feat(lib): use new challenge creation flow (#749)

* feat(decaymap): add Delete method Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(lib/challenge): refactor Validate to take ValidateInput Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib): implement store interface Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib/store): all metapackage to import all store implementations Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(policy): import all store backends Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib): use new challenge creation flow Previously Anubis constructed challenge strings from request metadata. This was a good idea in spirit, but has turned out to be a very bad idea in practice. This new flow reuses the Store facility to dynamically create challenge values with completely random data. This is a fairly big rewrite of how Anubis processes challenges. Right now it defaults to using the in-memory storage backend, but on-disk (boltdb) and valkey-based adaptors will come soon. Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(decaymap): fix documentation typo Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(lib): fix SA4004 Signed-off-by: Xe Iaso <me@xeiaso.net> * test(lib/store): make generic storage interface test adaptor Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: spelling Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(decaymap): invert locking process for Delete Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib/store): add bbolt store implementation Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: spelling Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: go mod tidy Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(devcontainer): adapt to docker compose, add valkey service Signed-off-by: Xe Iaso <me@xeiaso.net> * fix(lib): make challenges live for 30 minutes by default Signed-off-by: Xe Iaso <me@xeiaso.net> * feat(lib/store): implement valkey backend Signed-off-by: Xe Iaso <me@xeiaso.net> * test(lib/store/valkey): disable tests if not using docker Signed-off-by: Xe Iaso <me@xeiaso.net> * test(lib/policy/config): ensure valkey stores can be loaded Signed-off-by: Xe Iaso <me@xeiaso.net> * Update metadata check-spelling run (pull_request) for Xe/store-interface Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com> on-behalf-of: @check-spelling <check-spelling-bot@check-spelling.dev> * chore(devcontainer): remove port forwards because vs code handles that for you Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(default-config): add a nudge to the storage backends section of the docs Signed-off-by: Xe Iaso <me@xeiaso.net> * chore(docs): listen on 0.0.0.0 for dev container support Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(policy): document storage backends Signed-off-by: Xe Iaso <me@xeiaso.net> * docs: update CHANGELOG and internal links Signed-off-by: Xe Iaso <me@xeiaso.net> * docs(admin/policies): don't start a sentence with as Signed-off-by: Xe Iaso <me@xeiaso.net> * chore: fixes found in review Signed-off-by: Xe Iaso <me@xeiaso.net> --------- Signed-off-by: Xe Iaso <me@xeiaso.net> Signed-off-by: check-spelling-bot <check-spelling-bot@users.noreply.github.com>
2025-07-04 20:42:28 +00:00 · 2025-07-04 20:42:28 +00:00 · dff2176beb
commit dff2176beb
parent 506d8817d5
43 changed files with 1539 additions and 140 deletions
--- a/lib/store/storetest/storetest.go
+++ b/lib/store/storetest/storetest.go
@ -0,0 +1,92 @@
+package storetest
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"testing"
+	"time"
+
+	"github.com/TecharoHQ/anubis/lib/store"
+)
+
+func Common(t *testing.T, f store.Factory, config json.RawMessage) {
+	if err := f.Valid(config); err != nil {
+		t.Fatal(err)
+	}
+
+	s, err := f.Build(t.Context(), config)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for _, tt := range []struct {
+		name string
+		doer func(t *testing.T, s store.Interface) error
+		err  error
+	}{
+		{
+			name: "basic get set delete",
+			doer: func(t *testing.T, s store.Interface) error {
+				if _, err := s.Get(t.Context(), t.Name()); !errors.Is(err, store.ErrNotFound) {
+					t.Errorf("wanted %s to not exist in store but it exists anyways", t.Name())
+				}
+
+				if err := s.Set(t.Context(), t.Name(), []byte(t.Name()), 5*time.Minute); err != nil {
+					return err
+				}
+
+				val, err := s.Get(t.Context(), t.Name())
+				if errors.Is(err, store.ErrNotFound) {
+					t.Errorf("wanted %s to exist in store but it does not", t.Name())
+				}
+
+				if !bytes.Equal(val, []byte(t.Name())) {
+					t.Logf("want: %q", t.Name())
+					t.Logf("got:  %q", string(val))
+					t.Error("wrong value returned")
+				}
+
+				if err := s.Delete(t.Context(), t.Name()); err != nil {
+					return err
+				}
+
+				if _, err := s.Get(t.Context(), t.Name()); !errors.Is(err, store.ErrNotFound) {
+					t.Error("wanted test to not exist in store but it exists anyways")
+				}
+
+				if err := s.Delete(t.Context(), t.Name()); err == nil {
+					t.Errorf("key %q does not exist and Delete did not return non-nil", t.Name())
+				}
+
+				return nil
+			},
+		},
+		{
+			name: "expires",
+			doer: func(t *testing.T, s store.Interface) error {
+				if err := s.Set(t.Context(), t.Name(), []byte(t.Name()), 150*time.Millisecond); err != nil {
+					return err
+				}
+
+				//nosleep:bypass XXX(Xe): use Go's time faking thing in Go 1.25 when that is released.
+				time.Sleep(155 * time.Millisecond)
+
+				if _, err := s.Get(t.Context(), t.Name()); !errors.Is(err, store.ErrNotFound) {
+					t.Errorf("wanted %s to not exist in store but it exists anyways", t.Name())
+				}
+
+				return nil
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			if err := tt.doer(t, s); !errors.Is(err, tt.err) {
+				t.Logf("want: %v", tt.err)
+				t.Logf("got:  %v", err)
+				t.Error("wrong error")
+			}
+		})
+	}
+}