kyle/sift
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

p2.4: restricted workspace for permitted callers

Browse Source 
guardian-star context is allowed only when the authenticated caller is in
permit_restricted and mapped to that workspace. Fleet callers remapped to it
still refuse. CLI client.toml: SIFT_CLIENT, then $HERMES_HOME/sift, then ~/.config.
This commit is contained in:
kyle
2026-09-23 08:33:58 -07:00
parent 14eb7808ce
commit e36da19f57
10 changed files with 159 additions and 42 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/fleetctx/fleetctx_test.go
+52 -9
View File
@@ -11,9 +11,9 @@ import (
"time"
)
func TestGuardianStarRefusedEvenIfAllowlisted(t *testing.T) {
c := &Client{Base: "http://127.0.0.1:1", Allow: []string{"guardian-star", "hermes-fleet"}}
items, warn := c.Search(context.Background(), "guardian-star", "anything")
func TestRestrictedRefusedEvenIfAllowlisted(t *testing.T) {
c := &Client{Base: "http://127.0.0.1:1", Allow: []string{"guardian-star", "hermes-fleet"}, Permit: []string{"straylight-gs"}}
items, warn := c.Search(context.Background(), "guardian-star", "talos", "anything")
if len(items) != 0 {
t.Fatalf("items %v", items)
}
@@ -22,9 +22,52 @@ func TestGuardianStarRefusedEvenIfAllowlisted(t *testing.T) {
}
}
func TestRestrictedRefusedWhenFleetCallerRemapped(t *testing.T) {
c := &Client{Base: "http://127.0.0.1:1", Allow: []string{"guardian-star"}, Permit: []string{"straylight-gs"}}
items, warn := c.Search(context.Background(), "guardian-star", "straylight", "q")
if len(items) != 0 || warn == "" {
t.Fatalf("items %v warn %q", items, warn)
}
}
func TestRestrictedAllowedForPermittedCaller(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path != "/v3/workspaces/guardian-star/search" {
t.Errorf("path %s", r.URL.Path)
}
_ = json.NewEncoder(w).Encode([]map[string]any{{
"content": "gs already knows Y",
"created_at": "2026-09-23T00:00:00Z",
"peer_id": "kyle",
"session_id": "s1",
"workspace_id": "guardian-star",
"token_count": 4,
}})
}))
defer ts.Close()
c := &Client{
Base: ts.URL,
Allow: []string{"guardian-star", "hermes-fleet"},
Permit: []string{"straylight-gs"},
HTTP: ts.Client(),
}
items, warn := c.Search(context.Background(), "guardian-star", "straylight-gs", "Y")
if warn != "" || len(items) != 1 || items[0].Peer != "kyle" || items[0].Content != "gs already knows Y" {
t.Fatalf("%v %q", items, warn)
}
}
func TestRestrictedSkippedIfNotAllowlisted(t *testing.T) {
c := &Client{Base: "http://127.0.0.1:1", Permit: []string{"straylight-gs"}}
_, warn := c.Search(context.Background(), "guardian-star", "straylight-gs", "q")
if warn == "" {
t.Fatal("want skip")
}
}
func TestAllowlist(t *testing.T) {
c := &Client{Base: "http://127.0.0.1:1", Allow: []string{"hermes-fleet"}}
_, warn := c.Search(context.Background(), "other-ws", "q")
_, warn := c.Search(context.Background(), "other-ws", "straylight", "q")
if warn == "" {
t.Fatal("want skip")
}
@@ -39,7 +82,7 @@ func TestTimeoutWarning(t *testing.T) {
defer ts.Close()
c := &Client{Base: ts.URL, Allow: []string{"hermes-fleet"}, HTTP: ts.Client()}
start := time.Now()
_, warn := c.Search(context.Background(), "hermes-fleet", "q")
_, warn := c.Search(context.Background(), "hermes-fleet", "straylight", "q")
if time.Since(start) > 3500*time.Millisecond {
t.Fatalf("took %s", time.Since(start))
}
@@ -67,7 +110,7 @@ func TestHappyPath(t *testing.T) {
}))
defer ts.Close()
c := &Client{Base: ts.URL, Allow: []string{"hermes-fleet"}, HTTP: ts.Client()}
items, warn := c.Search(context.Background(), "hermes-fleet", "X")
items, warn := c.Search(context.Background(), "hermes-fleet", "straylight", "X")
if warn != "" || len(items) != 1 || items[0].Peer != "kyle" {
t.Fatalf("%v %q", items, warn)
}
@@ -75,7 +118,7 @@ func TestHappyPath(t *testing.T) {
func TestTraversalRejected(t *testing.T) {
c := &Client{Base: "http://127.0.0.1:1", Allow: []string{"hermes-fleet"}}
_, warn := c.Search(context.Background(), "hermes-fleet/../guardian-star", "q")
_, warn := c.Search(context.Background(), "hermes-fleet/../guardian-star", "straylight-gs", "q")
if warn == "" {
t.Fatal("want skip")
}
@@ -90,7 +133,7 @@ func TestDropsForeignWorkspace(t *testing.T) {
}))
defer ts.Close()
c := &Client{Base: ts.URL, Allow: []string{"hermes-fleet"}, HTTP: ts.Client()}
items, warn := c.Search(context.Background(), "hermes-fleet", "q")
items, warn := c.Search(context.Background(), "hermes-fleet", "straylight", "q")
if warn != "" || len(items) != 1 || items[0].Content != "ok" {
t.Fatalf("%v %q", items, warn)
}
@@ -109,7 +152,7 @@ func TestConcurrentSearch(t *testing.T) {
wg.Add(1)
go func() {
defer wg.Done()
_, _ = c.Search(context.Background(), "hermes-fleet", "q")
_, _ = c.Search(context.Background(), "hermes-fleet", "straylight", "q")
}()
}
wg.Wait()