gunnar-server 3.0.0

//! **A person's passkeys are rows in gunnar's identity table** (Stage L,
//! 2026-10-04; the identity core's ceremony over them since IDENTITY-HOST,
//! 2026-10-27), so they survive what the identity table survives: a restart of
//! the box, and — riding the same document the twin replicates
//! (`refs/gunnar/auth`) — a restore. Driven through the real plane over real
//! stores, reopened from disk between the write and the read.

use std::sync::Arc;

use gunnar_grpc::ControlPlane as _;
use gunnar_server::control_plane::CoreControlPlane;
use gunnar_server::stores::ServerStores;

fn passkey(seed: u8) -> Vec<u8> {
    let key = p256::ecdsa::SigningKey::from_slice(&[seed; 32]).expect("a scalar");
    key.verifying_key().to_sec1_point(false).as_bytes().to_vec()
}

fn person(stores: &ServerStores, id: &str, kind: gunnar_core::PrincipalKind) {
    stores
        .auth()
        .add_principal(gunnar_core::Principal {
            id: id.to_owned(),
            name: id.to_owned(),
            kind,
            created: 0,
        })
        .expect("principal");
}

/// ★ **A passkey written before a restart is read after it, key and all**,
/// and goes when its principal goes.
#[test]
fn a_passkey_survives_a_restart_and_goes_with_its_principal() {
    let dir = tempfile::tempdir().expect("tempdir");
    {
        let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
        person(&stores, "kim", gunnar_core::PrincipalKind::User);
        let plane = CoreControlPlane::new(Arc::clone(&stores));
        let added = plane
            .add_credential("kim", b"kim-yubikey", &passkey(1), "YubiKey", 7)
            .expect("kim's passkey");
        assert_eq!(added.credential_id, b"kim-yubikey".to_vec());
        assert_eq!(added.sign_count, 7);
    }
    let stores = Arc::new(ServerStores::open(dir.path()).expect("stores, reopened"));
    let plane = CoreControlPlane::new(Arc::clone(&stores));
    let listed = plane.credentials(Some("kim")).expect("listed");
    assert_eq!(listed.len(), 1, "{listed:?}");
    assert_eq!(listed[0].label, "YubiKey");
    let stored = plane
        .credential(b"kim-yubikey")
        .expect("read")
        .expect("the passkey is still there");
    assert_eq!(
        stored.public_key,
        passkey(1),
        "the key came back byte for byte"
    );
    assert_eq!(stored.credential.principal_id, "kim");

    plane.remove_principal("kim").expect("removed");
    assert!(
        plane.credentials(None).expect("listed").is_empty(),
        "the passkey outlived kim"
    );
    assert!(plane.credential(b"kim-yubikey").expect("read").is_none());
}

/// No human credential on a machine principal, and a credential id once.
#[test]
fn a_machine_holds_no_passkey_and_an_id_is_registered_once() {
    let dir = tempfile::tempdir().expect("tempdir");
    let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
    person(&stores, "ci", gunnar_core::PrincipalKind::Machine);
    person(&stores, "kim", gunnar_core::PrincipalKind::User);
    let plane = CoreControlPlane::new(Arc::clone(&stores));
    let refused = plane
        .add_credential("ci", b"ci-key", &passkey(2), "ci", 0)
        .expect_err("a machine holds no passkey");
    assert!(
        matches!(refused, gunnar_grpc::ControlError::FailedPrecondition(_)),
        "{refused:?}"
    );
    plane
        .add_credential("kim", b"kim-key", &passkey(3), "laptop", 0)
        .expect("kim's");
    let twice = plane
        .add_credential("kim", b"kim-key", &passkey(4), "again", 0)
        .expect_err("an id once");
    assert!(
        matches!(twice, gunnar_grpc::ControlError::AlreadyExists(_)),
        "{twice:?}"
    );
    let ghost = plane
        .add_credential("ghost", b"ghost-key", &passkey(5), "ghost", 0)
        .expect_err("no such principal");
    assert!(
        matches!(ghost, gunnar_grpc::ControlError::NotFound(_)),
        "{ghost:?}"
    );
}

/// The box's identity core over `plane` (IDENTITY-HOST): what `serve` builds.
fn core(
    dir: &std::path::Path,
    plane: &Arc<CoreControlPlane>,
) -> Arc<gunnar_grpc::identity::GunnarIdentity> {
    gunnar_server::identity::build(
        dir,
        plane.clone(),
        &gunnar_grpc::ServerConfig::default(),
        false,
    )
}

fn relay() -> nornir_identity::Relay {
    nornir_identity::Relay {
        rp_id: "console.example".into(),
        origin: "https://console.example".into(),
        client: None,
    }
}

/// ★ **A login's counter is kept on the real plane, across a restart**, and a
/// counter that did not move is refused (the core's ceremony over Gunnar's
/// passkey; Gunnar's own session keys are gone).
#[test]
fn a_logins_counter_is_kept_and_a_replayed_counter_is_refused() {
    let dir = tempfile::tempdir().expect("tempdir");
    let mut key = nornir_identity::test_host::SoftPasskey::new(6);
    {
        let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
        person(&stores, "kim", gunnar_core::PrincipalKind::User);
        let plane = Arc::new(CoreControlPlane::new(Arc::clone(&stores)));
        plane
            .add_credential("kim", &key.id, &key.public_key(), "YubiKey", 0)
            .expect("kim's passkey");
        let identity = core(dir.path(), &plane);
        for _ in 0..4 {
            let c = identity.login_start(&relay()).expect("a login");
            identity
                .login_finish(key.login(&c, "https://console.example", true))
                .expect("kim logs in");
        }
    }
    let stores = Arc::new(ServerStores::open(dir.path()).expect("stores, reopened"));
    let plane = Arc::new(CoreControlPlane::new(Arc::clone(&stores)));
    let stored = plane.credential(&key.id).expect("read").expect("there");
    assert_eq!(
        stored.credential.sign_count, 4,
        "the counter survived the restart"
    );
    assert!(stored.credential.last_used_unix_ms.is_some());
    let identity = core(dir.path(), &plane);
    let mut replay = nornir_identity::test_host::SoftPasskey::new(6);
    let c = identity.login_start(&relay()).expect("a login");
    let refused = identity
        .login_finish(replay.login(&c, "https://console.example", true))
        .expect_err("a counter that went back");
    assert_eq!(refused.code, nornir_identity::Code::Ceremony, "{refused:?}");
}

/// ★ **An invite's grant is applied on the real plane when it is redeemed**
/// (an operator's WRITE) — once; a second redemption is refused.
#[test]
fn an_invite_is_redeemed_once_with_its_grant() {
    use gunnar_grpc::Identity as _;
    use nornir_identity::IdentityHost as _;
    let dir = tempfile::tempdir().expect("tempdir");
    let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
    person(&stores, "boss", gunnar_core::PrincipalKind::User);
    let plane = Arc::new(CoreControlPlane::new(Arc::clone(&stores)));
    plane
        .grant("boss", "", "", gunnar_proto::GrantLevel::Admin)
        .expect("boss is a server admin");
    let identity = core(dir.path(), &plane);
    let mut boss = identity
        .host()
        .store()
        .user("boss")
        .expect("read")
        .expect("boss");
    boss.state = nornir_identity::UserState::Active;
    identity.host().store().put_user(&boss).expect("active");
    let token = identity
        .vouched_session("boss", true)
        .expect("boss's session")
        .token;
    let invited = identity
        .invite(
            &token,
            nornir_identity::InviteAsk {
                display: "kim".into(),
                groups: vec![gunnar_grpc::identity::SERVER_WRITE.into()],
                ..Default::default()
            },
        )
        .expect("an operator's invite");
    let c = identity
        .redeem_start(&invited.secret, "", &relay())
        .expect("the ceremony");
    let kim = identity
        .redeem_finish(
            nornir_identity::test_host::SoftPasskey::new(7).register(&c, "https://console.example"),
        )
        .expect("redeemed");
    let id = kim.session.user_id;
    assert!(
        plane
            .may(
                &id,
                &gunnar_grpc::Access::Server,
                gunnar_proto::GrantLevel::Write
            )
            .expect("asked"),
        "Write applied"
    );
    assert!(!plane
        .may(
            &id,
            &gunnar_grpc::Access::Server,
            gunnar_proto::GrantLevel::Admin
        )
        .expect("asked"));
    let again = identity
        .redeem_start(&invited.secret, "", &relay())
        .expect_err("once");
    assert_eq!(
        again.code,
        nornir_identity::Code::InviteNotOpen,
        "{again:?}"
    );
    assert_eq!(plane.credentials(Some(&id)).expect("listed").len(), 1);
}

/// The kit's passkey (`kit-dwarf-key` is its id below).
fn kit_key() -> nornir_identity::test_host::SoftPasskey {
    nornir_identity::test_host::SoftPasskey::new(3)
}

/// kit-dwarf's approval, its credential the kit's soft passkey.
fn kit_approval() -> gunnar_grpc::MachineApproval {
    let key = kit_key();
    gunnar_grpc::MachineApproval {
        credential_id: key.id.clone(),
        public_key: key.public_key(),
        ..approval("kit-dwarf", b"", 3)
    }
}

fn approval(machine: &str, id: &[u8], seed: u8) -> gunnar_grpc::MachineApproval {
    gunnar_grpc::MachineApproval {
        machine: machine.to_owned(),
        server_level: gunnar_proto::GrantLevel::Admin,
        credential_id: id.to_vec(),
        public_key: passkey(seed),
        label: format!("installer kit on {}", machine.trim_start_matches("kit-")),
        sign_count: 0,
        now_unix_ms: gunnar_core::now_ms(),
        step_up: None,
    }
}

/// ★ **An approved machine enrolment is ONE update on the real plane**
/// (2026-10-05): the MACHINE principal made, its server grant, its credential
/// — read back after a restart, logging in as the machine — while a person's
/// id under the machine's name is refused and nothing lands.
#[test]
fn an_approved_machine_enrolment_makes_a_machine_with_its_credential_and_survives_a_restart() {
    use gunnar_grpc::Identity as _;
    let dir = tempfile::tempdir().expect("tempdir");
    {
        let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
        person(&stores, "kim", gunnar_core::PrincipalKind::User);
        let plane = CoreControlPlane::new(Arc::clone(&stores));
        plane
            .add_credential("kim", b"kim-yubikey", &passkey(1), "YubiKey", 5)
            .expect("kim's passkey");
        // kim's step-up presented a counter that went backwards: refused, nothing made.
        let mut backwards = kit_approval();
        backwards.step_up = Some((b"kim-yubikey".to_vec(), 4));
        let refused = plane
            .approve_machine_enrolment(backwards)
            .expect_err("a rolled-back counter");
        assert!(
            matches!(refused, gunnar_grpc::ControlError::PermissionDenied(_)),
            "{refused:?}"
        );
        assert!(plane.principal("kit-dwarf").expect("read").is_none());
        let mut fresh = kit_approval();
        fresh.step_up = Some((b"kim-yubikey".to_vec(), 6));
        let approved = plane.approve_machine_enrolment(fresh).expect("approved");
        assert!(approved.created);
        assert_eq!(
            approved.principal.kind,
            gunnar_proto::PrincipalKind::Machine as i32
        );
        assert_eq!(approved.credential.principal_id, "kit-dwarf");
        assert_eq!(approved.credential.credential_id, kit_key().id);
        assert_eq!(
            plane
                .credential(b"kim-yubikey")
                .expect("read")
                .expect("there")
                .credential
                .sign_count,
            6,
            "the step-up's counter is kept"
        );
        let again = plane
            .approve_machine_enrolment(kit_approval())
            .expect_err("an id once");
        assert!(
            matches!(again, gunnar_grpc::ControlError::AlreadyExists(_)),
            "{again:?}"
        );
    }
    let stores = Arc::new(ServerStores::open(dir.path()).expect("stores, reopened"));
    let plane = CoreControlPlane::new(Arc::clone(&stores));
    let machine = plane
        .principal("kit-dwarf")
        .expect("read")
        .expect("the machine is still there");
    assert_eq!(machine.kind, gunnar_proto::PrincipalKind::Machine as i32);
    assert!(plane
        .may(
            "kit-dwarf",
            &gunnar_grpc::Access::Server,
            gunnar_proto::GrantLevel::Admin
        )
        .expect("asked"));
    assert_eq!(
        plane.credentials(Some("kit-dwarf")).expect("listed").len(),
        1
    );
    assert!(plane
        .credentials(Some("kim"))
        .expect("listed")
        .iter()
        .all(|c| c.credential_id != kit_key().id));
    let plane = Arc::new(plane);
    let identity = core(dir.path(), &plane);
    let c = identity.login_start(&relay()).expect("a login");
    let session = identity
        .login_finish(kit_key().login(&c, "https://console.example", true))
        .expect("the machine logs in");
    assert_eq!(session.session.user_id, "kit-dwarf");

    person(&stores, "kit-person", gunnar_core::PrincipalKind::User);
    let refused = plane
        .approve_machine_enrolment(approval("kit-person", b"other-key", 4))
        .expect_err("a person under the id");
    assert!(
        matches!(refused, gunnar_grpc::ControlError::FailedPrecondition(_)),
        "{refused:?}"
    );
    assert!(plane.credential(b"other-key").expect("read").is_none());
}

/// ★ **An approved machine never touches the owner's first invite** (the
/// stage-L constraint, 2026-10-05: the break-glass token IS his first invite).
/// The invite stays pending under its hash, the feed renews it rather than
/// calling it spent, and the operator holds no credential.
#[test]
fn an_approved_machine_leaves_the_owners_first_invite_pending() {
    let dir = tempfile::tempdir().expect("tempdir");
    let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
    let plane = CoreControlPlane::new(Arc::clone(&stores));
    plane
        .claim_operator_named(Some("rickard"), "")
        .expect("the operator");
    let hash = gunnar_grpc::webauthn::sha256_hex(b"break-glass");
    assert_eq!(
        plane
            .operator_bootstrap_invite(
                "rickard",
                &hash,
                gunnar_core::now_ms(),
                gunnar_grpc::seam::OPERATOR_INVITE_TTL_MS
            )
            .expect("recorded"),
        gunnar_grpc::BootstrapInvite::Recorded
    );
    plane
        .approve_machine_enrolment(approval("kit-fresh", b"kit-fresh-key", 5))
        .expect("approved");
    assert!(
        plane.first_invite().expect("read").is_some(),
        "the owner's first invite is still pending"
    );
    assert_eq!(
        plane
            .operator_bootstrap_invite(
                "rickard",
                &hash,
                gunnar_core::now_ms(),
                gunnar_grpc::seam::OPERATOR_INVITE_TTL_MS
            )
            .expect("asked"),
        gunnar_grpc::BootstrapInvite::Renewed
    );
    assert!(
        plane
            .credentials(Some("rickard"))
            .expect("listed")
            .is_empty(),
        "nothing on the operator"
    );
}