feat(gateway): fetch sealed Apollo session work

2026-07-29 11:27:31 +07:00
parent 8a302cd8cc
commit 844e548c95
9 changed files with 217 additions and 44 deletions
@@ -0,0 +1,73 @@
+package gateway
+
+import (
+	"context"
+	"crypto/sha256"
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
+	"encoding/pem"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"testing"
+
+	protocol "git.sechmachine.io.vn/sechmachine/VerseVDI-Protocol/gen/go/protocol"
+)
+
+func TestNativeApolloManagementUsesSessionScopedMTLS(t *testing.T) {
+	serverTLS, clientTLS := testTLS(t)
+	server := httptest.NewUnstartedServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
+		if request.URL.Path != "/serverinfo" || request.TLS == nil || len(request.TLS.PeerCertificates) != 1 {
+			http.Error(response, "mTLS required", http.StatusUnauthorized)
+			return
+		}
+		_, _ = response.Write([]byte("<root><uniqueid>apollo-server</uniqueid></root>"))
+	}))
+	server.TLS = serverTLS
+	server.StartTLS()
+	defer server.Close()
+	host, portText, err := net.SplitHostPort(server.Listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	port, err := strconv.ParseInt(portText, 10, 64)
+	if err != nil {
+		t.Fatal(err)
+	}
+	pinned := sha256.Sum256(serverTLS.Certificates[0].Certificate[0])
+	work := protocol.ProviderSessionWork{
+		Version: "1", SessionID: "session-1", GatewayID: "gateway-1", ReconnectSequence: 0,
+		ExpiresAt: "2099-01-01T00:00:00Z", ProviderProfile: ProviderProfileApollo,
+		ProviderIdentity: "apollo-server#sha256:" + hex.EncodeToString(pinned[:]), PolicyVersionID: "policy-1", ApplicationID: "1",
+		ManagementHost: host, ManagementPort: port, StreamHost: host, StreamPort: 47984,
+		ClientCertificatePem: certificatePEM(t, clientTLS.Certificates[0]),
+		ClientPrivateKeyPem:  privateKeyPEM(t, clientTLS.Certificates[0]),
+		ServerCertificatePem: certificatePEM(t, tls.Certificate{Certificate: [][]byte{serverTLS.Certificates[0].Certificate[1]}}),
+	}
+	data, err := NewNativeApolloBackend().Management(context.Background(), LaunchRequest{SessionID: "session-1", ProviderProfile: ProviderProfileApollo, ProviderWork: work})
+	if err != nil {
+		t.Fatalf("Management() error = %v", err)
+	}
+	if info, err := ParseManagementXML(data); err != nil || info.Identity.UniqueID != "apollo-server" {
+		t.Fatalf("ParseManagementXML() = %+v, %v", info, err)
+	}
+}
+
+func certificatePEM(t *testing.T, certificate tls.Certificate) string {
+	t.Helper()
+	if len(certificate.Certificate) == 0 {
+		t.Fatal("expected certificate")
+	}
+	return string(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: certificate.Certificate[0]}))
+}
+
+func privateKeyPEM(t *testing.T, certificate tls.Certificate) string {
+	t.Helper()
+	encoded, err := x509.MarshalPKCS8PrivateKey(certificate.PrivateKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return string(pem.EncodeToMemory(&pem.Block{Type: "PRIVATE KEY", Bytes: encoded}))
+}