107 lines
5.5 KiB
Go
107 lines
5.5 KiB
Go
package broker
|
|
|
|
import "testing"
|
|
|
|
// Defends issue 1790 and novox/hq ADR 0547 §5 (the operator, 2026-10-26 08:54): the grants part may create the stream
|
|
// of each bucket, log and stream a placed module's manifest declares, by its own name, and read it back; nothing
|
|
// wider, nothing updated or deleted, and no other principal so. Held byte-equal in the controller's copy. And ADR 0547
|
|
// clause 7 (issue 1945, the operator's second exception): the grants part writes its own object bucket of sealed user
|
|
// lists, and the node-engine of the node holding mesh-broker alone reads its one key and an object of it by name.
|
|
func TestTheGrantsPartCreatesOnlyDeclaredStreams(t *testing.T) {
|
|
records := Records{
|
|
Nodes: []string{"novox", "ace"},
|
|
Assigned: map[string][]Declared{"ace": {{Module: "plex"}}, "novox": {
|
|
{Module: "nats", SnapshotsTheBus: true},
|
|
{Module: "mesh-delivery-builder",
|
|
State: []Bucket{{Module: "mesh-delivery-builder", Name: "steps", History: 5}},
|
|
Logs: []Log{{Module: "mesh-delivery-builder", Name: "builds"}},
|
|
Streams: []ModuleStream{{Module: "mesh-delivery-builder", Name: "BUILDASKS", Events: []string{"ask"}}}},
|
|
{Module: GrantsModule, State: []Bucket{{Module: GrantsModule, Name: "assertions"}}},
|
|
}},
|
|
}
|
|
users, err := Users(records)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
perms := map[string]Permissions{}
|
|
for _, u := range users {
|
|
if u.Kind == KindNode {
|
|
p, err := PermissionsFor(u)
|
|
if err != nil {
|
|
t.Fatalf("%s: %v", u.Username(), err)
|
|
}
|
|
perms[u.Username()] = p
|
|
continue
|
|
}
|
|
if u.Kind != KindModule {
|
|
continue
|
|
}
|
|
p, err := PermissionsFor(u)
|
|
if err != nil {
|
|
t.Fatalf("%s: %v", u.Username(), err)
|
|
}
|
|
perms[u.Module] = p
|
|
}
|
|
for _, row := range []struct {
|
|
who, subject string
|
|
may bool
|
|
}{
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", true},
|
|
{GrantsModule, "$JS.API.STREAM.INFO.KV_mesh-delivery-builder_steps", true},
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.LOG_mesh-delivery-builder_builds", true},
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.BUILDASKS", true},
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-grants_assertions", true},
|
|
{GrantsModule, "$JS.API.STREAM.UPDATE.KV_mesh-delivery-builder_steps", false},
|
|
{GrantsModule, "$JS.API.STREAM.DELETE.KV_mesh-delivery-builder_steps", false},
|
|
{GrantsModule, "$JS.API.STREAM.PURGE.KV_mesh-delivery-builder_steps", false},
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_undeclared", false},
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.EVENTS", false},
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.ASSIGNMENTS", false},
|
|
{GrantsModule, "$JS.API.STREAM.INFO.EVENTS", false},
|
|
{"mesh-delivery-builder", "$JS.API.STREAM.CREATE.KV_mesh-delivery-builder_steps", false},
|
|
// The sealed user list (ADR 0547 clause 7): the grants part writes its own bucket and no other.
|
|
{GrantsModule, "$JS.API.STREAM.CREATE.OBJ_mesh-grants-user-list", true},
|
|
{GrantsModule, "$O.mesh-grants-user-list.C.abc", true},
|
|
{GrantsModule, "$JS.API.STREAM.PURGE.OBJ_mesh-grants-user-list", true},
|
|
{GrantsModule, "$O.declaration-files-novox.C.abc", false},
|
|
{GrantsModule, "$JS.API.STREAM.DELETE.OBJ_mesh-grants-user-list", false},
|
|
{"mesh-delivery-builder", "$O.mesh-grants-user-list.C.abc", false},
|
|
// The bus node's engine reads the one key and an object by name; nothing of the bucket's list, no write.
|
|
{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", true},
|
|
{"node.novox", "$JS.API.CONSUMER.CREATE.KV_mesh-grants_user-list.abc.$KV.mesh-grants_user-list.sealed", true},
|
|
{"node.novox", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", true},
|
|
{"node.novox", "$JS.API.CONSUMER.CREATE.OBJ_mesh-grants-user-list.abc.$O.mesh-grants-user-list.C.abc", true},
|
|
{"node.novox", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.list", false},
|
|
{"node.novox", "$JS.API.STREAM.INFO.OBJ_mesh-grants-user-list", false},
|
|
{"node.novox", "$JS.API.STREAM.MSG.GET.OBJ_mesh-grants-user-list", false},
|
|
{"node.novox", "$O.mesh-grants-user-list.C.abc", false},
|
|
{"node.ace", "$JS.API.DIRECT.GET.KV_mesh-grants_user-list.$KV.mesh-grants_user-list.sealed", false},
|
|
{"node.ace", "$JS.API.DIRECT.GET.OBJ_mesh-grants-user-list.$O.mesh-grants-user-list.M.abc", false},
|
|
} {
|
|
if got := MayPublish(perms[row.who], row.subject); got != row.may {
|
|
t.Errorf("%s may publish %s: %v, want %v", row.who, row.subject, got, row.may)
|
|
}
|
|
}
|
|
// A name that is no plain token is never granted, and a module other than the grants part is never granted one.
|
|
if got := CreateStreamGrants([]string{"*", ">", "KV_a.b", "KV_a_b"}); len(got) != 2 {
|
|
t.Errorf("grants for wildcard names: %v", got)
|
|
}
|
|
other, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "shop", CreatesStreams: []string{"KV_shop_x"}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if MayPublish(other, "$JS.API.STREAM.CREATE.KV_shop_x") {
|
|
t.Error("a module other than the grants part was granted a create")
|
|
}
|
|
// The writers table refuses the grants part an update, and a create of a stream it was not given.
|
|
g := Principal{Kind: KindModule, Node: "novox", Module: GrantsModule, CreatesStreams: []string{"KV_a_b"}}
|
|
if err := CheckWriters(g, []string{"$JS.API.STREAM.CREATE.KV_a_b"}); err != nil {
|
|
t.Errorf("the declared create refused: %v", err)
|
|
}
|
|
for _, refused := range []string{"$JS.API.STREAM.UPDATE.KV_a_b", "$JS.API.STREAM.CREATE.KV_a_c", "$JS.API.STREAM.CREATE.*"} {
|
|
if CheckWriters(g, []string{refused}) == nil {
|
|
t.Errorf("%s was not refused", refused)
|
|
}
|
|
}
|
|
}
|