Documentation
¶
Overview ¶
Package backendtest is a conformance suite for authentication backends.
The contract in pkg/auth/backend is three methods and two sentinel errors, and every one of its subtle parts is stated in prose: that a rejection and an unreachable source are DIFFERENT answers, that an unknown user and a wrong password must be indistinguishable, that an empty password is not a credential. Prose is where those properties go to be misread — the framework's own first backend needed each of them pinned by a test that fails when the guard is removed.
This package is that set of tests, packaged so a third party gets them by writing four lines instead of by reading carefully:
func TestConformance(t *testing.T) {
backendtest.Run(t, backendtest.Suite{
New: func() (backend.Backend, error) { return New(cfg) },
ValidUser: "ana",
ValidPassword: "correcta",
UnknownUser: "nadie",
})
}
It asserts CONTRACT properties, not quality: passing means a backend answers the way the chain expects, so an operator's break-glass account still works when the directory does not. It cannot tell you the backend talks to the right directory.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Suite ¶
type Suite struct {
// New builds a fresh backend. Called once per check, so a backend
// holding a connection is built and discarded repeatedly — return a
// cheap constructor, not a shared instance, or the checks will observe
// each other's state.
New func() (backend.Backend, error)
// ValidUser and ValidPassword authenticate successfully. Required:
// without a credential that works, "rejects everything" would pass
// every other check.
ValidUser, ValidPassword string
// UnknownUser does not exist in the source.
UnknownUser string
// reach — a dead port, a wrong host. Optional, and the only check that
// needs cooperation from the author, because only they know how to
// break their own connection.
//
// Skipping it skips the single most consequential property in the
// contract: a backend that reports an outage as "wrong password" stops
// the chain and locks out the local account kept for exactly that
// morning.
Unavailable func() (backend.Backend, error)
}
Suite describes a backend and the credentials to exercise it with.
Source Files