Documentation
¶
Overview ¶
Package adminauthtest is the contract suite every adminauth.Store must pass, plus a failing store for error-path tests.
Why ¶
The in-memory store and the three SQL backends have to behave identically, or an authorization decision would depend on which database a deployment chose. RunSuite is what proves that, the same way storagetest, ddmtest, deptest, and acmetest do for their own interfaces.
The cases that matter most are the ones a naive implementation gets wrong: a revoked principal must not be findable by an empty digest, a rotated token must stop working the moment the new one is issued, and the policy version must move on every write so a cached compilation notices.
References ¶
- Decision record: docs/research/decisions/0034-admin-api-and-authorization.md
- Plan of record: docs/research/implementation_plan.md (phase 8)
- Sibling suites: storage/storagetest, ddm/ddmtest, acme/acmetest
Index ¶
- Variables
- func RunSuite(t *testing.T, newStore NewStore)
- type Failing
- func (f *Failing) CountRoot(ctx context.Context) (int, error)
- func (f *Failing) CreatePrincipal(ctx context.Context, p adminauth.Principal, digest string, now time.Time) (adminauth.Principal, error)
- func (f *Failing) DeletePolicy(ctx context.Context, name string) error
- func (f *Failing) DeletePrincipal(ctx context.Context, name string) error
- func (f *Failing) GetPolicy(ctx context.Context, name string) (adminauth.Policy, error)
- func (f *Failing) Policies(ctx context.Context) ([]adminauth.Policy, error)
- func (f *Failing) PolicyVersion(ctx context.Context) (int64, error)
- func (f *Failing) Principal(ctx context.Context, name string) (adminauth.Principal, error)
- func (f *Failing) PrincipalByDigest(ctx context.Context, digest string) (adminauth.Principal, error)
- func (f *Failing) Principals(ctx context.Context, p adminauth.Page) (adminauth.Result[adminauth.Principal], error)
- func (f *Failing) PutPolicy(ctx context.Context, p adminauth.Policy, now time.Time) (adminauth.Policy, error)
- func (f *Failing) RevokeToken(ctx context.Context, name string, now time.Time) error
- func (f *Failing) SetToken(ctx context.Context, name, digest, tokenID string, expires, now time.Time) (adminauth.Principal, error)
- func (f *Failing) UpdatePrincipal(ctx context.Context, name string, roles []string, root bool, now time.Time) (adminauth.Principal, error)
- type NewStore
Constants ¶
This section is empty.
Variables ¶
var ErrFailing = errors.New("adminauthtest: injected failure")
ErrFailing is what a Failing store returns from the selected method.
Functions ¶
Types ¶
type Failing ¶
Failing wraps a Store and makes one named method fail, so a caller's error path is reachable without a broken database. Fail is the method name, for example "Principal" or "Policies"; an empty Fail passes everything through.
func (*Failing) CreatePrincipal ¶
func (f *Failing) CreatePrincipal(ctx context.Context, p adminauth.Principal, digest string, now time.Time) (adminauth.Principal, error)
CreatePrincipal implements adminauth.Store.
func (*Failing) DeletePolicy ¶
DeletePolicy implements adminauth.Store.
func (*Failing) DeletePrincipal ¶
DeletePrincipal implements adminauth.Store.
func (*Failing) PolicyVersion ¶
PolicyVersion implements adminauth.Store.
func (*Failing) PrincipalByDigest ¶
func (f *Failing) PrincipalByDigest(ctx context.Context, digest string) (adminauth.Principal, error)
PrincipalByDigest implements adminauth.Store.
func (*Failing) Principals ¶
func (f *Failing) Principals(ctx context.Context, p adminauth.Page) (adminauth.Result[adminauth.Principal], error)
Principals implements adminauth.Store.
func (*Failing) PutPolicy ¶
func (f *Failing) PutPolicy(ctx context.Context, p adminauth.Policy, now time.Time) (adminauth.Policy, error)
PutPolicy implements adminauth.Store.
func (*Failing) RevokeToken ¶
RevokeToken implements adminauth.Store.
Source Files