22 lines
1.2 KiB
Go
22 lines
1.2 KiB
Go
package main
|
|
|
|
import "testing"
|
|
|
|
// A plan names, for each provision its module requires, the provider serving it (issue 760); only an entry with a
|
|
// name is a credential the machine's client fills (issue 757). The rule hands the value issued for the holder only
|
|
// for such an entry: naming a provider alone widens nothing.
|
|
func TestARuleHandsOnlyACredentialThePlanNamesNotAProviderAlone(t *testing.T) {
|
|
plan := `{"templates":{"source":"x","digest":"y"},"files":[],"provisions":[` +
|
|
`{"provision":"postgres-database","provider":"novox","provider-module":"postgres"},` +
|
|
`{"name":"gitea-read","provision":"gitea-read","provider":"novox","provider-module":"gitea",` +
|
|
`"path":"/s/gitea-read.secret"}]}`
|
|
mirror := assignments{"anchor.app": `{"node":"anchor","module":"app","provisioning":` + plan + `}`}
|
|
rule := Declared{Read: mirror.read}
|
|
if ok, why := rule.May("provisioner.anchor", "provision/novox/gitea-read/anchor/app"); !ok {
|
|
t.Fatalf("the credential the plan names was refused: %s", why)
|
|
}
|
|
if ok, _ := rule.May("provisioner.anchor", "provision/novox/postgres-database/anchor/app"); ok {
|
|
t.Fatal("a provision the plan names only with its provider was handed out")
|
|
}
|
|
}
|