b45ad34169
All checks were successful
validate / JSON Schema (ajv) (push) Successful in 19s
build-images / signing-service image (push) Successful in 22s
validate / Rego (opa fmt + opa test) (push) Successful in 13s
validate / DB (migrate up/down dry-run) (push) Successful in 26s
validate / Go (vet + test) (push) Successful in 1m13s
Trivial Senken-Adapter per §7 of architecture V1.1. Accepts
{decision_id, payload_hash, payload, approval_ref, transform_ref}
on POST /api/v1/sink/dummy/deliver; calls verification-service's
/api/v1/verify/chain and branches:
- valid=true → atomic .tmp+rename write of payload to
/data/dummy-sink/<decision_id>.json, builds a
basicstack.de/attestations/handover/v1 statement, signs via
signing-service with the double identity flow (Pocket-ID bearer
+ projected SA token), submits DSSE envelope to the TLog and
returns 201 {handover_ref, log_index}.
- valid=false & replay=true → 409.
- valid=false → 403 {reasons:[…]}.
Replay protection lives in verification-service per the parent plan;
dummy-sink keeps no local replay store. The payload_hash field is
verified against both the raw and canonical form so a verifier can
reproduce either hash.
Tests use httptest-backed fakes for verify / sign / tlog and cover
the DEV-611 acceptance criteria plus the bad-request shapes:
- happy path writes the file, calls signer with the handover
statement, submits the envelope to the TLog
- 403 keeps the disk and never calls signer/tlog
- replay returns 409 without re-signing
- payload_hash mismatch rejects before verify
- malformed bodies return 400
- verify unavailable → 502, signing denied → 403
Co-Authored-By: Paperclip <noreply@paperclip.ing>
84 lines
1.9 KiB
Go
84 lines
1.9 KiB
Go
package sink
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
)
|
|
|
|
func TestStoreWriteCreatesAtomicFile(t *testing.T) {
|
|
dir := t.TempDir()
|
|
s := Store{DataDir: dir}
|
|
|
|
payload := map[string]any{"workflow_id": "WF-0042", "amount": 42.5}
|
|
res, err := s.Write("decision-abc", payload)
|
|
if err != nil {
|
|
t.Fatalf("Write: %v", err)
|
|
}
|
|
want := filepath.Join(dir, "decision-abc.json")
|
|
if res.Path != want {
|
|
t.Fatalf("Path = %q, want %q", res.Path, want)
|
|
}
|
|
|
|
raw, err := os.ReadFile(res.Path)
|
|
if err != nil {
|
|
t.Fatalf("ReadFile: %v", err)
|
|
}
|
|
var got map[string]any
|
|
if err := json.Unmarshal(raw, &got); err != nil {
|
|
t.Fatalf("json.Unmarshal: %v", err)
|
|
}
|
|
if got["workflow_id"] != "WF-0042" {
|
|
t.Fatalf("workflow_id = %v, want WF-0042", got["workflow_id"])
|
|
}
|
|
if got["amount"].(float64) != 42.5 {
|
|
t.Fatalf("amount = %v, want 42.5", got["amount"])
|
|
}
|
|
|
|
// No lingering .tmp.
|
|
entries, _ := os.ReadDir(dir)
|
|
for _, e := range entries {
|
|
if filepath.Ext(e.Name()) == ".tmp" {
|
|
t.Fatalf("left stray tmp file %q", e.Name())
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestStoreWriteRejectsPathTraversal(t *testing.T) {
|
|
s := Store{DataDir: t.TempDir()}
|
|
for _, bad := range []string{
|
|
"",
|
|
"../etc/passwd",
|
|
"./x",
|
|
"with/slash",
|
|
"with:colon-but-starts-with-/",
|
|
} {
|
|
_, err := s.Write(bad, map[string]any{"a": 1})
|
|
if err == nil {
|
|
t.Fatalf("Write(%q) = nil err, want rejection", bad)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestStoreWriteOverwritesExisting(t *testing.T) {
|
|
dir := t.TempDir()
|
|
s := Store{DataDir: dir}
|
|
|
|
if _, err := s.Write("dec1", map[string]any{"v": 1}); err != nil {
|
|
t.Fatalf("first Write: %v", err)
|
|
}
|
|
if _, err := s.Write("dec1", map[string]any{"v": 2}); err != nil {
|
|
t.Fatalf("second Write: %v", err)
|
|
}
|
|
|
|
raw, err := os.ReadFile(filepath.Join(dir, "dec1.json"))
|
|
if err != nil {
|
|
t.Fatalf("ReadFile: %v", err)
|
|
}
|
|
var got map[string]any
|
|
_ = json.Unmarshal(raw, &got)
|
|
if got["v"].(float64) != 2 {
|
|
t.Fatalf("v = %v, want 2", got["v"])
|
|
}
|
|
}
|