jschoubben
db86dd52c8
mesh/delivery-group group feat/526-a-provider-delivers-what-its-software-issued rejected: a member's own check failed
mesh/delivery superseded: a newer head of the same pull request
mesh/merge-gate pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without …
mesh/repo-check pass: its merge-check.sh passed
A token a media server got from its vendor reached its consumers only as a value the mesh minted, which the server refused, or as a copy typed by hand. An offer may now say its software issues the credential; the new issued verb carries no value and asks the provider's tool, in the controller's own name, for the value sealed to one call, then seals it to every pair that does not hold it yet.
43 lines
1.9 KiB
Go
43 lines
1.9 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// A provision's credential may be issued by its provider's software (novox/hq ADR 0305, issue 526): the offer
|
|
// names the tool that answers it and no own secret, and every other shape is refused at parse.
|
|
func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
|
|
m, err := ParseManifest([]byte(`{"module":"media","version":"1",
|
|
"provides":[{"name":"media-api","scope":"mesh","credential":{"issued-by":"software","tool":"media_issued_credential"}}],
|
|
"serves":{"media-api":{"port":32400}}}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if tool, issued := m.IssuedCredentialOf("media-api"); !issued || tool != "media_issued_credential" {
|
|
t.Fatalf("the offer's issued credential was not read: %q %v", tool, issued)
|
|
}
|
|
if _, shared := m.SharedCredentialOf("media-api"); shared {
|
|
t.Fatal("an issued credential was read as an own secret shared")
|
|
}
|
|
if _, issued := m.IssuedCredentialOf("other"); issued {
|
|
t.Fatal("a provision the module does not offer reads as issued")
|
|
}
|
|
|
|
for want, raw := range map[string]string{
|
|
"the one issuer an offer may name": `{"module":"d","version":"1",
|
|
"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
|
|
"names no tool that answers it": `{"module":"d","version":"1",
|
|
"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
|
|
"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
|
|
"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
|
|
"the one issuer an offer may name ": `{"module":"d","version":"1",
|
|
"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
|
|
} {
|
|
want = strings.TrimSpace(want)
|
|
if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
|
|
t.Errorf("expected a refusal saying %q, got %v", want, err)
|
|
}
|
|
}
|
|
}
|