[Init] Initial commit - NetMesh terminal manager

electron/bridges/sshAuthHelper.passwordOnly.test.cjs

@@ -0,0 +1,281 @@
+"use strict";
+
+/**
+ * Password-only auth must not probe default ~/.ssh keys (issues #266 / #2079).
+ * Jump hosts and SFTP share buildAuthHandler; a wrong host password used to
+ * look fine on direct terminal (startSession still fell back to id_rsa) while
+ * ProxyJump / SFTP failed after password rejection alone.
+ */
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+
+const { buildAuthHandler } = require("./sshAuthHelper.cjs");
+
+const DEFAULT_KEYS = [
+  {
+    keyName: "id_ed25519",
+    keyPath: "/tmp/id_ed25519",
+    privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\ned\n-----END OPENSSH PRIVATE KEY-----\n",
+  },
+  {
+    keyName: "id_rsa",
+    keyPath: "/tmp/id_rsa",
+    privateKey: "-----BEGIN RSA PRIVATE KEY-----\nrsa\n-----END RSA PRIVATE KEY-----\n",
+  },
+];
+
+/**
+ * Walk the ssh2-style authHandler and collect method labels.
+ * Object methods expose type (and sometimes username/key); string methods
+ * come from the simple ordered-list path (e.g. password-only).
+ */
+function collectAuthMethods(authHandler, maxSteps = 16) {
+  const labels = [];
+  let methodsLeft = null;
+  for (let i = 0; i < maxSteps; i += 1) {
+    let offered = null;
+    authHandler(methodsLeft, false, (method) => {
+      offered = method;
+    });
+    if (offered == null || offered === false) break;
+    if (typeof offered === "string") {
+      labels.push(offered);
+    } else if (offered && typeof offered === "object") {
+      labels.push(offered.type || "unknown");
+    } else {
+      break;
+    }
+    // Keep all common methods available so the handler can walk its full list.
+    methodsLeft = ["publickey", "password", "keyboard-interactive", "agent"];
+  }
+  return labels;
+}
+
+test("buildAuthHandler password-only does not offer default SSH keys (#2079)", () => {
+  const auth = buildAuthHandler({
+    password: "wrong-or-stale-secret",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: false,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.ok(labels.includes("password"), `expected password; got ${labels.join(",")}`);
+  assert.ok(labels.includes("keyboard-interactive"), `expected KI; got ${labels.join(",")}`);
+  assert.equal(
+    labels.includes("publickey"),
+    false,
+    `password-only must not probe default keys; offered=${labels.join(",")}`,
+  );
+  assert.equal(labels.includes("agent"), false);
+});
+
+test("buildAuthHandler password-only still fires onAuthAttempt for jump/SFTP progress", () => {
+  const attempts = [];
+  const auth = buildAuthHandler({
+    password: "secret",
+    username: "root",
+    // Default keys on disk used to force the dynamic path for progress only;
+    // after #2079 the simple ordered path must still report attempts.
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: false,
+    onAuthAttempt: (label) => attempts.push(label),
+  });
+
+  collectAuthMethods(auth.authHandler);
+  assert.ok(
+    attempts.some((label) => label === "password" || label.includes("password")),
+    `expected password attempt callback; got ${attempts.join(" | ")}`,
+  );
+  assert.ok(
+    attempts.some((label) => label.includes("keyboard-interactive") || label.includes("exhausted")),
+    `expected KI or exhaustion callback; got ${attempts.join(" | ")}`,
+  );
+  assert.equal(
+    attempts.some((label) => /id_rsa|id_ed25519|default/.test(label)),
+    false,
+    `must not report default-key probes; got ${attempts.join(" | ")}`,
+  );
+});
+
+test("buildAuthHandler automatic mode tries agent and default keys before password", () => {
+  const auth = buildAuthHandler({
+    authMethod: "auto",
+    password: "saved-secret",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    sshAgentSocketOverride: "/tmp/ssh-agent.sock",
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  const agentIndex = labels.indexOf("agent");
+  const keyIndex = labels.indexOf("publickey");
+  const passwordIndex = labels.indexOf("password");
+  assert.ok(agentIndex >= 0, `expected agent; got ${labels.join(",")}`);
+  assert.ok(keyIndex >= 0, `expected publickey; got ${labels.join(",")}`);
+  assert.ok(passwordIndex >= 0, `expected password; got ${labels.join(",")}`);
+  assert.ok(agentIndex < passwordIndex, `agent should precede password; got ${labels.join(",")}`);
+  assert.ok(keyIndex < passwordIndex, `default key should precede password; got ${labels.join(",")}`);
+  assert.ok(
+    labels.every((label, index) => label !== "publickey" || index < passwordIndex),
+    `all default keys should precede password; got ${labels.join(",")}`,
+  );
+});
+
+test("buildAuthHandler automatic mode skips an unavailable validated agent", () => {
+  const auth = buildAuthHandler({
+    authMethod: "auto",
+    password: "saved-secret",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    sshAgentSocketOverride: null,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.equal(labels.includes("agent"), false, labels.join(","));
+  assert.equal(labels.includes("publickey"), true, labels.join(","));
+  assert.equal(labels.includes("password"), true, labels.join(","));
+});
+
+test("buildAuthHandler with no credentials still offers default keys", () => {
+  const auth = buildAuthHandler({
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: false,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.ok(
+    labels.includes("publickey"),
+    `expected default-key fallback when no explicit auth; offered=${labels.join(",")}`,
+  );
+});
+
+test("buildAuthHandler key+password still allows default key fallback after user key", () => {
+  const auth = buildAuthHandler({
+    privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nuser\n-----END OPENSSH PRIVATE KEY-----\n",
+    password: "also-have-password",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: false,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.ok(labels.includes("publickey"), `expected publickey; offered=${labels.join(",")}`);
+  assert.ok(labels.includes("password"), `expected password; offered=${labels.join(",")}`);
+  // user key + at least one default key => multiple publickey offers
+  const publickeyCount = labels.filter((l) => l === "publickey").length;
+  assert.ok(
+    publickeyCount >= 2,
+    `key auth may still fall back to default keys; offered=${labels.join(",")}`,
+  );
+});
+
+test("buildAuthHandler explicit key mode uses only the selected key and stated password fallback", () => {
+  const auth = buildAuthHandler({
+    authMethod: "key",
+    privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nuser\n-----END OPENSSH PRIVATE KEY-----\n",
+    password: "fallback-password",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: true,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.equal(labels.filter((label) => label === "publickey").length, 1, labels.join(","));
+  assert.equal(labels.includes("agent"), false, labels.join(","));
+  assert.equal(labels.includes("password"), true, labels.join(","));
+});
+
+test("buildAuthHandler explicit key mode never substitutes an unrelated default key", () => {
+  const auth = buildAuthHandler({
+    authMethod: "key",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: true,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.equal(labels.includes("publickey"), false, labels.join(","));
+  assert.equal(labels.includes("agent"), false, labels.join(","));
+  assert.equal(auth.privateKey, null);
+});
+
+test("buildAuthHandler explicit password mode ignores an agent and default keys", () => {
+  const auth = buildAuthHandler({
+    authMethod: "password",
+    password: "host-password",
+    agent: "/tmp/agent.sock",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: true,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.equal(labels.includes("agent"), false, labels.join(","));
+  assert.equal(labels.includes("publickey"), false, labels.join(","));
+  assert.equal(labels.includes("password"), true, labels.join(","));
+});
+
+test("buildAuthHandler explicit password mode never submits an empty saved password", () => {
+  const auth = buildAuthHandler({
+    authMethod: "password",
+    password: undefined,
+    agent: "/tmp/agent.sock",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: true,
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.equal(labels.includes("password"), false, labels.join(","));
+  assert.equal(labels.includes("agent"), false, labels.join(","));
+  assert.equal(labels.includes("publickey"), false, labels.join(","));
+  assert.equal(labels.includes("keyboard-interactive"), true, labels.join(","));
+});
+
+for (const authMethod of ["password", "key", "certificate"]) {
+  test(`buildAuthHandler explicit ${authMethod} mode ignores unlocked default keys`, () => {
+    const auth = buildAuthHandler({
+      authMethod,
+      password: "fallback-password",
+      privateKey: authMethod === "password" ? undefined : "-----BEGIN OPENSSH PRIVATE KEY-----\nselected\n-----END OPENSSH PRIVATE KEY-----\n",
+      username: "root",
+      allowAgentFallback: false,
+      unlockedEncryptedKeys: [{
+        keyName: "id_unrelated",
+        privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nunrelated\n-----END OPENSSH PRIVATE KEY-----\n",
+        passphrase: "key-pass",
+      }],
+    });
+
+    const labels = collectAuthMethods(auth.authHandler);
+    assert.equal(
+      labels.filter((label) => label === "publickey").length,
+      authMethod === "password" ? 0 : 1,
+      labels.join(","),
+    );
+  });
+}
+
+test("buildAuthHandler password-only may still attach unlocked encrypted keys for jump retry", () => {
+  const auth = buildAuthHandler({
+    password: "host-password",
+    username: "root",
+    defaultKeys: DEFAULT_KEYS,
+    allowAgentFallback: false,
+    unlockedEncryptedKeys: [{
+      keyName: "id_encrypted",
+      privateKey: "-----BEGIN OPENSSH PRIVATE KEY-----\nenc\n-----END OPENSSH PRIVATE KEY-----\n",
+      passphrase: "key-pass",
+    }],
+  });
+
+  const labels = collectAuthMethods(auth.authHandler);
+  assert.ok(labels.includes("password"), `offered=${labels.join(",")}`);
+  assert.ok(
+    labels.includes("publickey"),
+    `jump-chain retry may still offer unlocked keys; offered=${labels.join(",")}`,
+  );
+});