| 1 | package hostfence |
| 2 | |
| 3 | import "testing" |
| 4 | |
| 5 | func TestActivationCredentialsScope(t *testing.T) { |
| 6 | raw := []byte(`{"role":"arn:aws:iam::123456789012:role/fence","region":"eu-west-1","bucket":"bucket","access_key":"test","secret_key":"test"}`) |
| 7 | if err := ValidateActivationCredentials(raw, "bucket", "eu-west-1", "arn:aws:iam::123456789012:role/fence"); err != nil { |
| 8 | t.Fatal(err) |
| 9 | } |
| 10 | for _, scope := range [][3]string{{"other", "eu-west-1", "arn:aws:iam::123456789012:role/fence"}, {"bucket", "eu-west-2", "arn:aws:iam::123456789012:role/fence"}, {"bucket", "eu-west-1", "arn:aws:iam::123456789012:role/other"}} { |
| 11 | if err := ValidateActivationCredentials(raw, scope[0], scope[1], scope[2]); err == nil { |
| 12 | t.Fatal("scope mismatch accepted") |
| 13 | } |
| 14 | } |
| 15 | } |
| 16 | |
| 17 | func TestActivationReceiptBindsExactCredentialBytes(t *testing.T) { |
| 18 | raw := []byte(`{"role":"arn:aws:iam::123456789012:role/fence","region":"eu-west-1","bucket":"bucket","access_key":"test","secret_key":"test"}`) |
| 19 | receipt := ActivationCredentialReceipt(raw) |
| 20 | if !VerifyActivationCredentialReceipt(raw, receipt) { |
| 21 | t.Fatal("receipt rejected") |
| 22 | } |
| 23 | if VerifyActivationCredentialReceipt(append(raw, ' '), receipt) || VerifyActivationCredentialReceipt(raw, nil) { |
| 24 | t.Fatal("uninstalled credentials accepted") |
| 25 | } |
| 26 | } |
| 27 | |
amadan