1// SPDX-License-Identifier: AGPL-3.0-or-later
2
3package domain_test
4
5import (
6 "testing"
7
8 "github.com/stretchr/testify/assert"
9
10 "bnema.dev/ermite/internal/domain"
11)
12
13func tokenOf(t *testing.T, tok domain.Token) domain.Principal {
14 t.Helper()
15 return domain.TokenPrincipal(tok)
16}
17
18func TestTrustedActor(t *testing.T) {
19 t.Parallel()
20 repo, _ := domain.ParseRepoName("proj")
21 all := domain.AllScopes()
22 cases := []struct {
23 name string
24 p domain.Principal
25 want bool
26 }{
27 {"owner session", domain.Owner(), true},
28 {"root token", domain.Root(), true},
29 {"unlimited token with every scope", tokenOf(t, domain.Token{ID: "a", Scopes: all}), true},
30 {"branch-limited token with every scope", tokenOf(t, domain.Token{ID: "b", Scopes: all, BranchPrefixes: []string{"agent/x/"}}), false},
31 {"token limited to a repository", tokenOf(t, domain.Token{ID: "c", Scopes: all, Repos: []domain.RepoName{repo}}), false},
32 {"token without every scope", tokenOf(t, domain.Token{ID: "d", Scopes: []domain.Scope{domain.ScopeRepoWrite}}), false},
33 {"job token", domain.RepoTokenPrincipal(domain.CIRepoToken{ID: "e", Repo: repo}), false},
34 {"anonymous", domain.Anonymous(), false},
35 }
36 for _, tc := range cases {
37 assert.Equal(t, tc.want, domain.TrustedActor(tc.p), tc.name)
38 }
39}
40
41func TestRerunTrustedNeverRaises(t *testing.T) {
42 t.Parallel()
43 agent := tokenOf(t, domain.Token{ID: "b", Scopes: domain.AllScopes(), BranchPrefixes: []string{"agent/"}})
44 assert.True(t, domain.RerunTrusted(true, domain.Owner()), "owner re-runs an owner's run")
45 assert.False(t, domain.RerunTrusted(true, agent), "an agent re-running an owner's run lowers it")
46 assert.False(t, domain.RerunTrusted(false, domain.Owner()), "the owner re-running an agent's run does not unlock it")
47 assert.False(t, domain.RerunTrusted(false, domain.Root()), "nor does root")
48}