nordisk/holger

agent/lib/tests/creds_ron_and_tiers.rs

//! Two guards around the upstream-credential wiring.
//!
//! 1. The shipped example RON is the shape the parser actually accepts, and it
//!    names a vault rather than a secret.
//! 2. The vault rides the `online` gate and nothing else, so the airgap tiers
//!    (`embedded`, `mini`, the `--no-default-features` agent) link no vault.

/// The vault must be an OPTIONAL dependency enabled ONLY by `online`. If someone
/// makes it unconditional, the zero-egress tiers start linking a crypto/secrets
/// crate they have no upstream for, and the airgap floor has quietly widened.
/// Read straight from the manifest so the guard cannot be satisfied by a comment.
#[test]
fn the_vault_rides_the_online_gate_and_no_other() {
    let manifest = include_str!("../Cargo.toml");

    let dep_line = manifest
        .lines()
        .find(|l| l.trim_start().starts_with("nornir-vault ="))
        .expect("agent/lib/Cargo.toml must declare nornir-vault");
    assert!(
        dep_line.contains("optional = true"),
        "nornir-vault must be optional, got: {dep_line}"
    );

    // The `[features]` table: `online` turns the vault on; `default` does not
    // name the vault directly, and no tier feature does either.
    let features = manifest
        .split_once("\n[features]")
        .expect("agent/lib/Cargo.toml must have a [features] table")
        .1;
    let online = features
        .split_once("\nonline = [")
        .expect("`online` feature must exist")
        .1
        .split_once(']')
        .expect("`online` feature list must close")
        .0;
    assert!(
        online.contains("dep:nornir-vault"),
        "`online` must enable the vault, got: {online}"
    );

    let default = features
        .split_once("\ndefault = [")
        .expect("`default` feature must exist")
        .1
        .split_once(']')
        .expect("`default` feature list must close")
        .0;
    assert!(
        !default.contains("nornir-vault"),
        "`default` must reach the vault only through `online`, got: {default}"
    );

    // The OS-keyring provider stays off by default: it adds the `keyring` crate
    // and needs a running Secret Service.
    assert!(
        features.contains("vault-os-keyring = [\"nornir-vault/os-keyring\"]"),
        "the os-keyring provider must be its own opt-in feature"
    );
    assert!(
        !default.contains("vault-os-keyring") && !online.contains("vault-os-keyring"),
        "os-keyring must not be pulled in by default or by `online`"
    );
}

/// The example an operator copies must parse, and every repository in it must
/// name a vault entry (or nothing) — never a literal secret.
#[cfg(feature = "online")]
#[test]
fn the_shipped_example_ron_parses_and_names_no_secret() {
    use holger_agent_lib::creds::{CredentialRef, UpstreamCredsConfig, VaultProvider};

    let text = include_str!("../../../examples/mirror-credentials/upstream-credentials.ron");
    let cfg = UpstreamCredsConfig::parse(text).expect("the shipped example must parse");

    assert_eq!(cfg.ron_vault_provider, VaultProvider::Pin);
    assert!(
        cfg.refuse_literal_secrets().is_ok(),
        "the shipped example must not carry a literal secret"
    );

    let named: Vec<&str> = cfg
        .ron_repositories
        .iter()
        .map(|r| r.ron_name.as_str())
        .collect();
    assert!(named.contains(&"nexus-mirror"));
    assert!(named.contains(&"artifactory-mirror"));
    assert!(named.contains(&"public-crates"));

    for repo in &cfg.ron_repositories {
        assert!(
            repo.ron_credential.literal_fields().is_empty(),
            "repository {:?} writes a literal secret",
            repo.ron_name
        );
        if repo.ron_name != "public-crates" {
            assert!(
                matches!(repo.ron_credential, CredentialRef::Vault { .. }),
                "repository {:?} must name a vault entry",
                repo.ron_name
            );
        }
    }
}