gsadmin/spinifex
1
0
Fork 0
mirror of https://github.com/mulgadc/spinifex.git synced 2026-10-15 17:11:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

test: move gateway authz tests to external test packages

Browse Source 
Both files only ever called exported identifiers, so binding them to the
exported API needs just an import alias and qualified call sites. Clears
the test-package-check failure that surfaced once dev's base ref moved to
origin/main.
This commit is contained in:
Julian Sommer
2026-08-26 11:33:55 +10:00
parent e3d394864d
commit 3196c0c993
2 changed files with 12 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spinifex/gateway/eks/authz_test.go
+4 -3
View File
@@ -1,8 +1,9 @@
package gateway_eks
package gateway_eks_test
import (
"testing"
gateway_eks "github.com/mulgadc/spinifex/spinifex/gateway/eks"
handlers_eks "github.com/mulgadc/spinifex/spinifex/handlers/eks"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
@@ -15,7 +16,7 @@ const (
func resolveARNs(t *testing.T, action string, params []string, body string) []string {
t.Helper()
resources, err := ResourceARNs(action, authzRegion, authzAccountID, params, []byte(body))
resources, err := gateway_eks.ResourceARNs(action, authzRegion, authzAccountID, params, []byte(body))
require.NoError(t, err)
return resources
}
@@ -197,6 +198,6 @@ func TestResourceARNsIdentifierIsAValue(t *testing.T) {
}
func TestResourceARNsUnknownActionFailsClosed(t *testing.T) {
_, err := ResourceARNs("NotAnAction", authzRegion, authzAccountID, nil, nil)
_, err := gateway_eks.ResourceARNs("NotAnAction", authzRegion, authzAccountID, nil, nil)
require.Error(t, err)
}
spinifex/gateway/elbv2/authz_test.go
+8 -7
View File
@@ -1,4 +1,4 @@
package gateway_elbv2
package gateway_elbv2_test
import (
"fmt"
@@ -8,6 +8,7 @@ import (
"github.com/aws/aws-sdk-go/service/elbv2"
"github.com/mulgadc/spinifex/spinifex/arn"
"github.com/mulgadc/spinifex/spinifex/awserrors"
gateway_elbv2 "github.com/mulgadc/spinifex/spinifex/gateway/elbv2"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
)
@@ -31,13 +32,13 @@ func listenerARN(lbName, lbID, id string) string {
func resolveARNs(t *testing.T, action string, input any) []string {
t.Helper()
resources, err := ResourceARNs(action, authzRegion, authzAccount, input)
resources, err := gateway_elbv2.ResourceARNs(action, authzRegion, authzAccount, input)
require.NoError(t, err)
return resources
}
func TestResourceARNs_UnknownAction(t *testing.T) {
_, err := ResourceARNs("NotAnAction", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{})
_, err := gateway_elbv2.ResourceARNs("NotAnAction", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{})
require.Error(t, err)
assert.Equal(t, awserrors.ErrorInvalidAction, err.Error())
}
@@ -163,7 +164,7 @@ func TestResourceARNs_BoundsNestedFanOut(t *testing.T) {
})
}
_, err := ResourceARNs("CreateRule", authzRegion, authzAccount, &elbv2.CreateRuleInput{
_, err := gateway_elbv2.ResourceARNs("CreateRule", authzRegion, authzAccount, &elbv2.CreateRuleInput{
ListenerArn: aws.String(listenerARN("prod", "abc123", "l1")),
Actions: actions,
})
@@ -211,7 +212,7 @@ func TestResourceARNs_AccountWideActions(t *testing.T) {
"DescribeLoadBalancers", "DescribeTargetGroups", "DescribeListeners",
"DescribeRules", "DescribeSSLPolicies", "LBAgentHeartbeat", "GetLBConfig",
} {
assert.True(t, HasScope(action), action)
assert.True(t, gateway_elbv2.HasScope(action), action)
assert.Equal(t, []string{"*"}, resolveARNs(t, action, &elbv2.DescribeLoadBalancersInput{}), action)
}
}
@@ -229,7 +230,7 @@ func TestResourceARNs_RejectsForeignARNs(t *testing.T) {
"no resource at all": "arn:aws:elasticloadbalancing:ap-southeast-2:123456789012:loadbalancer/",
}
for name, value := range rejected {
_, err := ResourceARNs("DeleteLoadBalancer", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{
_, err := gateway_elbv2.ResourceARNs("DeleteLoadBalancer", authzRegion, authzAccount, &elbv2.DeleteLoadBalancerInput{
LoadBalancerArn: aws.String(value),
})
require.Error(t, err, name)
@@ -242,7 +243,7 @@ func TestResourceARNs_RejectsForeignARNs(t *testing.T) {
// A parent of the wrong type cannot derive a child, and must not silently
// produce an ARN naming a resource nobody asked for.
func TestResourceARNs_DerivedChildRejectsWrongParent(t *testing.T) {
_, err := ResourceARNs("CreateListener", authzRegion, authzAccount, &elbv2.CreateListenerInput{
_, err := gateway_elbv2.ResourceARNs("CreateListener", authzRegion, authzAccount, &elbv2.CreateListenerInput{
LoadBalancerArn: aws.String(tgARN("web", "def456")),
})
require.Error(t, err)