69 lines
2.5 KiB
Go
69 lines
2.5 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// A module that keeps the operator-sealed secrets is handed the export as a file, at 0600, and a
|
|
// module that does not keep them is handed nothing — the export goes to the vault and nowhere else.
|
|
func TestOnlyAModuleThatKeepsGetsTheExport(t *testing.T) {
|
|
vault := Manifest{Module: "mesh-vault", Version: "1", Provides: FromAnywhere("secret"),
|
|
Keeps: "/var/lib/mesh-vault/root"}
|
|
other := Manifest{Module: "zsh", Version: "1", Provides: Offers("shell")}
|
|
got, err := Resolve(shelf(vault, other), []string{"mesh-vault", "zsh"},
|
|
Node{Name: "anchor", At: "10.0.0.1", Capabilities: map[string]bool{}}, World{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
kept := &KeptExport{Export: 1, OperatorKey: "OPERATOR", Fingerprint: "sha256:abcd",
|
|
Kept: []Kept{{Node: "anchor", Module: "postgres", Name: "superuser", Origin: "accepted", Sealed: "CIPHERTEXT", Key: "OPERATOR"}}}
|
|
out, err := got.Declaration(Rendering{Kept: kept})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var files int
|
|
for _, r := range out {
|
|
if r["path"] != "/var/lib/mesh-vault/root/export.json" {
|
|
continue
|
|
}
|
|
files++
|
|
if r["mode"] != "0600" {
|
|
t.Errorf("the export is written at mode %v, and it is the mesh's root secrets, sealed or not", r["mode"])
|
|
}
|
|
content, _ := r["content"].(string)
|
|
for _, want := range []string{`"operator-key": "OPERATOR"`, `"sealed": "CIPHERTEXT"`, `"module": "postgres"`} {
|
|
if !strings.Contains(content, want) {
|
|
t.Errorf("the export lacks %s:\n%s", want, content)
|
|
}
|
|
}
|
|
if id, _ := r["id"].(string); !strings.Contains(id, "mesh-vault") {
|
|
t.Errorf("the export's resource id %q does not carry its module", id)
|
|
}
|
|
}
|
|
if files != 1 {
|
|
t.Fatalf("%d export files; one module keeps them", files)
|
|
}
|
|
|
|
// No operator key yet: the vault is declared without the file, not with an empty one.
|
|
out, err = got.Declaration(Rendering{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, r := range out {
|
|
if r["path"] == "/var/lib/mesh-vault/root/export.json" {
|
|
t.Fatal("an export was written with nothing to export")
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestKeepsMustBeAnAbsolutePath(t *testing.T) {
|
|
_, err := ParseManifest([]byte(`{"module":"mesh-vault","version":"1","keeps":"root"}`))
|
|
if err == nil || !strings.Contains(err.Error(), "keeps") {
|
|
t.Fatalf("a relative keeps path was not refused: %v", err)
|
|
}
|
|
if _, err := ParseManifest([]byte(`{"module":"mesh-vault","version":"1","keeps":"/var/lib/mesh-vault/root"}`)); err != nil {
|
|
t.Fatalf("an absolute keeps path was refused: %v", err)
|
|
}
|
|
}
|