tegwick
56940727bf
Close the remaining PDP obligations: mechanical layer declaration check, registry-snapshot digest in provenance, explicit allow TTL, per-input-class freshness deadlines, and the published decision-record contract. Document the canonical request digest as the §6.4.2 replay test. Assistant: grok Assistant-Session: 01a06256-fb71-7102-b3a9-27e6734257d0
56 lines
1.3 KiB
Go
56 lines
1.3 KiB
Go
package layer_test
|
|
|
|
import (
|
|
"path/filepath"
|
|
"runtime"
|
|
"testing"
|
|
|
|
"github.com/netkingdom/flex-auth/internal/layer"
|
|
)
|
|
|
|
func TestLayerDeclarationConforms(t *testing.T) {
|
|
root := repoRoot(t)
|
|
if err := layer.Check(root); err != nil {
|
|
t.Fatalf("layer conformance: %v", err)
|
|
}
|
|
|
|
decl, err := layer.LoadDeclaration(filepath.Join(root, "INTENT.md"))
|
|
if err != nil {
|
|
t.Fatalf("LoadDeclaration: %v", err)
|
|
}
|
|
if decl.Layer != "Engine" {
|
|
t.Fatalf("layer = %q; want Engine", decl.Layer)
|
|
}
|
|
if decl.Role != "PDP" {
|
|
t.Fatalf("role = %q; want PDP", decl.Role)
|
|
}
|
|
if decl.Framework != "netkingdom-security-layer-model" {
|
|
t.Fatalf("framework = %q", decl.Framework)
|
|
}
|
|
if decl.StandardVersion != "0.7" {
|
|
t.Fatalf("standard_version = %q; want 0.7", decl.StandardVersion)
|
|
}
|
|
}
|
|
|
|
func TestEngineWithoutRoleIsRejected(t *testing.T) {
|
|
err := layer.ValidateDeclaration(layer.Declaration{Layer: "Engine"})
|
|
if err == nil {
|
|
t.Fatal("Engine without role was accepted")
|
|
}
|
|
}
|
|
|
|
func TestUnknownLayerIsRejected(t *testing.T) {
|
|
err := layer.ValidateDeclaration(layer.Declaration{Layer: "ControlPlane", Role: "PDP"})
|
|
if err == nil {
|
|
t.Fatal("unknown layer was accepted")
|
|
}
|
|
}
|
|
|
|
func repoRoot(t *testing.T) string {
|
|
t.Helper()
|
|
_, file, _, ok := runtime.Caller(0)
|
|
if !ok {
|
|
t.Fatal("runtime.Caller failed")
|
|
}
|
|
return filepath.Clean(filepath.Join(filepath.Dir(file), "..", ".."))
|
|
}
|