Extract reusable keychain sigchain model

crates/geth/tests/bootstrap.rs

@@ -2575,6 +2575,85 @@ fn keychain_init_can_record_openssh_signatures() {
     }
 }
 
+#[test]
+fn keychain_admin_sigchain_exports_allowed_signers_and_verifies() {
+    if Command::new("ssh-keygen").arg("-?").output().is_err() {
+        return;
+    }
+
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+    let admin_key_path = home.path().join("admin_ed25519");
+    generate_ssh_key(&admin_key_path);
+
+    geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::KeychainInit {
+            admin_key_path: Some(admin_key_path.with_extension("pub")),
+            signing_key_path: Some(admin_key_path.clone()),
+        },
+    )
+    .expect("init signed keychain");
+
+    let second_admin_key_path = home.path().join("second_admin_ed25519");
+    generate_ssh_key(&second_admin_key_path);
+    let response = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::KeychainAdminAdd {
+            admin_key_path: second_admin_key_path.with_extension("pub"),
+            signing_key_path: admin_key_path.clone(),
+            principal: Some("second-admin".to_owned()),
+            valid_after_ms: None,
+            valid_before_ms: None,
+        },
+    )
+    .expect("admin add");
+    match response {
+        geth_control::ControlResponse::KeychainAdminUpdated { op, signatures, .. } => {
+            assert_eq!(signatures.len(), 1);
+            match op.kind {
+                geth_keychain::KeychainOpKind::AdminKeyAdd {
+                    public_key,
+                    principal,
+                    ..
+                } => {
+                    assert!(public_key.expect("public key").starts_with("ssh-ed25519 "));
+                    assert_eq!(principal.as_deref(), Some("second-admin"));
+                }
+                other => panic!("unexpected op kind: {other:?}"),
+            }
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let response =
+        geth_node::handle_request(&node, geth_control::ControlRequest::KeychainAllowedSigners)
+            .expect("allowed signers");
+    match response {
+        geth_control::ControlResponse::KeychainAllowedSigners {
+            entries,
+            allowed_signers,
+            ..
+        } => {
+            assert_eq!(entries.len(), 2);
+            assert!(allowed_signers.contains("second-admin ssh-ed25519 "));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let response = geth_node::handle_request(&node, geth_control::ControlRequest::KeychainVerify)
+        .expect("verify sigchain");
+    match response {
+        geth_control::ControlResponse::KeychainVerified { report } => {
+            assert_eq!(report.rejected_ops, 0);
+            assert_eq!(report.active_admin_keys, 2);
+            assert!(report.note.contains("git-skm"));
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+}
+
 #[test]
 fn init_owned_node_records_signed_owner_device_and_node() {
     if Command::new("ssh-keygen").arg("-?").output().is_err() {