mirror of
https://github.com/hanzoai/iamsdk.git
synced 2026-10-30 18:34:06 +00:00
zeekayandHanzo Dev
9e2bf31b68
The gate this repo shipped under could not run and could not pass.
It could not RUN: .github/workflows/ci.yml triggered on `push: branches:
[master]`, and the default branch is `main`. Its last execution was
2026-06-29, on master, and it FAILED — as did the three before it. Zero runs
on main, ever. So the route-prefix fix, the JWKS verification fix, the signed
orgs/billing claims, and v2.2.2 — the commit that stopped this client from
overwriting a caller's `owner`, i.e. a cross-tenant scoping fix — were all
published with no test run at all. Its release job carried
`if: github.repository == 'casdoor/casdoor-go-sdk'`, and .releaserc.json
released from `master`: upstream's machinery, dead on arrival here, and a
second release path beside the fleet's tag flow.
It could not PASS: 30 of the 43 tests drive a live server at
demo.hanzo-iam.com — a debrand-rewrite of the vendor's demo host. It does not
resolve, and this fleet runs no such host, so those 30 failed on every run,
permanently. That is the whole mechanism: a gate that cannot go green gets
parked on a branch nobody pushes, and then nothing is gated.
Collapse the 31 copies of the connect line to one seam. live() binds the
global client to a real IAM and returns the org/app the caller owns its rows
under, or SKIPS. "Is there a server to talk to?" is one question, asked once.
Config comes from the environment, so CI can inject a real endpoint from KMS
and the same 30 tests become real coverage the moment one exists.
Deleted, not shimmed:
- test_util.go. It had no _test suffix, so its hard-coded
TestClientSecret was compiled into every binary linking this SDK. A
credential belongs in KMS.
- sms_test.go. Its entire body was commented out; it asserted nothing and
reported PASS, and carried two hard-coded phone numbers.
- ci.yml + .releaserc.json, replaced by hanzo.yml + a 7-line cicd.yml
importing hanzoai/ci@v1 — the one way every repo in this fleet builds.
TDD:
before `go test ./...` FAIL — 13 pass / 30 fail (all DNS, and the 13th was
TestSms passing vacuously)
after `go test ./...` ok — 12 pass / 30 skip / 0 fail; `go vet` clean
The skip is conditional, not permanent: with IAM_TEST_ENDPOINT et al set to
127.0.0.1:1 the same tests RUN and fail on connect. Verified.
Consumer built, not grepped: test_util.go exported six symbols, so removing it
is an API removal. hanzoai/visor is the only direct requirer (6 import sites,
iamsdk.InitConfig/ParseJwtToken/GetOAuthToken/AddUser/Claims/User). Built and
vetted against this working tree through a go.work overlay — `go build ./...`
and `go vet` on all five importing packages, exit 0.
Co-authored-by: Hanzo Dev <[email protected]>
39 lines
1.7 KiB
YAML
39 lines
1.7 KiB
YAML
# Hanzo CI — the ONE way this repo is gated, read by hanzoai/ci.
|
|
#
|
|
# No `images:` and no `deploy:`: iamsdk is a Go library. A consumer links it
|
|
# from the module proxy at a tag, so what CI owes is a gate, not an artifact.
|
|
#
|
|
# This replaces a bespoke workflow that never ran. It triggered on `master`
|
|
# while the default branch is `main`, so its last execution was 2026-06-29 —
|
|
# and it FAILED. Every commit since, including v2.2.2 (the fix that stopped
|
|
# this client from silently rewriting a caller's `owner`, a cross-tenant
|
|
# scoping bug), was published with zero test runs. Its release job was also
|
|
# guarded `if: github.repository == 'casdoor/casdoor-go-sdk'`, so it could
|
|
# never fire in this fleet at all.
|
|
|
|
test:
|
|
- name: go-vet
|
|
run: |
|
|
set -e
|
|
export GOWORK=off
|
|
go vet ./...
|
|
- name: go-unit
|
|
# The whole tree, not a named list — an allowlist stops covering whatever
|
|
# is added after it is written.
|
|
#
|
|
# scope_test.go is the load-bearing one: it asserts that an explicit
|
|
# `owner` reaches the wire verbatim and that no route writes to the
|
|
# caller's query map. IAM's authz.Scope honours an owner the principal may
|
|
# read and REFUSES one it may not; that decision only happens if the client
|
|
# actually asks. This client used to answer it locally instead, so a
|
|
# multi-tenant caller was pinned to whatever org it was constructed with
|
|
# and could not tell. A red gate here must block the release.
|
|
#
|
|
# The 30 integration tests drive a REAL IAM. They skip unless
|
|
# IAM_TEST_ENDPOINT + credentials are present (see live() in
|
|
# iamsdk/live_test.go) — one seam, so "is there a server?" is asked once.
|
|
run: |
|
|
set -e
|
|
export GOWORK=off
|
|
go test -count=1 ./...
|