75 lines
2.2 KiB
Go
75 lines
2.2 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"git.novox.be/novox/mesh-delivery/modules/mesh-grants/grantsstate"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/buscompose"
|
|
"git.novox.be/novox/mesh-sdk/go/seal"
|
|
)
|
|
|
|
// Ledger accounts and the tool runner's own secret `ledgers` (novox/hq ADR 0597 §9, issue 1966). Not the custody
|
|
// ledger of ledger.go (ADR 0085), which is another thing.
|
|
|
|
// nodeToolsWant is the wanted account of a machine's tool runner, as the grants part writes it.
|
|
func nodeToolsWant(node string) grantsstate.WantedAccount {
|
|
w := aWant("node-tools")
|
|
w.Kind, w.Node, w.User = buscompose.KindNodeTools, node, node+".node-tools"
|
|
return w
|
|
}
|
|
|
|
// ledgerWant is the wanted ledger account of a module on a machine.
|
|
func ledgerWant(node, module string) grantsstate.WantedAccount {
|
|
w := aWant(module)
|
|
w.Kind, w.Node, w.User, w.Claims = buscompose.KindLedger, node, "ledger."+node+"."+module, nil
|
|
return w
|
|
}
|
|
|
|
// ledgersOf is what the vault's `own` answers the machine as node-tools' `ledgers`: the map of module to credential,
|
|
// and whether the secret is there at all.
|
|
func ledgersOf(t *testing.T, v testVault, priv string) (map[string]json.RawMessage, bool) {
|
|
t.Helper()
|
|
own, err := v.OwnOfNode("node.ace")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, o := range own.Own {
|
|
if o.Module == "node-tools" && o.Name == grantsstate.LedgersSecret {
|
|
value, err := seal.Open(o.Sealed, priv)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
got := map[string]json.RawMessage{}
|
|
if err := json.Unmarshal([]byte(value), &got); err != nil {
|
|
t.Fatalf("ledgers is not a JSON map: %v", err)
|
|
}
|
|
return got, true
|
|
}
|
|
}
|
|
return nil, false
|
|
}
|
|
|
|
// changesOf counts the secret-changed events said for name since the first of events.
|
|
func changesOf(v testVault, since int, name string) int {
|
|
n := 0
|
|
for _, e := range v.bus.events[since:] {
|
|
if body, _ := e["body"].(map[string]any); e["event"] == ChangedEvent && body["name"] == name {
|
|
n++
|
|
}
|
|
}
|
|
return n
|
|
}
|
|
|
|
// redacted says a credential's shape without its password, for a failure message.
|
|
func redacted(raw json.RawMessage) string {
|
|
var c map[string]any
|
|
if json.Unmarshal(raw, &c) != nil {
|
|
return "not JSON"
|
|
}
|
|
delete(c, "password")
|
|
out, _ := json.Marshal(c)
|
|
return string(out)
|
|
}
|