| 1 | package hostfence |
| 2 | |
| 3 | import ( |
| 4 | "strings" |
| 5 | "testing" |
| 6 | ) |
| 7 | |
| 8 | func TestPlan9FenceNeverFallsBackToSharedCredentials(t *testing.T) { |
| 9 | w, store := terminationFixture(t) |
| 10 | w.Fences = nil |
| 11 | if _, err := w.binding(t.Context(), "dead"); err == nil { |
| 12 | t.Fatal("missing dedicated writer accepted") |
| 13 | } |
| 14 | keys, err := store.List(t.Context(), "control/box-fences/") |
| 15 | if err != nil { |
| 16 | t.Fatal(err) |
| 17 | } |
| 18 | if len(keys) != 0 { |
| 19 | t.Fatalf("shared store used: %v", keys) |
| 20 | } |
| 21 | } |
| 22 | |
| 23 | func TestPlan9FenceCredentialScope(t *testing.T) { |
| 24 | for _, raw := range []string{ |
| 25 | `{"role":"arn:aws:iam::123456789012:role/writer","region":"eu-west-1","bucket":"dep","access_key":"a","secret_key":"s"}`, |
| 26 | `{"role":"arn:aws:iam::123456789012:role/*","region":"eu-west-1","bucket":"dep","access_key":"a","secret_key":"s"}`, |
| 27 | `{"role":"arn:aws:iam::123456789012:role/writer","region":"eu-west-1","bucket":"other","access_key":"a","secret_key":"s"}`, |
| 28 | } { |
| 29 | _, err := decodeFenceCredentials(strings.NewReader(raw), "dep") |
| 30 | want := strings.Contains(raw, `role/writer`) && !strings.Contains(raw, `"other"`) |
| 31 | if (err == nil) != want { |
| 32 | t.Fatalf("scope accepted=%v, want %v", err == nil, want) |
| 33 | } |
| 34 | } |
| 35 | } |
| 36 | |
amadan