| 1 | package svcrole |
| 2 | |
| 3 | import "testing" |
| 4 | |
| 5 | // Service is mintable the moment it is in the catalogue: the mint door, the |
| 6 | // mint form and doorsFor all read All(), so nothing else has to change for an |
| 7 | // account owner to issue one. |
| 8 | func TestServiceRoleIsMintable(t *testing.T) { |
| 9 | got, ok := Parse("service") |
| 10 | if !ok || got != Service { |
| 11 | t.Fatalf("Parse(\"service\") = %q, %v", got, ok) |
| 12 | } |
| 13 | |
| 14 | var found bool |
| 15 | for _, r := range All() { |
| 16 | if r == Service { |
| 17 | found = true |
| 18 | } |
| 19 | } |
| 20 | if !found { |
| 21 | t.Fatalf("Service is not in All(): %v", All()) |
| 22 | } |
| 23 | } |
| 24 | |
| 25 | // A Service door admits Service — and Admin, by construction. Allow adds Admin |
| 26 | // to every set, so this is not a hole to fix but a fact to state: the |
| 27 | // per-app isolation property is about role Service specifically. |
| 28 | func TestServiceDoorAdmitsServiceAndAdmin(t *testing.T) { |
| 29 | s := Allow(Service) |
| 30 | if !s.Permits(Service) { |
| 31 | t.Fatal("a Service door refuses Service") |
| 32 | } |
| 33 | if !s.Permits(Admin) { |
| 34 | t.Fatal("Allow adds Admin to every set; that changed") |
| 35 | } |
| 36 | for _, r := range []Role{Publish, Instance, Operate} { |
| 37 | if s.Permits(r) { |
| 38 | t.Fatalf("a Service door admits %q", r) |
| 39 | } |
| 40 | } |
| 41 | } |
| 42 | |
| 43 | // The mirror: adding Service must not widen the roles that already exist. A |
| 44 | // Publish or Instance credential has no business spending deployment CPU. |
| 45 | func TestExistingRolesDoNotReachServiceDoors(t *testing.T) { |
| 46 | for _, door := range []Set{Allow(Publish), Allow(Instance), Allow(Operate)} { |
| 47 | if door.Permits(Service) { |
| 48 | t.Fatalf("%v admits Service", door.Roles()) |
| 49 | } |
| 50 | } |
| 51 | } |
| 52 | |
amadan