jochen
4dc5f29d3e
mesh/delivery-group group fix/418-node-reads rejected: a member's own check failed
mesh/merge-gate pass: builds mesh-sdk, sent nowhere; no bus step; every machine composes with the change as it did without (4 of 4 compose)
mesh/repo-check pass: its merge-check.sh passed, each part in its toolchain: merge-check.sh (typescript), go/merge-check.sh (go)
mesh/delivery superseded: a newer head of the same pull request
The operator channel's rule (messenger's content.go, with the secret class split out as in issue 383's branch) moves here as package outward: Check for what may leave on a channel, CheckSecret for a secret's shape alone, which is what a node-reads answer is held to. The messenger switches to it once mesh-catalog #178, which changes that file, has merged.
93 lines
4.2 KiB
Go
93 lines
4.2 KiB
Go
package outward
|
|
|
|
// The operator channel's cases, carried here with the rule (novox/hq ADR 0310 §4): the rule moved, its meaning did not.
|
|
|
|
import "testing"
|
|
|
|
func TestRolesAndWordsMayLeave(t *testing.T) {
|
|
for _, s := range []string{
|
|
"URGENT: the home server has not been heard for 15 min",
|
|
"key: provider.keycloak.ace.gitea.failing",
|
|
"more: conditions show machine.ace.silent",
|
|
"since: 2026-10-06 12:30 UTC",
|
|
"call call-1759752000123456789-12 has run past its bound of 10 min",
|
|
"ace/postgres.query answers no more",
|
|
"3/4 machines answered; plan 41 waits on build 7f3a9c1e",
|
|
"the bus advisory slow-consumer for ace_records",
|
|
"core.controller.novox.rolled-back",
|
|
"seat node-notifier has no live holder",
|
|
"HELD BACK: 5 message(s) over the cap of 20 an hour",
|
|
"STILL OPEN after 1.5 h: the controller's event loop takes no message",
|
|
"node-engine and node tools builds differ from the plan's",
|
|
} {
|
|
if r, ok := Check(s); !ok {
|
|
t.Errorf("refused %q: %s", s, r)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestAnAddressAPathOrASecretMayNot(t *testing.T) {
|
|
for s, class := range map[string]string{
|
|
"cannot reach 192.168.1.20": "address",
|
|
"listening on 10.0.0.7:5432": "address",
|
|
"route fd00:1234:5678::1 is gone": "address",
|
|
"fe80::1 answered": "address",
|
|
"2001:db8:0:0:0:0:2:1 answered": "address",
|
|
"see https://git.example.org/x": "address",
|
|
"git.novox.internal does not answer": "address",
|
|
"the mail for admin@example.org bounced": "address",
|
|
"zurag.be is down": "address",
|
|
"localhost refused": "address",
|
|
"the card aa:bb:cc:dd:ee:ff went away": "address",
|
|
"/var/lib/mesh-controller is full": "path",
|
|
"~/.config/hal/env changed": "path",
|
|
"read ./grants.json": "path",
|
|
"services/postgres/data/pg_hba.conf": "path",
|
|
"C:\\Users\\x": "path",
|
|
"token 123456789:AAHdqTcvCH1vGWJxfSeofSAs0K5PALDsaw": "secret",
|
|
"ghp_abcdefghijklmnopqrstuvwxyz0123456789": "secret",
|
|
"password=hunter2": "secret",
|
|
"api_key: x": "secret",
|
|
"-----BEGIN OPENSSH PRIVATE KEY-----": "secret",
|
|
"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0": "secret",
|
|
"commit 3f2a9c1e5b7d4f6a8c0e2b4d6f8a0c2e4b6d8f0a": "secret",
|
|
"value Zx8Qp2Lm9Rt4Vb7Nc1Kd5Hs3Jf6": "secret",
|
|
} {
|
|
r, ok := Check(s)
|
|
if ok {
|
|
t.Errorf("let %q leave", s)
|
|
continue
|
|
}
|
|
if r.Class != class {
|
|
t.Errorf("%q refused as %s, want %s", s, r, class)
|
|
}
|
|
}
|
|
}
|
|
|
|
// The secret class alone (novox/hq ADR 0310 §4, issue 383): a path and an address pass, a path's pieces are
|
|
// judged between its slashes, and every named secret shape and a random run outside a path are refused.
|
|
func TestCheckSecretRefusesASecretsShapeAndNothingElse(t *testing.T) {
|
|
for text, may := range map[string]bool{
|
|
"+ shares: photos=/mnt/Photos_2024/Jochen": true,
|
|
"+ sources: games=smb://nas.lan/Recalbox_Games2024": true,
|
|
"+ library: /srv/media/Series_Archive/Season01": true,
|
|
"root:x:0:0::/root:/usr/bin/bash": true,
|
|
"nameserver 192.168.1.1": true,
|
|
"drwxr-x--- jochen users /home/jochen": true,
|
|
"+ key: xK9mQ2vL8pR4tW7yB3nF6hJ1dG5sA0zC": false,
|
|
"-----BEGIN OPENSSH PRIVATE KEY-----": false,
|
|
"password=hunter2": false,
|
|
"Authorization: token ghp_abcdefghijklmnopqrstuvwxyz0123456789": false,
|
|
"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0": false,
|
|
"sha 3f2a9c1e5b7d4f6a8c0e2b4d6f8a0c2e4b6d8f0a": false,
|
|
} {
|
|
r, ok := CheckSecret(text)
|
|
if ok != may {
|
|
t.Errorf("CheckSecret(%q) = %v (%s), want %v", text, ok, r, may)
|
|
}
|
|
if !ok && r.Class != "secret" {
|
|
t.Errorf("CheckSecret(%q) refused as %s: only the secret class is refused there", text, r)
|
|
}
|
|
}
|
|
}
|