nordisk/holger

plugin/guest-allocation/tests/allow_is_total.rs

//! **The open build stays unlimited, and this is the proof.**
//!
//! `evaluate` is asserted total: over every verb, every principal shape, every
//! digest state and every clock source, the answer is `Allow`. Not "allow in the
//! cases we thought of" — the whole cross product this guest can be handed.
//!
//! The law it enforces: the open build stays unbounded and still shows and
//! tests how much storage there is. The showing and the testing are
//! `capacity()` and `selftest()`; the staying unbounded is here.

use holger_plugin_abi::v2::{
    ClockSource, DigestAlgo, DigestState, Meter, MeterHost, WireArtifactRef, WireCallContext,
    WireDigest, WireInstant, WirePrincipal, WireVerb, WireVerdict,
};
use holger_plugin_abi::wire::WireArtifactId;
use holger_plugin_allocation::AllocationMeter;

struct NoHost;
impl MeterHost for NoHost {}

fn verbs() -> Vec<WireVerb> {
    vec![
        WireVerb::Fetch,
        WireVerb::Put,
        WireVerb::List,
        WireVerb::Http,
        WireVerb::Delete,
        WireVerb::Promote,
    ]
}

fn principals() -> Vec<Option<WirePrincipal>> {
    let mut out = vec![None];
    for method in ["bearer", "mtls", "oidc", "passkey", "anonymous"] {
        out.push(Some(WirePrincipal {
            ident: format!("ident-for-{method}"),
            method: method.to_string(),
            source_ip: "10.0.0.1:443".to_string(),
        }));
    }
    out
}

fn artifacts() -> Vec<Option<WireArtifactRef>> {
    let id = WireArtifactId {
        namespace: Some("ns".into()),
        name: "artifact".into(),
        version: "1.0.0".into(),
    };
    let mut out = vec![None];
    for state in [
        DigestState::Present,
        DigestState::NotGranted,
        DigestState::NotKnown,
    ] {
        for size in [0u64, 1, u64::MAX] {
            out.push(Some(WireArtifactRef {
                id: id.clone(),
                digest: match state {
                    DigestState::Present => Some(WireDigest {
                        algo: DigestAlgo::Blake3_256,
                        bytes: vec![0xab; 32],
                    }),
                    _ => None,
                },
                digest_state: state,
                size_bytes: size,
            }));
        }
    }
    out
}

fn clocks() -> Vec<Option<WireInstant>> {
    let mut out = vec![None];
    for source in [
        ClockSource::HostWall,
        ClockSource::SignedFact,
        ClockSource::MonotonicSinceBoot,
    ] {
        for unix_nanos in [i64::MIN, -1, 0, 1, i64::MAX] {
            out.push(Some(WireInstant {
                unix_nanos,
                source,
                trusted_until_unix_nanos: 0,
            }));
        }
    }
    out
}

#[test]
fn evaluate_is_total_and_every_answer_is_allow() {
    let meter = AllocationMeter;
    let mut cases = 0usize;
    for abi in [1u32, 2, u32::MAX] {
        for repository in ["", "releases", "a repository with spaces", "../escape"] {
            for verb in verbs() {
                for principal in principals() {
                    for artifact in artifacts() {
                        for now in clocks() {
                            let ctx = WireCallContext {
                                abi,
                                repository: repository.to_string(),
                                verb,
                                principal: principal.clone(),
                                artifact: artifact.clone(),
                                now,
                            };
                            let verdict = meter
                                .evaluate(&NoHost, &ctx)
                                .expect("evaluate never returns Err");
                            assert_eq!(
                                verdict,
                                WireVerdict::Allow,
                                "a refusal appeared for {ctx:?}"
                            );
                            cases += 1;
                        }
                    }
                }
            }
        }
    }
    // The cross product is real, not three hand-picked cases.
    assert!(cases > 10_000, "only {cases} contexts were tried");
}

#[test]
fn evaluate_never_reaches_the_host_so_it_cannot_fail_on_an_ungranted_capability() {
    // `NoHost` refuses every capability by name. `evaluate` still answers, which
    // is what "total" means here: there is no input and no environment in which
    // this guest declines.
    let ctx = WireCallContext {
        abi: 2,
        repository: "releases".into(),
        verb: WireVerb::Put,
        principal: None,
        artifact: None,
        now: None,
    };
    assert_eq!(
        AllocationMeter.evaluate(&NoHost, &ctx).unwrap(),
        WireVerdict::Allow
    );
}