ce7cb702218693d08ea6d83464d2457c9250027c

services/mirrored-image/k8s/bootstrap/bootstrap-tests.fsx

@@ -0,0 +1,127 @@
+#load "bootstrap-lib.fsx"
+
+open System
+open System.Collections.Generic
+open Bootstrap
+
+let require condition message =
+    if not condition then
+        invalidOp message
+
+let config = { AdminPath = "secret/data/bootstrap/admin" }
+
+let allPending () =
+    let reads = Dictionary<string, Map<string, string>>()
+
+    for app in apps do
+        reads[tokenPath app] <- Map.ofList (List.singleton ("token", "PLACEHOLDER"))
+
+    reads[config.AdminPath] <- Map.ofList (List.singleton ("token", "admin-value"))
+    reads[personaPath "candidates-bot"] <- Map.ofList (List.singleton ("password", "candidates-value"))
+    reads[personaPath "mirror-bot"] <- Map.ofList (List.singleton ("password", "mirror-value"))
+
+    let writes = ResizeArray<string * Map<string, string>>()
+    let logins = ResizeArray<string>()
+    let access = ResizeArray<string>()
+    let assigned = ResizeArray<App>()
+
+    let store =
+        { Read = fun path -> reads[path]
+          Write = fun path value -> writes.Add(path, value) }
+
+    let quay =
+        { LoginAuth = fun () -> "login-value"
+          Login =
+            fun user _ _ ->
+                logins.Add user
+                { User = user; State = null }
+          Access = fun _ app -> access.Add app.User
+          Application = fun _ app -> $"client-{app.Name}"
+          Assign = fun _ _ app -> assigned.Add app
+          Issue = fun _ app -> $"token-{app.Name}" }
+
+    run config store quay
+    require (Set.ofSeq logins = Set.ofList [ "candidates-bot"; "mirror-bot" ]) "personas were not logged in once"
+    require (Set.ofSeq access = Set.ofList [ "candidates-bot"; "mirror-bot" ]) "persona access was not reconciled once"
+    require (assigned.Count = 4) "OAuth assignments were incomplete"
+    require (writes.Count = 4) "OAuth tokens were not written"
+
+    for app in assigned do
+        require (app.Client = $"client-{app.Name}") "application client ID was not retained"
+
+    let writers = assigned |> Seq.filter (fun app -> app.Name.EndsWith "-writer")
+
+    for app in writers do
+        require (app.Scopes = [ "repo:create"; "repo:write" ]) "writer scopes were broader than prescribed"
+
+let complete () =
+    let mutable reads = 0
+    let mutable calls = 0
+
+    let store =
+        { Read =
+            fun _ ->
+                reads <- reads + 1
+                Map.ofList (List.singleton ("token", "existing"))
+          Write = fun _ _ -> calls <- calls + 1 }
+
+    let quay =
+        { LoginAuth =
+            fun () ->
+                calls <- calls + 1
+                ""
+          Login =
+            fun _ _ _ ->
+                calls <- calls + 1
+                { User = ""; State = null }
+          Access = fun _ _ -> calls <- calls + 1
+          Application =
+            fun _ _ ->
+                calls <- calls + 1
+                ""
+          Assign = fun _ _ _ -> calls <- calls + 1
+          Issue =
+            fun _ _ ->
+                calls <- calls + 1
+                "" }
+
+    run config store quay
+    require (reads = 4) "completed outputs were not inspected exactly once"
+    require (calls = 0) "completed bootstrap used privileged operations"
+
+let partial () =
+    let mutable logins = 0
+    let writes = ResizeArray<string>()
+
+    let store =
+        { Read =
+            fun path ->
+                if path = tokenPath apps[0] then
+                    Map.ofList (List.singleton ("token", "PLACEHOLDER"))
+                elif path = config.AdminPath then
+                    Map.ofList (List.singleton ("token", "value"))
+                elif path = personaPath "candidates-bot" then
+                    Map.ofList (List.singleton ("password", "value"))
+                else
+                    Map.ofList (List.singleton ("token", "existing"))
+          Write = fun path _ -> writes.Add path }
+
+    let quay =
+        { LoginAuth = fun () -> "login-token"
+          Login =
+            fun user _ _ ->
+                logins <- logins + 1
+                { User = user; State = null }
+          Access = fun _ _ -> ()
+          Application = fun _ _ -> "client"
+          Assign = fun _ _ _ -> ()
+          Issue = fun _ _ -> "token" }
+
+    run config store quay
+    require (logins = 1) "partial bootstrap logged in an unrelated persona"
+    require (Seq.toList writes = [ tokenPath apps[0] ]) "partial bootstrap changed unrelated outputs"
+
+allPending ()
+complete ()
+partial ()
+printfn "bootstrap tests passed"