access-engine/internal/decision/trusted_service_time_test.go
tegwick 2b064eee51
Some checks failed
CI Smoke / host-smoke (push) Successful in 0s
CI Smoke / container-smoke (push) Successful in 2s
Build and Publish Container Image / build-and-push (push) Failing after 1m10s
Bind trusted task approval to exact producer facts and lifetime
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786
2026-10-16 17:27:30 +02:00

56 lines
2.4 KiB
Go

package decision
import (
"encoding/json"
"testing"
"time"
)
func TestTrustedTaskWholeOperationLifetime(t *testing.T) {
now := time.Date(2026, 10, 16, 12, 0, 0, 0, time.UTC)
contract := func(ttl string) map[string]any {
return map[string]any{"backend_budget": map[string]any{"ttl_seconds": json.Number(ttl), "uses": json.Number("12")}}
}
end := now.Add(60 * time.Second)
lifetime, err := trustedTaskLifetime(contract("30"), end, now.Add(120*time.Second), now, "120s")
if err != nil {
t.Fatal(err)
}
if lifetime.ExpiresAt != end.Format(time.RFC3339) || lifetime.TTL != "1m0s" || lifetime.NotBefore != now.Format(time.RFC3339) {
t.Fatal("lifetime not derived from exact operation")
}
fractional := end.Add(123456789 * time.Nanosecond)
lifetime, err = trustedTaskLifetime(contract("30"), fractional, fractional, now, "120s")
if err != nil || lifetime.ExpiresAt != fractional.Format(time.RFC3339Nano) {
t.Fatal("exact fractional deadline shortened or extended")
}
cases := []struct {
name string
ttl string
end, authority, time time.Time
maximum string
}{
{"old-15s-conflict", "30", end, end, now, "15s"},
{"insufficient-cleanup-reserve", "30", now.Add(35*time.Second - time.Nanosecond), end, now, "120s"},
{"elapsed-consume-setup", "30", end, end, now.Add(26 * time.Second), "120s"},
{"expired-operation", "30", now, now, now, "120s"},
{"source-hard-maximum", "30", now.Add(120*time.Second + time.Nanosecond), now.Add(130 * time.Second), now, "120s"},
{"attempted-policy-cap-bypass", "30", end, end, now, "121s"},
{"shorter-original-or-fresh-fact", "30", end, end.Add(-time.Nanosecond), now, "120s"},
{"structural-120-cannot-fit", "120", now.Add(120 * time.Second), now.Add(120 * time.Second), now, "120s"},
{"noninteger-structural-ttl", "30.0", end, end, now, "120s"},
}
for _, c := range cases {
t.Run(c.name, func(t *testing.T) {
if _, err := trustedTaskLifetime(contract(c.ttl), c.end, c.authority, c.time, c.maximum); err == nil {
t.Fatal("invalid temporal authority accepted")
}
})
}
if _, err := trustedTaskLifetime(contract("30"), now.Add(35*time.Second), end, now, "120s"); err != nil {
t.Fatal("exact required lifetime refused")
}
if _, err := trustedTaskLifetime(contract("115"), now.Add(120*time.Second), now.Add(120*time.Second), now, "120s"); err != nil {
t.Fatal("max fitting declared budget refused")
}
}