feat: move step-ca into a plugin (C4)

src/backend/tests/hosts/connect/pipeline.test.ts

@@ -18,8 +18,6 @@ vi.mock("ssh2", async (importOriginal) => {
 const mocks = vi.hoisted(() => ({
   verifier: () => {},
   createHostVerifier: vi.fn(),
-  getStepCaCert: vi.fn(),
-  invalidateStepCaCert: vi.fn(),
   applyCertificateAuth: vi.fn(),
   getVaultCert: vi.fn(),
   deleteVaultCert: vi.fn(),
@@ -40,10 +38,6 @@ vi.mock("../../../hosts/host-key-verifier.js", () => ({
     createHostVerifier: mocks.createHostVerifier,
   },
 }));
-vi.mock("../../../hosts/step-ca-auth.js", () => ({
-  getStepCaCert: mocks.getStepCaCert,
-  invalidateStepCaCert: mocks.invalidateStepCaCert,
-}));
 vi.mock("@termix/plugin-sdk/ssh-certs", () => ({
   applyCertificateAuth: mocks.applyCertificateAuth,
 }));
@@ -276,25 +270,20 @@ describe("buildConnectConfig per auth type", () => {
   // OPKSSH is a plugin-registered SSH auth provider now: see
   // plugins/opkssh/tests/backend/provider.test.ts.
 
-  it("stepca without a cached certificate asks for a sign-in", async () => {
-    mocks.getStepCaCert.mockReturnValueOnce(null);
-    const { outcome } = await build(host({ authType: "stepca" }));
-    expect(outcome).toMatchObject({
-      status: "interaction-required",
-      interaction: "stepca",
-    });
-    expect(mocks.getStepCaCert).toHaveBeenCalledWith("user-1", 7);
-  });
+  // Step CA is the step-ca plugin's provider: see
+  // plugins/step-ca/tests/backend/step-ca.test.ts.
 
-  it("stepca uses the cached certificate", async () => {
-    mocks.getStepCaCert.mockReturnValueOnce({
-      privateKey: "k",
-      sshCert: "c",
+  it("a stepca host without the step-ca plugin names it", async () => {
+    setSshAuthTypeOwnerSource(() => [
+      { type: "stepca", pluginId: "step-ca", pluginName: "Step CA" },
+    ]);
+    const { outcome } = await build(host({ authType: "stepca" }));
+    expect(outcome).toEqual({
+      status: "error",
+      code: "provider-missing",
+      message: "This host uses stepca, which needs the Step CA plugin",
     });
-    const { config, outcome } = await build(host({ authType: "stepca" }));
-    expect(outcome.status).toBe("ready");
-    expect(config.authHandler).toBe("cert-handler");
-    expect(mocks.applyCertificateAuth).toHaveBeenCalledOnce();
+    setSshAuthTypeOwnerSource(() => []);
   });
 
   it("vault needs a profile, then a cached certificate", async () => {
@@ -465,18 +454,20 @@ describe("connectHost", () => {
   });
 
   it("throws the auth outcome instead of connecting", async () => {
-    mocks.getStepCaCert.mockReturnValue(null);
-    const attempt = connectHost(host({ authType: "stepca" }), {
+    mocks.getVaultCert.mockResolvedValue(null);
+    const vaultHost = () =>
+      host({ authType: "vault", vaultProfile: { id: 3 } });
+    const attempt = connectHost(vaultHost(), {
       userId: "user-1",
       purpose: "tmux",
     });
     await expect(attempt).rejects.toBeInstanceOf(SshConnectError);
     await expect(
-      connectHost(host({ authType: "stepca" }), {
+      connectHost(vaultHost(), {
         userId: "user-1",
         purpose: "tmux",
       }).catch((error) => error.code),
-    ).resolves.toBe("stepca-required");
+    ).resolves.toBe("vault-required");
   });
 
   it("goes through the jump chain and forwards to the target", async () => {
@@ -628,18 +619,18 @@ describe("connectHost", () => {
 
   it("lets the provider react to an auth failure", async () => {
     FakeSshClient.nextBehaviour = ["auth-fail"];
-    mocks.getStepCaCert.mockReturnValueOnce({
+    mocks.getVaultCert.mockResolvedValueOnce({
       privateKey: "k",
       sshCert: "c",
     });
     await expect(
-      connectHost(host({ authType: "stepca" }), {
+      connectHost(host({ authType: "vault", vaultProfile: { id: 3 } }), {
         userId: "user-1",
         purpose: "fleet",
       }),
     ).rejects.toThrow(/All configured authentication methods failed/);
     await vi.waitFor(() =>
-      expect(mocks.invalidateStepCaCert).toHaveBeenCalledWith("user-1", 7),
+      expect(mocks.deleteVaultCert).toHaveBeenCalledWith("user-1", 3),
     );
   });
 

src/backend/tests/hosts/step-ca-auth.test.ts

@@ -1,184 +0,0 @@
-import { beforeEach, describe, expect, it, vi } from "vitest";
-import type { WebSocket } from "ws";
-
-const state = vi.hoisted(() => ({
-  sent: [] as Array<Record<string, unknown>>,
-  parseInfo: {
-    publicKeyLine: "ssh-ed25519 TESTKEY",
-    principals: ["alice"],
-    validAfter: new Date(Date.now() - 60_000),
-    validBefore: new Date(Date.now() + 60 * 60_000),
-  },
-  idToken: "",
-  command: null as Record<string, string> | null,
-  remoteResult: null as { ok: boolean; message: string } | null,
-  runtimeComplete: vi.fn(async () => undefined),
-}));
-
-vi.mock("../../utils/logger.js", () => ({
-  sshLogger: { error: vi.fn(), warn: vi.fn(), info: vi.fn() },
-}));
-vi.mock("../../database/repositories/factory.js", () => ({
-  createCurrentSettingsRepository: () => ({
-    get: async (key: string) =>
-      ({
-        step_ca_url: "https://ca.example",
-        step_ca_fingerprint: "a".repeat(64),
-        step_ca_provisioner: "oidc",
-      })[key],
-  }),
-}));
-vi.mock("../../utils/step-ca-egress.js", () => ({
-  readStepCaPrivateAllowlist: async () => [],
-}));
-vi.mock("../../utils/step-ca-client.js", () => ({
-  fetchRootCertificate: async () => "ROOT",
-  findOidcProvisioner: async () => ({
-    clientID: "client",
-    configurationEndpoint: "https://idp.example/.well-known/openid",
-  }),
-  discoverOidcEndpoints: async () => ({
-    authorizationEndpoint: "https://idp.example/auth",
-    tokenEndpoint: "https://idp.example/token",
-  }),
-  createPkce: () => ({ verifier: "verifier", challenge: "challenge" }),
-  generateSshKeyPair: () => ({
-    publicKeyLine: "ssh-ed25519 TESTKEY",
-    privateKeyPem: "PRIVATE",
-  }),
-  buildAuthorizationUrl: (input: Record<string, string>) => {
-    const url = new URL("https://idp.example/auth");
-    url.searchParams.set("state", input.state);
-    url.searchParams.set("nonce", input.nonce);
-    return url.toString();
-  },
-  exchangeCodeForIdToken: async () => state.idToken,
-  decodeJwtClaims: (token: string) => {
-    const payload = token.split(".")[1];
-    return payload
-      ? JSON.parse(Buffer.from(payload, "base64url").toString("utf8"))
-      : {};
-  },
-  signSshCertificate: async () => "CERT",
-  parseSshCertificate: () => state.parseInfo,
-}));
-vi.mock("../../hosts/step-ca-runtime.js", () => ({
-  stepCaRuntime: {
-    register: vi.fn(async () => undefined),
-    remove: vi.fn(async () => undefined),
-    submit: vi.fn(async () => true),
-    takeCommand: vi.fn(async () => {
-      const command = state.command;
-      state.command = null;
-      return command;
-    }),
-    complete: state.runtimeComplete,
-    takeResult: vi.fn(async () => {
-      const result = state.remoteResult;
-      state.remoteResult = null;
-      return result;
-    }),
-  },
-}));
-
-const {
-  cancelStepCaAuth,
-  completeStepCaAuth,
-  getStepCaCert,
-  invalidateStepCaCert,
-  startStepCaAuth,
-} = await import("../../hosts/step-ca-auth.js");
-
-function jwt(payload: object): string {
-  return `x.${Buffer.from(JSON.stringify(payload)).toString("base64url")}.y`;
-}
-
-function fakeWs(): WebSocket {
-  return {
-    send: (raw: string) => state.sent.push(JSON.parse(raw)),
-    once: vi.fn(),
-  } as unknown as WebSocket;
-}
-
-async function start(): Promise<{ requestId: string; nonce: string }> {
-  await startStepCaAuth(
-    "user-1",
-    7,
-    "alice",
-    fakeWs(),
-    "https://termix.example",
-  );
-  const chooser = state.sent.at(-1)!;
-  const url = new URL(String(chooser.url));
-  return {
-    requestId: String(chooser.requestId),
-    nonce: url.searchParams.get("nonce")!,
-  };
-}
-
-beforeEach(() => {
-  state.sent.length = 0;
-  invalidateStepCaCert("user-1", 7);
-  state.runtimeComplete.mockClear();
-  state.command = null;
-  state.remoteResult = null;
-  state.parseInfo = {
-    publicKeyLine: "ssh-ed25519 TESTKEY",
-    principals: ["alice"],
-    validAfter: new Date(Date.now() - 60_000),
-    validBefore: new Date(Date.now() + 60 * 60_000),
-  };
-});
-
-describe("Step CA authentication", () => {
-  it("stores only a certificate bound to the nonce, key, principal and validity window", async () => {
-    const { requestId, nonce } = await start();
-    state.idToken = jwt({ nonce, email: "alice@example.com" });
-
-    await expect(
-      completeStepCaAuth({ state: requestId, code: "code" }),
-    ).resolves.toEqual({
-      ok: true,
-      message: "Signed in. You can close this window.",
-    });
-    expect(getStepCaCert("user-1", 7)).toEqual({
-      sshCert: "CERT",
-      privateKey: "PRIVATE",
-    });
-    expect(state.sent.at(-1)).toMatchObject({ type: "stepca_completed" });
-  });
-
-  it("rejects a token without the requested nonce", async () => {
-    const { requestId } = await start();
-    state.idToken = jwt({ email: "alice@example.com" });
-
-    const result = await completeStepCaAuth({ state: requestId, code: "code" });
-    expect(result.ok).toBe(false);
-    expect(result.message).toMatch(/does not match/);
-    expect(getStepCaCert("user-1", 7)).toBeNull();
-  });
-
-  it("routes a callback through Redis to the instance holding the WebSocket", async () => {
-    const { requestId, nonce } = await start();
-    state.idToken = jwt({ nonce });
-    state.command = { state: requestId, code: "remote-code" };
-
-    await vi.waitFor(() => expect(state.runtimeComplete).toHaveBeenCalled(), {
-      timeout: 2000,
-    });
-    expect(getStepCaCert("user-1", 7)).not.toBeNull();
-  });
-
-  it("returns a result produced by another instance", async () => {
-    state.remoteResult = { ok: true, message: "remote success" };
-    await expect(
-      completeStepCaAuth({ state: "remote-state", code: "code" }),
-    ).resolves.toEqual({ ok: true, message: "remote success" });
-  });
-
-  it("cancels local sessions", async () => {
-    const { requestId } = await start();
-    expect(cancelStepCaAuth(requestId)).toBe(true);
-    expect(cancelStepCaAuth(requestId)).toBe(false);
-  });
-});