45 lines
1.7 KiB
Go
45 lines
1.7 KiB
Go
package broker
|
|
|
|
import (
|
|
"slices"
|
|
"testing"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/delivery"
|
|
)
|
|
|
|
// Issue 1394/C9a (ADR 0528 clause 2): the grants bucket is mesh-sdk's, one of the controller's own buckets asserted at its
|
|
// start, written by the controller alone; the assigner, naming mesh-controller.grants in `reads`, reads it and writes
|
|
// nothing of it.
|
|
func TestTheAssignerReadsTheGrantsAndWritesNone(t *testing.T) {
|
|
if GrantsBucket != delivery.ControllerGrantsBucket {
|
|
t.Fatalf("the grants bucket is %s, mesh-sdk names %s", GrantsBucket, delivery.ControllerGrantsBucket)
|
|
}
|
|
if !slices.Contains(controllerReadableStates(), ControllerGrants) {
|
|
t.Fatalf("a module cannot name %s in `reads`: %v", GrantsBucket, controllerReadableStates())
|
|
}
|
|
if _, other := MirrorsWrittenByAnother[ControllerGrants]; other {
|
|
t.Error("the controller writes the grants itself")
|
|
}
|
|
if !IsControllerBucket(GrantsBucket) || !slices.Contains(ControllerBuckets(), GrantsBucket) {
|
|
t.Errorf("%s is not among the controller's buckets", GrantsBucket)
|
|
}
|
|
perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "mesh-delivery-assigner", PasswordHash: "x",
|
|
Reads: []string{"mesh-controller.grants"}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
stream := "KV_" + GrantsBucket
|
|
has(t, perms.Publish, "$JS.API.STREAM.INFO."+stream)
|
|
has(t, perms.Publish, "$JS.API.CONSUMER.CREATE."+stream+".>")
|
|
for _, p := range perms.Publish {
|
|
if SubjectsOverlap(p, "$KV."+GrantsBucket+".mesh-x") {
|
|
t.Errorf("the assigner may write %s through %q", GrantsBucket, p)
|
|
}
|
|
}
|
|
controller, err := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
has(t, controller.Publish, "$KV."+GrantsBucket+".>")
|
|
}
|