57 lines
2.7 KiB
Go
57 lines
2.7 KiB
Go
package grantsstate
|
|
|
|
import (
|
|
"encoding/json"
|
|
"strings"
|
|
"testing"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/buscompose"
|
|
)
|
|
|
|
// The wanted account is the grants part's state layout: a state `accounts` read as mesh-grants.accounts, each key the
|
|
// bus user, valid only when the user is the one the composer derives, held in the module's own secret (a ledger's in the
|
|
// tool runner's `ledgers`), and given to its holder in the shape the controller's credential had.
|
|
func TestAWantedAccountIsTheStatesLayout(t *testing.T) {
|
|
if AccountsState != "accounts" || GrantsAccounts != "mesh-grants.accounts" || LedgersSecret != "ledgers" {
|
|
t.Errorf("the state is %q read as %q, the ledgers' secret %q", AccountsState, GrantsAccounts, LedgersSecret)
|
|
}
|
|
url := "nats://10.0.0.1:4222"
|
|
for name, c := range map[string]struct {
|
|
w WantedAccount
|
|
secret string
|
|
bad string
|
|
}{
|
|
"module": {WantedAccount{User: "a.m", Kind: buscompose.KindModule, Node: "a", Module: "m", URL: url}, "broker", ""},
|
|
"ledger": {WantedAccount{User: "ledger.a.m", Kind: buscompose.KindLedger, Node: "a", Module: "m", URL: url}, LedgersSecret, ""},
|
|
"process": {WantedAccount{User: "a.m.p", Kind: buscompose.KindProcess, Node: "a", Module: "m", Process: "p", URL: url}, "broker-p", ""},
|
|
"provisioner": {WantedAccount{User: "provisioner.a", Kind: buscompose.KindProvisioner, Node: "a", Module: "m", URL: url}, "provisioner-broker", ""},
|
|
"other user": {WantedAccount{User: "x.m", Kind: buscompose.KindModule, Node: "a", Module: "m", URL: url}, "", "is not the user"},
|
|
"a node": {WantedAccount{User: "node.a", Kind: buscompose.KindNode, Node: "a", Module: "m", URL: url}, "", "never mints"},
|
|
"no address": {WantedAccount{User: "a.m", Kind: buscompose.KindModule, Node: "a", Module: "m"}, "", "no bus address"},
|
|
} {
|
|
err := c.w.Valid()
|
|
if c.bad == "" {
|
|
if err != nil || c.w.OwnSecret() != c.secret {
|
|
t.Errorf("%s: %v, held in %q, want %q", name, err, c.w.OwnSecret(), c.secret)
|
|
}
|
|
raw, _ := json.Marshal(c.w)
|
|
if back, err := ReadWantedAccount(c.w.User, raw); err != nil || !back.Same(c.w) {
|
|
t.Errorf("%s: read back %+v, %v", name, back, err)
|
|
}
|
|
if _, err := ReadWantedAccount("someone.else", raw); err == nil {
|
|
t.Errorf("%s: a key of another user was read", name)
|
|
}
|
|
if held, err := HeldCredential(c.w, "pw"); err != nil || !strings.Contains(string(held), `"password":"pw"`) {
|
|
t.Errorf("%s: held %s, %v", name, held, err)
|
|
}
|
|
continue
|
|
}
|
|
if err == nil || !strings.Contains(err.Error(), c.bad) {
|
|
t.Errorf("%s: %v, want a refusal saying %q", name, err, c.bad)
|
|
}
|
|
}
|
|
if _, err := HeldCredential(WantedAccount{User: "a.m", Kind: buscompose.KindModule, Node: "a", Module: "m", URL: url}, ""); err == nil {
|
|
t.Error("an account was held with no password")
|
|
}
|
|
}
|