From 892a3955b7cd73ec73967e994a12884928adbd0c Mon Sep 17 00:00:00 2001 From: mesh-tools Date: Tue, 20 Oct 2026 07:01:56 +0000 Subject: [PATCH] Place a given secret-family member whose value the Input lacks with a stand-in and name it foreseen, not drop it (review round 1, finding 4). The test failed first; the suite is 1256 tests in 1.05 s --- go/compose/credentials.go | 5 +++++ go/compose/credentials_test.go | 23 +++++++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/go/compose/credentials.go b/go/compose/credentials.go index 3114c8a..8d60fc4 100644 --- a/go/compose/credentials.go +++ b/go/compose/credentials.go @@ -315,6 +315,11 @@ func (c *composer) ownSecretsFor(node Node, plan catalogue.Resolution, handing c needed[m.Module] = map[string]string{} } needed[m.Module][g.Name] = g.Sealed + if g.Sealed == "" { + // Given, and its value is not in the Input: placed with a stand-in, named. + needed[m.Module][g.Name] = catalogue.ForeseenSealed + mark(m.Module, g.Name) + } } } names := make([]string, 0) diff --git a/go/compose/credentials_test.go b/go/compose/credentials_test.go index 4c82137..2974ace 100644 --- a/go/compose/credentials_test.go +++ b/go/compose/credentials_test.go @@ -424,3 +424,26 @@ func TestGrantsComeInTheOrderOfProvisionConsumerModuleAndLocal(t *testing.T) { t.Errorf("rows are %+v %v", rows, err) } } + +// Round 1, finding 4: a member of a secret family a person gave, whose sealed value the Input does not carry, is placed with a +// stand-in and named foreseen, not dropped as if nobody gave it. +func TestAGivenFamilyMemberWithoutItsValueIsAStandInAndNamedForeseen(t *testing.T) { + in := aMesh(t) + in.Catalogue["mailer"] = catalogue.Manifest{Module: "mailer", Version: "1", + OwnSecrets: catalogue.OwnSecrets{"credential-*": {Path: "/var/lib/mailer/credential-*.secret", Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside}}} + laptop := nodeOf(t, &in, "laptop") + laptop.Assigned = append(laptop.Assigned, "mailer") + laptop.SealingKey = keyOf(t, "laptop") + in.OwnSecrets = []OwnSecretRow{ + {Node: "laptop", Module: "mailer", Name: "credential-a", Origin: "accepted", SealedTo: laptop.SealingKey}, + {Node: "laptop", Module: "mailer", Name: "credential-b", Origin: "accepted", SealedTo: laptop.SealingKey, Sealed: "b-sealed"}, + } + got := rendered(t, in, "laptop", Foreseeing) + needed := got.Rendering.Needed["mailer"] + if needed["credential-a"] != catalogue.ForeseenSealed || needed["credential-b"] != "b-sealed" { + t.Errorf("needed %v", needed) + } + if !has(got.Foreseen, "mailer/credential-a") || has(got.Foreseen, "mailer/credential-b") { + t.Errorf("foreseen %v", got.Foreseen) + } +}