nordisk/edda

crates/nornir-auth-policy/tests/the_auth_block_is_strict.rs

//! **The `auth` block refuses a key it does not know, by name** (Holger G0, 2026-10-23).
//!
//! A typo such as `require_auth_for_read` (for `require_auth_for_reads`) used to parse,
//! and the read gate it looks like it turns on stayed OFF. A security block that drops
//! a misspelled control in silence is fail-open; this block now fails closed.

use nornir_auth_policy::AuthConfig;

fn refusal(ron: &str) -> String {
    match ron::from_str::<AuthConfig>(ron) {
        Ok(_) => panic!("an unknown key must be refused: {ron}"),
        Err(e) => e.to_string(),
    }
}

#[test]
fn an_unknown_key_in_the_auth_block_is_refused_by_name() {
    let err = refusal("(methods: [], require_auth_for_read: true)");
    assert!(err.contains("require_auth_for_read"), "names the key: {err}");
}

#[test]
fn an_unknown_key_inside_a_method_is_refused_by_name() {
    let err = refusal(r#"(methods: [StaticToken(subject: "a", token: Some("t"), tokne_file: None)])"#);
    assert!(err.contains("tokne_file"), "names the key: {err}");
}

#[test]
fn the_known_keys_still_load() {
    let c: AuthConfig =
        ron::from_str(r#"(methods: [StaticToken(subject: "a", token: Some("t"))], require_auth_for_reads: true)"#)
            .expect("the known spelling loads");
    assert!(c.require_auth_for_reads);
}