Refuse a module of its own account running as the node's operator or agent account (hq ADR 0259 §8, review L4)

2026-10-09 13:48:56 +02:00
parent 5fa8e40667
commit e2a45b18ba
2 changed files with 36 additions and 0 deletions
@@ -503,3 +503,29 @@ func TestAModuleOfItsOwnAccountIsServedByARuntimeOfItsOwn(t *testing.T) {
 		t.Error("a module of its own account composed without a runtime program")
 	}
 }
+
+// The review of 2026-10-09 (L4): a module of its own account never runs as the node's operator account, nor
+// as the account agents run as there — either would hand what it holds back to the accounts it is kept from.
+func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "telegram": {"broker": "own"}}}
+	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
+		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, account := range []string{"ops", "agent"} {
+		telegram := aToolsModule(t, "telegram", "tools/index.js")
+		telegram.RunsAs, telegram.SecretsOwner = account, account
+		telegram.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/telegram/broker"}}
+		_, err := Resolution{Node: "anchor", Account: "ops", AgentAccount: "agent",
+			Modules: []Manifest{telegram, goRuntime}}.ownRuntimes(with)
+		if err == nil || !strings.Contains(err.Error(), account) {
+			t.Errorf("telegram running as %s was composed: %v", account, err)
+		}
+	}
+}