| 1 | package activator |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "errors" |
| 6 | "os" |
| 7 | "path/filepath" |
| 8 | "syscall" |
| 9 | "testing" |
| 10 | |
| 11 | "github.com/carlosframework/platform/internal/hostbox" |
| 12 | "github.com/carlosframework/platform/internal/registry" |
| 13 | ) |
| 14 | |
| 15 | func TestClaimLaunchShapeSidecarInspection(t *testing.T) { |
| 16 | const host = "claim-sidecar.example" |
| 17 | rt := registry.Route{Host: host} |
| 18 | |
| 19 | t.Run("proven absent", func(t *testing.T) { |
| 20 | b := &ExecBackend{DataDir: t.TempDir()} |
| 21 | if err := b.claimLaunchShape(rt); err != nil { |
| 22 | t.Fatalf("claimLaunchShape: %v", err) |
| 23 | } |
| 24 | }) |
| 25 | |
| 26 | t.Run("present", func(t *testing.T) { |
| 27 | b := &ExecBackend{DataDir: t.TempDir()} |
| 28 | if err := os.WriteFile(filepath.Join(b.DataDir, host+"-sidecar.env"), nil, 0o600); err != nil { |
| 29 | t.Fatal(err) |
| 30 | } |
| 31 | if err := b.claimLaunchShape(rt); !errors.Is(err, hostbox.ErrUnsupported) { |
| 32 | t.Fatalf("claimLaunchShape error = %v, want unsupported", err) |
| 33 | } |
| 34 | }) |
| 35 | |
| 36 | t.Run("symlink loop", func(t *testing.T) { |
| 37 | b := &ExecBackend{DataDir: t.TempDir()} |
| 38 | path := filepath.Join(b.DataDir, host+"-sidecar.env") |
| 39 | if err := os.Symlink(filepath.Base(path), path); err != nil { |
| 40 | t.Fatal(err) |
| 41 | } |
| 42 | if _, err := os.Stat(path); !errors.Is(err, syscall.ELOOP) { |
| 43 | t.Fatalf("fixture os.Stat error = %v, want ELOOP", err) |
| 44 | } |
| 45 | if err := b.claimLaunchShape(rt); !errors.Is(err, syscall.ELOOP) { |
| 46 | t.Fatalf("claimLaunchShape error = %v, want ELOOP", err) |
| 47 | } |
| 48 | }) |
| 49 | |
| 50 | t.Run("permission denied", func(t *testing.T) { |
| 51 | parent := t.TempDir() |
| 52 | dataDir := filepath.Join(parent, "data") |
| 53 | if err := os.Mkdir(dataDir, 0o700); err != nil { |
| 54 | t.Fatal(err) |
| 55 | } |
| 56 | if err := os.Chmod(dataDir, 0); err != nil { |
| 57 | t.Fatal(err) |
| 58 | } |
| 59 | t.Cleanup(func() { _ = os.Chmod(dataDir, 0o700) }) |
| 60 | path := filepath.Join(dataDir, host+"-sidecar.env") |
| 61 | if _, err := os.Stat(path); !errors.Is(err, syscall.EACCES) { |
| 62 | t.Skipf("fixture cannot produce EACCES: %v", err) |
| 63 | } |
| 64 | b := &ExecBackend{DataDir: dataDir} |
| 65 | if err := b.claimLaunchShape(rt); !errors.Is(err, syscall.EACCES) { |
| 66 | t.Fatalf("claimLaunchShape error = %v, want EACCES", err) |
| 67 | } |
| 68 | }) |
| 69 | } |
| 70 | |
| 71 | func TestClaimLaunchRolesPropagatesInjectedInspectionErrors(t *testing.T) { |
| 72 | b := &ExecBackend{DataDir: t.TempDir()} |
| 73 | for _, want := range []error{syscall.EACCES, syscall.EIO, syscall.ELOOP} { |
| 74 | t.Run(want.Error(), func(t *testing.T) { |
| 75 | roles, err := b.claimLaunchRoles(registry.Route{Host: "claim-sidecar.example"}, func(string) (os.FileInfo, error) { |
| 76 | return nil, want |
| 77 | }) |
| 78 | if roles != nil || !errors.Is(err, want) { |
| 79 | t.Fatalf("roles=%v error=%v, want nil roles and %v", roles, err, want) |
| 80 | } |
| 81 | }) |
| 82 | } |
| 83 | } |
| 84 | |
| 85 | func TestEnsureClaimAdminTokenInspectsSidecarBeforeAuthorize(t *testing.T) { |
| 86 | const host = "claim-sidecar.example" |
| 87 | b := &ExecBackend{DataDir: t.TempDir()} |
| 88 | path := filepath.Join(b.DataDir, host+"-sidecar.env") |
| 89 | if err := os.Symlink(filepath.Base(path), path); err != nil { |
| 90 | t.Fatal(err) |
| 91 | } |
| 92 | rt := registry.Route{Host: host, Socket: "/run/carlos/claim-sidecar.sock", DBPath: "/data/claim-sidecar.db"} |
| 93 | authorized := 0 |
| 94 | err := b.EnsureClaimAdminToken(context.Background(), rt, func(_ context.Context, write func() error) error { |
| 95 | authorized++ |
| 96 | return write() |
| 97 | }) |
| 98 | if !errors.Is(err, syscall.ELOOP) { |
| 99 | t.Fatalf("EnsureClaimAdminToken error = %v, want ELOOP", err) |
| 100 | } |
| 101 | if authorized != 0 { |
| 102 | t.Fatalf("authorize called %d times after sidecar inspection failed", authorized) |
| 103 | } |
| 104 | } |
| 105 | |
amadan