78 lines
2.8 KiB
JavaScript
78 lines
2.8 KiB
JavaScript
|
"use strict";
|
||
|
|
|
||
|
|
const test = require("node:test");
|
||
|
|
const assert = require("node:assert/strict");
|
||
|
|
const {
|
||
|
|
_canFailedHopRetryWithEncryptedDefaultKeys,
|
||
|
|
_canRetryWithEncryptedDefaultKeys,
|
||
|
|
_isStrictAgentAuthFailure,
|
||
|
|
} = require("./sshBridge.cjs");
|
||
|
|
|
||
|
|
test("strict agent failures skip encrypted default-key prompts", () => {
|
||
|
|
const jumpHosts = [
|
||
|
|
{ hostname: "shared.example", useSshAgent: false },
|
||
|
|
{ hostname: "shared.example", useSshAgent: true, identitiesOnly: true },
|
||
|
|
];
|
||
|
|
assert.equal(_isStrictAgentAuthFailure({ jumpHosts }, {
|
||
|
|
isJumpHostAuthError: true,
|
||
|
|
jumpHostIndex: 1,
|
||
|
|
jumpHostHostname: "shared.example",
|
||
|
|
}), true);
|
||
|
|
assert.equal(_isStrictAgentAuthFailure({ jumpHosts }, {
|
||
|
|
isJumpHostAuthError: true,
|
||
|
|
jumpHostIndex: 0,
|
||
|
|
jumpHostHostname: "shared.example",
|
||
|
|
}), false);
|
||
|
|
assert.equal(_isStrictAgentAuthFailure({ jumpHosts }, {
|
||
|
|
isJumpHostAuthError: true,
|
||
|
|
jumpHostHostname: "shared.example",
|
||
|
|
}), false, "ambiguous legacy errors must not guess the failed hop");
|
||
|
|
});
|
||
|
|
|
||
|
|
test("encrypted default-key retry is limited to automatic or legacy hops", () => {
|
||
|
|
assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "password" }), false);
|
||
|
|
assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "key" }), false);
|
||
|
|
assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "certificate" }), false);
|
||
|
|
assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "auto" }), true);
|
||
|
|
assert.equal(_canRetryWithEncryptedDefaultKeys({
|
||
|
|
authMethod: "password",
|
||
|
|
jumpHosts: [{ authMethod: "auto" }],
|
||
|
|
}), true);
|
||
|
|
assert.equal(_canRetryWithEncryptedDefaultKeys({
|
||
|
|
authMethod: "password",
|
||
|
|
jumpHosts: [{ authMethod: "password" }, { authMethod: "key" }],
|
||
|
|
}), false);
|
||
|
|
assert.equal(_canRetryWithEncryptedDefaultKeys({
|
||
|
|
authMethod: "auto",
|
||
|
|
_unlockedEncryptedKeys: [{ keyName: "id_work" }],
|
||
|
|
}), false);
|
||
|
|
});
|
||
|
|
|
||
|
|
test("encrypted default-key prompts follow the hop that actually failed", () => {
|
||
|
|
const automaticJumpExplicitTarget = {
|
||
|
|
authMethod: "password",
|
||
|
|
jumpHosts: [{ authMethod: "auto", hostname: "jump.example" }],
|
||
|
|
};
|
||
|
|
assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
|
||
|
|
automaticJumpExplicitTarget,
|
||
|
|
{ level: "client-authentication" },
|
||
|
|
), false);
|
||
|
|
assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
|
||
|
|
automaticJumpExplicitTarget,
|
||
|
|
{ isJumpHostAuthError: true, jumpHostIndex: 0 },
|
||
|
|
), true);
|
||
|
|
|
||
|
|
const automaticTargetExplicitJump = {
|
||
|
|
authMethod: "auto",
|
||
|
|
jumpHosts: [{ authMethod: "key", hostname: "jump.example" }],
|
||
|
|
};
|
||
|
|
assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
|
||
|
|
automaticTargetExplicitJump,
|
||
|
|
{ level: "client-authentication" },
|
||
|
|
), true);
|
||
|
|
assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
|
||
|
|
automaticTargetExplicitJump,
|
||
|
|
{ isJumpHostAuthError: true, jumpHostIndex: 0 },
|
||
|
|
), false);
|
||
|
|
});
|