53 lines
2.4 KiB
Go
53 lines
2.4 KiB
Go
package main
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
"github.com/novox/mesh-controller/internal/inventory"
|
|
)
|
|
|
|
// novox/hq issue 274: a provider is granted exactly the consumers whose own resolution binds them to
|
|
// it — not every consumer a pair credential from it was ever made for.
|
|
|
|
// grantOf is the grant of one provision to one consuming module, and whether there is one at all.
|
|
func grantOf(grants []catalogue.Grant, provision, consumer, module string) (catalogue.Grant, bool) {
|
|
for _, g := range grants {
|
|
if g.Provision == provision && g.Consumer == consumer && (g.From == module || g.From == "") {
|
|
return g, true
|
|
}
|
|
}
|
|
return catalogue.Grant{}, false
|
|
}
|
|
|
|
// The morning after issue 273, through the stores: a consumer was bound to the store on another
|
|
// machine, a credential from there was made, and a person pinned it back to the store beside it. Both
|
|
// credentials are on record. The store it left is no longer granted it — so it retires it and keeps
|
|
// its data (ADR 0230) — and says so; the store it is bound to keeps its grant; and the credential from
|
|
// the store it left stays on record.
|
|
|
|
// A consumer whose resolution cannot be read is an error, never a consumer bound nowhere — withdrawing
|
|
// a grant on that reading would take its access away (issue 152).
|
|
|
|
// The rule itself, on a resolution: bound is the provider a need for exactly that credential is
|
|
// answered by, never one answered by a record, and a different local name is a different credential.
|
|
func TestBindsFromIsTheProviderOfThatCredential(t *testing.T) {
|
|
r := catalogue.Resolution{Needs: []catalogue.Needed{
|
|
{Name: "postgres-database", For: "board", From: "laptop"},
|
|
{Name: "postgres-database", For: "board", From: "laptop", Local: "reports"},
|
|
{Name: "postgres-database", For: "wiki", From: "anchor"},
|
|
{Name: "a-licence", For: "board", From: "the-licence", ByRecord: true},
|
|
}}
|
|
s := inventory.Secret{Name: "postgres-database", ConsumerModule: "board"}
|
|
if got := r.BindsFrom(s.Name, s.ConsumerModule, s.Local); strings.Join(got, ",") != "laptop" {
|
|
t.Fatalf("board's credential is bound to %v", got)
|
|
}
|
|
if got := r.BindsFrom("postgres-database", "board", "archive"); len(got) != 0 {
|
|
t.Fatalf("a local name nothing asks for is bound to %v", got)
|
|
}
|
|
if got := r.BindsFrom("a-licence", "board", ""); len(got) != 0 {
|
|
t.Fatalf("a need answered by a record is bound to %v", got)
|
|
}
|
|
}
|