30 lines
1.1 KiB
Go
30 lines
1.1 KiB
Go
package inventory
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
)
|
|
|
|
// A member of a secret family is given by its full name, at the desk too, and a name outside the family is refused
|
|
// (novox/hq ADR 0283).
|
|
func TestAMemberIsGivableAtTheDeskAndANameOutsideTheFamilyIsNot(t *testing.T) {
|
|
m := catalogue.Manifest{Module: "mounts", OwnSecrets: catalogue.OwnSecrets{
|
|
"smb-password-*": {Path: "/s/smb-password-*.secret", IssuedBy: catalogue.IssuedOutside},
|
|
}}
|
|
if err := GivableAtDesk(m, "smb-password-games"); err != nil {
|
|
t.Fatalf("a member was refused: %v", err)
|
|
}
|
|
for _, name := range []string{"smb-password-*", "smb-password-", "smb-password-a/b", "smb-password-A", "smb-credentials"} {
|
|
err := GivableAtDesk(m, name)
|
|
if err == nil {
|
|
t.Errorf("%q was givable", name)
|
|
} else if !strings.Contains(err.Error(), "smb-password-<name>") {
|
|
t.Errorf("%q: the refusal does not say the family's form: %v", name, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// A member given is read back as given, sealed to the machine's key; the mesh makes none, so nothing else is.
|