| 160 | } |
| 161 | |
| 162 | func TestRuntimeInputsForPolicy(t *testing.T) { |
| 163 | t.Run("nil receiver returns nothing", func(t *testing.T) { |
| 164 | var ri *RuntimeInputs |
| 165 | got, matched := ri.forPolicy("p", "p") |
| 166 | assert.Nil(t, got) |
| 167 | assert.Nil(t, matched) |
| 168 | }) |
| 169 | |
| 170 | t.Run("global inputs apply to every policy", func(t *testing.T) { |
| 171 | ri := &RuntimeInputs{Global: map[string]string{"ignored_paths": "a"}} |
| 172 | got, matched := ri.forPolicy("some-policy", "some-policy") |
| 173 | assert.Equal(t, map[string]string{"ignored_paths": "a"}, got) |
| 174 | assert.Empty(t, matched) |
| 175 | }) |
| 176 | |
| 177 | t.Run("scoped input applies only to the matching policy", func(t *testing.T) { |
| 178 | ri := &RuntimeInputs{Scoped: map[string]map[string]string{ |
| 179 | "trusted-binaries-signed": {"ignored_paths": "a"}, |
| 180 | }} |
| 181 | |
| 182 | got, matched := ri.forPolicy("trusted-binaries-signed", "chainloop://trusted-binaries-signed@sha256:abc") |
| 183 | assert.Equal(t, map[string]string{"ignored_paths": "a"}, got) |
| 184 | assert.ElementsMatch(t, []string{"trusted-binaries-signed"}, matched) |
| 185 | |
| 186 | got, matched = ri.forPolicy("trusted-binaries-vendor-keys", "chainloop://trusted-binaries-vendor-keys") |
| 187 | assert.Empty(t, got) |
| 188 | assert.Empty(t, matched) |
| 189 | }) |
| 190 | |
| 191 | t.Run("global and scoped merge additively for the same input", func(t *testing.T) { |
| 192 | ri := &RuntimeInputs{ |
| 193 | Global: map[string]string{"ignored_paths": "g"}, |
| 194 | Scoped: map[string]map[string]string{ |
| 195 | "trusted-binaries-signed": {"ignored_paths": "s"}, |
| 196 | }, |
| 197 | } |
| 198 | got, matched := ri.forPolicy("trusted-binaries-signed", "trusted-binaries-signed") |
| 199 | assert.Equal(t, map[string]string{"ignored_paths": "g\ns"}, got) |
| 200 | assert.ElementsMatch(t, []string{"trusted-binaries-signed"}, matched) |
| 201 | }) |
| 202 | |
| 203 | t.Run("does not mutate the global map", func(t *testing.T) { |
| 204 | ri := &RuntimeInputs{ |
| 205 | Global: map[string]string{"ignored_paths": "g"}, |
| 206 | Scoped: map[string]map[string]string{"p": {"ignored_paths": "s"}}, |
| 207 | } |
| 208 | _, _ = ri.forPolicy("p", "p") |
| 209 | assert.Equal(t, map[string]string{"ignored_paths": "g"}, ri.Global) |
| 210 | }) |
| 211 | } |
| 212 | |
| 213 | func TestScopeTrackerUnmatched(t *testing.T) { |
| 214 | testCases := []struct { |