ci_trust_test.go RawHistoryFolder

1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package domain_test
4
5import (
6	"testing"
7
8	"github.com/stretchr/testify/assert"
9
10	"bnema.dev/ermite/internal/domain"
11)
12
13func tokenOf(t *testing.T, tok domain.Token) domain.Principal {
14	t.Helper()
15	return domain.TokenPrincipal(tok)
16}
17
18func TestTrustedActor(t *testing.T) {
19	t.Parallel()
20	repo, _ := domain.ParseRepoName("proj")
21	all := domain.AllScopes()
22	cases := []struct {
23		name string
24		p    domain.Principal
25		want bool
26	}{
27		{"owner session", domain.Owner(), true},
28		{"root token", domain.Root(), true},
29		{"unlimited token with every scope", tokenOf(t, domain.Token{ID: "a", Scopes: all}), true},
30		{"branch-limited token with every scope", tokenOf(t, domain.Token{ID: "b", Scopes: all, BranchPrefixes: []string{"agent/x/"}}), false},
31		{"token limited to a repository", tokenOf(t, domain.Token{ID: "c", Scopes: all, Repos: []domain.RepoName{repo}}), false},
32		{"token without every scope", tokenOf(t, domain.Token{ID: "d", Scopes: []domain.Scope{domain.ScopeRepoWrite}}), false},
33		{"job token", domain.RepoTokenPrincipal(domain.CIRepoToken{ID: "e", Repo: repo}), false},
34		{"anonymous", domain.Anonymous(), false},
35	}
36	for _, tc := range cases {
37		assert.Equal(t, tc.want, domain.TrustedActor(tc.p), tc.name)
38	}
39}
40
41func TestRerunTrustedNeverRaises(t *testing.T) {
42	t.Parallel()
43	agent := tokenOf(t, domain.Token{ID: "b", Scopes: domain.AllScopes(), BranchPrefixes: []string{"agent/"}})
44	assert.True(t, domain.RerunTrusted(true, domain.Owner()), "owner re-runs an owner's run")
45	assert.False(t, domain.RerunTrusted(true, agent), "an agent re-running an owner's run lowers it")
46	assert.False(t, domain.RerunTrusted(false, domain.Owner()), "the owner re-running an agent's run does not unlock it")
47	assert.False(t, domain.RerunTrusted(false, domain.Root()), "nor does root")
48}