phase: 15_agent_mtls
All green. Report:
**Verified / implemented (final pass of `15_agent_mtls`)**
- Wrote `data/logs/verify-15-tls-e2e.py`: a real `host_agent.py --cert-bundle` + a real dashboard process over a scratch DB (`HOST_TARGETS=loop=https://…`) — **27/27 PASS**, transcript `verify-15-tls-e2e.out`, notes `data/logs/NOTES-tls-rollout.md`.
- Read-only checks against the running dev store: 5 `certs.*` rows byte-identical across a restart; served bundle == the `meta` row (1430 B); 0 events containing `-----BEGIN`; unsigned `/certs`→`303 ?next=`, unsigned `/api/certs`→`401`, signed-in `200`; screenshots `data/logs/15-final-{certs,system}.png`.
- Docs (step 6, full review): README — added *Protecting an agent, host by host* (the rollout task-07 left out), a `tests/test_certs.py`/TLS-matrix/sandbox-installer paragraph, and fixed two stale “the one write endpoint in the app” claims (`NUT_ALLOW_ACTIONS`, Battery-test buttons). AGENTS.md — test count 1424→1427, bundle-fetch command in *Commands*, a Testing-policy bullet on structurally pinning a key-holding module, fleet transport bullet (token mode is now the compatibility path), gap 11 final state.
**Tests / lint (full suite 100% green)**
- `uv run pytest` → **1427 passed, 15 skipped**, exit 0 · `bash .agents/validate.sh` → **exit 0** (coverage **98.94%** vs 94% floor, `certs.py` 100%; ruff “All checks passed”; pyright 0 errors; `node --check` clean; hygiene clean)
- `uv run pytest -m live --live` → **11 passed / 0 failed** · `./scripts/dev-server.sh status` → all 9 sources `ok`
- `uv pip list --outdated` → empty after bumping `fastapi 0.152.0 → 0.153.0` (`uv.lock` only); full suite re-run green.
**Completion criteria**
- Fresh-DB root CA, idempotent: ✅ (tests + live store hashes) · agent TLS matrix incl. wrong-CA/certless 403/`/health` CA-only/revoked 403 + live denylist re-read: ✅
- `https` `host:`/`disks:` `ok` + revoked says “agent certificate revoked” with no dial: ✅ on loopback (real agent + real dashboard) and spy-pinned hermetically; **not** on the fleet (below)
- Signed-in `/certs` + rotate/revoke/root-rotate + byte-identical bundle download: ✅ · installer bundle/unit/`--status` over TLS: ✅ (0640, see deviation)
- `pytest`/`validate.sh`/`--outdated`: ✅ · token-mode byte-identical, engine/UPS untouched, public surface unchanged (route walk): ✅
- **Live fleet TLS (deskwork+gateway flip): NOT done** — no live changes. It needs root on hosts without the installer grant (`deskwork`), has no both-ways-working window (`http://` dashboard vs https-only agent), and would deploy the agent from this not-yet-committed tree. Exact procedure recorded in README + `data/logs/NOTES-tls-rollout.md`.
**Deviations**: bundle mode `0640 root:dashboards-agent` instead of the task file’s `0600` (the agent re-reads its own bundle for the denylist; 0600 breaks the unit — already recorded in AGENTS.md); the loopback dashboard substitutes for the fleet flip. Incidental: a stray `pkill` of mine killed the dev server mid-pass; restarted and verified healthy.
**Next pending phase**: `.agents/phases/todo/16_agent_smart_pass_budget` (then `17_installer_device_filter`).
This commit is contained in:
+112
-6
@@ -42,7 +42,7 @@ from auth_contract import FAST_PBKDF2
|
||||
from dashboards import auth
|
||||
from dashboards.api import MIN_PASSWORD_LENGTH, AppContext
|
||||
from dashboards.app import PUBLIC_PATHS, PUBLIC_PREFIXES, create_app, is_public
|
||||
from dashboards.config import Settings
|
||||
from dashboards.config import Settings, Target
|
||||
from dashboards.poller import Hub
|
||||
from dashboards.sources import nut
|
||||
from dashboards.store import SampleStore
|
||||
@@ -58,11 +58,17 @@ PROTECTED_API = (
|
||||
"/api/system/snapshot", "/api/system/history", "/api/disks/snapshot",
|
||||
"/api/disks/history", "/api/llm/snapshot", "/api/llm/history", "/api/ups/snapshot",
|
||||
"/api/ups/history", "/api/ups/commands", "/api/auth/status",
|
||||
# Phase 15: the certificate authority's own surface. `/api/certs/<name>/bundle` is every
|
||||
# agent's private key, so "it needs a session" is the whole point of listing it here.
|
||||
"/api/certs", "/api/certs/{name}/bundle", "/api/certs/{name}/rotate",
|
||||
"/api/certs/{name}/revoke", "/api/certs/root/rotate",
|
||||
)
|
||||
#: Every HTML page behind the gate. `/settings` is a **page** and not one of the four
|
||||
#: dashboards (it carries no `aria-current` tab), which is exactly why it is in this list: the
|
||||
#: one thing that must never regress is a new route answering anonymously.
|
||||
PROTECTED_PAGES = ("/", "/system", "/disks", "/llm", "/ups", "/settings")
|
||||
#: Every HTML page behind the gate. `/settings` and `/certs` are **pages** and not dashboards
|
||||
#: (neither carries an `aria-current` tab), which is exactly why they are in this list: the one
|
||||
#: thing that must never regress is a new route answering anonymously. `/certs` is the sharper
|
||||
#: case of the two — an anonymous caller reaching it would see the CA's serials and every host
|
||||
#: the dashboard dials.
|
||||
PROTECTED_PAGES = ("/", "/system", "/disks", "/llm", "/ups", "/settings", "/certs")
|
||||
|
||||
|
||||
#: The one write this app has, with the fields the route needs (the UPS is unconfigured, so a
|
||||
@@ -1256,6 +1262,105 @@ def test_the_danger_word_is_still_what_cuts_power_after_the_gate(nut_app: TestCl
|
||||
assert WireRecorder.sent == [("apc", "driver.killpower")]
|
||||
|
||||
|
||||
# --------------------------------------------------------------------------- #
|
||||
# The certificate authority's writes (phase 15 task 04)
|
||||
# --------------------------------------------------------------------------- #
|
||||
|
||||
|
||||
@pytest.fixture
|
||||
def cert_app(tmp_path: Path) -> Iterator[TestClient]:
|
||||
"""A signed-in client on an app with **one configured agent** and no live host.
|
||||
|
||||
What these routes *do* is `tests/test_api.py`'s business; this file asks only whether the gate
|
||||
stops a write before it reaches `certs.py`. The target is a dead loopback port because a
|
||||
certificate route is never allowed to dial anything (invariant 1) — the stored agent table is
|
||||
the wire here, which is what the assertions below read.
|
||||
"""
|
||||
db = tmp_path / "certs-gate.sqlite3"
|
||||
store = SampleStore(str(db))
|
||||
try:
|
||||
app = create_app(Settings(db_path=str(db), admin_password=ADMIN_PASSWORD,
|
||||
pbkdf2_iterations=FAST_PBKDF2,
|
||||
host_targets=(Target(name="deskwork",
|
||||
url="https://127.0.0.1:1"),),
|
||||
host_interval=3600.0, disks_interval=3600.0), store)
|
||||
with TestClient(app, follow_redirects=False) as client:
|
||||
sign_in(client)
|
||||
yield client
|
||||
finally:
|
||||
store.close()
|
||||
|
||||
|
||||
def test_anonymous_calls_see_no_certificate_list_and_no_bundle(anon: TestClient) -> None:
|
||||
"""The named, explicit version of the route-walk proof.
|
||||
|
||||
`test_every_route_that_is_not_public_requires_a_session` walks the served table and cannot miss
|
||||
a route; this test is here so the *bundle* route — every agent's private key, behind a login —
|
||||
has one assertion that says what it is about, and so a redirect that would leak the existence of
|
||||
a host name into a `Location` header is caught as deliberately as the 401 is.
|
||||
"""
|
||||
listing = anon.get("/api/certs", headers=JSON_ACCEPT)
|
||||
assert listing.status_code == 401
|
||||
assert listing.json() == {"ok": False, "detail": "sign in required", "login": "/login"}
|
||||
assert "no-store" in listing.headers["cache-control"]
|
||||
|
||||
bundle = anon.get("/api/certs/deskwork/bundle", headers=JSON_ACCEPT)
|
||||
assert bundle.status_code == 401, "a bundle is a private key with a filename on it"
|
||||
assert "location" not in bundle.headers
|
||||
|
||||
for write in (anon.post("/api/certs/deskwork/rotate"),
|
||||
anon.post("/api/certs/deskwork/revoke"),
|
||||
anon.post("/api/certs/root/rotate")):
|
||||
assert write.status_code == 401, write.url
|
||||
assert write.json() == {"ok": False, "detail": "sign in required", "login": "/login"}
|
||||
assert "no-store" in write.headers["cache-control"]
|
||||
|
||||
|
||||
def test_a_cert_write_without_the_csrf_token_changes_no_stored_row(
|
||||
cert_app: TestClient) -> None:
|
||||
"""The UPS wire test's shape on the CA's own writes, with the row as the wire.
|
||||
|
||||
Proven in both directions on purpose: a gate that refused every write would pass a test that
|
||||
only asserted the refusal, and a route that wrote before checking would pass one that only
|
||||
asserted the success. The stored agent table is what a rotation changes, so it is what is read.
|
||||
"""
|
||||
def issued() -> dict[str, Any]:
|
||||
rows: list[dict[str, Any]] = cert_app.get("/api/certs").json()["agents"]
|
||||
return rows[0]
|
||||
|
||||
assert issued()["status"] == "unissued" and issued()["bundle_rev"] is None
|
||||
|
||||
csrf = str(cert_app.headers.get(auth.CSRF_HEADER))
|
||||
del cert_app.headers[auth.CSRF_HEADER]
|
||||
refused = cert_app.post("/api/certs/deskwork/rotate")
|
||||
assert refused.status_code == 403
|
||||
assert "csrf" in refused.json()["detail"].lower()
|
||||
assert issued()["status"] == "unissued", "a key was minted by a write the gate refused"
|
||||
|
||||
cert_app.headers[auth.CSRF_HEADER] = csrf
|
||||
accepted = cert_app.post("/api/certs/deskwork/rotate")
|
||||
assert accepted.status_code == 200, accepted.text
|
||||
assert accepted.json()["bundle_rev"] == 1
|
||||
assert issued()["bundle_rev"] == 1
|
||||
|
||||
|
||||
def test_a_cross_origin_cert_write_is_refused_before_the_authority_is_touched(
|
||||
cert_app: TestClient) -> None:
|
||||
"""The origin half of the gate on a route whose effect is durable and fleet-wide."""
|
||||
cross_site = cert_app.post("/api/certs/deskwork/revoke",
|
||||
headers={"origin": "https://elsewhere.example"})
|
||||
assert cross_site.status_code == 403
|
||||
assert "cross-origin" in cross_site.json()["detail"]
|
||||
|
||||
stalled = cert_app.post("/api/certs/root/rotate", headers={"sec-fetch-site": "cross-site"})
|
||||
assert stalled.status_code == 403
|
||||
assert cert_app.get("/api/certs").json()["agents"][0]["status"] == "unissued", (
|
||||
"nothing moved: not the host's identity and not the root")
|
||||
|
||||
# …and the same request with nothing forged is an ordinary gated write.
|
||||
assert cert_app.post("/api/certs/deskwork/revoke").status_code == 200
|
||||
|
||||
|
||||
def test_a_cross_origin_write_is_refused_even_with_a_session_and_a_csrf_token(
|
||||
authed: TestClient) -> None:
|
||||
response = authed.post("/api/ups/command", json=WRITE,
|
||||
@@ -1493,7 +1598,8 @@ def test_the_served_route_table_is_the_surface_the_gate_describes(anon: TestClie
|
||||
pages = sorted(str(route.path) for route in served_routes(anon)
|
||||
if isinstance(getattr(route, "path", None), str)
|
||||
and not str(route.path).startswith(("/api", "/static")))
|
||||
assert pages == ["/", "/disks", "/llm", "/login", "/settings", "/system", "/ups"]
|
||||
assert pages == ["/", "/certs", "/disks", "/llm", "/login", "/settings", "/system",
|
||||
"/ups"]
|
||||
for path in pages:
|
||||
response = anon.get(path, headers=BROWSER_HEADERS)
|
||||
if path == "/login":
|
||||
|
||||
Reference in New Issue
Block a user