221 lines
11 KiB
Go
221 lines
11 KiB
Go
package app_test
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
"proxyctl/internal/app"
|
|
"proxyctl/internal/profile"
|
|
"proxyctl/internal/target"
|
|
)
|
|
|
|
type maintenanceTarget struct {
|
|
id string
|
|
available target.Availability
|
|
inspection target.Inspection
|
|
checks []target.Check
|
|
disableErr error
|
|
disableCalls int
|
|
confirmation string
|
|
}
|
|
|
|
func (f *maintenanceTarget) ID() string { return f.id }
|
|
func (f *maintenanceTarget) Description() target.Description {
|
|
return target.Description{Name: strings.ToUpper(f.id)}
|
|
}
|
|
func (f *maintenanceTarget) Availability(context.Context) target.Availability { return f.available }
|
|
func (f *maintenanceTarget) Confirmation(bool) string { return f.confirmation }
|
|
func (f *maintenanceTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
|
|
return f.inspection
|
|
}
|
|
func (f *maintenanceTarget) SetDesired(_ context.Context, enabled bool, _ *profile.Profile) target.OperationResult {
|
|
if !enabled {
|
|
f.disableCalls++
|
|
if f.disableErr == nil {
|
|
f.inspection = target.Inspection{State: target.Disabled, Evidence: "managed state removed"}
|
|
}
|
|
}
|
|
return target.OperationResult{Inspection: f.inspection, Err: f.disableErr}
|
|
}
|
|
func (f *maintenanceTarget) DiagnosticChecks(context.Context, *profile.Profile) []target.Check {
|
|
return append([]target.Check(nil), f.checks...)
|
|
}
|
|
|
|
type staleFailureTarget struct{ inspectCalls int }
|
|
|
|
func (*staleFailureTarget) ID() string { return "stale" }
|
|
func (*staleFailureTarget) Description() target.Description { return target.Description{Name: "stale"} }
|
|
func (*staleFailureTarget) Availability(context.Context) target.Availability {
|
|
return target.Availability{Available: true}
|
|
}
|
|
func (*staleFailureTarget) Confirmation(bool) string { return "" }
|
|
func (f *staleFailureTarget) Inspect(context.Context, *profile.Profile) target.Inspection {
|
|
f.inspectCalls++
|
|
if f.inspectCalls == 1 {
|
|
return target.Inspection{State: target.Enabled, Evidence: "initial managed state"}
|
|
}
|
|
return target.Inspection{State: target.External, Evidence: "fresh evidence http://alice:secret@proxy.example:8080"}
|
|
}
|
|
func (*staleFailureTarget) SetDesired(context.Context, bool, *profile.Profile) target.OperationResult {
|
|
return target.OperationResult{
|
|
Inspection: target.Inspection{State: target.Drifted, Evidence: "stale returned evidence"},
|
|
Err: errors.New("failed https://bob:hunter2@proxy.example/path"),
|
|
}
|
|
}
|
|
|
|
type recordingLock struct{ held, acquired int }
|
|
|
|
func (l *recordingLock) Lock(context.Context) (func(), error) {
|
|
l.held++
|
|
l.acquired++
|
|
return func() { l.held-- }, nil
|
|
}
|
|
|
|
type recordingLog struct {
|
|
entries []app.LogEntry
|
|
err error
|
|
}
|
|
|
|
func (l *recordingLog) Write(entry app.LogEntry) error {
|
|
l.entries = append(l.entries, entry)
|
|
return l.err
|
|
}
|
|
|
|
func TestDoctorReportsReadOnlyChecksEvidenceAndRedactsCredentials(t *testing.T) {
|
|
adapter := &maintenanceTarget{
|
|
id: "fake", available: target.Availability{Available: true, Evidence: "fake command found"},
|
|
inspection: target.Inspection{State: target.External, Evidence: "found http://alice:secret@proxy.example:8080 in fake settings"},
|
|
checks: []target.Check{{Name: "required commands", OK: false, Evidence: "helper failed for https://bob:hunter2@proxy.example/path"}, {Name: "write authority", OK: true, Evidence: "settings directory is writable"}},
|
|
}
|
|
maintenance := app.NewMaintenance(profile.State{}, []target.Target{adapter}, nil, nil)
|
|
|
|
report := maintenance.Doctor(context.Background(), []target.Check{{Name: "Profile configuration", OK: true, Evidence: "valid"}, {Name: "identity resolution", OK: true, Evidence: "tester (1000)"}})
|
|
|
|
if adapter.disableCalls != 0 {
|
|
t.Fatalf("doctor mutated Target %d times", adapter.disableCalls)
|
|
}
|
|
text := report.String()
|
|
for _, want := range []string{"Profile configuration", "identity resolution", "Target availability", "External", "required commands", "write authority", "found http://alice:REDACTED@proxy.example:8080"} {
|
|
if !strings.Contains(text, want) {
|
|
t.Errorf("doctor report missing %q: %s", want, text)
|
|
}
|
|
}
|
|
for _, secret := range []string{"secret", "hunter2"} {
|
|
if strings.Contains(text, secret) {
|
|
t.Errorf("doctor leaked %q: %s", secret, text)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestApplicationSerializesAndLogsTargetMutations(t *testing.T) {
|
|
adapter := &maintenanceTarget{id: "fake", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Disabled}}
|
|
lock := &recordingLock{}
|
|
log := &recordingLog{}
|
|
application, err := app.NewWithTargetsAndRuntime(profile.NewFileStore(filepath.Join(t.TempDir(), "profiles.json")), []target.Target{adapter}, lock, log)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if result := application.Dispatch(app.Intent{Kind: app.CreateProfile, Profile: profile.Profile{Name: "office", SingleURL: "http://proxy.test:8080"}}); result.Err != nil {
|
|
t.Fatal(result.Err)
|
|
}
|
|
if result := application.Dispatch(app.Intent{Kind: app.ActivateProfile, Name: "office"}); result.Err != nil {
|
|
t.Fatal(result.Err)
|
|
}
|
|
adapter.inspection = target.Inspection{State: target.Enabled}
|
|
refreshApplicationTargets(t, application)
|
|
adapter.disableErr = errors.New("failed http://alice:secret@proxy.test/private")
|
|
result := application.Dispatch(app.Intent{Kind: app.DisableTarget, TargetID: "fake"})
|
|
if result.Err == nil {
|
|
t.Fatal("Target failure reported success")
|
|
}
|
|
if lock.acquired != 4 || lock.held != 0 {
|
|
t.Fatalf("all mutation lock acquired=%d held=%d", lock.acquired, lock.held)
|
|
}
|
|
if len(log.entries) != 1 || log.entries[0].Operation != "disable" || strings.Contains(log.entries[0].Detail, "secret") || strings.Contains(log.entries[0].Detail, "proxy.test/private") {
|
|
t.Fatalf("Target operation log = %#v", log.entries)
|
|
}
|
|
}
|
|
|
|
func TestResetFailureUsesFreshInspectionForResultAndRedactedLog(t *testing.T) {
|
|
adapter := &staleFailureTarget{}
|
|
log := &recordingLog{}
|
|
result := app.NewMaintenance(profile.State{}, []target.Target{adapter}, &recordingLock{}, log).Reset(context.Background(), true)
|
|
if result.Err == nil || adapter.inspectCalls != 2 || len(result.Targets) != 1 {
|
|
t.Fatalf("reset result=%#v inspect calls=%d", result, adapter.inspectCalls)
|
|
}
|
|
got := result.Targets[0].Inspection
|
|
if got.State != target.External || !strings.Contains(got.Evidence, "fresh evidence") || strings.Contains(got.Evidence, "stale") {
|
|
t.Fatalf("failure inspection = %#v", got)
|
|
}
|
|
if len(log.entries) != 1 || !strings.Contains(log.entries[0].Detail, "fresh inspection External") || strings.Contains(log.entries[0].Detail, "secret") || strings.Contains(log.entries[0].Detail, "hunter2") {
|
|
t.Fatalf("failure log = %#v", log.entries)
|
|
}
|
|
}
|
|
|
|
func TestResetConfirmationAggregatesWarningsOnlyForManagedCandidatesWithoutMutation(t *testing.T) {
|
|
managed := &maintenanceTarget{id: "managed", inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
|
|
drifted := &maintenanceTarget{id: "drifted", inspection: target.Inspection{State: target.Drifted, Evidence: "recovery metadata remains"}}
|
|
external := &maintenanceTarget{id: "external", inspection: target.Inspection{State: target.External, Evidence: "administrator owned"}}
|
|
managed.confirmation = "managed warning"
|
|
drifted.confirmation = "drifted warning"
|
|
external.confirmation = "must not be shown"
|
|
maintenance := app.NewMaintenance(profile.State{}, []target.Target{managed, drifted, external}, &recordingLock{}, nil)
|
|
|
|
confirmation := maintenance.ResetConfirmation(context.Background())
|
|
for _, want := range []string{"managed: managed warning", "drifted: drifted warning"} {
|
|
if !strings.Contains(confirmation, want) {
|
|
t.Errorf("confirmation missing %q: %q", want, confirmation)
|
|
}
|
|
}
|
|
if strings.Contains(confirmation, "must not be shown") || managed.disableCalls+drifted.disableCalls+external.disableCalls != 0 {
|
|
t.Fatalf("confirmation=%q mutation calls=%d/%d/%d", confirmation, managed.disableCalls, drifted.disableCalls, external.disableCalls)
|
|
}
|
|
}
|
|
|
|
func TestResetLoggerFailureIsReportedWithoutUndoingCompletedConfiguration(t *testing.T) {
|
|
adapter := &maintenanceTarget{id: "managed", inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
|
|
logger := &recordingLog{err: errors.New("operation log disk full")}
|
|
|
|
result := app.NewMaintenance(profile.State{}, []target.Target{adapter}, &recordingLock{}, logger).Reset(context.Background(), true)
|
|
|
|
if result.Err == nil || !strings.Contains(result.Err.Error(), "operation log disk full") || len(result.Targets) != 1 {
|
|
t.Fatalf("reset result = %#v", result)
|
|
}
|
|
item := result.Targets[0]
|
|
if item.Inspection.State != target.Disabled || item.OperationErr != nil || item.LogErr == nil || item.Err == nil || adapter.disableCalls != 1 {
|
|
t.Fatalf("logger failure outcome=%#v disable calls=%d", item, adapter.disableCalls)
|
|
}
|
|
}
|
|
|
|
func TestResetRequiresConfirmationAndReportsTruthfulPartialResults(t *testing.T) {
|
|
good := &maintenanceTarget{id: "good", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Enabled, Evidence: "managed"}}
|
|
failure := errors.New("remove https://alice:secret@proxy.example failed: permission denied")
|
|
bad := &maintenanceTarget{id: "bad", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.Drifted, Evidence: "managed fragment remains"}, disableErr: failure}
|
|
external := &maintenanceTarget{id: "external", available: target.Availability{Available: true}, inspection: target.Inspection{State: target.External, Evidence: "user owned"}}
|
|
lock := &recordingLock{}
|
|
log := &recordingLog{}
|
|
maintenance := app.NewMaintenance(profile.State{}, []target.Target{good, bad, external}, lock, log)
|
|
|
|
cancelled := maintenance.Reset(context.Background(), false)
|
|
if !cancelled.Cancelled || cancelled.Err != nil || good.disableCalls+bad.disableCalls+external.disableCalls != 0 || lock.acquired != 0 {
|
|
t.Fatalf("cancelled reset = %#v, calls %d/%d/%d lock=%d", cancelled, good.disableCalls, bad.disableCalls, external.disableCalls, lock.acquired)
|
|
}
|
|
|
|
result := maintenance.Reset(context.Background(), true)
|
|
if result.Err == nil || len(result.Targets) != 3 || good.disableCalls != 1 || bad.disableCalls != 1 || external.disableCalls != 0 {
|
|
t.Fatalf("confirmed reset = %#v, calls %d/%d/%d", result, good.disableCalls, bad.disableCalls, external.disableCalls)
|
|
}
|
|
if result.Targets[0].Inspection.State != target.Disabled || result.Targets[1].Inspection.State != target.Drifted || !result.Targets[2].Skipped {
|
|
t.Fatalf("reset did not preserve per-Target truth: %#v", result.Targets)
|
|
}
|
|
if lock.acquired != 1 || lock.held != 0 {
|
|
t.Fatalf("lock lifecycle acquired=%d held=%d", lock.acquired, lock.held)
|
|
}
|
|
if len(log.entries) != 2 || strings.Contains(log.entries[1].Detail, "secret") {
|
|
t.Fatalf("redacted operation log = %#v", log.entries)
|
|
}
|
|
}
|