jschoubben
68aaf235d4
Issue 1585, S19: the strict parser, every manifest problem function and the judge's tables (192 declarations, about 5,200 lines) and their 244 tests leave; composition keeps its own refusals and the helpers it uses. The catalogue's tests decode the manifests they build. ParseManifest, ParseManifestWith, ParseManifestForInputs, CatalogueProblems and the rest are gone; mesh-delivery-indexer/judge holds them. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
84 lines
2.6 KiB
Go
84 lines
2.6 KiB
Go
package catalogue
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// A secret a module needs in order to be itself.
|
|
//
|
|
// A database has a superuser password, a broker an administrator, a registry an account. None is
|
|
// *for* anybody — it is not the credential a consumer is given, and the mechanism that hands
|
|
// those out has a consumer in the middle of it.
|
|
|
|
func needy() Manifest {
|
|
return Manifest{
|
|
Module: "postgres", Version: "1",
|
|
OwnSecrets: OwnSecrets{"superuser": {Path: "/var/lib/mesh/postgres/superuser"}},
|
|
Resources: []map[string]any{
|
|
{"id": "store", "type": "container", "name": "mesh-postgres", "image": "postgres@sha256:x"},
|
|
},
|
|
}
|
|
}
|
|
|
|
func TestAModulesOwnSecretLandsSealed(t *testing.T) {
|
|
got, err := Resolve(shelf(needy()), []string{"postgres"}, reachable(), World{})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
out, err := got.Declaration(Rendering{
|
|
Needed: map[string]map[string]string{"postgres": {"superuser": "c2VhbGVk"}},
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, r := range out {
|
|
if r["path"] != "/var/lib/mesh/postgres/superuser" {
|
|
continue
|
|
}
|
|
if r["sealed"] != "c2VhbGVk" {
|
|
t.Fatalf("got %v", r)
|
|
}
|
|
if r["content"] != nil {
|
|
t.Fatal("a module's own secret was written in the clear")
|
|
}
|
|
return
|
|
}
|
|
t.Fatalf("no secret was written: %v", out)
|
|
}
|
|
|
|
func TestADeclaredNeedThatWasNotMadeIsRefused(t *testing.T) {
|
|
// Skipping it would start a database with no password it knows, which fails to authenticate
|
|
// three layers from the machine reporting it.
|
|
got, _ := Resolve(shelf(needy()), []string{"postgres"}, reachable(), World{})
|
|
_, err := got.Declaration(Rendering{})
|
|
if err == nil {
|
|
t.Fatal("a module needing a secret was declared without one")
|
|
}
|
|
if !strings.Contains(err.Error(), "superuser") {
|
|
t.Fatalf("the refusal does not name what is missing: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestAModuleMayNeedSeveralThings(t *testing.T) {
|
|
// A password and a token, say. Telling them apart is the module's business, not the mesh's.
|
|
m := needy()
|
|
m.OwnSecrets["replication"] = OwnSecret{Path: "/var/lib/mesh/postgres/replication"}
|
|
got, _ := Resolve(shelf(m), []string{"postgres"}, reachable(), World{})
|
|
out, err := got.Declaration(Rendering{Needed: map[string]map[string]string{
|
|
"postgres": {"superuser": "b25l", "replication": "dHdv"},
|
|
}})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
seen := map[string]string{}
|
|
for _, r := range out {
|
|
if path, ok := r["path"].(string); ok && strings.Contains(path, "/var/lib/mesh/postgres/") {
|
|
seen[path], _ = r["sealed"].(string)
|
|
}
|
|
}
|
|
if len(seen) != 2 || seen["/var/lib/mesh/postgres/superuser"] == seen["/var/lib/mesh/postgres/replication"] {
|
|
t.Fatalf("two needs did not land as two secrets: %v", seen)
|
|
}
|
|
}
|