57 lines
3.0 KiB
TypeScript
57 lines
3.0 KiB
TypeScript
/**
|
|
* **A module that takes a shared-cache grant presents the login it was granted** (novox/hq 081).
|
|
*
|
|
* The cache provider scopes each consumer to an ACL user of its own, confined to keys under its
|
|
* login (novox/hq 080). A consumer that hands its software the password and not the login logs in
|
|
* as the server's default user: the grant is honoured by the provider and ignored by the consumer,
|
|
* and nothing notices while the default user is open. The grant bed proves the provider's half
|
|
* against a consumer written to the contract; this holds every catalogue module that asks for the
|
|
* cache to its half — the login, as `${bound:redis-cache:as}`, somewhere it hands its software.
|
|
*
|
|
* What it cannot see is whether the software also keeps its keys under that login: that is the
|
|
* software's, and a module whose software cannot (fixed key or channel names in its code) does not
|
|
* take the shared cache at all — baserow runs its own, and n8n in its shipped mode needs none.
|
|
*/
|
|
import { test } from "node:test";
|
|
import assert from "node:assert/strict";
|
|
import { existsSync, readdirSync, readFileSync } from "node:fs";
|
|
import { resolve } from "node:path";
|
|
|
|
import { catalogueIsPresent, catalogueDir } from "./integration/harness.ts";
|
|
|
|
const CACHE = "redis-cache";
|
|
|
|
/** Whether a manifest hands its software the login it is granted for the cache. */
|
|
function presentsTheLogin(manifest: string): boolean {
|
|
return manifest.includes(`\${bound:${CACHE}:as}`);
|
|
}
|
|
|
|
test("the check sees a module that hands its software the password and not the login", () => {
|
|
const passwordOnly = JSON.stringify({ module: "m", requires: [CACHE], resources: [
|
|
{ id: "env", type: "file", path: "/x", content: `HOST=\${bound:${CACHE}:at}\nPASSWORD=\${secret:${CACHE}}\n` }] });
|
|
const withLogin = JSON.stringify({ module: "m", requires: [CACHE], resources: [
|
|
{ id: "env", type: "file", path: "/x", content: `USER=\${bound:${CACHE}:as}\nPASSWORD=\${secret:${CACHE}}\n` }] });
|
|
assert.equal(presentsTheLogin(passwordOnly), false);
|
|
assert.equal(presentsTheLogin(withLogin), true);
|
|
});
|
|
|
|
test("every catalogue module that takes the shared cache presents the login it was granted", (t) => {
|
|
const absent = catalogueIsPresent();
|
|
if (absent) {
|
|
t.skip(`cannot check — ${absent}`);
|
|
return;
|
|
}
|
|
const offences: string[] = [];
|
|
for (const d of readdirSync(catalogueDir(), { withFileTypes: true })) {
|
|
const file = resolve(catalogueDir(), d.name, "module.json");
|
|
if (!d.isDirectory() || !existsSync(file)) continue;
|
|
const text = readFileSync(file, "utf8");
|
|
const m = JSON.parse(text) as { requires?: string[] };
|
|
if (!(m.requires ?? []).includes(CACHE)) continue;
|
|
if (!presentsTheLogin(text)) offences.push(d.name);
|
|
}
|
|
assert.deepEqual(offences, [],
|
|
`these take the shared cache and never hand their software the login (\${bound:${CACHE}:as}), so they ` +
|
|
`log in as the server's default user — present the login, or run a cache of their own:\n ${offences.join("\n ")}`);
|
|
});
|