| 1 | package main |
| 2 | |
| 3 | import ( |
| 4 | "bytes" |
| 5 | "strings" |
| 6 | "testing" |
| 7 | "time" |
| 8 | ) |
| 9 | |
| 10 | func storeReplyWithScanning(sc *apiScanBlock) apiStoreReply { |
| 11 | at := time.Date(2026, 9, 1, 10, 0, 0, 0, time.UTC) |
| 12 | return apiStoreReply{ |
| 13 | App: "titogo", |
| 14 | Backend: "aws", |
| 15 | Declared: &apiStoreDeclared{EnvPrefix: "CARLOS_STORE", By: "m@example.com", At: at}, |
| 16 | Provisioned: &apiStoreProvisioned{ |
| 17 | Bucket: "carlos-bab-titogo", Region: "eu-west-1", |
| 18 | IAMUser: "carlos-bab-titogo", KeyID: "AKIA1", At: at, |
| 19 | }, |
| 20 | EnvNames: []string{"CARLOS_STORE_BUCKET"}, |
| 21 | MissingVars: []string{}, |
| 22 | Scanning: sc, |
| 23 | } |
| 24 | } |
| 25 | |
| 26 | // store status must mention scanning once it exists, and must not imply |
| 27 | // coverage — or enforcement — for a store that only has it recorded. |
| 28 | func TestPrintStoreStatusShowsScanState(t *testing.T) { |
| 29 | at := time.Date(2026, 9, 1, 10, 0, 0, 0, time.UTC) |
| 30 | |
| 31 | // Enabled but NOT enforcing: the line must say infected objects are not |
| 32 | // blocked. Someone reading "scanning: clamav" and assuming otherwise is |
| 33 | // the exact misunderstanding this line exists to prevent. |
| 34 | var b bytes.Buffer |
| 35 | printStoreStatus(&b, storeReplyWithScanning(&apiScanBlock{ |
| 36 | Requested: &apiScanRequested{At: at, By: "m@example.com"}, |
| 37 | Enabled: &apiScanEnabled{Engine: "clamav", At: at, By: "op@example.com"}, |
| 38 | })) |
| 39 | if out := b.String(); !strings.Contains(out, "recording only") || !strings.Contains(out, "NOT blocked") { |
| 40 | t.Fatalf("an enabled-but-not-enforcing store did not say so:\n%s", out) |
| 41 | } |
| 42 | |
| 43 | // Enforcing. |
| 44 | var b2 bytes.Buffer |
| 45 | printStoreStatus(&b2, storeReplyWithScanning(&apiScanBlock{ |
| 46 | Requested: &apiScanRequested{At: at, By: "m@example.com"}, |
| 47 | Enabled: &apiScanEnabled{Engine: "clamav", At: at, By: "op@example.com"}, |
| 48 | Enforce: &apiScanEnforce{Key: "carlos-scan", Value: "infected"}, |
| 49 | })) |
| 50 | if out := b2.String(); !strings.Contains(out, "enforcing") { |
| 51 | t.Fatalf("an enforcing store did not say so:\n%s", out) |
| 52 | } |
| 53 | |
| 54 | // Requested only: a member waiting on an operator, with no claim of |
| 55 | // anything having looked at an object. |
| 56 | var b3 bytes.Buffer |
| 57 | printStoreStatus(&b3, storeReplyWithScanning(&apiScanBlock{ |
| 58 | Requested: &apiScanRequested{At: at, By: "m@example.com"}, |
| 59 | })) |
| 60 | out3 := b3.String() |
| 61 | if !strings.Contains(out3, "no engine enabled yet") { |
| 62 | t.Fatalf("a requested-only store did not say it is waiting:\n%s", out3) |
| 63 | } |
| 64 | if strings.Contains(out3, "enforcing") { |
| 65 | t.Fatalf("a requested-only store implied enforcement:\n%s", out3) |
| 66 | } |
| 67 | |
| 68 | // Requested and attested encrypted. |
| 69 | var b4 bytes.Buffer |
| 70 | printStoreStatus(&b4, storeReplyWithScanning(&apiScanBlock{ |
| 71 | Requested: &apiScanRequested{At: at, By: "m@example.com", Encrypted: true}, |
| 72 | })) |
| 73 | if out := b4.String(); !strings.Contains(out, "no coverage will be claimed") { |
| 74 | t.Fatalf("an encrypted store's status implied coverage:\n%s", out) |
| 75 | } |
| 76 | } |
| 77 | |
| 78 | // A store with no scanning block prints exactly what it prints today — every |
| 79 | // existing deployment sees no change at all. |
| 80 | func TestPrintStoreStatusUnchangedWithoutScanning(t *testing.T) { |
| 81 | var b bytes.Buffer |
| 82 | printStoreStatus(&b, storeReplyWithScanning(nil)) |
| 83 | if strings.Contains(b.String(), "scanning") { |
| 84 | t.Fatalf("a store that never opted in grew a scanning line:\n%s", b.String()) |
| 85 | } |
| 86 | |
| 87 | // An empty block is the same case: a record can carry `scanning: {}` after |
| 88 | // a revoke cleared both halves, and that is not a state worth a line. |
| 89 | var b2 bytes.Buffer |
| 90 | printStoreStatus(&b2, storeReplyWithScanning(&apiScanBlock{})) |
| 91 | if strings.Contains(b2.String(), "scanning") { |
| 92 | t.Fatalf("an emptied scanning block still printed a line:\n%s", b2.String()) |
| 93 | } |
| 94 | } |
| 95 | |
amadan