125 lines
4.5 KiB
Go
125 lines
4.5 KiB
Go
package protocol
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestValidateRunJobAssignmentScopedFilePayloads(t *testing.T) {
|
|
assignment := RunJobAssignment{
|
|
JobID: "job-config-write",
|
|
ServerInstanceID: "server-1",
|
|
RunEndpointID: "run-local",
|
|
Capability: RunCapabilityConfigWrite,
|
|
TargetKey: "server.properties",
|
|
InputRef: "input://server-config/server-1/server.properties/v1",
|
|
IdempotencyKey: "idem-config",
|
|
}
|
|
if err := ValidateRunJobAssignment(assignment); err != nil {
|
|
t.Fatalf("expected valid config write assignment: %v", err)
|
|
}
|
|
|
|
assignment.TargetKey = "/Users/tasia/server.properties"
|
|
if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "targetKey") {
|
|
t.Fatalf("expected raw host path rejection, got %v", err)
|
|
}
|
|
|
|
assignment.TargetKey = "server.properties"
|
|
assignment.InputRef = "sk-raw-secret"
|
|
if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "inputRef") {
|
|
t.Fatalf("expected raw credential ref rejection, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestValidateRunJobAssignmentScopedReadDoesNotRequireInputRef(t *testing.T) {
|
|
assignment := RunJobAssignment{
|
|
JobID: "job-files-read",
|
|
ServerInstanceID: "server-1",
|
|
RunEndpointID: "run-local",
|
|
Capability: RunCapabilityFilesRead,
|
|
TargetKey: "logs/latest.log",
|
|
IdempotencyKey: "idem-read",
|
|
}
|
|
if err := ValidateRunJobAssignment(assignment); err != nil {
|
|
t.Fatalf("expected valid file read assignment: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestValidateRunJobAssignmentRemoteCapabilitiesAreBounded(t *testing.T) {
|
|
assignment := RunJobAssignment{
|
|
JobID: "job-remote-rcon",
|
|
ServerInstanceID: "server-1",
|
|
RunEndpointID: "run-local",
|
|
Capability: RunCapabilityRemoteRunRCONCommand,
|
|
TargetKey: "rcon/command",
|
|
InputRef: "input://server-1/rcon/command/1",
|
|
IdempotencyKey: "idem-rcon",
|
|
}
|
|
if err := ValidateRunJobAssignment(assignment); err != nil {
|
|
t.Fatalf("expected valid remote rcon assignment: %v", err)
|
|
}
|
|
|
|
assignment.InputRef = "password=raw"
|
|
if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "inputRef") {
|
|
t.Fatalf("expected unsafe inputRef rejection, got %v", err)
|
|
}
|
|
|
|
assignment.InputRef = "input://server-1/rcon/command/1"
|
|
assignment.TargetKey = "/Users/tasia/server.db"
|
|
if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "targetKey") {
|
|
t.Fatalf("expected unsafe targetKey rejection, got %v", err)
|
|
}
|
|
}
|
|
|
|
func TestValidateRunJobAssignmentDistributionCapabilitiesAreBounded(t *testing.T) {
|
|
selfUpdate := RunJobAssignment{
|
|
JobID: "job-update",
|
|
ServerInstanceID: "server-1",
|
|
RunEndpointID: "run-local",
|
|
Capability: RunCapabilityRunSelfUpdate,
|
|
TargetKey: "run/update",
|
|
InputRef: "artifact://artifact-run-latest",
|
|
IdempotencyKey: "idem-update",
|
|
}
|
|
if err := ValidateRunJobAssignment(selfUpdate); err != nil {
|
|
t.Fatalf("expected valid self-update assignment: %v", err)
|
|
}
|
|
selfUpdate.InputRef = "input://not-an-artifact"
|
|
if err := ValidateRunJobAssignment(selfUpdate); err == nil || !strings.Contains(err.Error(), "artifact") {
|
|
t.Fatalf("expected non-artifact self-update ref rejection, got %v", err)
|
|
}
|
|
|
|
check := RunJobAssignment{
|
|
JobID: "job-dependency-check",
|
|
ServerInstanceID: "server-1",
|
|
RunEndpointID: "run-local",
|
|
Capability: RunCapabilityDependenciesCheck,
|
|
TargetKey: "dependencies/java-21",
|
|
IdempotencyKey: "idem-dep-check",
|
|
}
|
|
if err := ValidateRunJobAssignment(check); err != nil {
|
|
t.Fatalf("expected valid dependency check assignment: %v", err)
|
|
}
|
|
check.TargetKey = "dependencies/install/java;rm"
|
|
if err := ValidateRunJobAssignment(check); err == nil || !strings.Contains(err.Error(), "targetKey") {
|
|
t.Fatalf("expected shell-like dependency target rejection, got %v", err)
|
|
}
|
|
|
|
backfill := RunJobAssignment{
|
|
JobID: "job-log-backfill",
|
|
ServerInstanceID: "server-1",
|
|
RunEndpointID: "run-local",
|
|
Capability: RunCapabilityLogsBackfill,
|
|
TargetKey: "logs/latest-log",
|
|
InputRef: "artifact://logs/checkpoint/1",
|
|
IdempotencyKey: "idem-log-backfill",
|
|
}
|
|
if err := ValidateRunJobAssignment(backfill); err != nil {
|
|
t.Fatalf("expected valid log backfill assignment: %v", err)
|
|
}
|
|
backfill.InputRef = "password=raw"
|
|
if err := ValidateRunJobAssignment(backfill); err == nil || !strings.Contains(err.Error(), "inputRef") {
|
|
t.Fatalf("expected unsafe log checkpoint rejection, got %v", err)
|
|
}
|
|
}
|