jschoubben
d68e241724
ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk carries no composition rule. The catalogue functions only the node-engine's composition reaches (Resolve, Resolution's Compose, Declaration, DataItems, LeftOut, Rules and the rest, the settings, placeholder and template refusals, the rendering helpers) are copied with their tests into internal/compose/resolution; a method of a mesh-sdk shape becomes a function taking it first. The composition calls its own copies, and the captured catalogue its tests read lives here now, shared by mesh-compose's tests. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
80 lines
2.4 KiB
Go
80 lines
2.4 KiB
Go
package resolution
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
|
|
)
|
|
|
|
func needy() mcat.Manifest {
|
|
return mcat.Manifest{
|
|
Module: "postgres", Version: "1",
|
|
OwnSecrets: mcat.OwnSecrets{"superuser": {Path: "/var/lib/mesh/postgres/superuser"}},
|
|
Resources: []map[string]any{
|
|
{"id": "store", "type": "container", "name": "mesh-postgres", "image": "postgres@sha256:x"},
|
|
},
|
|
}
|
|
}
|
|
|
|
func TestAModulesOwnSecretLandsSealed(t *testing.T) {
|
|
got, err := Resolve(shelf(needy()), []string{"postgres"}, reachable(), mcat.World{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out, err := Declaration(got, mcat.Rendering{
|
|
Needed: map[string]map[string]string{"postgres": {"superuser": "c2VhbGVk"}},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, r := range out {
|
|
if r["path"] != "/var/lib/mesh/postgres/superuser" {
|
|
continue
|
|
}
|
|
if r["sealed"] != "c2VhbGVk" {
|
|
t.Fatalf("got %v", r)
|
|
}
|
|
if r["content"] != nil {
|
|
t.Fatal("a module's own secret was written in the clear")
|
|
}
|
|
return
|
|
}
|
|
t.Fatalf("no secret was written: %v", out)
|
|
}
|
|
|
|
func TestADeclaredNeedThatWasNotMadeIsRefused(t *testing.T) {
|
|
// Skipping it would start a database with no password it knows, which fails to authenticate
|
|
// three layers from the machine reporting it.
|
|
got, _ := Resolve(shelf(needy()), []string{"postgres"}, reachable(), mcat.World{})
|
|
_, err := Declaration(got, mcat.Rendering{})
|
|
if err == nil {
|
|
t.Fatal("a module needing a secret was declared without one")
|
|
}
|
|
if !strings.Contains(err.Error(), "superuser") {
|
|
t.Fatalf("the refusal does not name what is missing: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestAModuleMayNeedSeveralThings(t *testing.T) {
|
|
// A password and a token, say. Telling them apart is the module's business, not the mesh's.
|
|
m := needy()
|
|
m.OwnSecrets["replication"] = mcat.OwnSecret{Path: "/var/lib/mesh/postgres/replication"}
|
|
got, _ := Resolve(shelf(m), []string{"postgres"}, reachable(), mcat.World{})
|
|
out, err := Declaration(got, mcat.Rendering{Needed: map[string]map[string]string{
|
|
"postgres": {"superuser": "b25l", "replication": "dHdv"},
|
|
}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
seen := map[string]string{}
|
|
for _, r := range out {
|
|
if path, ok := r["path"].(string); ok && strings.Contains(path, "/var/lib/mesh/postgres/") {
|
|
seen[path], _ = r["sealed"].(string)
|
|
}
|
|
}
|
|
if len(seen) != 2 || seen["/var/lib/mesh/postgres/superuser"] == seen["/var/lib/mesh/postgres/replication"] {
|
|
t.Fatalf("two needs did not land as two secrets: %v", seen)
|
|
}
|
|
}
|