46 lines
2.1 KiB
Go
46 lines
2.1 KiB
Go
package main
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/seal"
|
|
)
|
|
|
|
// A module only pulled in by another on a node has a value of its own in the assignments mirror (mesh-controller
|
|
// internal/inventory AssignmentValues, issue 765): its plan, what requires it, and no time it was assigned. The
|
|
// running rule hands that node's client what the plan names, as for an assigned module, and nothing else.
|
|
func TestTheRunningVaultAnswersAMachinesClientForWhatAPulledInModulesPlanNames(t *testing.T) {
|
|
mirror := assignments{
|
|
"g14.app": `{"node":"g14","module":"app","required-by":"desk","provisioning":` +
|
|
`{"templates":{"source":"x","digest":"y"},"files":[],"secrets":[{"name":"token"}],` +
|
|
`"provisions":[{"name":"gitea-read","provision":"gitea-read","provider":"novox"}]}}`,
|
|
"g14.kept": `{"node":"g14","module":"kept","required-by":"desk"}`,
|
|
}
|
|
v := newVault(t, Declared{Read: mirror.read})
|
|
for _, name := range []string{"own/g14/app/token", "own/g14/app/other", "own/g14/kept/token",
|
|
"provision/novox/gitea-read/g14/app"} {
|
|
if _, err := v.Put(name, "value-of-"+name, "the test"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
}
|
|
asker, _ := seal.GenerateKeyPair()
|
|
for _, name := range []string{"own/g14/app/token", "provision/novox/gitea-read/g14/app"} {
|
|
answer, err := v.Get("provisioner.g14", name, asker.PublicKey)
|
|
if err != nil {
|
|
t.Fatalf("the machine's client was refused %s, which its pulled-in module's plan names: %v", name, err)
|
|
}
|
|
if got, err := seal.Open(answer.Sealed, asker.PrivateKey); err != nil || got != "value-of-"+name {
|
|
t.Fatalf("the answer opens to %q (%v)", got, err)
|
|
}
|
|
}
|
|
for _, r := range []struct{ caller, name, why string }{
|
|
{"provisioner.g14", "own/g14/app/other", "a secret the pulled-in module's plan does not name"},
|
|
{"provisioner.g14", "own/g14/kept/token", "a pulled-in module not handed to the provisioner"},
|
|
{"provisioner.ace", "own/g14/app/token", "another machine's client"},
|
|
} {
|
|
if a, err := v.Get(r.caller, r.name, asker.PublicKey); err == nil {
|
|
t.Errorf("get answered %s (%s asking %s): %+v", r.why, r.caller, r.name, a)
|
|
}
|
|
}
|
|
}
|