-
Notifications
You must be signed in to change notification settings - Fork 52
Description
If user keys expire within the next 30 days, add the following notification:
- if EKM is used:
Your local keys expire in X days. To receive the latest keys, please ensure that you can connect to your corporate network either through VPN or in person and reload Gmail. If this notification still shows after that, please contact your Help Desk. - else, if
Your keys are expiring in X days. Please import a newer set of keys to use.
If EKM keys are being repulled automatically, then this check should run after EKM keys were pulled when browser extension is being loaded (successfully or not). So that the user is able to actually follow the instructions: connect to VPN and reload the extension, which will make the problem go away (instead they will see a successful message from the EKM sync).
For a test, when using EKM:
- set up with EKM and a key that expires in 29 days
- tell EKM to start returning error 500 for this user
- load Gmail mock
- observe that there is the warning notification
- re-enable mock EKM
- add another key that doesn't expire for that user on EKM (now, both keys will be returned. This mimics prod behavior during key rotation)
- reload Gmail mock
- observe "keys successfully updated" or similar message (already implemented)
Second test, not using EKM:
- set up with a key that expires in 29 days
- load Gmail mock
- observe that there is the warning notification
- import another key in the settings
- observe no warning
- remove that added another key in settings
- observe warning again
- add an updated version of the original key, that was updated to not expire
- observe no warning
When generating keys for this test, you'll have to do it during the running of each test using OpenPGP.js instead of checking the keys in, because of the expiration that is relative to current time. Make sure these are ECC keys (eg curve25519, should be the default) so that the keygen is fast.