-control-bearer";
const NAME: &str = "monetize.estate.test";

fn cert(name: &str) -> (String, String) {
    let key = rcgen::KeyPair::generate().unwrap();
    let c = rcgen::CertificateParams::new(vec![name.to_string()]).unwrap().self_signed(&key).unwrap();
    (c.pem(), key.serialize_pem())
}

#[tokio::test(flavor = "multi_thread")]
async fn the_console_speaks_to_the_monetize_it_pinned_and_to_nothing_else() {
    let (pem, key) = cert(NAME);
    let at = mock::serve_tls(mock::Mock::new(), "127.0.0.1:0", BEARER, &pem, &key).await.unwrap().to_string();
    let url = format!("https://{NAME}");

    let m = Monetize::connect_pinned(&url, Some(&at), &pem, BEARER).unwrap();
    let got = m.products().list(monetize_proto::ListProductsRequest::default()).await.expect("the pinned monetize answers");
    assert!(!got.into_inner().products.is_empty(), "the fixture's products arrive over TLS");

    let (other, _) = cert(NAME);
    let wrong = Monetize::connect_pinned(&url, Some(&at), &other, BEARER).unwrap();
    assert!(wrong.products().list(monetize_proto::ListProductsRequest::default()).await.is_err(), "another certificate under the same name is not this monetize");

    let elsewhere = Monetize::connect_pinned("https://monetize.other.test", Some(&at), &pem, BEARER).unwrap();
    assert!(elsewhere.products().list(monetize_proto::ListProductsRequest::default()).await.is_err(), "the right certificate under another name is not this monetize");

    let no_bearer = Monetize::connect_pinned(&url, Some(&at), &pem, "").unwrap();
    let refused = no_bearer.products().list(monetize_proto::ListProductsRequest::default()).await.unwrap_err();
    assert_eq!(refused.code(), tonic::Code::Unauthenticated, "monetize still decides who may call");

    assert!(Monetize::connect_pinned("http://monetize.estate.test", None, &pem, BEARER).is_err(), "a pinned control url is https");
}