75 lines
2.2 KiB
JavaScript
75 lines
2.2 KiB
JavaScript
'use strict';
|
|
|
|
// Agent-facing ops (DESIGN.md §5): node-scoped secrets. OpenBao is not present
|
|
// in the test env, so @simpleworkjs/bao-conf is mocked.
|
|
|
|
jest.mock('@simpleworkjs/bao-conf', () => ({
|
|
request: jest.fn(async (method, path) => {
|
|
if (path.startsWith('secret/data/nodes/')) {
|
|
return {
|
|
ok: true,
|
|
status: 200,
|
|
json: async () => ({ data: { data: { username: 'alice', password: 's3cret' } } }),
|
|
};
|
|
}
|
|
return { ok: false, status: 404, json: async () => ({}) };
|
|
}),
|
|
}));
|
|
|
|
const { request, app } = require('./setup');
|
|
const { Agent } = require('../models/agent');
|
|
|
|
async function enrollAgent() {
|
|
const { agent, token } = await Agent.enroll({
|
|
name: `ops-test-${Date.now().toString(36)}`,
|
|
description: 'api_agent_ops test',
|
|
enrolledBy: 'test'
|
|
});
|
|
return { agent, token };
|
|
}
|
|
|
|
describe('Agent ops — POST /api/v1/agent/secrets', () => {
|
|
test('an agent can fetch its own node-scoped secrets', async () => {
|
|
const { agent, token } = await enrollAgent();
|
|
const path = `secret/data/nodes/${agent.id}/db`;
|
|
const res = await request(app)
|
|
.post('/api/v1/agent/secrets')
|
|
.set('Authorization', `Bearer ${token}`)
|
|
.send({ paths: [path] });
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.status).toBe('ok');
|
|
expect(res.body.secrets[path]).toEqual({ username: 'alice', password: 's3cret' });
|
|
});
|
|
|
|
test('a path outside the node scope is rejected', async () => {
|
|
const { token } = await enrollAgent();
|
|
const res = await request(app)
|
|
.post('/api/v1/agent/secrets')
|
|
.set('Authorization', `Bearer ${token}`)
|
|
.send({ paths: ['secret/data/nodes/other-node/db'] });
|
|
|
|
expect(res.status).toBe(403);
|
|
});
|
|
|
|
test('no bearer token returns 401', async () => {
|
|
const res = await request(app)
|
|
.post('/api/v1/agent/secrets')
|
|
.send({ paths: ['secret/data/nodes/x/db'] });
|
|
|
|
expect(res.status).toBe(401);
|
|
});
|
|
|
|
test('missing paths defaults to agent node & resource secrets', async () => {
|
|
const { token } = await enrollAgent();
|
|
const res = await request(app)
|
|
.post('/api/v1/agent/secrets')
|
|
.set('Authorization', `Bearer ${token}`)
|
|
.send({});
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(res.body.status).toBe('ok');
|
|
expect(res.body.secrets).toBeDefined();
|
|
});
|
|
});
|