97 lines
3.6 KiB
Go
97 lines
3.6 KiB
Go
//go:build integration
|
|
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"errors"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/novox/mesh-controller/internal/link"
|
|
)
|
|
|
|
func TestASecretValueIsNeverAcceptedThroughAVerb(t *testing.T) {
|
|
t.Setenv(verbVar, "mesh-controller.command")
|
|
for _, args := range [][]string{
|
|
{"accept", "anchor", "telegram", "telegram-token", "--from", "/dev/null"},
|
|
{"accept", "anchor", "app", "db", "--from", "/dev/null", "--provider", "store"},
|
|
} {
|
|
err := secretCommand(context.Background(), args)
|
|
if err == nil || !strings.Contains(err.Error(), "never through a verb") {
|
|
t.Errorf("%v: %v", args, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestATrustedPartysSecretGivenAtTheTerminalIsAnnouncedBeforeItIsKept(t *testing.T) {
|
|
var order []string
|
|
announce := func(fail bool) func() error {
|
|
return func() error {
|
|
order = append(order, "announce")
|
|
if fail {
|
|
return errors.New("no channel")
|
|
}
|
|
return nil
|
|
}
|
|
}
|
|
keep := func() (bool, error) { order = append(order, "keep"); return false, nil }
|
|
|
|
order = nil
|
|
if _, unannounced, err := keepGiven(true, announce(false), keep); err != nil || unannounced != nil ||
|
|
strings.Join(order, ",") != "announce,keep" {
|
|
t.Errorf("trusted: %v %v, order %v; want announced, then kept", unannounced, err, order)
|
|
}
|
|
order = nil
|
|
if _, _, err := keepGiven(true, announce(true), keep); err == nil || strings.Join(order, ",") != "announce" {
|
|
t.Errorf("trusted, announcement failed: %v, order %v; want refused and nothing kept", err, order)
|
|
}
|
|
order = nil
|
|
if _, unannounced, err := keepGiven(false, announce(true), keep); err != nil || unannounced == nil ||
|
|
strings.Join(order, ",") != "keep,announce" {
|
|
t.Errorf("not trusted: %v %v, order %v; want kept, then the failed announcement said", unannounced, err, order)
|
|
}
|
|
order = nil
|
|
failing := func() (bool, error) { order = append(order, "keep"); return false, errors.New("store away") }
|
|
if _, _, err := keepGiven(false, announce(false), failing); err == nil || strings.Join(order, ",") != "keep" {
|
|
t.Errorf("not trusted, keep failed: %v, order %v; want refused and nothing announced", err, order)
|
|
}
|
|
}
|
|
|
|
func TestASecretAskIsNeverASecretRead(t *testing.T) {
|
|
t.Setenv(verbVar, "mesh-controller.secret-ask")
|
|
for _, args := range [][]string{
|
|
{"ask", "anchor", "telegram", "telegram-token", "the-value"},
|
|
{"ask", "anchor", "telegram"},
|
|
{"ask", "anchor", "telegram", "telegram-token", "--from", "/dev/null"},
|
|
} {
|
|
if err := secretCommand(context.Background(), args); err == nil {
|
|
t.Errorf("secret %v was taken", args)
|
|
}
|
|
}
|
|
for _, args := range [][]string{{"recover", "anchor", "telegram", "telegram-token"}, {"export"}} {
|
|
if err := terminalOnly(append([]string{"secret"}, args...)); err == nil {
|
|
t.Errorf("secret %v passed the terminal rule", args)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestATrustedPartysSecretAtTheTerminalIsNotKeptWhenTellAndTheConditionBothFail(t *testing.T) {
|
|
ctx := context.Background()
|
|
askOperatorChannelFake(t, func(map[string]any) (json.RawMessage, error) { return nil, link.ErrNothingServes })
|
|
// conditionsFrom is left nil and there is no bus to dial here, so the fallback condition cannot be
|
|
// raised either: both of ADR 0380's ways to tell the operator fail.
|
|
kept := false
|
|
if _, _, err := keepGiven(true,
|
|
func() error {
|
|
return announceSecretGiven(ctx, "anchor", "telegram", "telegram-token", "at the controller's terminal", "me")
|
|
},
|
|
func() (bool, error) { kept = true; return false, nil }); err == nil {
|
|
t.Error("a trusted party's secret was kept though telling the operator and raising the condition both failed")
|
|
}
|
|
if kept {
|
|
t.Error("the value was kept despite the failure")
|
|
}
|
|
}
|