FilesExpand file tree

main

/

clear_authorization_test.go

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

98 lines (95 loc) · 3.89 KB

main

/

clear_authorization_test.go

Copy path

Top

File metadata and controls

• Code
• Blame

98 lines (95 loc) · 3.89 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

package workqueue

import (

"context"

"strings"

"testing"

)

func TestClearAuthorizationDoesNotWidenOtherAdministratorOperations(t *testing.T) {

for _, scenario := range []string{"admin", "maintain", "write", "no_push"} {

t.Run(scenario, func(t *testing.T) {

branch, mock := newQueueAPI(t)

mock.noAdmin = scenario != "admin"

mock.maintain = scenario == "maintain" || scenario == "no_push"

mock.noPush = scenario == "no_push"

actor, err := branch.AuthenticateClear(context.Background())

allowed := scenario == "admin" || scenario == "maintain"

if (err == nil) != allowed || mock.ledgerCalls != 0 || mock.refWrites != 0 {

t.Fatalf("clear authorization performed I/O or accepted the wrong role: %+v %v", actor, err)

}

if !allowed {

if !strings.HasPrefix(err.Error(), "actor_unauthorized:") {

t.Fatal(err)

}

return

}

if actor.Role != "administrator" || actor.Principal != testPrincipal || actor.Repository != testRepository {

t.Fatalf("clear authorization changed audit actor: %+v", actor)

}

selected := testGenesis(t, nil)

node := testNode(t, selected, "selected")

selected = testSubmit(t, selected, "submit", node)

installMockLog(t, mock, selected)

control, err := NewRequest("pause", "control", actor, OperationsParameters{Operations: []Operation{

mustOp(t, map[string]any{"kind": "Control", "control": "grants_paused", "value": true, "reason": "pause"}),

}})

if err != nil {

t.Fatal(err)

}

_, genericErr := branch.PublishFromSnapshot(context.Background(), actor, control, selected)

if (genericErr == nil) != (scenario == "admin") {

t.Fatalf("maintainer access widened another administrator operation: %v", genericErr)

}

_, genericErr = branch.Publish(context.Background(), actor, snapshotCancellation(t, node))

if scenario == "maintain" && genericErr == nil {

t.Fatal("unfenced administrator publication accepted maintainer access")

}

if _, err := branch.PublishFromSnapshot(context.Background(), actor, snapshotCancellation(t, node), selected); err != nil {

t.Fatalf("authorized snapshot clear failed: %v", err)

}

})

}

}

func TestHardClearFromSnapshotChecksConfirmedRevision(t *testing.T) {

for _, scenario := range []string{"unchanged", "changed", "invalid", "maintain", "write"} {

t.Run(scenario, func(t *testing.T) {

branch, mock := newQueueAPI(t)

mock.noAdmin = scenario == "maintain" || scenario == "write"

mock.maintain = scenario == "maintain"

commits := hardClearFixture(t)

installMockLog(t, mock, commits)

preview, err := branch.HardClear(context.Background(), "hard-action", "operator_clear", true)

if scenario == "write" {

if err == nil || mock.ledgerCalls != 0 || mock.refWrites != 0 {

t.Fatalf("writer could preview a hard clear: %+v %v", preview, err)

}

return

}

if err != nil {

t.Fatal(err)

}

if scenario == "changed" {

commits = testOperations(t, commits, testActor("administrator"), "new-generation", "control",

mustOp(t, map[string]any{"kind": "Control", "control": "credential_generation", "value": "new_generation", "reason": "rotate"}))

installMockLog(t, mock, commits)

}

revision := preview.PriorGitSHA

if scenario == "invalid" {

revision = ""

}

_, err = branch.HardClearFromSnapshot(context.Background(), "hard-action", "operator_clear", revision)

if scenario == "changed" || scenario == "invalid" {

if err == nil || mock.refWrites != 0 {

t.Fatalf("hard clear accepted an unconfirmed snapshot: %v", err)

}

return

}

if err != nil || mock.refWrites != 1 {

t.Fatalf("confirmed hard clear failed: %v", err)

}

result, err := branch.HardClearFromSnapshot(context.Background(), "hard-action", "operator_clear", revision)

if err != nil || result.Status != "already_committed" || mock.refWrites != 1 {

t.Fatalf("confirmed hard-clear retry performed another reset: %+v %v", result, err)

}

})

}

}