novox/mesh-controller
3
0
Fork 0
Code Issues Pull Requests 1 Releases Wiki Activity

Review: module issue's pre-check factored and tested; a pair delivery for a requirement the module keeps no secret for is refused; builder issue's usage says the module comes first

Browse Source
This commit is contained in:
jschoubben
2026-09-21 23:58:36 +02:00
parent 66332705cd
commit 0d1f2a4152
5 changed files with 61 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/inventory/secrets.go
+3
View File
@@ -159,6 +159,9 @@ func (i *Inventory) AcceptSecretForPair(ctx context.Context, name, consumer, con
return fmt.Errorf("%s does not keep %q for %q; it keeps: %s",
consumerModule, local, name, orNone(sortedNames(locals)))
}
} else if m.Secrets[name] == "" {
return fmt.Errorf("%s requires %q but keeps no secret for it, so a delivered value would sit unread; "+
"it keeps secrets for: %s", consumerModule, name, orNone(sortedNames(m.Secrets)))
} else if local != "" {
return fmt.Errorf("%s keeps one secret for %q, not several; drop --local", consumerModule, name)
}
internal/inventory/secrets_test.go
+16 -3
View File
@@ -55,7 +55,8 @@ func twoNodesWithKeys(t *testing.T) (*Inventory, context.Context) {
// Each requires what a test delivers to it: a pair credential is refused for a
// requirement the module does not have (novox/hq 04-ISSUES/078).
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1",
Requires: []string{"secret", "postgres-database"}}, Source{}); err != nil {
Requires: []string{"secret", "postgres-database", "object-store"},
Secrets: map[string]string{"secret": "/run/secret", "postgres-database": "/run/pg"}}, Source{}); err != nil {
t.Fatal(err)
}
}
@@ -748,11 +749,23 @@ func TestADeliveredSecretIsRefusedUnderANameTheModuleDoesNotDeclare(t *testing.T
func TestADeliveredPairCredentialIsRefusedForARequirementTheModuleDoesNotHave(t *testing.T) {
inv, ctx := twoNodesWithKeys(t)
// gitea requires secret and postgres-database (the fixture); not an object store.
err := inv.AcceptSecretForPair(ctx, "object-store", "consumer", "gitea", "provider", "", "hunter2")
// gitea requires secret, postgres-database and object-store (the fixture); it keeps a secret
// for the first two only, and requires no cache at all.
err := inv.AcceptSecretForPair(ctx, "redis-cache", "consumer", "gitea", "provider", "", "hunter2")
if err == nil || !strings.Contains(err.Error(), "postgres-database") {
t.Fatalf("a pair credential for a requirement the module does not have was not refused naming what it requires: %v", err)
}
err = inv.AcceptSecretForPair(ctx, "object-store", "consumer", "gitea", "provider", "", "hunter2")
if err == nil || !strings.Contains(err.Error(), "keeps no secret") {
t.Fatalf("a pair credential for a requirement the module keeps no secret for was not refused: %v", err)
}
err = inv.AcceptSecretForPair(ctx, "secret", "consumer", "gitea", "provider", "extra", "hunter2")
if err == nil || !strings.Contains(err.Error(), "drop --local") {
t.Fatalf("a local named where the module keeps one secret was not refused: %v", err)
}
if err := inv.AcceptSecretForPair(ctx, "secret", "consumer", "gitea", "provider", "", "hunter2"); err != nil {
t.Fatalf("a delivery for a requirement the module keeps one secret for was refused: %v", err)
}
// A module keeping several secrets for one requirement (ADR 0094) takes a delivery only
// under one of its locals.
m := catalogue.Manifest{Module: "mailu", Version: "1", Requires: []string{"secret"},