Documentation
¶
Index ¶
- Variables
- func ActivityCompletionAttestations(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.ActivityCompletionAttestation
- func AssertSignerCertificateStripped(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string)
- func CertificateCount(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) int
- func ChildCompletionAttestations(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.ChildCompletionAttestation
- func ChildInstanceIDFromHistory(t *testing.T, ctx context.Context, db *sqlite.SQLite, parentInstanceID string) string
- func CountHistoryEventsMatching(t *testing.T, ctx context.Context, cl *client.TaskHubGrpcClient, ...) int
- func CountHistoryEventsOfType[T any](t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, ...) int
- func CountPropagatedHistoryRows(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) int
- func ExtSigCertCount(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) int
- func ForgeChunkWithSpiffePath(t *testing.T, sen *sentry.Sentry, chunk *protos.PropagatedHistoryChunk, ...)
- func GetLastHistoryEventOfType[T any](t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, ...) *protos.HistoryEvent
- func HistoryCount(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) int
- func InjectInboxEvent(t *testing.T, ctx context.Context, db *sqlite.SQLite, daprd *daprd.Daprd, ...)
- func IsChildCompletedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
- func IsChildFailedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
- func IsTaskCompletedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
- func IsTaskFailedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
- func IsTaskScheduledFor(eventID int32) func(*protos.HistoryEvent) bool
- func IsTimerFiredFor(timerID int32) func(*protos.HistoryEvent) bool
- func MutateMetadata(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string, ...)
- func ReadExtSigCerts(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.ExternalSigningCertificate
- func ReadHistoryEvents(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.HistoryEvent
- func ReadPropagatedHistory(t *testing.T, ctx context.Context, db *sqlite.SQLite, needle string) (string, *protos.PropagatedHistory)
- func RemoveHistoryEvent(t *testing.T, ctx context.Context, db *sqlite.SQLite, daprd *daprd.Daprd, ...)
- func SignatureCount(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) int
- func VerifyCertAppID(t *testing.T, ctx context.Context, db *sqlite.SQLite, ...)
- func VerifySignatureChain(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string, ...)
- func WaitForRuntimeStatus(t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, ...)
- func WaitForWorkflowStartedEvent(t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, ...)
- func WritePropagatedHistory(t *testing.T, ctx context.Context, db *sqlite.SQLite, key string, ...)
- type SigningData
Constants ¶
This section is empty.
Variables ¶
var EscapeLike = strings.NewReplacer(`\`, `\\`, `%`, `\%`, `_`, `\_`).Replace
EscapeLike escapes the SQL LIKE wildcards (%, _) and the backslash escape character itself so a substring can be embedded as a literal in a LIKE pattern.
Functions ¶
func ActivityCompletionAttestations ¶ added in v1.18.0
func ActivityCompletionAttestations(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.ActivityCompletionAttestation
ActivityCompletionAttestations returns every ActivityCompletionAttestation present on Task{Completed,Failed} events stored in the given workflow instance's history.
func AssertSignerCertificateStripped ¶ added in v1.18.0
func AssertSignerCertificateStripped(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string)
AssertSignerCertificateStripped verifies that no completion events in the given workflow instance's history still carry a signerCertificate companion field. The companion is wire-only - it must always be cleared before persisting the event so the cert lives only once in ext-sigcert.
func CertificateCount ¶ added in v1.18.0
CertificateCount returns the number of signing certificate entries stored for the given workflow instance.
func ChildCompletionAttestations ¶ added in v1.18.0
func ChildCompletionAttestations(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.ChildCompletionAttestation
ChildCompletionAttestations returns every ChildCompletionAttestation present on ChildWorkflowInstance{Completed,Failed} events stored in the given workflow instance's history.
func ChildInstanceIDFromHistory ¶ added in v1.18.0
func ChildInstanceIDFromHistory(t *testing.T, ctx context.Context, db *sqlite.SQLite, parentInstanceID string) string
ChildInstanceIDFromHistory pulls the child workflow's InstanceID out of the parent workflow's persisted history, by searching for the ChildWorkflowInstanceCreated event. Returns empty string when not yet present (parent hasn't reached the child-creation event).
func CountHistoryEventsMatching ¶ added in v1.17.7
func CountHistoryEventsMatching(t *testing.T, ctx context.Context, cl *client.TaskHubGrpcClient, id api.InstanceID, pred func(*protos.HistoryEvent) bool) int
CountHistoryEventsMatching returns the number of events in the workflow's history (as exposed via GetInstanceHistory) that satisfy pred.
func CountHistoryEventsOfType ¶
func CountHistoryEventsOfType[T any](t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, id api.InstanceID) int
func CountPropagatedHistoryRows ¶ added in v1.18.0
func CountPropagatedHistoryRows(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) int
CountPropagatedHistoryRows counts persisted propagated-history rows whose key contains the given instanceID substring. Used by tests that need to confirm the child has stored its IncomingHistory before proceeding (e.g. tampering with it).
func ExtSigCertCount ¶ added in v1.18.0
ExtSigCertCount returns the number of external (foreign) signing certificate entries (ext-sigcert-NNNNNN keys) stored for the given workflow instance. Foreign certs are absorbed on inbox ingestion of completion events that carry attestations from child workflows and activities.
func ForgeChunkWithSpiffePath ¶ added in v1.18.0
func ForgeChunkWithSpiffePath(t *testing.T, sen *sentry.Sentry, chunk *protos.PropagatedHistoryChunk, spiffePath string)
ForgeChunkWithSpiffePath rewrites a single PropagatedHistoryChunk so its signing material attests to spiffe://<sentry-trust-domain><spiffePath> - a cert that the test framework's Sentry would not have issued in production (e.g. wrong namespace) but that nevertheless chains cleanly to that Sentry's trust anchor.
The leaf cert is freshly issued against Sentry's IssChain, and a fresh HistorySignature over chunk.RawEvents is produced with the matching private key, then written into chunk.RawSignatures. The result: the receiver's chain-of-trust verification and per-signature cryptographic verification both succeed; only the SPIFFE identity check (app or namespace component) can fire. This isolates the identity gate from the chain gate in tampering tests.
Mutates chunk in place. Caller should set the modified chunk back into the persisted PropagatedHistory before re-loading.
func GetLastHistoryEventOfType ¶
func GetLastHistoryEventOfType[T any](t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, id api.InstanceID) *protos.HistoryEvent
func HistoryCount ¶ added in v1.18.0
HistoryCount returns the number of history entries stored for the given workflow instance.
func InjectInboxEvent ¶ added in v1.17.7
func InjectInboxEvent(t *testing.T, ctx context.Context, db *sqlite.SQLite, daprd *daprd.Daprd, instanceID string, evt *protos.HistoryEvent)
InjectInboxEvent appends evt to the workflow actor's persisted inbox in the SQLite state store and increments the metadata's InboxLength by one. The caller is responsible for invalidating the actor's in-memory cache (e.g. via daprd.Restart) before relying on the injection to take effect.
func IsChildCompletedFor ¶ added in v1.17.7
func IsChildCompletedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
func IsChildFailedFor ¶ added in v1.17.7
func IsChildFailedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
func IsTaskCompletedFor ¶ added in v1.17.7
func IsTaskCompletedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
IsTaskCompletedFor returns a predicate that matches a TaskCompleted event for the given TaskScheduledId.
func IsTaskFailedFor ¶ added in v1.17.7
func IsTaskFailedFor(taskScheduledID int32) func(*protos.HistoryEvent) bool
func IsTaskScheduledFor ¶ added in v1.17.7
func IsTaskScheduledFor(eventID int32) func(*protos.HistoryEvent) bool
func IsTimerFiredFor ¶ added in v1.17.7
func IsTimerFiredFor(timerID int32) func(*protos.HistoryEvent) bool
func MutateMetadata ¶ added in v1.18.0
func MutateMetadata(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string, mutate func(*backend.BackendWorkflowStateMetadata))
MutateMetadata loads the persisted BackendWorkflowStateMetadata for the given workflow instance, applies the mutation, and writes it back. Used by negative tests that simulate state store tampering.
func ReadExtSigCerts ¶ added in v1.18.0
func ReadExtSigCerts(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.ExternalSigningCertificate
ReadExtSigCerts reads and unmarshals all ExternalSigningCertificate entries for the given workflow instance.
func ReadHistoryEvents ¶ added in v1.18.0
func ReadHistoryEvents(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) []*protos.HistoryEvent
ReadHistoryEvents reads and unmarshals all stored history events for the given workflow instance, preserving state-store order.
func ReadPropagatedHistory ¶ added in v1.18.0
func ReadPropagatedHistory(t *testing.T, ctx context.Context, db *sqlite.SQLite, needle string) (string, *protos.PropagatedHistory)
ReadPropagatedHistory looks up the single `propagated-history` state-store row whose key contains needle, decodes it, and returns the row key (so the caller can WriteStateValue back) plus the parsed PropagatedHistory. `needle` is typically the child workflow's instance ID (or any unique substring of its actor key) so we can disambiguate when multiple propagated-history rows exist (e.g. lineage chains).
func RemoveHistoryEvent ¶ added in v1.17.7
func RemoveHistoryEvent(t *testing.T, ctx context.Context, db *sqlite.SQLite, daprd *daprd.Daprd, instanceID string, pred func(*protos.HistoryEvent) bool)
RemoveHistoryEvent deletes the first history event matching pred and renumbers any subsequent history-* keys to keep the sequence contiguous. The metadata's HistoryLength is decremented by one.
func SignatureCount ¶ added in v1.18.0
SignatureCount returns the number of signature entries stored for the given workflow instance. Use this in tests to verify signing happened or did not happen, instead of calling CountStateKeys directly with a raw key prefix string (which is error-prone).
func VerifyCertAppID ¶ added in v1.18.0
func VerifyCertAppID(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID, expectedAppID string)
VerifyCertAppID checks that all signing certificates for a workflow instance contain a SPIFFE ID matching the expected app ID in the "default" namespace, and that each certificate has a 2-deep chain (leaf + issuer intermediate).
func VerifySignatureChain ¶ added in v1.18.0
func VerifySignatureChain(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string, trustAnchors []byte)
VerifySignatureChain verifies the full history signature chain for a workflow instance, including cryptographic signatures and certificate chain-of-trust against the given trust anchors.
func WaitForRuntimeStatus ¶
func WaitForRuntimeStatus(t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, id api.InstanceID, status protos.OrchestrationStatus)
func WaitForWorkflowStartedEvent ¶ added in v1.18.0
func WaitForWorkflowStartedEvent(t *testing.T, ctx context.Context, client *client.TaskHubGrpcClient, id api.InstanceID)
Types ¶
type SigningData ¶ added in v1.18.0
type SigningData struct {
// RawSignatures are the raw serialized bytes of each HistorySignature
// as stored. Required for digest computation in chain verification.
RawSignatures [][]byte
// Signatures are the parsed HistorySignature protos.
Signatures []*protos.HistorySignature
// Certs are the signing certificates.
Certs []*protos.SigningCertificate
// RawEvents are the raw serialized bytes of each history event as stored.
RawEvents [][]byte
}
SigningData holds signatures, certificates, and raw history events for a workflow instance, loaded from the state store for verification.
func UnmarshalSigningData ¶ added in v1.18.0
func UnmarshalSigningData(t *testing.T, ctx context.Context, db *sqlite.SQLite, instanceID string) SigningData
UnmarshalSigningData reads and unmarshals signatures, certificates, and raw history events from the SQLite state store for the given workflow instance.
Source Files
Directories