81 lines
2.7 KiB
Go
81 lines
2.7 KiB
Go
package catalogue
|
|
|
|
import "testing"
|
|
|
|
// The mesh's user list reaches the module holding the bus, and nothing else.
|
|
//
|
|
// Three refusals and one delivery, because each of the refusals would be silent in a different way:
|
|
// a module that asked and was given it could read every credential on the bus; a bus given an empty
|
|
// file refuses every connection in the mesh and looks like a machine problem; and a bus that never
|
|
// asked gets nothing rather than a file it does not read.
|
|
func TestTheMeshsUserListGoesOnlyToTheModuleHoldingTheBus(t *testing.T) {
|
|
theBus := func() Manifest {
|
|
return Manifest{
|
|
Module: "nats", Version: "1",
|
|
Claims: []Claim{{Name: "mesh-broker", Scope: ScopeMesh}},
|
|
BusUsers: "/var/lib/nats-module/conf/accounts.conf",
|
|
Resources: []map[string]any{},
|
|
}
|
|
}
|
|
|
|
on := func(t *testing.T, m Manifest, with Rendering) ([]map[string]any, error) {
|
|
t.Helper()
|
|
return Resolution{Node: "anchor", Modules: []Manifest{m}}.Declaration(with)
|
|
}
|
|
|
|
t.Run("the holder is given it", func(t *testing.T) {
|
|
resources, err := on(t, theBus(), Rendering{BusUsers: "accounts { MESH { users = [] } }"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Prefixed with the module it came from, like every resource: two modules may reasonably
|
|
// both call something "config", and without the prefix the second would silently replace
|
|
// the first.
|
|
var found map[string]any
|
|
for _, r := range resources {
|
|
if r["id"] == "nats."+BusUsersID() {
|
|
found = r
|
|
}
|
|
}
|
|
if found == nil {
|
|
t.Fatalf("the bus was given no user list: %+v", resources)
|
|
}
|
|
if found["path"] != "/var/lib/nats-module/conf/accounts.conf" {
|
|
t.Errorf("written to %v rather than where the module asked", found["path"])
|
|
}
|
|
if found["mode"] != "0600" {
|
|
t.Errorf("mode %v: a list of every user in the mesh belongs to the one process that "+
|
|
"needs it", found["mode"])
|
|
}
|
|
})
|
|
|
|
t.Run("a module that does not claim the seat is refused", func(t *testing.T) {
|
|
m := theBus()
|
|
m.Claims = nil
|
|
if _, err := on(t, m, Rendering{BusUsers: "accounts {}"}); err == nil {
|
|
t.Fatal("a module that claims nothing was handed every user's password hash")
|
|
}
|
|
})
|
|
|
|
t.Run("the holder with nothing composed is refused", func(t *testing.T) {
|
|
if _, err := on(t, theBus(), Rendering{}); err == nil {
|
|
t.Fatal("the bus was given an empty user list, so it would refuse every connection in " +
|
|
"the mesh and look like a machine problem")
|
|
}
|
|
})
|
|
|
|
t.Run("a module that did not ask gets nothing", func(t *testing.T) {
|
|
m := theBus()
|
|
m.BusUsers = ""
|
|
resources, err := on(t, m, Rendering{BusUsers: "accounts {}"})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, r := range resources {
|
|
if r["id"] == "nats."+BusUsersID() {
|
|
t.Fatal("a module that asked for no user list was given one")
|
|
}
|
|
}
|
|
})
|
|
}
|