Separate vault and gateway passphrases

2026-05-20 00:27:43 -03:00
parent e24daf54c1
commit 18c67ef27d
8 changed files with 144 additions and 41 deletions
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+"""Smoke-test vault/content and gateway relay passphrases stay separate."""
+
+import importlib.util
+import os
+import pathlib
+import sys
+
+
+PROJECT_ID = "11111111-1111-1111-1111-111111111111"
+ACCOUNT_ID = "22222222-2222-2222-2222-222222222222"
+
+
+def load_module():
+    script_path = pathlib.Path(__file__).resolve().parents[1] / "resources" / "scripts" / "napseer_mcp_server.py"
+    sys.path.insert(0, str(script_path.parent))
+    spec = importlib.util.spec_from_file_location("napseer_mcp_server_two_passphrase_test", script_path)
+    module = importlib.util.module_from_spec(spec)
+    assert spec and spec.loader
+    spec.loader.exec_module(module)
+    return module
+
+
+def run():
+    mod = load_module()
+    original_env = dict(os.environ)
+    try:
+        os.environ.pop("NAPSEER_VAULT_PASSPHRASE", None)
+        os.environ.pop("NAPSEER_MASTER_PASSPHRASE", None)
+        os.environ["NAPSEER_GATEWAY_PASSPHRASE"] = "gateway-only"
+        mod.PROJECT_VAULT_PASSPHRASE = None
+
+        try:
+            mod.gateway_generate_project_vault_setup_payload(PROJECT_ID, "setup-1")
+        except RuntimeError as exc:
+            assert "NAPSEER_VAULT_PASSPHRASE" in str(exc)
+        else:
+            raise AssertionError("gateway relay passphrase must not wrap project bundles")
+
+        os.environ["NAPSEER_VAULT_PASSPHRASE"] = "vault-content"
+        mod.AUTH = {"agent_id": "gateway-agent-1", "account_id": ACCOUNT_ID}
+        payload = mod.gateway_generate_project_vault_setup_payload(PROJECT_ID, "setup-2")
+        assert {item["secret_kind"] for item in payload["project_secrets"]} == {"chat", "tabs", "gateway", "memory"}
+        first = payload["project_secrets"][0]["wrapped_key_bundle"]
+        assert mod.unwrap_project_key_bundle(first)["project_id"] == PROJECT_ID
+
+        os.environ["NAPSEER_VAULT_PASSPHRASE"] = "wrong-vault-content"
+        mod.PROJECT_VAULT_PASSPHRASE = None
+        try:
+            mod.unwrap_project_key_bundle(first)
+        except RuntimeError:
+            pass
+        else:
+            raise AssertionError("project bundle unwrap must require the vault/content passphrase")
+
+        mod.PROJECT_VAULT_PASSPHRASE = "manual-vault"
+        assert mod.project_bundle_passphrase() == "manual-vault"
+    finally:
+        os.environ.clear()
+        os.environ.update(original_env)
+
+    print("ok: two passphrase boundary smoke passed")
+
+
+if __name__ == "__main__":
+    run()