78 lines
3.2 KiB
Go
78 lines
3.2 KiB
Go
|
package infrastructureconformance
|
||
|
|
|
||
|
|
import (
|
||
|
|
"encoding/json"
|
||
|
|
"strings"
|
||
|
|
"testing"
|
||
|
|
"time"
|
||
|
|
)
|
||
|
|
|
||
|
|
func TestProductionInfrastructureCompleteCoveragePasses(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
capture := infrastructureFixture("PRODUCTION")
|
||
|
|
report := Evaluate(capture, capture.CandidateVersion, capture.BuildDigest, time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC))
|
||
|
|
if report.Result != "PASS" || report.EvidenceScope != "PRODUCTION_INFRASTRUCTURE" || report.ExternalValidationRequired {
|
||
|
|
t.Fatalf("unexpected report: %+v", report)
|
||
|
|
}
|
||
|
|
if len(report.VerifiedComponents) != len(RequiredComponents) {
|
||
|
|
t.Fatalf("expected all components, got %v", report.VerifiedComponents)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestProductionInfrastructureMissingControlFails(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
capture := infrastructureFixture("PRODUCTION")
|
||
|
|
capture.Components[2].VerifiedControls = capture.Components[2].VerifiedControls[:1]
|
||
|
|
report := Evaluate(capture, capture.CandidateVersion, capture.BuildDigest, time.Now())
|
||
|
|
if report.Result != "FAIL" || !report.ExternalValidationRequired {
|
||
|
|
t.Fatalf("expected failed production report, got %+v", report)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestLocalInfrastructurePassesWithoutExternalReleaseCredit(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
capture := infrastructureFixture("LOCAL")
|
||
|
|
capture.Components = capture.Components[:3]
|
||
|
|
for position := range capture.Components {
|
||
|
|
capture.Components[position].VerifiedControls = []string{"LOCAL_REACHABLE"}
|
||
|
|
}
|
||
|
|
report := Evaluate(capture, capture.CandidateVersion, capture.BuildDigest, time.Now())
|
||
|
|
if report.Result != "PASS" || report.EvidenceScope != "LOCAL_INFRASTRUCTURE" || !report.ExternalValidationRequired {
|
||
|
|
t.Fatalf("unexpected local report: %+v", report)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func TestParseCaptureRejectsUnknownFields(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
content, err := json.Marshal(infrastructureFixture("LOCAL"))
|
||
|
|
if err != nil {
|
||
|
|
t.Fatal(err)
|
||
|
|
}
|
||
|
|
content = []byte(strings.TrimSuffix(string(content), "}") + `,"unexpected":true}`)
|
||
|
|
if _, err = ParseCapture(content); err == nil {
|
||
|
|
t.Fatal("expected unknown field rejection")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func infrastructureFixture(source string) Capture {
|
||
|
|
observedAt := time.Date(2026, 8, 25, 11, 0, 0, 0, time.UTC)
|
||
|
|
collectedAt := observedAt.Add(time.Hour)
|
||
|
|
environment := "STAGING"
|
||
|
|
regionRef, clusterRef, changeRef := "cn-region-a", "cluster-a", "change-20260825"
|
||
|
|
if source == "LOCAL" {
|
||
|
|
environment, regionRef, clusterRef, changeRef = "LOCAL", "local-machine", "compose", "local-smoke"
|
||
|
|
}
|
||
|
|
components := make([]ComponentEvidence, 0, len(RequiredComponents))
|
||
|
|
for _, componentType := range RequiredComponents {
|
||
|
|
components = append(components, ComponentEvidence{
|
||
|
|
ComponentType: componentType, ResourceRef: strings.ToLower(componentType) + "-resource", Status: "VERIFIED", ObservedAt: observedAt,
|
||
|
|
VerifiedControls: RequiredControls(componentType), ProbeRef: "probe:" + componentType, ConfigurationRef: "config:" + componentType, AuditRef: "audit:" + componentType,
|
||
|
|
})
|
||
|
|
}
|
||
|
|
return Capture{
|
||
|
|
SchemaVersion: CaptureSchema, EvidenceSource: source, CandidateVersion: "0.63.0-rc.1", BuildDigest: "sha256:" + strings.Repeat("a", 64),
|
||
|
|
Environment: environment, RegionRef: regionRef, ClusterRef: clusterRef, ChangeTicketRef: changeRef,
|
||
|
|
AttestedByRef: "platform-reviewer", AttestedAt: observedAt.Add(30 * time.Minute), CollectedAt: collectedAt, Components: components,
|
||
|
|
}
|
||
|
|
}
|