429 lines
22 KiB
Go
429 lines
22 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"reflect"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/novox/mesh-host/validate"
|
|
)
|
|
|
|
// Defends novox/hq ADR 0328 on the controller's side, row by row of its "How it is checked" table where the row is the
|
|
// controller's: libraries defined (1, 13), entries resolved (2), groups and numbers (3, 4, 15), the identity and library
|
|
// placeholders (5), a read use mounted read-only (10), the tool runner in a library's group (11), a joining module held
|
|
// until its libraries are taken (8), and a module that does not join composed exactly as before (14).
|
|
|
|
const libraryImage = "x@sha256:1111111111111111111111111111111111111111111111111111111111111111"
|
|
|
|
var mediaLibrary = Library{Name: "media", Home: "ace", Root: "/storage/media", Reach: []string{"novox"}}
|
|
|
|
// aRadarr writes movies and reads books, tells its image its identity by PUID and PGID, and has tools on the runner.
|
|
func aRadarr(t *testing.T) Manifest {
|
|
t.Helper()
|
|
m := aToolsModule(t, "radarr", "tools/index.js")
|
|
m.Libraries = []LibraryUse{
|
|
{ID: "movies", Library: "media", Path: "movies", Use: AccessReadWrite},
|
|
{ID: "books", Library: "books", Path: "shelf", Use: AccessRead},
|
|
}
|
|
m.Resources = []map[string]any{
|
|
{"id": "config", "type": "directory", "mode": "0750"},
|
|
{"id": "env", "type": "file", "path": "${dir:config}/identity.env", "mode": "0644",
|
|
"content": "PUID=${identity:uid}\nPGID=${identity:gid}\nUSER=${identity:user}\nGROUP=${identity:group}\nUMASK=002\n"},
|
|
{"id": "app", "type": "container", "name": "radarr", "image": libraryImage,
|
|
"env": map[string]any{"PUID": "${identity:uid}", "PGID": "${identity:gid}"},
|
|
"volumes": []any{"${dir:config}:/config", "${library:movies}:/movies", "${library:books}:/books:z"}},
|
|
}
|
|
return m
|
|
}
|
|
|
|
// aPlain is a module that neither declares libraries nor uses its identity.
|
|
func aPlain() Manifest {
|
|
return Manifest{Module: "plain", Version: "1", Resources: []map[string]any{
|
|
{"id": "data", "type": "directory", "mode": "0700", "owner": "999:999"},
|
|
{"id": "app", "type": "container", "name": "plain", "image": libraryImage, "volumes": []any{"${dir:data}:/data"}},
|
|
}}
|
|
}
|
|
|
|
func librariesRendering() Rendering {
|
|
books := Library{Name: "books", Home: "ace", Root: "/storage/books"}
|
|
return Rendering{KeepsLibraries: true,
|
|
Libraries: map[string]Library{"media": mediaLibrary, "books": books},
|
|
LibraryGroups: map[string]int{"media": 50010, "books": 50011},
|
|
Identities: map[string]ModuleIdentity{"radarr": {Module: "radarr", UID: 50020}},
|
|
TakenLibraries: map[string]bool{"media": true, "books": true},
|
|
LibraryPaths: map[string][]string{"media": {"movies", "series"}},
|
|
}
|
|
}
|
|
|
|
func composeLibraries(t *testing.T, r Resolution, with Rendering) Composed {
|
|
t.Helper()
|
|
with.Needed = map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}
|
|
with.ArtifactStore = "anchor.internal:5101"
|
|
composed, err := r.Compose(with)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return composed
|
|
}
|
|
|
|
// Rows 2, 4, 5, 10: a joining module's identity is filled everywhere, its library entries resolve to root + path in its
|
|
// volume sources, a read entry mounts read-only, its directories are owned by its user and primary group — the first
|
|
// library it uses — and its other libraries are added groups.
|
|
func TestAJoiningModuleIsComposedWithItsIdentityAndLibraries(t *testing.T) {
|
|
r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aRadarr(t), theRuntime(t)}}
|
|
composed := composeLibraries(t, r, librariesRendering())
|
|
got := byID(composed.Resources)
|
|
|
|
app := got["radarr.app"]
|
|
if fmt.Sprint(app["env"]) != fmt.Sprint(map[string]any{"PUID": "50020", "PGID": "50010"}) {
|
|
t.Errorf("the container's environment is %v", app["env"])
|
|
}
|
|
want := []any{"/var/lib/radarr/config:/config", "/storage/media/movies:/movies", "/storage/books/shelf:/books:ro,z"}
|
|
if !reflect.DeepEqual(app["volumes"], want) {
|
|
t.Errorf("the volumes are %v; want %v", app["volumes"], want)
|
|
}
|
|
if content := fmt.Sprint(got["radarr.env"]["content"]); content !=
|
|
"PUID=50020\nPGID=50010\nUSER=mesh-radarr\nGROUP=mesh-media\nUMASK=002\n" {
|
|
t.Errorf("the identity file reads %q", content)
|
|
}
|
|
if owner := got["radarr.config"]["owner"]; owner != "50020:50020" {
|
|
t.Errorf("its directory is owned by %v; want its user and own group (ADR 0334 §1)", owner)
|
|
}
|
|
if len(composed.Identities) != 1 || !reflect.DeepEqual(composed.Identities[0], IdentityEntry{Module: "radarr",
|
|
Name: "mesh-radarr", UID: 50020, GID: 50010, Groups: []int{50011}}) {
|
|
t.Errorf("the identities are %+v", composed.Identities)
|
|
}
|
|
if w := LibraryWarnings(aRadarr(t)); len(w) != 1 || !strings.Contains(w[0], "reaches only media") {
|
|
t.Errorf("a module of two libraries is warned %q", w)
|
|
}
|
|
}
|
|
|
|
// Rows 3, 7, 11: every library reaching the machine has its group, with its number; each library used here or homed
|
|
// here is named with its root, whether this is its home, whether it is taken, the sub-paths kept on its home, and the
|
|
// tool runner's account where a module whose tools run there uses it.
|
|
func TestTheDeclarationNamesTheLibrariesAndTheirGroups(t *testing.T) {
|
|
with := librariesRendering()
|
|
with.TakenLibraries = map[string]bool{"media": false, "books": true}
|
|
r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aRadarr(t), theRuntime(t)}}
|
|
composed := composeLibraries(t, r, with)
|
|
raw, _ := json.Marshal(map[string]any{"groups": composed.Groups, "libraries": composed.Libraries})
|
|
want := `{"groups":[{"name":"mesh-books","gid":50011},{"name":"mesh-media","gid":50010}],` +
|
|
`"libraries":[{"library":"books","root":"/storage/books","group":"mesh-books","gid":50011,"home":true,` +
|
|
`"taken":true,"paths":["shelf"],"runner":"jochen"},` +
|
|
`{"library":"media","root":"/storage/media","group":"mesh-media","gid":50010,"home":true,"taken":false,` +
|
|
`"paths":["movies","series"],"runner":"jochen"}]}`
|
|
if string(raw) != want {
|
|
t.Errorf("the declaration says\n %s\nwant\n %s", raw, want)
|
|
}
|
|
// On a machine it reaches but is not home: the group, the library as used there, and no sub-path from elsewhere.
|
|
elsewhere := composeLibraries(t, Resolution{Node: "novox", Account: "jochen",
|
|
Modules: []Manifest{aPlain(), theRuntime(t)}}, with)
|
|
raw, _ = json.Marshal(map[string]any{"groups": elsewhere.Groups, "libraries": elsewhere.Libraries})
|
|
if string(raw) != `{"groups":[{"name":"mesh-media","gid":50010}],"libraries":null}` {
|
|
t.Errorf("on a machine it only reaches: %s", raw)
|
|
}
|
|
}
|
|
|
|
// Row 2: a module assigned to a machine its library does not reach is left out there, naming the library; one whose
|
|
// library is not defined likewise.
|
|
func TestALibraryNotReachingTheMachineLeavesItsModuleOut(t *testing.T) {
|
|
with := librariesRendering()
|
|
with.Identities["radarr"] = ModuleIdentity{Module: "radarr", UID: 50020}
|
|
composed := composeLibraries(t, Resolution{Node: "far", Account: "jochen",
|
|
Modules: []Manifest{aRadarr(t), theRuntime(t)}}, with)
|
|
if why := composed.LeftOut["radarr"]; !strings.Contains(why, "does not reach far") {
|
|
t.Errorf("radarr on a machine media does not reach: %q", why)
|
|
}
|
|
delete(with.Libraries, "books")
|
|
composed = composeLibraries(t, Resolution{Node: "ace", Account: "jochen",
|
|
Modules: []Manifest{aRadarr(t), theRuntime(t)}}, with)
|
|
if why := composed.LeftOut["radarr"]; !strings.Contains(why, "books, which is not defined") {
|
|
t.Errorf("radarr with an undefined library: %q", why)
|
|
}
|
|
}
|
|
|
|
// Row 14: a module that neither declares libraries nor uses its identity is composed exactly as before — the whole
|
|
// declaration: its resources, the filter its port reaches, the contributions it makes — on an engine that keeps
|
|
// libraries or not; on a machine a library reaches, only that library's group is added. A joining module on an older
|
|
// engine is left out, naming why.
|
|
func TestAModuleThatDoesNotJoinIsComposedAsBefore(t *testing.T) {
|
|
plain := aPlain()
|
|
plain.Listens = []Listening{{Port: 8080, From: FromEverywhere, Name: "web", Why: "its page"}}
|
|
plain.Contributes = map[string]map[string]any{"reverse-proxy": {"host": "plain", "port": 8080}}
|
|
plain.Requires = []string{"reverse-proxy"}
|
|
modules := []Manifest{plain, proxy(), {Module: "nftables", Filtering: &Filtering{Into: "/etc/mesh/filter.nft"}},
|
|
theRuntime(t)}
|
|
base := Rendering{Mesh: []string{"198.51.100.2"}, OutwardLinks: []string{"eth0"}, TunnelInterface: "mesh0"}
|
|
keeping := func(node string) Rendering {
|
|
with := librariesRendering()
|
|
with.Mesh, with.OutwardLinks, with.TunnelInterface = base.Mesh, base.OutwardLinks, base.TunnelInterface
|
|
return with
|
|
}
|
|
for _, node := range []string{"far", "ace"} {
|
|
r := Resolution{Node: node, Account: "jochen", Modules: modules}
|
|
before := composeLibraries(t, r, base)
|
|
after := composeLibraries(t, r, keeping(node))
|
|
if node == "far" {
|
|
if !reflect.DeepEqual(before, after) {
|
|
t.Fatalf("on a machine no library reaches, a module that does not join composed otherwise:\n %+v\n %+v",
|
|
before, after)
|
|
}
|
|
continue
|
|
}
|
|
groups := after.Groups
|
|
after.Groups, after.Libraries = nil, nil
|
|
if !reflect.DeepEqual(before, after) {
|
|
t.Fatalf("on %s, a module that does not join composed otherwise:\n %+v\n %+v", node, before, after)
|
|
}
|
|
if len(groups) == 0 || len(after.Identities) > 0 {
|
|
t.Fatalf("on the library's home: groups %v, identities %v", groups, after.Identities)
|
|
}
|
|
filter := fmt.Sprint(byID(before.Resources)["nftables."+FilteringID()]["content"])
|
|
if !strings.Contains(filter, "8080") || received(t, before.Resources)[0].From != "plain" {
|
|
t.Fatalf("the comparison held no filter or contribution of the module: %s", filter)
|
|
}
|
|
}
|
|
if Joins(aPlain()) || !Joins(aRadarr(t)) {
|
|
t.Fatal("joining is not read from the libraries and the identity")
|
|
}
|
|
older := librariesRendering()
|
|
older.KeepsLibraries = false
|
|
composed := composeLibraries(t, Resolution{Node: "ace", Account: "jochen",
|
|
Modules: []Manifest{aRadarr(t), aPlain(), theRuntime(t)}}, older)
|
|
if why := composed.LeftOut["radarr"]; !strings.Contains(why, "older than them") {
|
|
t.Fatalf("a joining module on an older engine: %q", why)
|
|
}
|
|
if len(composed.Groups)+len(composed.Identities)+len(composed.Libraries) > 0 {
|
|
t.Fatal("an older engine was sent groups, identities or libraries")
|
|
}
|
|
if byID(composed.Resources)["plain.app"] == nil {
|
|
t.Fatal("a module that does not join was left out beside one that does")
|
|
}
|
|
}
|
|
|
|
// Row 15: no number outside the range is sent, root's above all; the composition refuses, naming why.
|
|
func TestNoNumberTheMeshGivesIsRoot(t *testing.T) {
|
|
for _, n := range []int{0, 4, 10, IdentityLow - 1, IdentityHigh + 1} {
|
|
if AllocatableID(n) {
|
|
t.Errorf("%d is allocatable", n)
|
|
}
|
|
with := librariesRendering()
|
|
with.Identities["radarr"] = ModuleIdentity{Module: "radarr", UID: n}
|
|
with.Needed = map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}
|
|
with.ArtifactStore = "anchor.internal:5101"
|
|
r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aRadarr(t), theRuntime(t)}}
|
|
if _, err := r.Compose(with); err == nil || !strings.Contains(err.Error(), "§15") {
|
|
t.Errorf("a module numbered %d composed: %v", n, err)
|
|
}
|
|
with = librariesRendering()
|
|
with.LibraryGroups["media"] = n
|
|
with.Needed = map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}}
|
|
with.ArtifactStore = "anchor.internal:5101"
|
|
if _, err := r.Compose(with); err == nil || !strings.Contains(err.Error(), "§15") {
|
|
t.Errorf("a library group numbered %d composed: %v", n, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func libraryManifest(t *testing.T, extra map[string]any) []byte {
|
|
t.Helper()
|
|
m := map[string]any{"module": "app", "version": "1", "capabilities": []any{"container-runtime"},
|
|
"libraries": []any{map[string]any{"id": "movies", "library": "media", "path": "movies", "use": "read-write"}},
|
|
"resources": []any{map[string]any{"id": "app", "type": "container", "name": "app", "image": libraryImage,
|
|
"volumes": []any{"${library:movies}:/movies"}}}}
|
|
for k, v := range extra {
|
|
m[k] = v
|
|
}
|
|
raw, err := json.Marshal(m)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return raw
|
|
}
|
|
|
|
// Rows 2 and 5 at the module check: library entries are accepted by name, sub-path and use, and refused with a host
|
|
// path, an owner, a group, a mode or a number; ${library:<id>} only in a volume source; ${identity:…} only by its four
|
|
// names; a joining module names no directory owner and declares no number setting.
|
|
func TestTheModuleCheckHoldsLibrariesAndIdentityToTheDecision(t *testing.T) {
|
|
if _, err := ParseManifest(libraryManifest(t, nil)); err != nil {
|
|
t.Fatalf("a library entry was refused: %v", err)
|
|
}
|
|
entry := func(extra map[string]any) map[string]any {
|
|
e := map[string]any{"id": "movies", "library": "media", "path": "movies", "use": "read-write"}
|
|
for k, v := range extra {
|
|
e[k] = v
|
|
}
|
|
return map[string]any{"libraries": []any{e}}
|
|
}
|
|
for name, c := range map[string]struct {
|
|
extra map[string]any
|
|
want string
|
|
}{
|
|
"a host path": {entry(map[string]any{"path": "/storage/media/movies"}), "never a host path"},
|
|
"out of it": {entry(map[string]any{"path": "../other"}), "never a host path"},
|
|
"an owner": {entry(map[string]any{"owner": "1000"}), "owner"},
|
|
"a group": {entry(map[string]any{"group": "media"}), "group"},
|
|
"a mode": {entry(map[string]any{"mode": "0775"}), "mode"},
|
|
"a number": {entry(map[string]any{"gid": 1000}), "gid"},
|
|
"a use": {entry(map[string]any{"use": "write"}), "is used \"write\""},
|
|
"in the env": {map[string]any{"resources": []any{map[string]any{"id": "app", "type": "container",
|
|
"name": "app", "image": libraryImage, "env": map[string]any{"MOVIES": "${library:movies}"}}}}, "volume source"},
|
|
"in a file": {map[string]any{"resources": []any{map[string]any{"id": "f", "type": "file", "path": "/etc/app.conf",
|
|
"mode": "0644", "content": "movies=${library:movies}"}}}, "volume source"},
|
|
"on the container side": {map[string]any{"resources": []any{map[string]any{"id": "app", "type": "container",
|
|
"name": "app", "image": libraryImage, "volumes": []any{"/srv:${library:movies}"}}}}, "volume source"},
|
|
"an unknown identity": {map[string]any{"resources": []any{map[string]any{"id": "app", "type": "container",
|
|
"name": "app", "image": libraryImage, "env": map[string]any{"HOME": "${identity:home}"}}}}, "${identity:home}"},
|
|
"a directory owner": {map[string]any{"resources": []any{map[string]any{"id": "d", "type": "directory",
|
|
"mode": "0750", "owner": "1000:1000"}}}, "names its owner"},
|
|
} {
|
|
_, err := ParseManifest(libraryManifest(t, c.extra))
|
|
if err == nil || !strings.Contains(err.Error(), c.want) {
|
|
t.Errorf("%s: %v; want refused saying %q", name, err, c.want)
|
|
}
|
|
}
|
|
// A module that does not join keeps its directory owner and its settings as they are (§14).
|
|
plain := map[string]any{"module": "plain", "version": "1",
|
|
"resources": []any{map[string]any{"id": "d", "type": "directory", "mode": "0750", "owner": "1000:1000"}}}
|
|
raw, _ := json.Marshal(plain)
|
|
if _, err := ParseManifest(raw); err != nil {
|
|
t.Errorf("a module that does not join was refused: %v", err)
|
|
}
|
|
// A setting carrying a number, or a placement's owner, is refused for a joining module, and kept for one that does
|
|
// not.
|
|
if err := JoiningSettingProblem(aRadarr(t), []Layer{{From: "ace", Values: map[string]any{"puid": "1000"}}}); err == nil ||
|
|
!strings.Contains(err.Error(), "carries a user or group number") {
|
|
t.Errorf("a joining module's puid setting: %v", err)
|
|
}
|
|
if err := JoiningSettingProblem(aPlain(), []Layer{{From: "ace", Values: map[string]any{"puid": "1000"}}}); err != nil {
|
|
t.Errorf("a plain module's puid setting: %v", err)
|
|
}
|
|
placed := []Layer{{From: "ace", Values: map[string]any{PlacesSetting: map[string]any{
|
|
"config": map[string]any{"path": "/srv/x", "owner": "1000:1000"}}}}}
|
|
if err := PlacesOwnerProblem(aRadarr(t), placed); err == nil || !strings.Contains(err.Error(), "ADR 0328") {
|
|
t.Errorf("a joining module's placed owner: %v", err)
|
|
}
|
|
if err := PlacesOwnerProblem(aPlain(), placed); err != nil {
|
|
t.Errorf("a plain module's placed owner: %v", err)
|
|
}
|
|
}
|
|
|
|
// Row 1: the libraries are the controller's own mesh-wide setting, the terminal's or the operator's Approve alone.
|
|
func TestTheLibrariesAreTheOperatorsSetting(t *testing.T) {
|
|
controller := Manifest{Module: LibrariesModule, Version: "1"}
|
|
keys := TerminalKeys(controller)
|
|
if !hasName(keys, LibrariesSetting) {
|
|
t.Fatalf("the libraries are not among the terminal's keys: %v", keys)
|
|
}
|
|
if hasName(TerminalKeys(Manifest{Module: "radarr"}), LibrariesSetting) {
|
|
t.Fatal("another module's libraries key is the terminal's")
|
|
}
|
|
if err := ComposesWith(controller, []Layer{{From: "ace", Values: map[string]any{LibrariesSetting: map[string]any{}}}},
|
|
false); err == nil {
|
|
t.Fatal("libraries set on one machine were accepted")
|
|
}
|
|
if _, err := ParseLibraries(map[string]any{"media": map[string]any{"home": "ace", "root": "/etc/media"}}); err == nil {
|
|
t.Fatal("a library in the machine's own tree was accepted")
|
|
}
|
|
}
|
|
|
|
// What the node-engine this controller pins (mesh-host #95, ADR 0328's half) makes of a composed declaration with
|
|
// libraries and a joining module: nothing refused.
|
|
func TestTheEngineTakesWhatIsComposedForLibraries(t *testing.T) {
|
|
for _, node := range []string{"ace", "novox"} {
|
|
r := Resolution{Node: node, Account: "jochen", Modules: []Manifest{aRadarr(t), theRuntime(t)}}
|
|
with := librariesRendering()
|
|
with.Libraries["books"] = Library{Name: "books", Home: "ace", Root: "/storage/books", Reach: []string{"novox"}}
|
|
composed := composeLibraries(t, r, with)
|
|
body, err := json.Marshal(map[string]any{"declaration": validate.Version, "resources": composed.Resources,
|
|
"groups": composed.Groups, "identities": composed.Identities, "libraries": composed.Libraries})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if problems := validate.Declaration(body); len(problems) > 0 {
|
|
t.Fatalf("%s: the pinned node-engine refuses it: %v", node, problems)
|
|
}
|
|
}
|
|
}
|
|
|
|
// novox/hq ADR 0334 §1, §2 (the review of 7ea6d36e, item 2): a joining module's own directories are owned by its user
|
|
// and its own group, not the library's; and the tool runner's account joins the own group of every joining module whose
|
|
// tools run on the machine — sent only to an engine that reads it (link.OwnGroupContract).
|
|
func TestAJoiningModulesOwnDirectoriesAreItsOwnGroups(t *testing.T) {
|
|
r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aRadarr(t), theRuntime(t)}}
|
|
got := byID(composeLibraries(t, r, librariesRendering()).Resources)
|
|
if owner := got["radarr.config"]["owner"]; owner != "50020:50020" {
|
|
t.Errorf("its directory is owned by %v; want its user and its own group", owner)
|
|
}
|
|
// ADR 0334 v4: with setgid, so what is made in it later keeps mesh-radarr though the process's primary group is the
|
|
// library's.
|
|
if mode := got["radarr.config"]["mode"]; mode != "0750" {
|
|
t.Errorf("an engine that refuses setgid modes was sent %v", mode)
|
|
}
|
|
if env := got["radarr.app"]["env"].(map[string]any); env["PGID"] != "50010" {
|
|
t.Errorf("its process's primary group is %v; want the library's, so what it makes there keeps the group", env["PGID"])
|
|
}
|
|
older := composeLibraries(t, r, librariesRendering())
|
|
if older.Identities[0].Runner != "" {
|
|
t.Errorf("an engine that cannot put the runner in a module's own group was told %q", older.Identities[0].Runner)
|
|
}
|
|
with := librariesRendering()
|
|
with.RunnerJoinsOwnGroups = true
|
|
newer := composeLibraries(t, r, with)
|
|
if got := newer.Identities[0].Runner; got != "jochen" {
|
|
t.Errorf("the runner joins %q's own group; want jochen, whose tools it runs", got)
|
|
}
|
|
if mode := byID(newer.Resources)["radarr.config"]["mode"]; mode != "2750" {
|
|
t.Errorf("its directory's mode is %v; want 2750, setgid on its own 0750", mode)
|
|
}
|
|
}
|
|
|
|
// novox/hq ADR 0334 §3: a joining module whose tools name a directory whose mode closes it to its group is refused at
|
|
// the module check, naming the directory.
|
|
func TestAToolsDirectoryIsOpenToItsGroup(t *testing.T) {
|
|
closed := map[string]any{
|
|
"libraries": []any{map[string]any{"id": "movies", "library": "media", "path": "movies", "use": "read"}},
|
|
"resources": []any{
|
|
map[string]any{"id": "config", "type": "directory", "mode": "0700"},
|
|
map[string]any{"id": "app", "type": "container", "name": "app", "image": libraryImage,
|
|
"volumes": []any{"${dir:config}:/config", "${library:movies}:/movies"}}},
|
|
"build": map[string]any{"artifacts": []any{map[string]any{"name": "tools", "kind": "bundle",
|
|
"language": "go", "system": "arch", "from": "cmd/app", "binary": "app", "loads": []any{"app"},
|
|
"env": map[string]any{"APP_CONFIG": "${dir:config}/config.xml"}}}}}
|
|
_, err := ParseManifest(libraryManifest(t, closed))
|
|
if err == nil || !strings.Contains(err.Error(), "config") || !strings.Contains(err.Error(), "ADR 0334") {
|
|
t.Fatalf("a tools' directory closed to its group: %v", err)
|
|
}
|
|
open := closed
|
|
open["resources"] = []any{
|
|
map[string]any{"id": "config", "type": "directory", "mode": "0750"},
|
|
map[string]any{"id": "app", "type": "container", "name": "app", "image": libraryImage,
|
|
"volumes": []any{"${dir:config}:/config", "${library:movies}:/movies"}}}
|
|
if _, err := ParseManifest(libraryManifest(t, open)); err != nil {
|
|
t.Fatalf("a tools' directory open to its group was refused: %v", err)
|
|
}
|
|
}
|
|
|
|
// The review of 7ea6d36e, item 6: a service's unit takes the identity too — `User=${identity:user}` — at the module
|
|
// check and in what is composed.
|
|
func TestAServicesUnitTakesTheIdentity(t *testing.T) {
|
|
unit := "[Service]\nUser=${identity:user}\nGroup=${identity:group}\nUMask=0002\nExecStart=/usr/bin/importer\n"
|
|
raw := libraryManifest(t, map[string]any{"resources": []any{
|
|
map[string]any{"id": "app", "type": "container", "name": "app", "image": libraryImage,
|
|
"volumes": []any{"${library:movies}:/movies"}},
|
|
map[string]any{"id": "watch", "type": "service", "name": "app-watch", "unit": unit}}})
|
|
m, err := ParseManifest(raw)
|
|
if err != nil {
|
|
t.Fatalf("a unit naming the identity was refused: %v", err)
|
|
}
|
|
with := librariesRendering()
|
|
with.Identities["app"] = ModuleIdentity{Module: "app", UID: 50030}
|
|
composed := composeLibraries(t, Resolution{Node: "ace", Modules: []Manifest{m}}, with)
|
|
got := fmt.Sprint(byID(composed.Resources)["app.watch"]["unit"])
|
|
if !strings.Contains(got, "User=mesh-app\nGroup=mesh-media\n") {
|
|
t.Fatalf("the unit reads %q", got)
|
|
}
|
|
}
|