Keep Mongo operations online across Vault credential rotation

backend/shared/database/vault/issuer_test.go

@@ -0,0 +1,79 @@
+package vault
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestIssuerLifetimeEncodingAndCleanup(t *testing.T) {
+	for _, test := range []struct {
+		name                     string
+		identityTTL, databaseTTL int
+		reject                   bool
+		wantError                bool
+	}{
+		{"identity limits lease", 4, 20, false, false},
+		{"database limits lease", 20, 4, false, false},
+		{"invalid identity", 0, 20, false, true},
+		{"invalid database lifetime", 20, 0, false, true},
+		{"rejected issuance", 20, 20, true, true},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			var revoked atomic.Bool
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				switch r.URL.Path {
+				case "/v1/auth/approle/login":
+					_ = json.NewEncoder(w).Encode(map[string]any{"auth": map[string]any{"client_token": "private-token", "lease_duration": test.identityTTL}})
+				case "/v1/database/creds/bff":
+					if test.reject {
+						http.Error(w, "private-password", 403)
+						return
+					}
+					_ = json.NewEncoder(w).Encode(map[string]any{"lease_id": "lease", "lease_duration": test.databaseTTL, "data": map[string]string{"username": "user@host", "password": "p@ss:/?#"}})
+				case "/v1/auth/token/revoke-self":
+					if r.Header.Get("X-Vault-Token") == "private-token" {
+						revoked.Store(true)
+					}
+					w.WriteHeader(204)
+				default:
+					w.WriteHeader(404)
+				}
+			}))
+			defer server.Close()
+			directory := t.TempDir()
+			identity, secret := filepath.Join(directory, "identity"), filepath.Join(directory, "secret")
+			require.NoError(t, os.WriteFile(identity, []byte("identity"), 0600))
+			require.NoError(t, os.WriteFile(secret, []byte("secret"), 0600))
+			issuer, err := New(Config{Address: server.URL, DatabaseRole: "bff", RoleIDFile: identity, SecretIDFile: secret}, "mongodb://localhost/db?authSource=admin")
+			require.NoError(t, err)
+			started := time.Now()
+			lease, err := issuer.Issue(context.Background())
+			if test.wantError {
+				require.Error(t, err)
+				require.NotContains(t, err.Error(), "private-")
+				require.True(t, revoked.Load())
+				return
+			}
+			require.NoError(t, err)
+			require.WithinDuration(t, started.Add(4*time.Second), lease.ExpiresAt, time.Second)
+			parsed, err := url.Parse(lease.URI)
+			require.NoError(t, err)
+			require.Equal(t, "user@host", parsed.User.Username())
+			password, _ := parsed.User.Password()
+			require.Equal(t, "p@ss:/?#", password)
+			require.False(t, revoked.Load())
+			require.NoError(t, lease.Revoke(context.Background()))
+			require.True(t, revoked.Load())
+		})
+	}
+}