gunnar-ssh 3.0.0

//! The path sandbox at the level it actually protects: the dispatch (the ACL model).
//!
//! `tests/command_parsing.rs` covers the syntax and carries this crate's half of
//! the merged rejection table. This file covers the decision (parse, resolve,
//! check the grant), because that is where "reject an escape" and "accept a
//! legitimate nested path" have to both be true at once.
//!
//! Since the merge the sandbox under all of this is `gunnar_core::resolve_repo_path`,
//! the only one, and the lookups are `gunnar-core`'s real
//! `AuthTable`/`RepoCatalog` rather than test doubles.

mod common;

use gunnar_core::model::Level;
use gunnar_ssh::server::{Dispatch, DispatchError};
use gunnar_ssh::{Access, GitService, Principal, RepoRef};

use common::{plane_with_key, principal, Plane};

/// A dispatch where `principal-1` holds `level` on `nordisk/osm-katana`.
fn dispatch(level: Access) -> (Dispatch, Principal) {
    let plane = Plane::empty()
        .with_the_repo()
        .with_principal("principal-1")
        .with_grant("principal-1", level);
    (Dispatch::new(plane.control), principal("principal-1"))
}

#[test]
fn a_legitimate_nested_path_is_served() {
    // The identity-value guard for the whole file. A sandbox that refuses
    // everything satisfies every escape test below and serves nobody.
    let (dispatch, who) = dispatch(Access::Read);
    let request = dispatch
        .authorise(&who, None, b"git-upload-pack 'nordisk/osm-katana.git'")
        .expect("a registered repository with a read grant must be served");
    assert_eq!(request.service, GitService::UploadPack);
    assert_eq!(request.repo.key(), "nordisk/osm-katana");
    assert_eq!(request.principal.id, "principal-1");

    // And the ssh:// spelling of the same repository reaches the same place.
    let via_url = dispatch
        .authorise(&who, None, b"git-upload-pack '/nordisk/osm-katana'")
        .expect("the ssh:// spelling names the same repository");
    assert_eq!(via_url.repo, request.repo);
}

/// **The behaviour that changed when the sandbox merged, pinned.**
///
/// This crate's deleted sandbox enforced exactly two path components, so
/// `team/sub/repo.git` was a *parse error*. `gunnar-core`'s permits nested
/// namespaces, and that is the one that survived. Without this test the merge
/// could silently be undone by reinstating the stricter rule, and every
/// rejection test in the crate would stay green.
#[test]
fn a_nested_namespace_resolves_and_is_served() {
    let plane = Plane::empty().with_principal("principal-1");
    let deep = RepoRef::new("team/sub", "project").expect("nested namespaces are legal");
    plane
        .catalog()
        .create_namespace("team/sub")
        .expect("create the nested namespace");
    plane
        .catalog()
        .create(gunnar_core::NewRepo::new(deep.clone()))
        .expect("create");
    plane
        .auth()
        .grant(gunnar_core::model::Grant::repo(
            "principal-1",
            deep,
            Level::Read,
        ))
        .expect("grant");

    let dispatch = Dispatch::new(plane.control);
    let request = dispatch
        .authorise(
            &principal("principal-1"),
            None,
            b"git-upload-pack 'team/sub/project.git'",
        )
        .expect("a nested namespace is legal");
    assert_eq!(request.repo.namespace, "team/sub");
    assert_eq!(request.repo.name, "project");
}

/// **The rule that makes the permissive sandbox safe.**
///
/// Nested namespaces being legal would be a privilege escalation if a grant on
/// `team` reached `team/sub`. It does not, and that is asserted here at the
/// dispatch. `gunnar-core`'s `tests/acl.rs` asserts it at the ACL, but the
/// escalation would be *exploited* through this path, so it is pinned on this
/// side too.
#[test]
fn a_grant_on_the_parent_namespace_does_not_reach_a_nested_one() {
    let plane = Plane::empty().with_principal("principal-1");
    for (namespace, name) in [("team", "shallow"), ("team/sub", "deep")] {
        plane
            .catalog()
            .create_namespace(namespace)
            .expect("create namespace");
        plane
            .catalog()
            .create(gunnar_core::NewRepo::new(
                RepoRef::new(namespace, name).expect("legal"),
            ))
            .expect("create");
    }
    // Admin on `team`, and nothing at all on `team/sub`.
    let plane = plane.with_namespace_grant("principal-1", "team", Level::Admin);
    let dispatch = Dispatch::new(plane.control);
    let who = principal("principal-1");

    // The red half first: the grant really does work where it applies. Without
    // this, a grant table that did nothing at all would pass the assertion
    // below.
    dispatch
        .authorise(&who, None, b"git-receive-pack 'team/shallow.git'")
        .expect("an admin grant on `team` must serve a repository in `team`");

    let err = dispatch
        .authorise(&who, None, b"git-upload-pack 'team/sub/deep.git'")
        .expect_err("a grant on `team` must NOT reach `team/sub`");
    assert!(
        matches!(&err, DispatchError::Denied { held, .. } if held == "none"),
        "nested namespaces must not inherit grants: {err}"
    );
}

#[test]
fn escapes_never_reach_a_repository() {
    let (dispatch, who) = dispatch(Access::Admin);
    for raw in [
        &b"git-upload-pack '../../etc/passwd'"[..],
        b"git-upload-pack 'nordisk/../../etc/passwd'",
        b"git-upload-pack '/nordisk/../osm-katana'",
        b"git-upload-pack '.git/../..'",
        b"git-upload-pack '~/nordisk/osm-katana.git'",
        b"git-upload-pack 'nordisk/osm-katana.git\0'",
        // Merged in with the sandbox: git's lock-file suffix, which this
        // crate's deleted copy refused and `gunnar-core`'s did not until now.
        b"git-upload-pack 'nordisk/osm-katana.lock'",
    ] {
        let err = dispatch.authorise(&who, None, raw).expect_err(&format!(
            "should have refused {:?}",
            String::from_utf8_lossy(raw)
        ));
        assert!(
            matches!(err, DispatchError::Command(_)),
            "{:?} should have failed at the parser, not later: {err}",
            String::from_utf8_lossy(raw)
        );
    }
}

#[test]
fn an_absolute_system_path_is_refused_because_it_names_nothing() {
    // The ACL model lists `/etc/passwd` as a sandbox case. It is refused, but
    // one layer later than the spec implies, and for a better reason. See the
    // module docs of `gunnar_core::sandbox`: it parses as namespace `etc`,
    // repository `passwd`, which is not in the catalog, and there is never a
    // filename anywhere in the pipeline for it to have escaped into.
    let (dispatch, who) = dispatch(Access::Admin);
    let err = dispatch
        .authorise(&who, None, b"git-upload-pack '/etc/passwd'")
        .expect_err("must be refused");
    match err {
        DispatchError::NoSuchRepo(path) => {
            assert_eq!(path, RepoRef::new("etc", "passwd").unwrap());
        }
        other => panic!("expected NoSuchRepo, got {other}"),
    }
}

#[test]
fn upload_pack_needs_read_and_receive_pack_needs_write() {
    let (read_only, who) = dispatch(Access::Read);
    read_only
        .authorise(&who, None, b"git-upload-pack 'nordisk/osm-katana.git'")
        .expect("read is enough to fetch");
    let err = read_only
        .authorise(&who, None, b"git-receive-pack 'nordisk/osm-katana.git'")
        .expect_err("read must NOT be enough to push");
    assert!(
        matches!(
            &err,
            DispatchError::Denied { needed: Access::Write, held, .. } if held == "read"
        ),
        "{err}"
    );

    let (writable, who) = dispatch(Access::Write);
    writable
        .authorise(&who, None, b"git-receive-pack 'nordisk/osm-katana.git'")
        .expect("write is enough to push");
    writable
        .authorise(&who, None, b"git-upload-pack 'nordisk/osm-katana.git'")
        .expect("write implies read");
}

#[test]
fn a_principal_with_no_grant_at_all_is_denied() {
    let plane = Plane::empty().with_the_repo().with_principal("stranger");
    let dispatch = Dispatch::new(plane.control);
    let err = dispatch
        .authorise(
            &principal("stranger"),
            None,
            b"git-upload-pack 'nordisk/osm-katana.git'",
        )
        .expect_err("no grant means no access");
    assert!(
        matches!(&err, DispatchError::Denied { held, .. } if held == "none"),
        "{err}"
    );
}

#[test]
fn not_found_and_not_allowed_are_indistinguishable_to_the_client() {
    // Two different server-side facts, one client-visible string. If these ever
    // diverge, a client can enumerate private repositories one guess at a time.
    let (dispatch, who) = dispatch(Access::Read);
    let missing = dispatch
        .authorise(&who, None, b"git-upload-pack 'nordisk/does-not-exist.git'")
        .expect_err("no such repo");
    let denied = dispatch
        .authorise(&who, None, b"git-receive-pack 'nordisk/osm-katana.git'")
        .expect_err("no write grant");

    assert!(matches!(missing, DispatchError::NoSuchRepo(_)));
    assert!(matches!(denied, DispatchError::Denied { .. }));
    // Different internally…
    assert_ne!(missing.to_string(), denied.to_string());
    // …and both refer to the repository the client named, with the same wording.
    let missing_msg = missing.client_message().expect("a git client is listening");
    let denied_msg = denied.client_message().expect("a git client is listening");
    assert!(missing_msg.starts_with("repository not found, or you do not have access:"));
    assert!(denied_msg.starts_with("repository not found, or you do not have access:"));

    // The one place they may legitimately differ is the path the client itself
    // sent back to it, so compare the wording with the paths removed.
    let strip = |m: &str| m.split(':').next().unwrap().to_string();
    assert_eq!(strip(&missing_msg), strip(&denied_msg));
}

/// **A storage fault is not a permission denial (the ACL model).**
///
/// The seam this dispatch replaced returned `Option`, so an unreadable catalog
/// and an empty one were the same answer: "no such repository". `gunnar-core`
/// returns `Result` precisely so they are not, and this is the guard that the
/// `Result` is still carried rather than swallowed somewhere in between.
///
/// The red half is built in: the same dispatch, the same command, served
/// successfully first, so a green here cannot come from the request being
/// refused for some other reason.
#[test]
fn an_unreadable_catalog_is_a_fault_and_not_a_denial() {
    let plane = plane_with_key(&common::mint_key(), Access::Read);
    let dispatch = Dispatch::new(plane.control.clone());
    let who = principal("principal-1");

    dispatch
        .authorise(&who, None, b"git-upload-pack 'nordisk/osm-katana.git'")
        .expect("served while the catalog is readable");

    plane.corrupt_the_catalog();

    let err = dispatch
        .authorise(&who, None, b"git-upload-pack 'nordisk/osm-katana.git'")
        .expect_err("an unreadable catalog must not be answered at all");
    assert!(
        matches!(err, DispatchError::Store(_)),
        "a storage fault reported as {err:?}; it must not be a Denied or a NoSuchRepo, \
         or an outage becomes a silent permission denial"
    );
    // And the client is told the truth, not that it lacks access.
    let message = err.client_message().expect("say something");
    assert!(
        !message.contains("do not have access"),
        "a storage fault must not be reported to the client as a permission problem: {message}"
    );
}

/// The same, for the identity table rather than the catalog.
#[test]
fn an_unreadable_identity_table_is_a_fault_and_not_a_denial() {
    let plane = plane_with_key(&common::mint_key(), Access::Read);
    let dispatch = Dispatch::new(plane.control.clone());
    let who = principal("principal-1");

    dispatch
        .authorise(&who, None, b"git-upload-pack 'nordisk/osm-katana.git'")
        .expect("served while the table is readable");

    plane.corrupt_the_auth_table();

    assert!(
        matches!(
            dispatch.authorise(&who, None, b"git-upload-pack 'nordisk/osm-katana.git'"),
            Err(DispatchError::Store(_))
        ),
        "an unreadable identity table must be a fault, not `you have no grant`"
    );
}

#[test]
fn a_shell_gets_no_message_at_all() {
    // `None` means channel_failure and silence: there is no git client on the
    // other end that would understand a pkt-line.
    let (dispatch, who) = dispatch(Access::Admin);
    let err = dispatch
        .authorise(&who, None, b"bash")
        .expect_err("no shell, ever");
    assert!(err.client_message().is_none(), "{err}");
}

/// **The LFS verb through the real ACL.**
///
/// `tests/command_parsing.rs` proves the exec line `git-lfs-transfer <path>
/// upload` *parses* to `Access::Write`. That is a statement about the parser
/// and nothing else: it never builds an `AuthTable`, never holds a grant, and
/// would stay green if the dispatch dropped the parsed requirement on the floor
/// and handed every authenticated caller a writable LFS stream.
///
/// This is the same matrix `upload_pack_needs_read_and_receive_pack_needs_write`
/// asserts for the two git verbs, for the third one, which had no coverage at
/// this level at all. The `download` half is what makes it discriminating: a
/// dispatch that refused all LFS would satisfy the upload assertion alone.
#[test]
fn lfs_download_needs_read_and_lfs_upload_needs_write() {
    const DOWNLOAD: &[u8] = b"git-lfs-transfer nordisk/osm-katana.git download";
    const UPLOAD: &[u8] = b"git-lfs-transfer nordisk/osm-katana.git upload";

    let (read_only, who) = dispatch(Access::Read);
    read_only
        .authorise(&who, None, DOWNLOAD)
        .expect("read is enough to download an LFS object");
    let err = read_only
        .authorise(&who, None, UPLOAD)
        .expect_err("read must NOT be enough to upload an LFS object");
    assert!(
        matches!(
            &err,
            DispatchError::Denied { needed: Access::Write, held, .. } if held == "read"
        ),
        "an LFS upload refused a read-only principal for the wrong reason: {err}"
    );

    let (writable, who) = dispatch(Access::Write);
    writable
        .authorise(&who, None, UPLOAD)
        .expect("write is enough to upload an LFS object");
    writable
        .authorise(&who, None, DOWNLOAD)
        .expect("write implies read for LFS too");

    // And a principal with no grant reaches neither, so the read half above is
    // a grant being honoured rather than LFS being ungated.
    let plane = Plane::empty().with_the_repo().with_principal("stranger");
    let ungranted = Dispatch::new(plane.control);
    for line in [DOWNLOAD, UPLOAD] {
        let err = ungranted
            .authorise(&principal("stranger"), None, line)
            .expect_err("no grant must reach no LFS operation");
        assert!(
            matches!(&err, DispatchError::Denied { held, .. } if held == "none"),
            "{err}"
        );
    }
}

/// The LFS operation the *caller* names is the one that is checked.
///
/// The failure this excludes: a dispatch that read the requirement from the
/// service's first `OperationSpec` (or from any fixed field) rather than from
/// the operation on the exec line would grant `upload` at `Read`, because
/// `Download` is the row that comes first in `SERVICES`.
#[test]
fn the_lfs_operation_named_on_the_exec_line_is_the_one_that_is_checked() {
    let (read_only, who) = dispatch(Access::Read);

    let allowed = read_only
        .authorise(
            &who,
            None,
            b"git-lfs-transfer nordisk/osm-katana.git download",
        )
        .expect("download is a read");
    assert!(
        matches!(
            allowed.service,
            GitService::LfsTransfer(gunnar_lfs::Operation::Download)
        ),
        "the dispatch carried the wrong operation forward: {:?}",
        allowed.service
    );

    // Same principal, same repository, same verb — only the operation differs.
    read_only
        .authorise(
            &who,
            None,
            b"git-lfs-transfer nordisk/osm-katana.git upload",
        )
        .expect_err("upload must be judged as a write even though download was allowed");
}