Function TestSSHCheckModeNegativeCLI

integration/ssh_test.go:1351–1399

TestSSHCheckModeNegativeCLI verifies that `headscale auth reject` properly denies an SSH check.

(t *testing.T)

// TestSSHCheckModeNegativeCLI verifies that `headscale auth reject`
// properly denies an SSH check.
func TestSSHCheckModeNegativeCLI(t *testing.T) {
	IntegrationSkip(t)

	scenario := sshScenario(t, sshCheckPolicy(), "ssh-negcli", 1)
	defer scenario.ShutdownAssertNoPanics(t)

	allClients, err := scenario.ListTailscaleClients()
	requireNoErrListClients(t, err)

	user1Clients, err := scenario.ListTailscaleClients("user1")
	requireNoErrListClients(t, err)

	headscale, err := scenario.Headscale()
	require.NoError(t, err)

	err = scenario.WaitForTailscaleSync()
	requireNoErrSync(t, err)

	_, err = scenario.ListTailscaleClientsFQDNs()
	requireNoErrListFQDN(t, err)

	for _, client := range user1Clients {
		for _, peer := range allClients {
			if client.Hostname() == peer.Hostname() {
				continue
			}

			sshResult := doSSHCheck(t, client, peer)
			authID := findSSHCheckAuthID(t, headscale)

			// Reject via CLI
			_, err := headscale.Execute(
				[]string{
					"headscale", "auth", "reject",
					"--auth-id", authID,
				},
			)
			require.NoError(t, err)

			select {
			case result := <-sshResult:
				require.Error(t, result.err, "SSH should be rejected")
				assert.Empty(t, result.stdout, "no command output expected on rejection")
			case <-time.After(30 * time.Second):
				t.Fatal("SSH did not complete after auth rejection")
			}
		}
	}
}

// TestSSHLocalpart tests that SSH with localpart:*@<domain> works correctly.
// localpart maps the local-part of each user's OIDC email to an OS user,