mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
Julian Sommer
39 lines
2.3 KiB
Go
39 lines
2.3 KiB
Go
//go:build integration
|
|
|
|
package integration
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/mulgadc/spinifex/internal/awsmodel"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestRequestConformanceBlocksOnlyRequestPromotedServices(t *testing.T) {
|
|
collector := newRequestCollector()
|
|
accepted := awsmodel.RequestCase{Operation: "ListRoles", Constraint: awsmodel.ConstraintRange, Path: "$.MaxItems", Detail: "above max 1000"}
|
|
collector.record(awsmodel.IAM, accepted, awsmodel.RequestResult{Status: 200}, awsmodel.VerdictFinding)
|
|
|
|
responseOnly := conformancePolicy{promoted: map[awsmodel.Service]bool{awsmodel.IAM: true}}
|
|
require.Zero(t, collector.blocking(responseOnly, conformanceModeFail), "response promotion does not promote requests")
|
|
|
|
requestPromoted := conformancePolicy{requestPromoted: map[awsmodel.Service]bool{awsmodel.IAM: true}}
|
|
require.Equal(t, 1, collector.blocking(requestPromoted, conformanceModeFail))
|
|
require.Zero(t, collector.blocking(requestPromoted, conformanceModeWarn))
|
|
require.Contains(t, collector.report(requestPromoted, conformanceModeFail), "FAIL iam ListRoles $.MaxItems range (above max 1000) accepted")
|
|
}
|
|
|
|
func TestRequestConformanceReportsUndeclaredErrorsAndUntestedOperations(t *testing.T) {
|
|
collector := newRequestCollector()
|
|
refused := awsmodel.RequestCase{Operation: "TagResource", Constraint: awsmodel.ConstraintLength, Path: "$.tags.{key}", Detail: "below min 1"}
|
|
collector.record(awsmodel.ECR, refused, awsmodel.RequestResult{Status: 400, Code: "InvalidParameterValueException", Message: "bad key"}, awsmodel.VerdictUndeclaredError)
|
|
collector.recordOperation(awsmodel.ACM, "RequestCertificate", awsmodel.RequestPlan{Skipped: []awsmodel.Skip{{Path: "$.DomainName", Reason: "pattern is not supported by Go regexp"}}})
|
|
|
|
policy := conformancePolicy{requestPromoted: map[awsmodel.Service]bool{awsmodel.ECR: true}}
|
|
require.Equal(t, 1, collector.blocking(policy, conformanceModeFail), "an undeclared error blocks like any finding")
|
|
report := collector.report(policy, conformanceModeFail)
|
|
require.Contains(t, report, "FAIL ecr TagResource $.tags.{key} length (below min 1) refused with undeclared InvalidParameterValueException: bad key")
|
|
require.Contains(t, report, "UNTESTED acm RequestCertificate: $.DomainName: pattern is not supported by Go regexp")
|
|
require.Contains(t, report, "operations=1 untested_operations=1 requests=0")
|
|
}
|