Add elevation for dangerous ssh flags

client/cmd/elevate_test.go

@@ -0,0 +1,99 @@
+//go:build !ios && !android
+
+package cmd
+
+import (
+	"testing"
+
+	"github.com/spf13/cobra"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBuildSetSSHConfigArgs(t *testing.T) {
+	tr, fa := true, false
+
+	t.Run("enable root only, with daemon-addr", func(t *testing.T) {
+		got := buildSetSSHConfigArgs("prof", "alice", &tr, nil, "unix:///x.sock")
+		assert.Equal(t, []string{
+			SetSSHConfigCmdName, "--profile", "prof", "--username", "alice",
+			"--" + enableSSHRootFlag, "--daemon-addr", "unix:///x.sock",
+		}, got)
+	})
+
+	t.Run("disable auth only, no daemon-addr", func(t *testing.T) {
+		got := buildSetSSHConfigArgs("prof", "alice", nil, &tr, "")
+		assert.Equal(t, []string{
+			SetSSHConfigCmdName, "--profile", "prof", "--username", "alice",
+			"--" + disableSSHAuthFlag,
+		}, got)
+	})
+
+	t.Run("false pointers omit the flags", func(t *testing.T) {
+		got := buildSetSSHConfigArgs("", "", &fa, &fa, "")
+		assert.Equal(t, []string{SetSSHConfigCmdName}, got)
+	})
+
+	t.Run("both enabled", func(t *testing.T) {
+		got := buildSetSSHConfigArgs("p", "u", &tr, &tr, "")
+		assert.Equal(t, []string{
+			SetSSHConfigCmdName, "--profile", "p", "--username", "u",
+			"--" + enableSSHRootFlag, "--" + disableSSHAuthFlag,
+		}, got)
+	})
+}
+
+func TestBuildSetSSHConfigRequest(t *testing.T) {
+	tr := true
+
+	req := buildSetSSHConfigRequest("p", "u", &tr, nil)
+	assert.Equal(t, "p", req.ProfileName)
+	assert.Equal(t, "u", req.Username)
+	if assert.NotNil(t, req.EnableSSHRoot) {
+		assert.True(t, *req.EnableSSHRoot)
+	}
+	assert.Nil(t, req.DisableSSHAuth, "an unset flag must leave the daemon value untouched")
+}
+
+func TestWantsDangerousSSH(t *testing.T) {
+	origRoot, origAuth := enableSSHRoot, disableSSHAuth
+	t.Cleanup(func() { enableSSHRoot, disableSSHAuth = origRoot, origAuth })
+
+	newCmd := func() *cobra.Command {
+		enableSSHRoot, disableSSHAuth = false, false
+		c := &cobra.Command{Use: "x"}
+		c.Flags().BoolVar(&enableSSHRoot, enableSSHRootFlag, false, "")
+		c.Flags().BoolVar(&disableSSHAuth, disableSSHAuthFlag, false, "")
+		return c
+	}
+
+	// wantsDangerousSSH fires only in the privileged direction.
+	t.Run("enable root true is dangerous", func(t *testing.T) {
+		c := newCmd()
+		require.NoError(t, c.Flags().Set(enableSSHRootFlag, "true"))
+		assert.True(t, wantsDangerousSSH(c))
+	})
+
+	t.Run("enable root false is not dangerous", func(t *testing.T) {
+		c := newCmd()
+		require.NoError(t, c.Flags().Set(enableSSHRootFlag, "false"))
+		assert.False(t, wantsDangerousSSH(c))
+	})
+
+	t.Run("disable auth true is dangerous", func(t *testing.T) {
+		c := newCmd()
+		require.NoError(t, c.Flags().Set(disableSSHAuthFlag, "true"))
+		assert.True(t, wantsDangerousSSH(c))
+	})
+
+	t.Run("disable auth false is not dangerous", func(t *testing.T) {
+		c := newCmd()
+		require.NoError(t, c.Flags().Set(disableSSHAuthFlag, "false"))
+		assert.False(t, wantsDangerousSSH(c))
+	})
+
+	t.Run("nothing changed is not dangerous", func(t *testing.T) {
+		c := newCmd()
+		assert.False(t, wantsDangerousSSH(c))
+	})
+}