nordisk/holger

server/cli/tests/jobs_cli_names_the_runner.rs

//! **`holger jobs` says where untrusted work runs** (lane HOL-SANDBOX-TRAIT): the runner
//! the config declares, what it has and has not, the id of its pinned per-boot key, and,
//! on a `boundary: OneWay` box, the strict CDS warning that it is the interim runner, not
//! Heimdall.

use std::process::Command;

const BIN: &str = env!("CARGO_BIN_EXE_holger");

fn config(dir: &std::path::Path, extra: &str) -> std::path::PathBuf {
    let d = dir.display();
    let repo = |n: &str| {
        format!(
            r#"(ron_name: "{n}", ron_repo_type: "raw", ron_upstreams: [], ron_in: None, ron_out: Some((ron_storage_endpoint: "storage", ron_exposed_endpoint: "door")), ron_data_dir: Some("{d}/{n}")),"#
        )
    };
    let ron = format!(
        r#"(
    {extra}
    repositories: [ {} {} {} {} ],
    exposed_endpoints: [ (ron_name: "door", ron_url: "127.0.0.1:1") ],
    storage_endpoints: [ (ron_name: "storage", ron_storage_type: "znippy", ron_path: "{d}") ],
    promotion: Some((
        ladder_name: "intake",
        stages: [ (name: "incoming", repo: "incoming"), (name: "quarantine", repo: "quarantine"), (name: "approved", repo: "approved"), (name: "production", repo: "production") ],
        intake: Some(( incoming: "incoming", quarantine: "quarantine", approved: "approved", production: "production" )),
    )),
)"#,
        repo("incoming"),
        repo("quarantine"),
        repo("approved"),
        repo("production"),
    );
    let p = dir.join(format!("c{}.ron", extra.len()));
    std::fs::write(&p, ron).unwrap();
    p
}

fn jobs(cfg: &std::path::Path) -> String {
    let o = Command::new(BIN)
        .args(["jobs", "--config"])
        .arg(cfg)
        .output()
        .unwrap();
    let t = format!(
        "{}{}",
        String::from_utf8_lossy(&o.stdout),
        String::from_utf8_lossy(&o.stderr)
    );
    assert!(o.status.success(), "{t}");
    t
}

#[test]
fn the_cli_names_the_interim_runner_and_what_it_does_not_have() {
    let dir = tempfile::tempdir().unwrap();
    let t = jobs(&config(dir.path(), ""));
    assert!(
        t.contains("jobs run in holger-podman (the interim runner, not Heimdall)"),
        "{t}"
    );
    assert!(t.contains("result key (pinned at boot): ed25519:"), "{t}");
    for line in [
        "container  yes",
        "seccomp    no ",
        "landlock   no ",
        "broker     no ",
        "wasm       no ",
    ] {
        assert!(t.contains(line), "{line:?} in\n{t}");
    }
    assert!(
        !t.contains("strict CDS"),
        "no boundary, no strict warning: {t}"
    );
}

#[test]
fn a_one_way_box_warns_that_its_runner_is_not_heimdall() {
    let dir = tempfile::tempdir().unwrap();
    let t = jobs(&config(dir.path(), "boundary: Some(OneWay),"));
    assert!(
        t.contains("WARNING: strict CDS (boundary: OneWay)") && t.contains("not Heimdall"),
        "{t}"
    );
}