Function TestPolicyScopeMatches

pkg/policies/runtime_inputs_test.go:82–160

(t *testing.T)

}

func TestPolicyScopeMatches(t *testing.T) {
	testCases := []struct {
		name  string
		scope string
		pname string // policy metadata name
		ref   string // attachment raw ref
		want  bool
	}{
		{
			name:  "exact metadata name",
			scope: "trusted-binaries-signed",
			pname: "trusted-binaries-signed",
			ref:   "chainloop://trusted-binaries-signed@sha256:abc",
			want:  true,
		},
		{
			name:  "exact raw ref",
			scope: "chainloop://trusted-binaries-signed@sha256:abc",
			pname: "",
			ref:   "chainloop://trusted-binaries-signed@sha256:abc",
			want:  true,
		},
		{
			name:  "bare name matches versioned ref when unversioned",
			scope: "trusted-binaries-signed",
			pname: "",
			ref:   "chainloop://trusted-binaries-signed@sha256:abc",
			want:  true,
		},
		{
			name:  "bare name matches plain ref",
			scope: "trusted-binaries-signed",
			pname: "",
			ref:   "trusted-binaries-signed",
			want:  true,
		},
		{
			name:  "org-scoped scope matches org-scoped ref",
			scope: "myorg/trusted-binaries-signed",
			pname: "trusted-binaries-signed",
			ref:   "chainloop://myorg/trusted-binaries-signed",
			want:  true,
		},
		{
			name:  "pinned digest matches same digest",
			scope: "trusted-binaries-signed@sha256:abc",
			pname: "trusted-binaries-signed",
			ref:   "chainloop://trusted-binaries-signed@sha256:abc",
			want:  true,
		},
		{
			name:  "pinned digest does not match different digest",
			scope: "trusted-binaries-signed@sha256:abc",
			pname: "trusted-binaries-signed",
			ref:   "chainloop://trusted-binaries-signed@sha256:xyz",
			want:  false,
		},
		{