rhi

Coordinated trade for connected markets
git clone https://radroots.dev/git/rhi.git
Log | Files | Refs | README | LICENSE

services_hardening_admin_domain.rs (4702B)

      1 #![forbid(unsafe_code)]
      2 
      3 use std::collections::BTreeSet;
      4 
      5 use rhi::RhiAdminRoute;
      6 use serde_json::Value;
      7 
      8 const COMMON_CONTRACT: &str = include_str!("../contracts/services_hardening/admin_common.v1.json");
      9 const DOMAIN_CONTRACT: &str = include_str!("../contracts/services_hardening/admin_domain.v1.json");
     10 const OPERATOR_CONTRACT: &str =
     11     include_str!("../contracts/services_hardening/operator_contract.v1.json");
     12 const ADMIN_SOURCE: &str = include_str!("../src/admin_v1.rs");
     13 
     14 #[test]
     15 fn domain_inventory_is_exact_ordered_disjoint_and_cumulative() {
     16     let common: Value = serde_json::from_str(COMMON_CONTRACT).expect("common admin contract");
     17     let domain: Value = serde_json::from_str(DOMAIN_CONTRACT).expect("domain admin contract");
     18     let operator: Value = serde_json::from_str(OPERATOR_CONTRACT).expect("operator contract");
     19     assert_eq!(domain["schema"], "radroots.rhi.admin-domain.v1");
     20     assert_eq!(domain["contract_version"], 1);
     21     assert_eq!(domain["active_route_count"], 20);
     22 
     23     let common = common["registered_routes"]
     24         .as_array()
     25         .expect("common routes")
     26         .iter()
     27         .map(|value| value.as_str().expect("operation ID"))
     28         .collect::<Vec<_>>();
     29     let newly_registered = domain["newly_registered_routes"]
     30         .as_array()
     31         .expect("domain routes")
     32         .iter()
     33         .map(|value| value.as_str().expect("operation ID"))
     34         .collect::<Vec<_>>();
     35     assert_eq!(common.len(), 7);
     36     assert_eq!(newly_registered.len(), 13);
     37     assert!(common.iter().all(|route| !newly_registered.contains(route)));
     38 
     39     let active = common
     40         .iter()
     41         .chain(&newly_registered)
     42         .copied()
     43         .collect::<Vec<_>>();
     44     let governed = operator["admin"]["routes"]
     45         .as_array()
     46         .expect("operator routes")
     47         .iter()
     48         .map(|route| route["operation_id"].as_str().expect("operation ID"))
     49         .collect::<Vec<_>>();
     50     let expected_active = governed.clone();
     51     assert_eq!(active, expected_active);
     52     assert_eq!(
     53         RhiAdminRoute::COMMON
     54             .into_iter()
     55             .map(RhiAdminRoute::operation_id)
     56             .collect::<Vec<_>>(),
     57         common
     58     );
     59     assert_eq!(
     60         RhiAdminRoute::DOMAIN
     61             .into_iter()
     62             .map(RhiAdminRoute::operation_id)
     63             .collect::<Vec<_>>(),
     64         newly_registered
     65     );
     66     assert_eq!(
     67         RhiAdminRoute::ACTIVE
     68             .into_iter()
     69             .map(RhiAdminRoute::operation_id)
     70             .collect::<Vec<_>>(),
     71         expected_active
     72     );
     73     assert_eq!(active.iter().copied().collect::<BTreeSet<_>>().len(), 20);
     74     assert_eq!(
     75         domain["removed_live_identity_routes"],
     76         serde_json::json!([
     77             "radroots.rhi.identity.rekey.v1",
     78             "radroots.rhi.identity.replace.v1"
     79         ])
     80     );
     81     assert_eq!(governed.len(), 20);
     82 }
     83 
     84 #[test]
     85 fn domain_adapter_is_bounded_handler_owned_and_sensitive_route_free() {
     86     let domain: Value = serde_json::from_str(DOMAIN_CONTRACT).expect("domain admin contract");
     87     assert_eq!(domain["pagination"]["maximum_page_items"], 200);
     88     assert_eq!(
     89         domain["pagination"]["cursor_encoding"],
     90         "canonical_base64url_no_padding"
     91     );
     92     assert_eq!(
     93         domain["pagination"]["cursor_integrity"],
     94         "server_authenticated"
     95     );
     96     assert_eq!(
     97         domain["pagination"]["cursor_binding"],
     98         serde_json::json!(["route", "filters", "snapshot"])
     99     );
    100     assert_eq!(domain["pagination"]["duplicate_query_items"], "reject");
    101     assert_eq!(domain["path_parameters"]["trade_id"]["utf8_bytes"], 32);
    102     assert_eq!(
    103         domain["authority"]["operation_id_conflicting_reuse"],
    104         "reject"
    105     );
    106     assert_eq!(domain["authority"]["raw_shared_router_public"], false);
    107     assert_eq!(domain["effects"]["adapter_performs_sqlite"], false);
    108     assert_eq!(domain["effects"]["adapter_performs_relay_io"], false);
    109     assert_eq!(domain["effects"]["identity_mutation"], false);
    110 
    111     for required in [
    112         "pub const DOMAIN: [Self; 13]",
    113         "pub const ACTIVE: [Self; 20]",
    114         "for route in RhiAdminRoute::ACTIVE",
    115         "Some((\"trade_id\", \"trade_id\"))",
    116         "RhiAdminHandlerErrorKind::InvalidCursor",
    117         "twenty_active_routes_round_trip_over_the_hardened_unix_boundary",
    118     ] {
    119         assert!(
    120             ADMIN_SOURCE.contains(required),
    121             "missing boundary `{required}`"
    122         );
    123     }
    124     for forbidden in [
    125         "for route in RhiAdminRoute::ALL",
    126         "pub fn into_inner",
    127         "TcpListener",
    128         "Cors",
    129     ] {
    130         assert!(
    131             !ADMIN_SOURCE.contains(forbidden),
    132             "forbidden boundary `{forbidden}`"
    133         );
    134     }
    135 }