mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: serve DWH authentication over Unix socket

Browse Source
This commit is contained in:
User
2026-08-21 01:57:19 +02:00
parent 943f809d01
commit 419c3440d7
4 changed files with 855 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/dwh-auth/internal/command/command_test.go
+28 -3
View File
@@ -19,6 +19,7 @@ import (
"github.com/aritmolab/thothii/tools/dwh-auth/internal/credential"
"github.com/aritmolab/thothii/tools/dwh-auth/internal/record"
"github.com/aritmolab/thothii/tools/dwh-auth/internal/registry"
"github.com/aritmolab/thothii/tools/dwh-auth/internal/service"
)
const sentinelSecret = "SENTINEL-DWH-SECRET-must-never-be-emitted"
@@ -295,17 +296,29 @@ func TestMetadataAndExpiryAreValidatedBeforeKeyGeneration(t *testing.T) {
}
}
func TestServeAcceptsOnlyExactTaskFourReservation(t *testing.T) {
func TestServeAcceptsOnlyExactCheckedServiceConfig(t *testing.T) {
root := t.TempDir()
socket := filepath.Join(t.TempDir(), "verify.sock")
oldListen := listenAndServe
t.Cleanup(func() { listenAndServe = oldListen })
called := false
listenAndServe = func(ctx context.Context, config service.Config) error {
called = true
if ctx == nil || config.RegistryRoot != root || config.Socket != socket || config.Logger == nil {
t.Fatalf("serve config = %#v", config)
}
return nil
}
stdout, stderr, code := run(t, "serve", "--registry-root", root, "--socket", socket)
if code != 4 || stdout != "" || stderr != "serve is not available in this release\n" {
t.Fatalf("valid serve reservation = (%d, %q, %q)", code, stdout, stderr)
if code != 0 || stdout != "" || stderr != "" || !called {
t.Fatalf("valid serve = (%d, %q, %q), called=%v", code, stdout, stderr, called)
}
invalid := [][]string{
{"serve", "--registry-root", "relative", "--socket", socket},
{"serve", "--registry-root", root + "/.", "--socket", socket},
{"serve", "--registry-root", root},
{"serve", "--registry-root", root, "--socket", "relative"},
{"serve", "--registry-root", root, "--socket", filepath.Dir(socket) + "/./verify.sock"},
{"serve", "--registry-root", root, "--socket", socket, "--socket", socket},
{"serve", "--socket", socket, "--registry-root", root},
{"serve", "--registry-root", root, "--socket", socket, "--unknown", "x"},
@@ -319,6 +332,18 @@ func TestServeAcceptsOnlyExactTaskFourReservation(t *testing.T) {
}
}
func TestServeSanitizesServiceStartupFailure(t *testing.T) {
root := t.TempDir()
socket := filepath.Join(t.TempDir(), "verify.sock")
oldListen := listenAndServe
t.Cleanup(func() { listenAndServe = oldListen })
listenAndServe = func(context.Context, service.Config) error { return errors.New(sentinelSecret) }
stdout, stderr, code := run(t, "serve", "--registry-root", root, "--socket", socket)
if code != 4 || stdout != "" || stderr != "integrity failure\n" || strings.Contains(stdout+stderr, sentinelSecret) {
t.Fatalf("service startup failure = (%d, %q, %q)", code, stdout, stderr)
}
}
func TestCreateCleansOnlyWhenFailedPublicationProvesKeyAbsent(t *testing.T) {
oldAdd, oldClose := addRecord, closeStore
t.Cleanup(func() { addRecord, closeStore = oldAdd, oldClose })