jochen
f75cd0239d
The tool runner's bus account carried the heard grants, consumer and bind word of every module it runs, and every agent session on that machine reaches the bus as that account, so any session could pull a granted module's consumer on MAIL. Per ADR 0376 §1 the controller now composes a restricted stream's consumer, grants and bind word only for a module that declares runs-as; registration refuses a consumes of a restricted stream without runs-as (§2), and a grant that composes nothing is said in doctor (D-heard) and in the controller's log on every raise and send.
46 lines
1.9 KiB
Go
46 lines
1.9 KiB
Go
package inventory
|
|
|
|
import (
|
|
"encoding/json"
|
|
"slices"
|
|
"testing"
|
|
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
)
|
|
|
|
// A machine's layer wins over the mesh's for the setting that restricts a stream (novox/hq ADR 0363 §5).
|
|
func TestARestrictingSettingIsReadMachineOverMesh(t *testing.T) {
|
|
layers := []catalogue.Layer{
|
|
{From: catalogue.MeshWideLayer, Values: map[string]any{"grants": "mesh", "other": 1}},
|
|
{From: "novox", Values: map[string]any{"grants": "novox"}},
|
|
}
|
|
if v, set := settingValue(layers, "grants"); !set || v != "novox" {
|
|
t.Fatalf("read %v, %v", v, set)
|
|
}
|
|
if _, set := settingValue(layers[:1], "absent"); set {
|
|
t.Fatal("a key no layer sets read as set")
|
|
}
|
|
}
|
|
|
|
// What a consumer hears is composed into the bus's subjects, and what a stream carries leaves EVENTS.
|
|
func TestWhatAModuleHearsIsComposedOntoTheStreamsSubjects(t *testing.T) {
|
|
provider := catalogue.Manifest{Module: "mesh-mail", Streams: []catalogue.StreamDeclaration{{Name: "mail",
|
|
Events: []string{"mail.*.message.added"}, Grant: &catalogue.StreamGrant{Config: "grants", Events: "mail.{key}.**"}}}}
|
|
var value any
|
|
_ = json.Unmarshal([]byte(`{"mesh":["reader"]}`), &value)
|
|
grants := grantValues{"mesh-mail/grants": {value}}
|
|
reader := catalogue.Manifest{Module: "reader"}
|
|
hears, touches, onEvents := hearsOf(reader, map[string]catalogue.Manifest{"mesh-mail": provider}, "ace", grants,
|
|
[]string{"mesh-mail.mail.**", "billing.paid"})
|
|
if !touches || len(hears) != 1 || hears[0].Stream != "MAIL" || !hears[0].Restricted ||
|
|
!slices.Equal(hears[0].Filters, []string{"mesh.stream.mesh-mail.event.mail.mesh.message.added"}) {
|
|
t.Fatalf("heard %+v", hears)
|
|
}
|
|
if !slices.Equal(onEvents, []string{"billing.paid"}) {
|
|
t.Fatalf("left on EVENTS: %v", onEvents)
|
|
}
|
|
if got := streamsOf(provider); len(got) != 1 || got[0].Name != "MAIL" || got[0].MaxAgeDays != 7 || !got[0].Restricted {
|
|
t.Fatalf("the provider's stream: %+v", got)
|
|
}
|
|
}
|