update to test authorized keys

Author: JacobBarthelmeh

.github/workflows/windows-cert-store-test.yml

@@ -230,6 +230,46 @@ jobs:
         Write-Host "Client cert thumbprint: $($clientCert.Thumbprint)"
         Add-Content -Path $env:GITHUB_ENV -Value "CLIENT_CERT_SUBJECT=$($clientCert.Subject)"
 
+    - name: Create Windows user testuser and authorized_keys
+      shell: pwsh
+      run: |
+        $homeDir = "C:\Users\testuser"
+        $authKeysFile = "$homeDir\authorized_keys_test"
+        # Password: <=14 chars to avoid net user "Windows 2000" prompt; mixed case, number, special.
+        # This is a test user and not a sensitive password.
+        $pw = 'T3stP@ss!xY9'
+
+        # Create home dir (profile) for testuser
+        New-Item -ItemType Directory -Path $homeDir -Force | Out-Null
+        Write-Host "Created $homeDir"
+
+        # Create local user testuser (net user avoids New-LocalUser password policy issues in CI)
+        $o = net user testuser $pw /add /homedir:$homeDir 2>&1
+        if ($LASTEXITCODE -ne 0) {
+          if ($o -match "already exists") {
+            Write-Host "User testuser already exists"
+            net user testuser /homedir:$homeDir 2>$null
+          } else {
+            Write-Host "net user failed: $o"
+            exit 1
+          }
+        } else {
+          Write-Host "Created user testuser"
+        }
+        
+        # authorized_keys: hansel public key with comment 'testuser'
+        $pubKey = Get-Content "${{ github.workspace }}\wolfssh\keys\hansel-key-ecc.pub" -Raw
+        if (-not $pubKey) {
+          Write-Host "ERROR: hansel-key-ecc.pub not found"
+          exit 1
+        }
+        $pubKey = ($pubKey -replace '\s+hansel\s*$', ' testuser').TrimEnd()
+        $pubKey | Out-File -FilePath $authKeysFile -Encoding ASCII -NoNewline
+        # ensure testuser can read (wolfsshd impersonates testuser when checking authorized_keys)
+        icacls $authKeysFile /grant "testuser:R" /q
+        Write-Host "Created $authKeysFile"
+        Get-Content $authKeysFile
+
     - name: Create wolfSSHd config file
       working-directory: ${{ github.workspace }}\wolfssh
       shell: pwsh
@@ -240,6 +280,12 @@ jobs:
         PermitRootLogin yes
         "@
         
+        # AuthorizedKeysFile: relative to user home (e.g. C:\Users\testuser/authorized_keys_test)
+        $configContent += @"
+
+        AuthorizedKeysFile authorized_keys_test
+        "@
+        
         if ("${{ matrix.server_key_source }}" -eq "store") {
             # Get server cert subject from environment
             $serverSubject = (Get-Content env:SERVER_CERT_SUBJECT)
@@ -731,8 +777,7 @@ jobs:
             $errOut = Get-Content sftp_error.txt -Raw
         }
         
-        # Success indicators: connection established, key exchange completed
-        # Failure indicators: connection refused, key exchange failed
+        # Failure indicators
         if ($output -match "connection.*refused" -or $errOut -match "connection.*refused") {
             Write-Host "ERROR: Connection refused - server may not be running"
             exit 1
@@ -741,8 +786,16 @@ jobs:
             Write-Host "ERROR: Key exchange failed - cert store key may not be working"
             exit 1
         }
+        if ($output -match "Couldn't connect" -or $errOut -match "Couldn't connect") {
+            Write-Host "ERROR: SFTP could not connect (check authorized_keys, user, or server)"
+            exit 1
+        }
+        if ($process.ExitCode -ne 0) {
+            Write-Host "ERROR: SFTP client exited with code $($process.ExitCode)"
+            exit 1
+        }
         
-        Write-Host "Test completed - key exchange appears to have worked"
+        Write-Host "Test completed - key exchange and SFTP connection succeeded"
 
     - name: Test SSH client connection
       working-directory: ${{ github.workspace }}\wolfssh