44 lines
2.4 KiB
Go
44 lines
2.4 KiB
Go
package main
|
|
|
|
import "testing"
|
|
|
|
// Issue 1098: a value of the assignments bucket that is not a standing assignment (one with `ended` set, or with a
|
|
// `state`) reads as a removed key, whichever way the vault reads it; the fields the controller adds change nothing.
|
|
func TestAnEndedAssignmentIsNotAnAssignmentToTheVault(t *testing.T) {
|
|
plan := `"provisioning":{"templates":{"source":"x","digest":"y"},"files":[],"secrets":[{"name":"token"}],` +
|
|
`"provisions":[{"provision":"gitea-read","provider":"novox","provider-module":"gitea"},` +
|
|
`{"name":"gitea-read","provision":"gitea-read","provider":"novox","provider-module":"gitea"}]}`
|
|
head := `{"node":"g14","module":"dunst","assigned":"2026-10-14T20:00:00Z",`
|
|
mirror := assignments{
|
|
"g14.dunst": head + plan + `}`,
|
|
"g14.ended": `{"node":"g14","module":"ended","ended":"2026-10-18T01:00:00Z",` + plan + `}`,
|
|
"g14.wait": `{"node":"g14","module":"wait","state":"pending",` + plan + `}`,
|
|
"g14.new": `{"node":"g14","module":"new","build":"b1","artifact":{"name":"x","version":"1"},"commit":"c1",` +
|
|
`"rollout":"r1","since":"2026-10-18T00:00:00Z","unknown-field":[1],"ended":"","state":"",` + plan + `}`,
|
|
}
|
|
rule := Declared{Read: mirror.read}
|
|
for module, want := range map[string]bool{"dunst": true, "new": true, "ended": false, "wait": false} {
|
|
if ok, why := rule.May("provisioner.g14", "own/g14/"+module+"/token"); ok != want {
|
|
t.Errorf("own secret of %s: allowed %v (%s), want %v", module, ok, why, want)
|
|
}
|
|
if ok, why := rule.May("provisioner.g14", "provision/novox/gitea-read/g14/"+module); ok != want {
|
|
t.Errorf("credential of %s: allowed %v (%s), want %v", module, ok, why, want)
|
|
}
|
|
if why := pairRowRefusal(mirror.read, "g14", []string{"pair", "novox", "gitea-read", "g14", module}); (why == "") != want {
|
|
t.Errorf("pair row of %s: refusal %q, want allowed %v", module, why, want)
|
|
}
|
|
}
|
|
seen, err := readBindings(Mirror{Keys: mirror.keys, Read: mirror.read})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for module, want := range map[string]bool{"dunst": true, "new": true, "ended": false, "wait": false} {
|
|
if seen.assigned["g14."+module] != want || seen.handed["g14."+module] != want {
|
|
t.Errorf("binding of %s: assigned %v, want %v", module, seen.assigned["g14."+module], want)
|
|
}
|
|
}
|
|
if got := seen.bound[pairKey{"novox", "gitea-read"}]; got == nil || len(got.holders) != 2 {
|
|
t.Errorf("the bound holders of the provision: %+v", got)
|
|
}
|
|
}
|