# gentest seed b4e385f4358f7373cfa9184b176f3cccf808e795baf04092ddfde9461014f0c4
# gentest seed 8ece6c6015722b4ed02111acbc928cbf15022611be54264b70aa8458a5466f13

# set up log with bastion
exec witnessctl add-sigsum-log -key=ffdc2d4d98e4124d3feaf788c0c2f9abfd796083d1f0495437f302ec79cf100f
exec witnessctl add-bastion -origin=sigsum.org/v1/tree/4d6d8825a6bb689d459628312889dfbb0bcd41b5211d9e1ce768b0ff0309e562 -bastion=localhost:9443

# start bastion
exec litebastion -listen localhost:9443 -tls-cert localhost.pem -tls-key localhost-key.pem -backends=backends.txt &litebastion&
waitfor localhost:9443

# start ssh-agent
env SSH_AUTH_SOCK=$WORK/s # barely below the max path length
! exec ssh-agent -a $SSH_AUTH_SOCK -D & # ssh-agent always exits 2
waitfor $SSH_AUTH_SOCK
chmod 600 witness_key.pem
exec ssh-add witness_key.pem

# start litewitness
exec litewitness -ssh-agent=$SSH_AUTH_SOCK -name=example.com/witness -testcert -key=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a -no-listen &litewitness&
waitfor https://localhost:9443/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/

# add-checkpoint
exec hurl --cacert rootCA.pem --test add-checkpoint.hurl

# start a second bastion on a different port
exec litebastion -listen localhost:9444 -tls-cert localhost.pem -tls-key localhost-key.pem -backends=backends.txt &litebastion2&
waitfor localhost:9444

# add a second log and configure it to use the second bastion
exec witnessctl add-sigsum-log -key=7c589ec3432005b91812adef062f4783ce95c6ff502048ce67063c1b84062e34
exec witnessctl add-bastion -origin=example.org/v1/tree/7c589ec3432005b91812adef062f4783ce95c6ff502048ce67063c1b84062e34 -bastion=localhost:9444

# reload litewitness to pick up new log and bastion
killall -SIGHUP litewitness
waitfor https://localhost:9444/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/

# test that accessing a log configured for bastion 9444 through bastion 9443 fails with 403
! exec hurl --cacert rootCA.pem --test add-checkpoint-second-log.hurl

# check that litewitness shut down cleanly
killall
wait litewitness
stderr 'shutting down'

# check the litebastion output
wait litebastion
stderr 'msg="accepted new backend connection" backend=e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a'

# witnessctl list-logs
exec witnessctl list-logs
stdout sigsum.org/v1/tree/4d6d8825a6bb689d459628312889dfbb0bcd41b5211d9e1ce768b0ff0309e562
stdout "size":1


-- backends.txt --
f97f12534ff2478cfc36b00d09a85d4faeb6589ac19a0895c348a499627c531c
e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a


-- witness_key.pem --
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtz
c2gtZWQyNTUxOQAAACBkhIrYq+1uhZgbOzh1slK4dn67SwL3A6yjsecbvWqOUAAA
AIgN5+09DeftPQAAAAtzc2gtZWQyNTUxOQAAACBkhIrYq+1uhZgbOzh1slK4dn67
SwL3A6yjsecbvWqOUAAAAEAx/8IRbsvgA6yqgAq3B1e9fVMgbj/r72ptB5bZVTCz
T2SEitir7W6FmBs7OHWyUrh2frtLAvcDrKOx5xu9ao5QAAAAAAECAwQF
-----END OPENSSH PRIVATE KEY-----


-- localhost.pem --
-----BEGIN CERTIFICATE-----

QTyv4nS0hwl7T0VCoBC+bSg=
-----END CERTIFICATE-----


-- localhost-key.pem --
-----BEGIN PRIVATE KEY-----

tKfWSmtc1XhMiUpw331jNg==
-----END PRIVATE KEY-----


-- rootCA.pem --
-----BEGIN CERTIFICATE-----

kJHt
-----END CERTIFICATE-----


-- add-checkpoint.hurl --
POST https://localhost:9443/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/add-checkpoint
```
old 0

sigsum.org/v1/tree/4d6d8825a6bb689d459628312889dfbb0bcd41b5211d9e1ce768b0ff0309e562
1
KgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

— sigsum.org/v1/tree/4d6d8825a6bb689d459628312889dfbb0bcd41b5211d9e1ce768b0ff0309e562 UgIom7fPZTqpxWWhyjWduBvTvGVqsokMbqTArsQilegKoFBJQjUFAmQ0+YeSPM3wfUQMFSzVnnNuWRTYrajXpNUbIQY=
```
HTTP 200
[Asserts]
body contains "— example.com/witness"


-- add-checkpoint-second-log.hurl --
# This test verifies that a request coming through bastion A (9443) for a log configured
# with bastion B (9444) is rejected with a 403
POST https://localhost:9443/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/add-checkpoint
```
old 0

sigsum.org/v1/tree/7c589ec3432005b91812adef062f4783ce95c6ff502048ce67063c1b84062e34
1
KgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

— sigsum.org/v1/tree/7c589ec3432005b91812adef062f4783ce95c6ff502048ce67063c1b84062e34
```
HTTP 403
[Asserts]
body contains "wrong bastion"

POST https://localhost:9444/e933707e0e36c30f01d94b5d81e742da373679d88eb0f85f959ccd80b83b992a/add-checkpoint
```
old 0

sigsum.org/v1/tree/7c589ec3432005b91812adef062f4783ce95c6ff502048ce67063c1b84062e34
1
KgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

— sigsum.org/v1/tree/7c589ec3432005b91812adef062f4783ce95c6ff502048ce67063c1b84062e34
```
HTTP 200
