mirror of
https://github.com/hanzoai/kms-operator.git
synced 2026-10-30 18:32:57 +00:00
zeekayandHanzo Dev
6bdb695a14
Three faults, found live in one incident (index-chat-env pending, a push
"succeeding" while every read missed):
1. The client addressed /v1/kms/orgs/{org}/... — the org-addressed shape both
servers removed (a URL that names a tenant is caller-selectable). Every
URL is /v1/kms/secrets/... now; the org rides the TOKEN minted at login,
and the org parameter still selects which credential logs in.
2. The push wrote the raw spec path while reads normalized it: a leading-slash
secretsPath was WRITTEN at "/x" and READ (never found) at "x", and the
reconciler honestly reported the write it had made — to an address nothing
reads. One normalization (NormaliseScopePath) now rides both directions.
3. resyncInterval "300" failed "invalid time unit" once a minute forever. A
bare integer is seconds; "5m" still works.
Each pinned by test, negatives included.
Co-authored-by: Hanzo Dev <[email protected]>
24 lines
743 B
Go
24 lines
743 B
Go
package kmsapi
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// The URL names no org (the token carries it), and a write ships the SAME
|
|
// normalized coordinate a read resolves — the two halves of the coordinate
|
|
// split that had pushes "succeed" at "/x" while every read missed at "x".
|
|
func TestBuildSecretURL_TenantShape(t *testing.T) {
|
|
u, err := buildSecretURL("http://cloud.hanzo.svc:8000", "hanzo", "/iam-service-token", "IAM_SERVICE_TOKEN", "prod")
|
|
if err != nil {
|
|
t.Fatalf("buildSecretURL: %v", err)
|
|
}
|
|
if strings.Contains(u, "/orgs/") {
|
|
t.Fatalf("URL names an org: %s", u)
|
|
}
|
|
want := "http://cloud.hanzo.svc:8000/v1/kms/secrets/iam-service-token/IAM_SERVICE_TOKEN?env=prod"
|
|
if u != want {
|
|
t.Fatalf("url = %s, want %s", u, want)
|
|
}
|
|
}
|