dtoro
b98d7c24bf
- ApprovalService (core/app/approval.go) + ApprovalRepo (postgres adapter) with
full decide transaction: HMAC token verify, approval flip, execution un-gate,
session-scoped window keys (+session suffix matching GovernanceStore gate),
nomos session flip, audit+event on failure abort. httpapi DecideApproval now
a thin presenter delegating to the service. ListPending payload format fixed
(json.Unmarshal not raw-wrap).
- execlog folded into postgres adapter: internal/execlog deleted, NewExecutionLog
/ ReadExecutionLog live in the db package, callers updated (mcp, httpapi).
- execworker poller over ExecutionService.DispatchQueued: advisory lock leak
fixed (defer/recover per execution), correlation_id preserved via Finalize
event emission (ExecRunRepo.Finalize now emits execution.{status} with
correlation_id from the row).
- Phase 8 session export-rename completed: Store, New, and all 53 methods
exported; cmd/nomos/ agent.go fixed to use session.PendingContinuation etc.
- Coverage gates: ExecutionService.Submit 93.1%, PolicyService.Decide 100%.
- Plans index updated, VERSION bumped to 0.36.0.
115 lines
3.1 KiB
Go
115 lines
3.1 KiB
Go
package app
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/dtoro/oikos/internal/core/domain"
|
|
"github.com/dtoro/oikos/internal/core/ports"
|
|
"github.com/dtoro/oikos/internal/core/ports/portstest"
|
|
"github.com/google/uuid"
|
|
)
|
|
|
|
func TestApprovalDecideValidDecisions(t *testing.T) {
|
|
for _, tc := range []struct {
|
|
decision string
|
|
want string
|
|
}{
|
|
{"approve", "approved"},
|
|
{"deny", "denied"},
|
|
{"revoke", "revoked"},
|
|
} {
|
|
t.Run(tc.decision, func(t *testing.T) {
|
|
repo := portstest.NewApprovalRepo()
|
|
repo.Result = ports.ApprovalDecideResult{
|
|
Approval: domain.Approval{EntityID: "some-id", Status: tc.want},
|
|
}
|
|
svc := NewApprovalService(repo)
|
|
|
|
aid := uuid.New()
|
|
got, err := svc.Decide(context.Background(), ApprovalDecideCmd{
|
|
ApprovalID: domain.UUID(aid.String()),
|
|
Decision: tc.decision,
|
|
Actor: "operator",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("Decide(%s): %v", tc.decision, err)
|
|
}
|
|
if len(repo.Decided) != 1 {
|
|
t.Fatalf("Decide called %d times, want 1", len(repo.Decided))
|
|
}
|
|
in := repo.Decided[0]
|
|
if in.Status != tc.want {
|
|
t.Errorf("repo status = %q, want %q", in.Status, tc.want)
|
|
}
|
|
if in.Actor != "operator" || string(in.ApprovalID) != aid.String() {
|
|
t.Errorf("repo input = %+v", in)
|
|
}
|
|
if got.Approval.Status != tc.want {
|
|
t.Errorf("result approval status = %q, want %q", got.Approval.Status, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestApprovalDecideInvalidDecision(t *testing.T) {
|
|
repo := portstest.NewApprovalRepo()
|
|
svc := NewApprovalService(repo)
|
|
_, err := svc.Decide(context.Background(), ApprovalDecideCmd{
|
|
ApprovalID: domain.UUID(uuid.New().String()),
|
|
Decision: "maybe",
|
|
Actor: "operator",
|
|
})
|
|
if !errors.Is(err, domain.ErrInvalidInput) {
|
|
t.Fatalf("err = %v, want ErrInvalidInput", err)
|
|
}
|
|
if len(repo.Decided) != 0 {
|
|
t.Error("repo must not be called on an invalid decision")
|
|
}
|
|
}
|
|
|
|
func TestApprovalDecideRepoErrorPropagates(t *testing.T) {
|
|
repo := portstest.NewApprovalRepo()
|
|
repo.ErrStub = domain.ErrNotFound
|
|
svc := NewApprovalService(repo)
|
|
_, err := svc.Decide(context.Background(), ApprovalDecideCmd{
|
|
ApprovalID: domain.UUID(uuid.New().String()),
|
|
Decision: "approve",
|
|
})
|
|
if !errors.Is(err, domain.ErrNotFound) {
|
|
t.Fatalf("err = %v, want ErrNotFound", err)
|
|
}
|
|
}
|
|
|
|
func TestApprovalList(t *testing.T) {
|
|
repo := portstest.NewApprovalRepo()
|
|
repo.Pending = []domain.Approval{{EntityID: "a", Status: "pending"}}
|
|
svc := NewApprovalService(repo)
|
|
got, err := svc.List(context.Background(), "e1", 10)
|
|
if err != nil {
|
|
t.Fatalf("List: %v", err)
|
|
}
|
|
if len(got) != 1 || got[0].Status != "pending" {
|
|
t.Fatalf("got %+v", got)
|
|
}
|
|
}
|
|
|
|
func TestApprovalDecideTokenForwarded(t *testing.T) {
|
|
repo := portstest.NewApprovalRepo()
|
|
svc := NewApprovalService(repo)
|
|
aid := uuid.New()
|
|
_, err := svc.Decide(context.Background(), ApprovalDecideCmd{
|
|
ApprovalID: domain.UUID(aid.String()),
|
|
Token: "hmac-token",
|
|
Decision: "approve",
|
|
Actor: "operator",
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("Decide: %v", err)
|
|
}
|
|
if repo.Decided[0].Token != "hmac-token" {
|
|
t.Errorf("token = %q, want forwarded", repo.Decided[0].Token)
|
|
}
|
|
}
|