Documentation
¶
Overview ¶
Package taintfixture builds the journal of a run that read untrusted content and then called a tool, so the packages that read gates (the run viewer, bide approve, the notifier, the audit verifiers) can probe the escalation instance of a call (docs/design/untrusted-content-and-amount-caps.md, section 5.3) through the exported taint option. It is for tests.
Index ¶
- Constants
- type F
- func (f *F) Decision(call, signedFor, id string, approved bool) agent.Decision
- func (f *F) Drive() error
- func (f *F) Subject(call string) agent.ApprovalSubject
- func (f *F) Submit(call, signedFor, id string, approved bool) error
- func (f *F) SubmitUnchecked(call, signedFor, id string, approved bool) error
- func (f *F) Verifiers(id string) (agent.ApproverVerifier, bool)
- func (f *F) WithCapReason() *agent.Journal
Constants ¶
const Run = "run-taint"
Run is the ID of the fixture's run.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type F ¶
type F struct {
T *testing.T
Journal *agent.Journal
Own *agent.ApprovalPolicy
Esc *agent.ApprovalPolicy
Priv map[string]ed25519.PrivateKey
Pub map[string]ed25519.PublicKey
LogPriv ed25519.PrivateKey
LogPub ed25519.PublicKey
Wrote int
// At is when the fixture's decisions are signed.
At time.Time
}
F is a run with an untrusted read (c1) and a write (c2) whose tool has its own gate (1 of own1), under a taint policy whose escalation gate is 2 of {esc1, esc2}.
func New ¶
func New(t *testing.T, own *agent.ApprovalPolicy) *F
New returns a fixture over a signed journal. own is the write tool's own gate, nil for none.
func (*F) Decision ¶
Decision is approver id's decision on subject call, signed over the subject signedFor.
func (*F) Subject ¶
func (f *F) Subject(call string) agent.ApprovalSubject
Subject is the subject of call (the call, or its "#taint" instance) as the journal records it.
func (*F) Submit ¶
Submit records approver id's decision on call, signed for signedFor, checking its signature as the approvals intake does (agent.WithDecisionCheck): a decision signed for another subject is refused.
func (*F) SubmitUnchecked ¶
SubmitUnchecked records the decision without checking its signature, as a writer of the journal could: the tally and the recount must still not count it.
func (*F) Verifiers ¶
func (f *F) Verifiers(id string) (agent.ApproverVerifier, bool)
Verifiers resolves the fixture's approvers.
func (*F) WithCapReason ¶
WithCapReason returns a copy of the fixture's journal in which the gate-reason record of the write call (c2) (written if the call has none yet) also holds a hand-written cap reason: rule "refund_one" gating a call of 6,000.00 USD over a limit of 5,000.00 USD. A cap gate does not exist yet, so the engine writes no such record; the record format is the one it will write, and this lets the readers of it be tested before the engine writes it.
Source Files