mirror of
https://github.com/netbirdio/netbird.git
synced 2026-09-13 18:29:07 +02:00
riccardom
07dc9cb1c8
ConfigFromJSON refused a document with no WireGuard or SSH key. A config legitimately has none between a logout and the next login: mobile LogoutProfile clears both in place and writes the profile back, so the peer re-registers on the next login instead of returning as itself. So the refusal broke the mobile flows it was meant to protect. On iOS and tvOS the stored JSON of a logged-out profile stopped loading through Client.SetConfigFromJSON and Auth.SetConfigFromJSON, and copyConfig — which round-trips a Config through JSON to take an in-memory copy before applying the MDM overlay — failed on the same document. Where the old code silently minted a key, this returned an error, which is worse for logout and profile switching alike: neither is asking to connect. The deserializer now stays out of the identity question in both directions: it does not generate one (a read cannot hand back keys nothing will write down) and does not refuse one that is absent. Whoever goes on to connect is where an absent identity has to be answered — and it already is, by the login path that provisions and persists. ErrConfigWithoutIdentity goes with it; nothing else used it.
45 lines
1.7 KiB
Go
45 lines
1.7 KiB
Go
package profilemanager
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
// The serialized form is how the tvOS SDK stores a profile and how the iOS SDK
|
|
// copies one in memory, so it must round-trip whatever a profile legitimately
|
|
// holds — including no identity at all, which is the state mobile logout leaves
|
|
// behind when it clears both keys in place. Refusing that document here broke
|
|
// logout, profile switching and the login that follows them.
|
|
func TestConfigFromJSONRoundTripsALoggedOutProfile(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "exported.json")
|
|
stored, err := UpdateOrCreateConfig(ConfigInput{ConfigPath: path, ManagementURL: DefaultManagementURL})
|
|
require.NoError(t, err)
|
|
require.NotEmpty(t, stored.PrivateKey, "a provisioned config is the fixture this test starts from")
|
|
require.NotEmpty(t, stored.SSHKey)
|
|
|
|
exported, err := ConfigToJSON(stored)
|
|
require.NoError(t, err)
|
|
|
|
restored, err := ConfigFromJSON(exported)
|
|
require.NoError(t, err, "a config exported after a login must load")
|
|
require.Equal(t, stored.PrivateKey, restored.PrivateKey, "the restored peer is not the stored one")
|
|
require.Equal(t, stored.SSHKey, restored.SSHKey)
|
|
|
|
// What mobile logout leaves on disk.
|
|
loggedOut := stored.clone()
|
|
loggedOut.PrivateKey = ""
|
|
loggedOut.SSHKey = ""
|
|
|
|
document, err := ConfigToJSON(loggedOut)
|
|
require.NoError(t, err)
|
|
|
|
reloaded, err := ConfigFromJSON(document)
|
|
require.NoError(t, err, "a logged-out profile must still load")
|
|
require.Empty(t, reloaded.PrivateKey, "loading must not mint a key nothing will write down")
|
|
require.Empty(t, reloaded.SSHKey)
|
|
require.Equal(t, stored.ManagementURL.String(), reloaded.ManagementURL.String(),
|
|
"the rest of the profile survives the logout")
|
|
}
|