mesh-tools
97a2d841c7
The controller plans config, templates and moved providers' provisions, hands bus accounts to the vault and judges the new manifest words, on the feature's SDK and node-engine validator (feature 57, config and provisioning).
59 lines
2.3 KiB
Go
59 lines
2.3 KiB
Go
package broker
|
|
|
|
import "testing"
|
|
|
|
// Issue 786 (novox/hq ADR 0372): each machine's node-engine may ask the vault's node-key in its own name, the
|
|
// subject that names it and no other machine's, once the vault's holder serves it; and nothing else of the vault's
|
|
// is granted by it. A vault that does not serve it grants nothing.
|
|
func TestANodeEngineMayStateItsSealingKeyToTheVaultInItsOwnNameAlone(t *testing.T) {
|
|
vault := Declared{Module: "mesh-vault", Holds: []Seat{{Name: "mesh-vault", Serves: []string{"get", "node-key"}}}}
|
|
users, err := Users(Records{Nodes: []string{"anchor", "shanks"}, Assigned: map[string][]Declared{"anchor": {vault}}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var anchor Principal
|
|
for _, u := range users {
|
|
if u.Kind == KindNode && u.Node == "anchor" {
|
|
anchor = u
|
|
}
|
|
}
|
|
p, err := PermissionsFor(anchor)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !MayPublish(p, CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.anchor")) {
|
|
t.Error("anchor's node-engine may not state its key to the vault in its own name")
|
|
}
|
|
for _, s := range []string{CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.shanks"),
|
|
CalledSubject("mesh.seat.mesh-vault.tool.node-key", ControllerName),
|
|
CalledSubject("mesh.seat.mesh-vault.tool.get", "node.anchor"),
|
|
CalledSubject("mesh.seat.mesh-vault.tool.move-in", "node.anchor"),
|
|
"mesh.seat.mesh-vault.tool.node-key"} {
|
|
if MayPublish(p, s) {
|
|
t.Errorf("anchor's node-engine may publish %s", s)
|
|
}
|
|
}
|
|
for _, u := range users {
|
|
if u.Kind == KindModule && u.Module == "mesh-vault" {
|
|
h, err := PermissionsFor(u)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !MaySubscribe(h, CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.anchor")) {
|
|
t.Error("the vault's holder does not hear node-key asked by a node-engine")
|
|
}
|
|
}
|
|
}
|
|
older := Declared{Module: "mesh-vault", Holds: []Seat{{Name: "mesh-vault", Serves: []string{"get", "move-in"}}}}
|
|
users, _ = Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {older}}})
|
|
for _, u := range users {
|
|
if u.Kind != KindNode {
|
|
continue
|
|
}
|
|
q, _ := PermissionsFor(u)
|
|
if MayPublish(q, CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.anchor")) {
|
|
t.Error("a node-engine may state its key while the vault does not serve node-key")
|
|
}
|
|
}
|
|
}
|