stack/hw/test/yubikey.bats

#!/usr/bin/env bats
# Tests for YubiKey enrollment logic

load test_helper

setup() {
    setup_test_work
    source_nanny_functions
    mkdir -p "${TEST_WORK}/ssh-keys"
}

teardown() {
    teardown_test_work
}

# ─── YubiKey manifest format ───

@test "yubikey manifest entry has correct format" {
    cat > "$YKCONF" << 'YK'
YUBIKEY_1=12345678|YubiKey 5 NFC|5.4.3|yubikey1_storagenode.pub
YK
    local line
    line=$(grep "^YUBIKEY_1=" "$YKCONF")
    local field_count
    field_count=$(echo "$line" | cut -d= -f2 | tr '|' '\n' | wc -l)
    assert_equal "$field_count" "4"
}

@test "yubikey manifest stores serial as first field" {
    cat > "$YKCONF" << 'YK'
YUBIKEY_1=12345678|YubiKey 5 NFC|5.4.3|yubikey1_storagenode.pub
YK
    local serial
    serial=$(grep "^YUBIKEY_1=" "$YKCONF" | cut -d= -f2 | cut -d'|' -f1)
    assert_equal "$serial" "12345678"
}

@test "yubikey manifest stores type as second field" {
    cat > "$YKCONF" << 'YK'
YUBIKEY_1=12345678|YubiKey 5 NFC|5.4.3|yubikey1_storagenode.pub
YK
    local type
    type=$(grep "^YUBIKEY_1=" "$YKCONF" | cut -d= -f2 | cut -d'|' -f2)
    assert_equal "$type" "YubiKey 5 NFC"
}

@test "yubikey manifest stores firmware as third field" {
    cat > "$YKCONF" << 'YK'
YUBIKEY_1=12345678|YubiKey 5 NFC|5.4.3|yubikey1_storagenode.pub
YK
    local fw
    fw=$(grep "^YUBIKEY_1=" "$YKCONF" | cut -d= -f2 | cut -d'|' -f3)
    assert_equal "$fw" "5.4.3"
}

@test "yubikey manifest references SSH pubkey filename" {
    cat > "$YKCONF" << 'YK'
YUBIKEY_1=12345678|YubiKey 5 NFC|5.4.3|yubikey1_storagenode.pub
YK
    local pubkey
    pubkey=$(grep "^YUBIKEY_1=" "$YKCONF" | cut -d= -f2 | cut -d'|' -f4)
    assert_equal "$pubkey" "yubikey1_storagenode.pub"
}

# ─── Duplicate YubiKey detection ───

@test "duplicate yubikey serial is detected" {
    cat > "$YKCONF" << 'YK'
YUBIKEY_1=12345678|YubiKey 5 NFC|5.4.3|yubikey1_storagenode.pub
YK
    run grep -q "12345678" "$YKCONF"
    assert_success
}

@test "different yubikey serial is not flagged" {
    cat > "$YKCONF" << 'YK'
YUBIKEY_1=12345678|YubiKey 5 NFC|5.4.3|yubikey1_storagenode.pub
YK
    run grep -q "99999999" "$YKCONF"
    assert_failure
}

# ─── authorized_keys generation ───

@test "authorized_keys includes all pubkeys" {
    echo "sk-ssh-ed25519 AAAA key1-comment" > "${TEST_WORK}/ssh-keys/yubikey1_storagenode.pub"
    echo "sk-ssh-ed25519 BBBB key2-comment" > "${TEST_WORK}/ssh-keys/yubikey2_storagenode.pub"

    {
        echo "# Generated by nanny.sh"
        for kf in "${TEST_WORK}"/ssh-keys/*.pub; do
            [ -f "$kf" ] || continue
            echo "# $(basename "$kf")"
            cat "$kf"
        done
    } > "${TEST_WORK}/authorized_keys"

    run grep -c "sk-ssh-ed25519" "${TEST_WORK}/authorized_keys"
    assert_output "2"
}

@test "authorized_keys has comment headers per key" {
    echo "sk-ssh-ed25519 AAAA key1" > "${TEST_WORK}/ssh-keys/yubikey1_storagenode.pub"

    {
        echo "# Generated by nanny.sh"
        for kf in "${TEST_WORK}"/ssh-keys/*.pub; do
            [ -f "$kf" ] || continue
            echo "# $(basename "$kf")"
            cat "$kf"
        done
    } > "${TEST_WORK}/authorized_keys"

    run grep "# yubikey1_storagenode.pub" "${TEST_WORK}/authorized_keys"
    assert_success
}

@test "authorized_keys with ed25519 fallback (non-FIDO key)" {
    echo "ssh-ed25519 CCCC non-fido-key" > "${TEST_WORK}/ssh-keys/yubikey1_storagenode.pub"

    {
        for kf in "${TEST_WORK}"/ssh-keys/*.pub; do
            cat "$kf"
        done
    } > "${TEST_WORK}/authorized_keys"

    run grep "ssh-ed25519" "${TEST_WORK}/authorized_keys"
    assert_success
}

# ─── YubiKey state tracking ───

@test "yubikey enrollment marks state for key 1" {
    state_mark "yubikey_1"
    run state_done "yubikey_1"
    assert_success
    run state_done "yubikey_2"
    assert_failure
}

@test "yubikey enrollment marks state for both keys" {
    state_mark "yubikey_1"
    state_mark "yubikey_2"
    run state_done "yubikey_1"
    assert_success
    run state_done "yubikey_2"
    assert_success
}

@test "authorized_keys generation marks state" {
    state_mark "phase2_authkeys"
    run state_done "phase2_authkeys"
    assert_success
}