40 lines
1.7 KiB
Go
40 lines
1.7 KiB
Go
package broker
|
|
|
|
import "testing"
|
|
|
|
// The build agent's credential is the module principal `<node>.build-agent` (Username, KindModule): its manifest's
|
|
// `reads: ["mesh-delivery.pulls"]` reaches that principal as a read and a watch of mesh-delivery's bucket of pull requests'
|
|
// keys — the direct get of a key, the consumer a watch makes, the stream's info — and as no write and no direct
|
|
// subscription of the bucket's subjects (novox/hq ADR 0406 §4, issue 974).
|
|
func TestTheBuildAgentReadsAndWatchesThePullRequestsKeys(t *testing.T) {
|
|
seat := Seat{Name: TheBuildSeat, Scope: "node", Accepts: []string{"build"}, Emits: []string{"built", "started"}}
|
|
p := Principal{Kind: KindModule, Node: "one", Module: "build-agent", Holds: []Seat{seat},
|
|
Reads: []string{"mesh-delivery.pulls"}, PasswordHash: "x"}
|
|
if got := p.Username(); got != "one.build-agent" {
|
|
t.Fatalf("the build agent's credential is %q", got)
|
|
}
|
|
perms, err := PermissionsFor(p)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, s := range []string{
|
|
"$JS.API.STREAM.INFO.KV_mesh-delivery_pulls",
|
|
"$JS.API.DIRECT.GET.KV_mesh-delivery_pulls.>",
|
|
"$JS.API.CONSUMER.CREATE.KV_mesh-delivery_pulls.>",
|
|
"$JS.API.CONSUMER.DELETE.KV_mesh-delivery_pulls.>",
|
|
// And the two check workers it takes from.
|
|
"$JS.API.CONSUMER.MSG.NEXT.CHECKS_READY.CHECKS_READY_worker",
|
|
"$JS.API.CONSUMER.MSG.NEXT.CHECKS_OTHER.CHECKS_OTHER_worker",
|
|
"$JS.ACK.CHECKS_OTHER.CHECKS_OTHER_worker.>",
|
|
} {
|
|
has(t, perms.Publish, s)
|
|
}
|
|
hasNot(t, perms.Publish, "$KV."+PullsBucket+".>")
|
|
hasNot(t, perms.Publish, "mesh.seat.node-build-agent.check.>")
|
|
for _, s := range perms.Subscribe {
|
|
if s == "$KV."+PullsBucket+".>" {
|
|
t.Fatalf("the build agent subscribes the bucket's subjects directly: %v", perms.Subscribe)
|
|
}
|
|
}
|
|
}
|