jschoubben
9bed7d6398
Every grant to call a tool is granted again under the call kind, with the credential's own bus user as the last token, and every grant to answer one is granted for calls naming any caller: the caller of a tool call becomes a fact the bus enforces, as ADR 0259 section 3 made the asker of an ask. A kind of its own because every existing tool grant is a wildcard that would match any caller appended. The old tool grants stay for one release so nothing loses its way to a tool (hq issue 464); the controller's own grants move with that issue, since they are also the installer's first user list.
108 lines
4.1 KiB
Go
108 lines
4.1 KiB
Go
package broker
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// A module that says it calls a tool may publish exactly that subject (novox/hq ADR 0152): the same
|
|
// grant a person gets, derived the same way, so one list answers "what may this ask" for everybody.
|
|
func TestAModuleMayAskOnlyTheToolsItInvokes(t *testing.T) {
|
|
perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "desk", Module: "mesh-console",
|
|
Invokes: []string{"shop.price"}, PasswordHash: "x"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
has(t, perms.Publish, "mesh.mod.shop.tool.price")
|
|
hasNot(t, perms.Publish, "mesh.mod.shop.tool.refund")
|
|
hasNot(t, perms.Publish, "mesh.mod.*.tool.>")
|
|
}
|
|
|
|
// The console's grant: every tool, as one subject, and it reads as one.
|
|
func TestAModuleInvokingEverythingMayAskAnyTool(t *testing.T) {
|
|
perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "desk", Module: "mesh-console",
|
|
Invokes: []string{"*"}, PasswordHash: "x"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
has(t, perms.Publish, "mesh.mod.*.tool.>")
|
|
}
|
|
|
|
// **A grant to call widens nothing else.** A module that invokes may not publish an event it did not
|
|
// declare, may not answer as another module, and subscribes nothing it did not consume — the
|
|
// difference between the console and a person is that the console is on a machine, not that it may
|
|
// do more.
|
|
func TestInvokingGrantsNothingButTheCall(t *testing.T) {
|
|
perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "desk", Module: "mesh-console",
|
|
Invokes: []string{"*"}, PasswordHash: "x"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, p := range perms.Publish {
|
|
if strings.Contains(p, ".event.") {
|
|
t.Errorf("a module that only invokes may publish %q, an event it never declared", p)
|
|
}
|
|
// A role's tools are tools (ADR 0132), named by their caller or not (novox/hq issue 365); a role's work
|
|
// queue and events are not.
|
|
if strings.HasPrefix(p, "mesh.seat.") && !strings.Contains(p, ".tool.") && !strings.Contains(p, ".call.") {
|
|
t.Errorf("a module that only invokes may publish %q, a seat it neither holds nor uses", p)
|
|
}
|
|
}
|
|
for _, s := range perms.Subscribe {
|
|
if strings.Contains(s, ".tool.") && !strings.HasPrefix(s, "mesh.mod.mesh-console.") {
|
|
t.Errorf("a module that invokes may subscribe %q, another module's tools", s)
|
|
}
|
|
}
|
|
}
|
|
|
|
// A module that declares no invokes calls nothing, which is every module but the console.
|
|
func TestAModuleThatInvokesNothingCallsNothing(t *testing.T) {
|
|
perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "shop",
|
|
Emits: []string{"order.placed"}, PasswordHash: "x"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, p := range perms.Publish {
|
|
if strings.Contains(p, ".tool.") {
|
|
t.Errorf("a module with no invokes may publish %q", p)
|
|
}
|
|
}
|
|
}
|
|
|
|
// The malformed entry is refused for a module as it is for a person, and in the same words.
|
|
func TestAModulesToolGrantThatNamesNoToolIsRefused(t *testing.T) {
|
|
if _, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "shop",
|
|
Invokes: []string{"telegram"}, PasswordHash: "x"}); err == nil {
|
|
t.Fatal("a grant naming a module but no tool was accepted")
|
|
}
|
|
}
|
|
|
|
// What a declaration says reaches the composed user, so a manifest's `invokes` is the grant.
|
|
func TestADeclaredInvokeReachesTheComposedUser(t *testing.T) {
|
|
users, err := Users(Records{
|
|
Nodes: []string{"desk"},
|
|
Assigned: map[string][]Declared{"desk": {{Module: "mesh-console", Invokes: []string{"*"}}}},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
perms, err := PermissionsFor(users[len(users)-1])
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
has(t, perms.Publish, "mesh.mod.*.tool.>")
|
|
}
|
|
|
|
// A module's tool is addressed two ways (novox/hq ADR 0159): to whichever instance answers, and to
|
|
// the instance on one machine. A grant for the tool covers both and nothing wider.
|
|
func TestInvokingAToolMayAddressTheMachineToo(t *testing.T) {
|
|
got, err := invokedSubjects([]string{"postgres.postgres_query"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
want := []string{"mesh.mod.postgres.tool.postgres_query", "mesh.mod.postgres.tool.postgres_query.*"}
|
|
if len(got) != 2 || got[0] != want[0] || got[1] != want[1] {
|
|
t.Fatalf("the grant is %v, want %v", got, want)
|
|
}
|
|
}
|