jochen
ee99a24f77
The seat now covers /etc/hostname too. The migration keeps the old name as an alias so hosts, still assigned while machines move, holds the same seat. Claims were compared by spelling, so the old and new module would both have held it on one machine; they are now compared by the seat they resolve to.
58 lines
2.9 KiB
Go
58 lines
2.9 KiB
Go
package broker
|
|
|
|
import "testing"
|
|
|
|
// A node-scoped seat's tool carries the node (novox/hq ADR 0132, design 33 §4): two nodes holding one
|
|
// node-scoped seat derive two addresses, and a user of the seat may publish any node's.
|
|
func TestTwoNodesHoldingOneNodeSeatDeriveTwoToolAddresses(t *testing.T) {
|
|
seat := Seat{Name: "node-hostname", Scope: "node", Serves: []string{"entries"}}
|
|
one, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "hostname", Holds: []Seat{seat}, PasswordHash: "x"})
|
|
two, _ := PermissionsFor(Principal{Kind: KindModule, Node: "two", Module: "hostname", Holds: []Seat{seat}, PasswordHash: "x"})
|
|
has(t, one.Subscribe, "mesh.seat.node-hostname.tool.entries.one")
|
|
has(t, two.Subscribe, "mesh.seat.node-hostname.tool.entries.two")
|
|
hasNot(t, one.Subscribe, "mesh.seat.node-hostname.tool.entries")
|
|
hasNot(t, one.Subscribe, "mesh.seat.node-hostname.tool.entries.two")
|
|
|
|
user, _ := PermissionsFor(Principal{Kind: KindModule, Node: "three", Module: "asker", Uses: []Seat{seat}, PasswordHash: "x"})
|
|
has(t, user.Publish, "mesh.seat.node-hostname.tool.entries.*")
|
|
}
|
|
|
|
// A mesh-scoped seat's tool stays flat: nothing about it changes.
|
|
func TestAMeshSeatsToolIsAddressedToTheSeatAlone(t *testing.T) {
|
|
seat := Seat{Name: "git", Scope: "mesh", Serves: []string{"list_repos"}}
|
|
holder, _ := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "gitea", Holds: []Seat{seat}, PasswordHash: "x"})
|
|
has(t, holder.Subscribe, "mesh.seat.git.tool.list_repos")
|
|
user, _ := PermissionsFor(Principal{Kind: KindModule, Node: "two", Module: "asker", Uses: []Seat{seat}, PasswordHash: "x"})
|
|
has(t, user.Publish, "mesh.seat.git.tool.list_repos")
|
|
}
|
|
|
|
// The controller serves its own seat's verbs and may answer them (novox/hq ADR 0154).
|
|
func TestTheControllerServesItsSeatsToolsAndMayAnswer(t *testing.T) {
|
|
perms, err := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
has(t, perms.Subscribe, "mesh.seat.mesh-controller.tool.>")
|
|
if !perms.AllowResponses {
|
|
t.Fatal("the controller serves tools and may not answer one")
|
|
}
|
|
}
|
|
|
|
// A grant to every tool reaches a role's tools too, and a role's tool is granted by name.
|
|
func TestAGrantReachesARolesTools(t *testing.T) {
|
|
all, _ := PermissionsFor(Principal{Kind: KindModule, Node: "desk", Module: "mesh-console", Invokes: []string{"*"}, PasswordHash: "x"})
|
|
has(t, all.Publish, "mesh.seat.*.tool.>")
|
|
|
|
one, err := PermissionsFor(Principal{Kind: KindPerson, Module: "jo", Invokes: []string{"seat:mesh-controller.status"}, PasswordHash: "x"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
has(t, one.Publish, "mesh.seat.mesh-controller.tool.status")
|
|
hasNot(t, one.Publish, "mesh.seat.mesh-controller.tool.push")
|
|
hasNot(t, one.Publish, "mesh.mod.*.tool.>")
|
|
|
|
if _, err := PermissionsFor(Principal{Kind: KindPerson, Module: "jo", Invokes: []string{"seat:mesh-controller"}, PasswordHash: "x"}); err == nil {
|
|
t.Fatal("a role grant naming no verb was accepted")
|
|
}
|
|
}
|