[Init] Initial commit - NetMesh terminal manager

electron/bridges/sshBridge.strictAgentRetry.test.cjs

@@ -0,0 +1,77 @@
+"use strict";
+
+const test = require("node:test");
+const assert = require("node:assert/strict");
+const {
+  _canFailedHopRetryWithEncryptedDefaultKeys,
+  _canRetryWithEncryptedDefaultKeys,
+  _isStrictAgentAuthFailure,
+} = require("./sshBridge.cjs");
+
+test("strict agent failures skip encrypted default-key prompts", () => {
+  const jumpHosts = [
+    { hostname: "shared.example", useSshAgent: false },
+    { hostname: "shared.example", useSshAgent: true, identitiesOnly: true },
+  ];
+  assert.equal(_isStrictAgentAuthFailure({ jumpHosts }, {
+    isJumpHostAuthError: true,
+    jumpHostIndex: 1,
+    jumpHostHostname: "shared.example",
+  }), true);
+  assert.equal(_isStrictAgentAuthFailure({ jumpHosts }, {
+    isJumpHostAuthError: true,
+    jumpHostIndex: 0,
+    jumpHostHostname: "shared.example",
+  }), false);
+  assert.equal(_isStrictAgentAuthFailure({ jumpHosts }, {
+    isJumpHostAuthError: true,
+    jumpHostHostname: "shared.example",
+  }), false, "ambiguous legacy errors must not guess the failed hop");
+});
+
+test("encrypted default-key retry is limited to automatic or legacy hops", () => {
+  assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "password" }), false);
+  assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "key" }), false);
+  assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "certificate" }), false);
+  assert.equal(_canRetryWithEncryptedDefaultKeys({ authMethod: "auto" }), true);
+  assert.equal(_canRetryWithEncryptedDefaultKeys({
+    authMethod: "password",
+    jumpHosts: [{ authMethod: "auto" }],
+  }), true);
+  assert.equal(_canRetryWithEncryptedDefaultKeys({
+    authMethod: "password",
+    jumpHosts: [{ authMethod: "password" }, { authMethod: "key" }],
+  }), false);
+  assert.equal(_canRetryWithEncryptedDefaultKeys({
+    authMethod: "auto",
+    _unlockedEncryptedKeys: [{ keyName: "id_work" }],
+  }), false);
+});
+
+test("encrypted default-key prompts follow the hop that actually failed", () => {
+  const automaticJumpExplicitTarget = {
+    authMethod: "password",
+    jumpHosts: [{ authMethod: "auto", hostname: "jump.example" }],
+  };
+  assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
+    automaticJumpExplicitTarget,
+    { level: "client-authentication" },
+  ), false);
+  assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
+    automaticJumpExplicitTarget,
+    { isJumpHostAuthError: true, jumpHostIndex: 0 },
+  ), true);
+
+  const automaticTargetExplicitJump = {
+    authMethod: "auto",
+    jumpHosts: [{ authMethod: "key", hostname: "jump.example" }],
+  };
+  assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
+    automaticTargetExplicitJump,
+    { level: "client-authentication" },
+  ), true);
+  assert.equal(_canFailedHopRetryWithEncryptedDefaultKeys(
+    automaticTargetExplicitJump,
+    { isJumpHostAuthError: true, jumpHostIndex: 0 },
+  ), false);
+});