tests/github_secret_scanning: Use non-hardcoded payload signatures

This will allow us to test with other payloads in the future.

Author: Turbo87

src/tests/github_secret_scanning.rs

@@ -2,33 +2,59 @@ use crate::tests::util::MockRequestExt;
 use crate::tests::{RequestHelper, TestApp};
 use crate::util::token::HashedToken;
 use crate::{models::ApiToken, schema::api_tokens};
+use base64::{Engine as _, engine::general_purpose};
 use crates_io_github::{GitHubPublicKey, MockGitHubClient};
 use diesel::prelude::*;
 use diesel_async::RunQueryDsl;
 use googletest::prelude::*;
 use insta::{assert_json_snapshot, assert_snapshot};
+use p256::ecdsa::{Signature, SigningKey, signature::Signer};
+use p256::pkcs8::DecodePrivateKey;
+use std::sync::LazyLock;
 
 static URL: &str = "/api/github/secret-scanning/verify";
 
-// Test request and signature from https://docs.github.com/en/developers/overview/secret-scanning-partner-program#create-a-secret-alert-service
+// Test request payload for GitHub secret scanning
 static GITHUB_ALERT: &[u8] =
     br#"[{"token":"some_token","type":"some_type","url":"some_url","source":"some_source"}]"#;
 
-static GITHUB_PUBLIC_KEY_IDENTIFIER: &str =
-    "f9525bf080f75b3506ca1ead061add62b8633a346606dc5fe544e29231c6ee0d";
-
-/// Test key from https://docs.github.com/en/developers/overview/secret-scanning-partner-program#create-a-secret-alert-service
-static GITHUB_PUBLIC_KEY: &str = "-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEsz9ugWDj5jK5ELBK42ynytbo38gP\nHzZFI03Exwz8Lh/tCfL3YxwMdLjB+bMznsanlhK0RwcGP3IDb34kQDIo3Q==\n-----END PUBLIC KEY-----";
-
-static GITHUB_PUBLIC_KEY_SIGNATURE: &str = "MEUCIFLZzeK++IhS+y276SRk2Pe5LfDrfvTXu6iwKKcFGCrvAiEAhHN2kDOhy2I6eGkOFmxNkOJ+L2y8oQ9A2T9GGJo6WJY=";
+/// Private key for signing payloads (ECDSA P-256)
+///
+/// Generated specifically for testing - do not use in production.
+///
+/// This corresponds to the public key below and is used to generate valid signatures
+static PRIVATE_KEY: &str = r#"-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgV64BdEFXg9aT/m4p
+wOQ/o9WUHxZ6qfBaP3D7Km1TOWuhRANCAARYKkbkTbIr//8klg1CMYGQIwtlfNd4
+JQYV5+q0s3+JnBSLb1/sx/lEDzmMVZQIZQrACUHFW4UVdmox2NvmNWyy
+-----END PRIVATE KEY-----"#;
+
+/// Public key (corresponds to the private key above)
+static PUBLIC_KEY: &str = r#"-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWCpG5E2yK///JJYNQjGBkCMLZXzX
+eCUGFefqtLN/iZwUi29f7Mf5RA85jFWUCGUKwAlBxVuFFXZqMdjb5jVssg==
+-----END PUBLIC KEY-----"#;
+
+/// Public key identifier (SHA256 hash of the DER-encoded public key)
+static KEY_IDENTIFIER: &str = "2aafbbe2d329af78d875cd2dd0291048799176466844315b6a846d6e12aa26ca";
+
+/// Signing key derived from the private key
+static SIGNING_KEY: LazyLock<SigningKey> =
+    LazyLock::new(|| SigningKey::from_pkcs8_pem(PRIVATE_KEY).unwrap());
+
+/// Generate a signature for the payload using our private key
+fn sign_payload(payload: &[u8]) -> String {
+    let signature: Signature = SIGNING_KEY.sign(payload);
+    general_purpose::STANDARD.encode(signature.to_der())
+}
 
 fn github_mock() -> MockGitHubClient {
     let mut mock = MockGitHubClient::new();
 
     mock.expect_public_keys().returning(|_, _| {
         let key = GitHubPublicKey {
-            key_identifier: GITHUB_PUBLIC_KEY_IDENTIFIER.to_string(),
-            key: GITHUB_PUBLIC_KEY.to_string(),
+            key_identifier: KEY_IDENTIFIER.to_string(),
+            key: PUBLIC_KEY.to_string(),
             is_current: true,
         };
 
@@ -70,8 +96,8 @@ async fn github_secret_alert_revokes_token() {
 
     let mut request = anon.post_request(URL);
     *request.body_mut() = GITHUB_ALERT.into();
-    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", GITHUB_PUBLIC_KEY_IDENTIFIER);
-    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", GITHUB_PUBLIC_KEY_SIGNATURE);
+    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", KEY_IDENTIFIER);
+    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", &sign_payload(GITHUB_ALERT));
     let response = anon.run::<()>(request).await;
     assert_snapshot!(response.status(), @"200 OK");
     assert_json_snapshot!(response.json());
@@ -134,8 +160,8 @@ async fn github_secret_alert_for_revoked_token() {
 
     let mut request = anon.post_request(URL);
     *request.body_mut() = GITHUB_ALERT.into();
-    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", GITHUB_PUBLIC_KEY_IDENTIFIER);
-    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", GITHUB_PUBLIC_KEY_SIGNATURE);
+    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", KEY_IDENTIFIER);
+    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", &sign_payload(GITHUB_ALERT));
     let response = anon.run::<()>(request).await;
     assert_snapshot!(response.status(), @"200 OK");
     assert_json_snapshot!(response.json());
@@ -187,8 +213,8 @@ async fn github_secret_alert_for_unknown_token() {
 
     let mut request = anon.post_request(URL);
     *request.body_mut() = GITHUB_ALERT.into();
-    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", GITHUB_PUBLIC_KEY_IDENTIFIER);
-    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", GITHUB_PUBLIC_KEY_SIGNATURE);
+    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", KEY_IDENTIFIER);
+    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", &sign_payload(GITHUB_ALERT));
     let response = anon.run::<()>(request).await;
     assert_snapshot!(response.status(), @"200 OK");
     assert_json_snapshot!(response.json());
@@ -225,30 +251,30 @@ async fn github_secret_alert_invalid_signature_fails() {
 
     // Headers but no request body
     let mut request = anon.post_request(URL);
-    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", GITHUB_PUBLIC_KEY_IDENTIFIER);
-    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", GITHUB_PUBLIC_KEY_SIGNATURE);
+    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", KEY_IDENTIFIER);
+    request.header("GITHUB-PUBLIC-KEY-SIGNATURE", &sign_payload(GITHUB_ALERT));
     let response = anon.run::<()>(request).await;
     assert_snapshot!(response.status(), @"400 Bad Request");
 
     // Request body but only key identifier header
     let mut request = anon.post_request(URL);
     *request.body_mut() = GITHUB_ALERT.into();
-    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", GITHUB_PUBLIC_KEY_IDENTIFIER);
+    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", KEY_IDENTIFIER);
     let response = anon.run::<()>(request).await;
     assert_snapshot!(response.status(), @"400 Bad Request");
 
     // Invalid signature
     let mut request = anon.post_request(URL);
     *request.body_mut() = GITHUB_ALERT.into();
-    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", GITHUB_PUBLIC_KEY_IDENTIFIER);
+    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", KEY_IDENTIFIER);
     request.header("GITHUB-PUBLIC-KEY-SIGNATURE", "bad signature");
     let response = anon.run::<()>(request).await;
     assert_snapshot!(response.status(), @"400 Bad Request");
 
     // Invalid signature that is valid base64
     let mut request = anon.post_request(URL);
     *request.body_mut() = GITHUB_ALERT.into();
-    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", GITHUB_PUBLIC_KEY_IDENTIFIER);
+    request.header("GITHUB-PUBLIC-KEY-IDENTIFIER", KEY_IDENTIFIER);
     request.header("GITHUB-PUBLIC-KEY-SIGNATURE", "YmFkIHNpZ25hdHVyZQ==");
     let response = anon.run::<()>(request).await;
     assert_snapshot!(response.status(), @"400 Bad Request");