| 1 | package gates |
| 2 | |
| 3 | import ( |
| 4 | "context" |
| 5 | "strconv" |
| 6 | "strings" |
| 7 | "testing" |
| 8 | |
| 9 | "github.com/FelineStateMachine/tinyrelay/internal/event" |
| 10 | "github.com/FelineStateMachine/tinyrelay/internal/policy" |
| 11 | "github.com/FelineStateMachine/tinyrelay/internal/relay" |
| 12 | "github.com/FelineStateMachine/tinyrelay/internal/sites" |
| 13 | ) |
| 14 | |
| 15 | func validSiteSnapshot(t *testing.T, secret, source string, createdAt int64) event.Event { |
| 16 | t.Helper() |
| 17 | hash := strings.Repeat("a" , 64) |
| 18 | paths := [][]string{{"path" , "/index.html" , hash}} |
| 19 | e := event.Event{ |
| 20 | Kind: sites.KindSiteSnapshot, |
| 21 | CreatedAt: createdAt, |
| 22 | Tags: append(paths, |
| 23 | []string{"x" , sites.Aggregate(paths), "aggregate" }, |
| 24 | []string{"a" , "15128:" + source + ":" }, |
| 25 | ), |
| 26 | } |
| 27 | if err := event.Sign(&e, secret); err != nil { |
| 28 | t.Fatal(err) |
| 29 | } |
| 30 | if err := sites.ValidateManifest(e); err != nil { |
| 31 | t.Fatalf("snapshot fixture is invalid: %v" , err) |
| 32 | } |
| 33 | return e |
| 34 | } |
| 35 | |
| 36 | func TestSiteSnapshotIsNotControlledByJobFeature(t *testing.T) { |
| 37 | f := newAgentFixture(t) |
| 38 | ctx := context.Background() |
| 39 | snapshot := validSiteSnapshot(t, agentOtherSecret, f.owner, agentNow) |
| 40 | session := relay.Session{PubKeys: []string{snapshot.PubKey}} |
| 41 | |
| 42 | for _, jobsEnabled := range []bool{true, false} { |
| 43 | t.Run("jobs-enabled=" +strconv.FormatBool(jobsEnabled), func(t *testing.T) { |
| 44 | p := policy.Defaults(f.owner) |
| 45 | p.Features.Jobs = jobsEnabled |
| 46 | f.gate.cfg.Policy = func() policy.Policy { return p } |
| 47 | if err := f.gate.Write(ctx, snapshot, session, agentNow); err != nil { |
| 48 | t.Fatalf("valid site snapshot rejected with jobs=%t: %v" , jobsEnabled, err) |
| 49 | } |
| 50 | }) |
| 51 | } |
| 52 | } |
| 53 | |
| 54 | func TestSiteSnapshotRespectsRelayWritePolicy(t *testing.T) { |
| 55 | f := newAgentFixture(t) |
| 56 | p := policy.Defaults(f.owner) |
| 57 | p.Writes = "allowlist" |
| 58 | p.Features.Jobs = false |
| 59 | f.gate.cfg.Policy = func() policy.Policy { return p } |
| 60 | snapshot := validSiteSnapshot(t, agentOtherSecret, f.owner, agentNow) |
| 61 | err := f.gate.Write(context.Background(), snapshot, relay.Session{PubKeys: []string{snapshot.PubKey}}, agentNow) |
| 62 | expectError(t, err, "blocked:" , "relay write policy" ) |
| 63 | } |