70 lines
2.2 KiB
Go
70 lines
2.2 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// The manifest keeps the bot token and this channel's state from every agent (novox/hq ADR 0259 §8): the
|
|
// bundle runs as the module's own account, which owns its state directory and its secret; it claims one kind
|
|
// on both benches, with what it promises; and it names nothing of one installation.
|
|
func TestItRunsAsItsOwnAccountWhichAloneHoldsTheToken(t *testing.T) {
|
|
raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var m struct {
|
|
Claims []struct {
|
|
Name, Scope, Kind string
|
|
Capabilities []string
|
|
}
|
|
Own map[string]string `json:"own-secrets"`
|
|
Owner string `json:"secrets-owner"`
|
|
RunsAs string `json:"runs-as"`
|
|
Resources []map[string]any
|
|
Build struct {
|
|
Artifacts []struct {
|
|
Env map[string]string
|
|
}
|
|
}
|
|
}
|
|
if err := json.Unmarshal(raw, &m); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(m.Claims) != 2 || m.Claims[0].Name != "channel" || m.Claims[0].Kind != Kind || m.Claims[1].Name != "intake" ||
|
|
m.Claims[1].Kind != Kind {
|
|
t.Fatalf("claims %+v", m.Claims)
|
|
}
|
|
promises := strings.Join(m.Claims[0].Capabilities, " ")
|
|
for _, c := range []string{"reaches-away", "choice", "verified-sender", "edit", "max-length:4096"} {
|
|
if !strings.Contains(promises, c) {
|
|
t.Errorf("it does not promise %s", c)
|
|
}
|
|
}
|
|
env := m.Build.Artifacts[0].Env
|
|
if m.RunsAs != "telegram" || env["MESH_TELEGRAM_TOKEN_FILE"] != m.Own["telegram-token"] || m.Owner != "telegram" ||
|
|
m.Own["broker"] == "" {
|
|
t.Fatalf("runs as %q, env %v, secrets %v, owner %q", m.RunsAs, env, m.Own, m.Owner)
|
|
}
|
|
var account, state bool
|
|
for _, r := range m.Resources {
|
|
switch r["type"] {
|
|
case "user":
|
|
account = r["name"] == "telegram" && r["shell"] == "/usr/bin/nologin"
|
|
case "directory":
|
|
state = r["id"] == "state" && r["owner"] == "telegram" && r["mode"] == "0700"
|
|
}
|
|
}
|
|
if !account || !state {
|
|
t.Errorf("the account %v, its state %v", account, state)
|
|
}
|
|
for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox", "api.telegram"} {
|
|
if strings.Contains(strings.ToLower(string(raw)), never) {
|
|
t.Errorf("module.json names %q", never)
|
|
}
|
|
}
|
|
}
|