jochen
c9dd07f919
mesh/merge-gate head c9dd07f919a2 merged into trunk 404b4409e70e — pass: builds build-agent, mesh-controller → ace, g14, novox, shanks; no bus step; every …
mesh/repo-check head c9dd07f919a2 merged into trunk 404b4409e70e — pass: its merge-check.sh passed (run 2)
mesh/delivery delivered
A Servarr app's API key, an indexer's key and a downloader's password are values the provider's
software holds; the pair path made a random value for every consumer of them, sealed it to both ends
and reported success, and the provider refused it. An offer may now say `"credential": {"issued-by":
"outside"}`: SecretFor never makes a value for it, the plan reads such a pair as given or not given
and sends the consumer no credential file until a person gives it, without refusing its machine;
remakeShared and SharedSecretFor never make a provider's own secret issued outside either.
`secret accept <provider's node> <provider module> <provision>` seals one value to every consumer that
binds the provision from that provider, the provider and the operator, under one generation; the
per-pair form is refused for such a provision, and rotate names the accept. A consumer may wait for a
provision's credential: the controller excuses the wait only when the store bears it out, and its
needs-operator condition names the one accept line.
Adds the replay of issue 164 (TestReplay164), written with only what the controller had before.
43 lines
1.9 KiB
Go
43 lines
1.9 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// A provision's credential may be issued by its provider's software (novox/hq ADR 0305, issue 526): the offer
|
|
// names the tool that answers it and no own secret, and every other shape is refused at parse.
|
|
func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
|
|
m, err := ParseManifest([]byte(`{"module":"media","version":"1",
|
|
"provides":[{"name":"media-api","scope":"mesh","credential":{"issued-by":"software","tool":"media_issued_credential"}}],
|
|
"serves":{"media-api":{"port":32400}}}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if tool, issued := m.IssuedCredentialOf("media-api"); !issued || tool != "media_issued_credential" {
|
|
t.Fatalf("the offer's issued credential was not read: %q %v", tool, issued)
|
|
}
|
|
if _, shared := m.SharedCredentialOf("media-api"); shared {
|
|
t.Fatal("an issued credential was read as an own secret shared")
|
|
}
|
|
if _, issued := m.IssuedCredentialOf("other"); issued {
|
|
t.Fatal("a provision the module does not offer reads as issued")
|
|
}
|
|
|
|
for want, raw := range map[string]string{
|
|
"the issuers an offer may name": `{"module":"d","version":"1",
|
|
"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
|
|
"names no tool that answers it": `{"module":"d","version":"1",
|
|
"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
|
|
"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
|
|
"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
|
|
"the issuers an offer may name ": `{"module":"d","version":"1",
|
|
"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
|
|
} {
|
|
want = strings.TrimSpace(want)
|
|
if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
|
|
t.Errorf("expected a refusal saying %q, got %v", want, err)
|
|
}
|
|
}
|
|
}
|