dtoro
75c0848a6f
E1: split monolithic files — cmd/nomos (main.go → server.go + mcp.go + workers.go),
internal/mcp/tools.go → entity_tools/ops_tools/knowledge_tools/analysis_tools,
internal/httpapi/impl.go → domain files (entities, events, signals, ontology,
fleet_health, client_context, client_lifecycle, entity_mutations, query_audit).
E2: migrate raw pool.Exec queries to sqlc (entities/relationships queries + generated).
E3: unify SSH — consolidate crypto/ssh dial into actuator/client.go (+client_test).
E4/E5: add tests — db/lifecycle, checkdefaults/build, ontology/preconditions, policy/risk.
103 lines
3.2 KiB
Go
103 lines
3.2 KiB
Go
package ontology
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/dtoro/oikos/internal/domain"
|
|
"github.com/google/uuid"
|
|
"github.com/jackc/pgx/v5/pgxpool"
|
|
)
|
|
|
|
// The lifecycle precondition checks split into a pure attribute/type guard
|
|
// and a DB query. These cover the pure guards at 0%: the entity-type skip
|
|
// rules and the attribute presence/absence semantics. The DB-backed checks
|
|
// (health, edges, backups, docs) are exercised by make test-db.
|
|
//
|
|
// ctx/pool/entityID are unused by the pure guards, so nil is safe here.
|
|
var (
|
|
noCtx = context.Background()
|
|
noPool *pgxpool.Pool // nil: the pure guards never touch the pool
|
|
noID = uuid.New()
|
|
)
|
|
|
|
func TestCheckAgeKeyEnrolled(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
entityType string
|
|
attrs map[string]any
|
|
wantErr bool
|
|
}{
|
|
{"workstation with age key", "workstation", map[string]any{"age_pubkey": "age1abc"}, false},
|
|
{"workstation missing age key", "workstation", map[string]any{}, true},
|
|
{"server needs a key too", "server", map[string]any{}, true},
|
|
{"lxc is exempt", "lxc", map[string]any{}, false},
|
|
{"vm is exempt", "vm", map[string]any{}, false},
|
|
{"docker-container is exempt", "docker-container", map[string]any{}, false},
|
|
{"nil attrs on a workstation", "workstation", nil, true},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.name, func(t *testing.T) {
|
|
err := checkAgeKeyEnrolled(noCtx, noPool, noID, c.entityType, c.attrs)
|
|
if c.wantErr && !errors.Is(err, domain.ErrInvalidTransition) {
|
|
t.Errorf("want ErrInvalidTransition, got %v", err)
|
|
}
|
|
if !c.wantErr && err != nil {
|
|
t.Errorf("want nil, got %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCheckMeshJoined(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
entityType string
|
|
attrs map[string]any
|
|
wantErr bool
|
|
}{
|
|
{"workstation with mesh_ip", "workstation", map[string]any{"mesh_ip": "10.0.0.5"}, false},
|
|
{"workstation missing mesh_ip", "workstation", map[string]any{}, true},
|
|
{"server missing mesh_ip", "server", map[string]any{}, true},
|
|
{"lxc is exempt", "lxc", map[string]any{}, false},
|
|
{"vm is exempt", "vm", map[string]any{}, false},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.name, func(t *testing.T) {
|
|
err := checkMeshJoined(noCtx, noPool, noID, c.entityType, c.attrs)
|
|
if c.wantErr && !errors.Is(err, domain.ErrInvalidTransition) {
|
|
t.Errorf("want ErrInvalidTransition, got %v", err)
|
|
}
|
|
if !c.wantErr && err != nil {
|
|
t.Errorf("want nil, got %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestCheckSecretsRevoked(t *testing.T) {
|
|
// checkSecretsRevoked treats an ABSENT age_pubkey as "secrets revoked"
|
|
// (the inverse of checkAgeKeyEnrolled). It is type-agnostic.
|
|
cases := []struct {
|
|
name string
|
|
attrs map[string]any
|
|
wantErr bool
|
|
}{
|
|
{"age key gone → revoked", map[string]any{}, false},
|
|
{"age key still present → blocked", map[string]any{"age_pubkey": "age1abc"}, true},
|
|
{"nil attrs → revoked", nil, false},
|
|
}
|
|
for _, c := range cases {
|
|
t.Run(c.name, func(t *testing.T) {
|
|
err := checkSecretsRevoked(noCtx, noPool, noID, "workstation", c.attrs)
|
|
if c.wantErr && !errors.Is(err, domain.ErrInvalidTransition) {
|
|
t.Errorf("want ErrInvalidTransition, got %v", err)
|
|
}
|
|
if !c.wantErr && err != nil {
|
|
t.Errorf("want nil, got %v", err)
|
|
}
|
|
})
|
|
}
|
|
}
|