vaultik/internal/vaultik/blob_fetch_hash_test.go

package vaultik_test

import (
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"strings"
	"testing"

	"filippo.io/age"
	"sneak.berlin/go/vaultik/internal/blobgen"
	"sneak.berlin/go/vaultik/internal/vaultik"
)

// buildHashTestBlob encrypts plaintext with blobgen.Writer and returns
// the encrypted bytes plus the expected double-SHA-256 hash.
func buildHashTestBlob(
	t *testing.T, identity *age.X25519Identity, plaintext []byte,
) ([]byte, string) {
	t.Helper()

	var encBuf bytes.Buffer

	writer, err := blobgen.NewWriter(&encBuf, 1,
		[]string{identity.Recipient().String()})
	if err != nil {
		t.Fatalf("creating blobgen writer: %v", err)
	}

	_, err = writer.Write(plaintext)
	if err != nil {
		t.Fatalf("writing plaintext: %v", err)
	}

	err = writer.Close()
	if err != nil {
		t.Fatalf("closing writer: %v", err)
	}

	// Compute the double-SHA-256 hash of the plaintext (matches
	// blobgen.Writer.ContentID).
	firstHash := sha256.Sum256(plaintext)
	secondHash := sha256.Sum256(firstHash[:])
	correctHash := hex.EncodeToString(secondHash[:])

	// Verify our hash matches what blobgen.Writer produces
	writerHash := hex.EncodeToString(writer.ContentID())
	if correctHash != writerHash {
		t.Fatalf("hash computation mismatch: manual=%s, writer=%s",
			correctHash, writerHash)
	}

	return encBuf.Bytes(), correctHash
}

// TestFetchBlobRejectsMalformedHash verifies FetchBlob refuses a blob hash
// that is not 64 lowercase hex characters before it builds a storage path
// or issues any request. The hash reaches FetchBlob from the snapshot
// database, which is not trusted, so a value such as one containing "/.."
// must never reach the store.
func TestFetchBlobRejectsMalformedHash(t *testing.T) {
	t.Parallel()

	mockStorage := NewMockStorer()
	tv := vaultik.NewForTesting(mockStorage)
	ctx := context.Background()

	for _, bad := range []string{
		"aa/../../../home/u/.profile",
		"abc",
		strings.Repeat("A", 64), // uppercase hex is not accepted
		strings.Repeat("g", 64), // not hex
	} {
		_, err := tv.FetchBlob(ctx, bad)
		if err == nil {
			t.Fatalf("expected error for malformed hash %q, got nil", bad)
		}
	}

	if calls := mockStorage.GetCalls(); len(calls) != 0 {
		t.Fatalf("storage was accessed for a malformed hash: %v", calls)
	}
}

// TestFetchAndDecryptBlobVerifiesHash verifies that FetchAndDecryptBlob checks
// the double-SHA-256 hash of the decrypted plaintext against the expected blob hash.
func TestFetchAndDecryptBlobVerifiesHash(t *testing.T) {
	t.Parallel()

	identity, err := age.GenerateX25519Identity()
	if err != nil {
		t.Fatalf("generating identity: %v", err)
	}

	plaintext := []byte("hello world test data for blob hash verification")
	encryptedData, correctHash := buildHashTestBlob(t, identity, plaintext)

	// Set up mock storage with the blob at the correct path
	mockStorage := NewMockStorer()
	blobPath := "blobs/" + correctHash[:2] + "/" +
		correctHash[2:4] + "/" + correctHash

	mockStorage.mu.Lock()
	mockStorage.data[blobPath] = encryptedData
	mockStorage.mu.Unlock()

	tv := vaultik.NewForTesting(mockStorage)
	ctx := context.Background()

	t.Run("correct hash succeeds", func(t *testing.T) {
		t.Parallel()

		rc, err := tv.FetchAndDecryptBlob(
			ctx, correctHash, int64(len(plaintext)), identity)
		if err != nil {
			t.Fatalf("expected success, got error: %v", err)
		}

		data, err := io.ReadAll(rc)
		if err != nil {
			t.Fatalf("reading stream: %v", err)
		}

		err = rc.Close()
		if err != nil {
			t.Fatalf("close (hash verification) failed: %v", err)
		}

		if !bytes.Equal(data, plaintext) {
			t.Fatalf("decrypted data mismatch: got %q, want %q", data, plaintext)
		}
	})

	t.Run("wrong hash fails", func(t *testing.T) {
		t.Parallel()

		// Use a fake hash that doesn't match the actual plaintext
		fakeHash := strings.Repeat("ab", 32) // 64 hex chars
		fakePath := "blobs/" + fakeHash[:2] + "/" + fakeHash[2:4] + "/" + fakeHash

		mockStorage.mu.Lock()
		mockStorage.data[fakePath] = encryptedData
		mockStorage.mu.Unlock()

		rc, err := tv.FetchAndDecryptBlob(
			ctx, fakeHash, int64(len(plaintext)), identity)
		if err != nil {
			t.Fatalf("unexpected error opening stream: %v", err)
		}
		// Read all data — hash is verified on Close
		_, _ = io.ReadAll(rc)

		err = rc.Close()
		if err == nil {
			t.Fatal("expected error for mismatched hash, got nil")
		}

		if !strings.Contains(err.Error(), "hash mismatch") {
			t.Fatalf("expected hash mismatch error, got: %v", err)
		}
	})
}

// TestFetchAndDecryptBlobCloseBeforeEOFFails verifies the hash check
// cannot be skipped: a caller that reads only part of the blob and then
// closes gets an error rather than silently unverified bytes.
func TestFetchAndDecryptBlobCloseBeforeEOFFails(t *testing.T) {
	t.Parallel()

	identity, err := age.GenerateX25519Identity()
	if err != nil {
		t.Fatalf("generating identity: %v", err)
	}

	plaintext := []byte("hello world test data for blob hash verification")
	encryptedData, correctHash := buildHashTestBlob(t, identity, plaintext)

	mockStorage := NewMockStorer()
	blobPath := "blobs/" + correctHash[:2] + "/" +
		correctHash[2:4] + "/" + correctHash

	mockStorage.mu.Lock()
	mockStorage.data[blobPath] = encryptedData
	mockStorage.mu.Unlock()

	tv := vaultik.NewForTesting(mockStorage)

	rc, err := tv.FetchAndDecryptBlob(
		context.Background(), correctHash, int64(len(plaintext)), identity)
	if err != nil {
		t.Fatalf("unexpected error opening stream: %v", err)
	}

	// Read one byte, far short of the plaintext length, then close.
	buf := make([]byte, 1)

	_, err = rc.Read(buf)
	if err != nil {
		t.Fatalf("reading first byte: %v", err)
	}

	err = rc.Close()
	if err == nil {
		t.Fatal("expected error closing before EOF, got nil")
	}

	if !strings.Contains(err.Error(), "hash not verified") {
		t.Fatalf("expected not-verified error, got: %v", err)
	}
}