test(agent): cover policy management end to end

.github/workflows/ci.yml

@@ -1346,12 +1346,14 @@ jobs:
     name: Agent policy end-to-end test
     runs-on: windows-2022
     needs: [preflight]
+    env:
+      AGENT_POLICY_TEST_SHA: ${{ inputs.ref || github.event.pull_request.head.sha || needs.preflight.outputs.ref }}
 
     steps:
       - name: Checkout ${{ github.repository }}
         uses: actions/checkout@v6
         with:
-          ref: ${{ needs.preflight.outputs.ref }}
+          ref: ${{ env.AGENT_POLICY_TEST_SHA }}
 
       - name: Setup Rust cache
         uses: ./.github/actions/setup-rust-cache
@@ -1374,8 +1376,13 @@ jobs:
           Add-Content -Path $env:GITHUB_PATH -Value $toolsDir
 
       - name: Build Agent policy test executables
+        id: build-policy-executables
         shell: pwsh
         run: |
+          $actualCommit = git rev-parse HEAD
+          if ($LASTEXITCODE -ne 0 -or $actualCommit -ne $env:AGENT_POLICY_TEST_SHA) {
+            throw "Agent policy tests must build the requested commit $env:AGENT_POLICY_TEST_SHA, got $actualCommit"
+          }
           cargo build --locked -p devolutions-agent --features dev-skip-broker-signature
           if ($LASTEXITCODE -ne 0) {
             exit $LASTEXITCODE
@@ -1385,7 +1392,18 @@ jobs:
             exit $LASTEXITCODE
           }
 
+      - name: Run Agent policy tester as standard user
+        shell: pwsh
+        run: |
+          ./crates/agent-policy-tester/run-unelevated.ps1
+          $exitCode = $LASTEXITCODE
+          Get-Content -Path ./crates/agent-policy-tester/agent-policy-tester-unelevated.out
+          if ($exitCode -ne 0) {
+            exit $exitCode
+          }
+
       - name: Run Agent policy tester as LocalSystem
+        if: ${{ !cancelled() && steps.build-policy-executables.outcome == 'success' }}
         shell: pwsh
         run: |
           $scriptPath = Resolve-Path -Path "./crates/agent-policy-tester/run-as-system.ps1"
@@ -1396,6 +1414,10 @@ jobs:
             exit $exitCode
           }
 
+      - name: Run policy route authorization tests
+        shell: pwsh
+        run: cargo test --locked -p now-package-broker --features dev-skip-broker-signature
+
       - name: Show sccache stats
         if: ${{ needs.preflight.outputs.sccache == 'true' && !cancelled() }}
         shell: pwsh

crates/agent-policy-tester/Cargo.toml

@@ -12,6 +12,8 @@ fastrand = "2"
 serde_json = "1"
 tempfile = "3"
 tokio = { version = "1", features = ["io-util", "macros", "net", "process", "rt-multi-thread", "time"] }
+win-api-wrappers = { path = "../win-api-wrappers" }
+windows = { version = "0.61", features = ["Win32_Security", "Win32_System_Threading"] }
 
 [lints]
 workspace = true

crates/agent-policy-tester/run-as-system.ps1

@@ -4,11 +4,18 @@ $workspacePath = (Resolve-Path (Join-Path $PSScriptRoot "../..")).Path
 $testerPath = Join-Path $workspacePath "target/debug/agent-policy-tester.exe"
 $agentPath = Join-Path $workspacePath "target/debug/devolutions-agent.exe"
 $outputPath = Join-Path $PSScriptRoot "agent-policy-tester.out"
-$stagingPath = Join-Path $env:ProgramData "dgw-agent-policy-tester-$([guid]::NewGuid().ToString('N'))"
+$stagingPath = Join-Path ([Environment]::GetFolderPath('CommonApplicationData')) "dgw-agent-policy-tester-$([guid]::NewGuid().ToString('N'))"
 $stagedTesterPath = Join-Path $stagingPath "agent-policy-tester.exe"
+$exitCode = 1
 
 try {
     Set-Content -LiteralPath $outputPath -Value ""
+    if (-not [System.Security.Principal.WindowsIdentity]::GetCurrent().IsSystem) {
+        throw "This runner requires LocalSystem"
+    }
+    if ([System.IO.DriveInfo]::new([System.IO.Path]::GetPathRoot($workspacePath)).DriveType -ne 'Fixed') {
+        throw "Use a local fixed-volume workspace path visible to LocalSystem, not a mapped drive"
+    }
     Add-Type -TypeDefinition @'
 using System;
 using System.ComponentModel;
@@ -61,7 +68,6 @@ public static class AgentPolicyTesterNativeDirectory
     if (Get-ChildItem -LiteralPath $stagingPath -Force) {
         throw "The atomically protected staged tester directory was not empty"
     }
-
     Copy-Item -LiteralPath $testerPath -Destination $stagedTesterPath
     & icacls.exe $stagedTesterPath /setowner '*S-1-5-18' 2>&1 | Out-File $outputPath -Append
     if ($LASTEXITCODE -ne 0) {
@@ -76,7 +82,7 @@ public static class AgentPolicyTesterNativeDirectory
     "Staged policy tester at $stagedTesterPath" | Out-File $outputPath -Append
     Get-Acl -LiteralPath $stagingPath | Format-List Owner, Sddl | Out-File $outputPath -Append
     Get-Acl -LiteralPath $stagedTesterPath | Format-List Owner, Sddl | Out-File $outputPath -Append
-    & $stagedTesterPath $agentPath 2>&1 | Out-File $outputPath -Append
+    & $stagedTesterPath $agentPath elevated 2>&1 | Out-File $outputPath -Append
     $exitCode = $LASTEXITCODE
 } catch {
     $_ | Out-File $outputPath -Append
@@ -88,6 +94,7 @@ public static class AgentPolicyTesterNativeDirectory
         } catch {
             if ($attempt -eq 19) {
                 "Failed to remove $stagingPath after 20 attempts: $_" | Out-File $outputPath -Append
+                $exitCode = 1
             } else {
                 Start-Sleep -Milliseconds 250
             }