mesh-tools
bff1ac14a1
mesh/merge-gate head bff1ac14a198 merged into trunk 49c9002c04d3 beside mesh-controller#355@8c381172 — pass: builds mesh-host → ace, g14, novox, shanks; no…
mesh/repo-check head bff1ac14a198 merged into trunk 49c9002c04d3 beside mesh-controller#355@8c381172 — pass: its merge-check.sh passed
mesh/delivery delivered
mesh/delivery-group group release/57-config-and-provisioning delivered: every member is delivered
38 lines
1.4 KiB
Go
38 lines
1.4 KiB
Go
package declaration
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// Defends novox/hq ADR 0349 §4 (issue 668): the declaration names the account the provisioner's client runs as,
|
|
// the only one whose write of a filled file the node-engine accepts. Read here before any controller sends it.
|
|
|
|
func TestTheDeclarationNamesTheProvisionersAccount(t *testing.T) {
|
|
d, err := Parse([]byte(`{"declaration":1,"provisioner_account":"mesh-node-provisioner","filled_files":["/etc/a"],
|
|
"resources":[{"id":"a","type":"file","path":"/etc/a","content":"a","owner-at-runtime":"owned"}]}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if d.Provisioner != "mesh-node-provisioner" {
|
|
t.Errorf("the provisioner's account read as %q", d.Provisioner)
|
|
}
|
|
d, err = Parse([]byte(`{"declaration":1,"resources":[{"id":"a","type":"file","path":"/etc/a","content":"a"}]}`))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if d.Provisioner != "" {
|
|
t.Errorf("a declaration naming no account names %q", d.Provisioner)
|
|
}
|
|
}
|
|
|
|
func TestAProvisionersAccountThatIsNoAccountIsRefused(t *testing.T) {
|
|
for name, account := range map[string]string{"root": "root", "not a name": "a b", "a path": "../x"} {
|
|
_, err := Parse([]byte(`{"declaration":1,"provisioner_account":"` + account + `",
|
|
"resources":[{"id":"a","type":"file","path":"/etc/a","content":"a"}]}`))
|
|
if err == nil || !strings.Contains(err.Error(), "provisioner_account") {
|
|
t.Errorf("%s: want a refusal naming provisioner_account, got %v", name, err)
|
|
}
|
|
}
|
|
}
|