Documentation
¶
Overview ¶
Package testlive is the opt-in live-local harness: tests that reach the owner's real identity provider, Azure DevOps organisation and AWS account. The live suites build only under `-tags live`, skip unless their own WARDYN_LIVE_* gate is set, and never run in CI. docs/LIVE-TESTS.md is the owner's setup and run guide.
Everything the live suites print goes through Redact first, and they take secrets only as paths to files kept outside the repository.
Index ¶
- Constants
- Variables
- func Errorf(t testing.TB, format string, args ...any)
- func Fatalf(t testing.TB, format string, args ...any)
- func LoadIdentities() (map[string]Identity, error)
- func LoadSSOToken(now time.Time) (string, error)
- func Logf(t testing.TB, format string, args ...any)
- func ModelAllowed(id string) bool
- func ReadSecretFile(name string) ([]byte, error)
- func Redact(s string) string
- func Require(t testing.TB, gate string, names ...string)
- func RequireAccount(want, got string) error
- func SignV4(req *http.Request, body []byte, c Creds, region, service string, now time.Time)
- func Skipf(t testing.TB, format string, args ...any)
- type Bedrock
- type BedrockConfig
- type Creds
- type Endpoints
- type Identity
- type SSOToken
Constants ¶
const ( // MaxTokens is the ceiling on one call's max_tokens. MaxTokens = 32 // DefaultMaxCalls and HardMaxCalls bound WARDYN_LIVE_BEDROCK_MAX_CALLS. DefaultMaxCalls = 5 HardMaxCalls = 20 // DefaultModel is Claude Haiku 4.5 through the US cross-region profile. DefaultModel = "us.anthropic.claude-haiku-4-5-20251001-v1:0" )
const ( EnvEntra = "WARDYN_LIVE_ENTRA" EnvADO = "WARDYN_LIVE_ADO" EnvBedrock = "WARDYN_LIVE_BEDROCK" EnvAWSSSO = "WARDYN_LIVE_AWS_SSO" EnvBaseURL = "WARDYN_LIVE_BASE_URL" EnvIdentities = "WARDYN_LIVE_IDENTITIES_FILE" EnvADOOrg = "WARDYN_LIVE_ADO_ORG" EnvADOProject = "WARDYN_LIVE_ADO_PROJECT" EnvADORepo = "WARDYN_LIVE_ADO_REPO" // The LL2 project and repository whose names carry a space (#485); // optional, defaulting to the fixture names docs/LIVE-TESTS.md lists. EnvADOSpacedProject = "WARDYN_LIVE_ADO_SPACED_PROJECT" EnvADOSpacedRepo = "WARDYN_LIVE_ADO_SPACED_REPO" EnvSSORegion = "WARDYN_LIVE_AWS_SSO_REGION" EnvSSOTokenFile = "WARDYN_LIVE_AWS_SSO_TOKEN_FILE" EnvBedrockAccount = "WARDYN_LIVE_BEDROCK_ACCOUNT_ID" EnvBedrockRole = "WARDYN_LIVE_BEDROCK_ROLE_NAME" EnvBedrockRegion = "WARDYN_LIVE_BEDROCK_REGION" EnvBedrockModel = "WARDYN_LIVE_BEDROCK_MODEL" EnvBedrockMaxCalls = "WARDYN_LIVE_BEDROCK_MAX_CALLS" )
The live suites' environment. Values that are secrets are never read from the environment: the *_FILE names hold a path to a file outside the repo.
Variables ¶
var ErrTokenExpired = errors.New("the Identity Center sign-in has expired")
ErrTokenExpired means the owner has to sign in again; the suite skips on it.
Functions ¶
func LoadIdentities ¶
LoadIdentities parses WARDYN_LIVE_IDENTITIES_FILE: an object keyed by role ("admin", "member", "norole").
func LoadSSOToken ¶
LoadSSOToken reads WARDYN_LIVE_AWS_SSO_TOKEN_FILE.
func ModelAllowed ¶
ModelAllowed reports whether id is on the allow-list.
func ReadSecretFile ¶
ReadSecretFile reads the file whose path is in env var name. It refuses a file inside the checkout, where a stray `git add` would publish it, and its errors name the variable, never the path or the contents.
func Require ¶
Require skips t unless gate is "1" and every name is set. The message names the variables and never prints a value.
func RequireAccount ¶
RequireAccount refuses unless the credential's account is the capped one.
Types ¶
type Bedrock ¶
type Bedrock struct {
// contains filtered or unexported fields
}
Bedrock is a client that has already proven it holds member-account credentials. The only way to get one is NewMemberBedrock.
func NewMemberBedrock ¶
func NewMemberBedrock(ctx context.Context, cfg BedrockConfig, ssoToken string, ep Endpoints, hc *http.Client) (*Bedrock, error)
NewMemberBedrock exchanges the Identity Center token for role credentials on cfg.AccountID and then refuses unless STS says those credentials belong to exactly that account.
type BedrockConfig ¶
BedrockConfig is the validated WARDYN_LIVE_BEDROCK_* environment.
func LoadBedrockConfig ¶
func LoadBedrockConfig(getenv func(string) string) (BedrockConfig, error)
LoadBedrockConfig validates the suite's environment. Anything outside the limits is an error, never clamped into range.
type Creds ¶
type Creds struct{ AccessKeyID, SecretAccessKey, SessionToken string }
Creds are temporary role credentials.
type Endpoints ¶
type Endpoints struct{ Portal, STS, Bedrock string }
Endpoints are the three AWS base URLs the suite talks to; tests point them at local fakes.
func DefaultEndpoints ¶
func DefaultEndpoints(c BedrockConfig) Endpoints
DefaultEndpoints returns the real regional endpoints.
Source Files