Public Access
Merge branch 'main' into the desktop updater, and give way on two numbers
Main landed a realtime push feature while this branch was building the updater, and the two collided in three places. Every one of them resolves the same way: main got there first, so this branch moves. **Two ADRs were both numbered 0012.** Main's is realtime push; this one is now [ADR 0013](docs/adr/0013-desktop-distribution-and-updates.md). Git did not call this a conflict — the filenames differ — so it would have merged quietly and left the directory with two 0012s and every cross-reference ambiguous. Renumbered here along with the nine places that point at it. **Two manual-check phases were both numbered 15**, and that one git did catch. Main's "Changes that arrive without a timer" keeps 15; installing and updating the desktop client becomes Phase 16, with its checks and every reference to them renumbered. The file's own rule is that a number is for life, which is exactly why the one that had not been pushed is the one that gives way. **The merge rewrote several files with CRLF**, and `.editorconfig` asks for LF on everything except `*.ps1`. That is not cosmetic here: IDE0055 is an error and `EnforceCodeStyleInBuild` is on, so it failed the build on three lines of App.axaml.cs whose only change in this branch was an ADR number in a comment. Forty-six files normalised back to LF; the release script keeps CRLF, which is what `.gitattributes` and `.editorconfig` both already say for a PowerShell file. Nothing else conflicted. The updater does not touch the sync loop or the event stream, and the one file both sides edited heavily — MainWindowViewModel — merged without a hunk in common. Verified after merging: the solution restores locked and builds clean, and 304 shell, 100 layout, 54 session, 28 client-api and 25 contracts tests pass. The first two counts are higher than before the merge because main's own tests came with it and pass alongside these.
This commit is contained in:
@@ -0,0 +1,49 @@
|
||||
using System.Threading.Channels;
|
||||
using DodoSSH.Client.Api;
|
||||
using DodoSSH.Contracts;
|
||||
|
||||
namespace DodoSSH.Client.App.Tests;
|
||||
|
||||
/// <summary>
|
||||
/// A server's push channel, driven by a test rather than by a socket.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The real <c>VaultEventStream</c> is a reconnection policy wrapped round a WebSocket, and none of
|
||||
/// that is what the shell's behaviour depends on: what the shell does with a notice is the same
|
||||
/// whether it arrived over a healthy socket, after four reconnections, or from this. Driving it by
|
||||
/// hand is what makes "the loop synchronised because it was told to, not because a minute passed" a
|
||||
/// test that finishes in milliseconds and cannot flake.
|
||||
/// </remarks>
|
||||
internal sealed class FakeVaultEventStream : IVaultEventStream
|
||||
{
|
||||
private readonly Channel<VaultEvent> notices = Channel.CreateUnbounded<VaultEvent>();
|
||||
|
||||
/// <inheritdoc />
|
||||
public bool IsConnected => true;
|
||||
|
||||
/// <summary>How many times the shell has waited on this. Proves the loop is watching at all.</summary>
|
||||
internal int Reads { get; private set; }
|
||||
|
||||
/// <summary>Delivers a notice, as a server would.</summary>
|
||||
internal void Push(Guid vaultId, long sequence = 1) =>
|
||||
notices.Writer.TryWrite(
|
||||
new VaultEvent(VaultEventKinds.VaultChanged, vaultId, sequence));
|
||||
|
||||
/// <summary>Delivers the notice that says the caller's vault list has changed.</summary>
|
||||
internal void PushAccessChanged() =>
|
||||
notices.Writer.TryWrite(new VaultEvent(VaultEventKinds.VaultsChanged));
|
||||
|
||||
/// <inheritdoc />
|
||||
public ValueTask<VaultEvent> ReadAsync(CancellationToken cancellationToken)
|
||||
{
|
||||
Reads++;
|
||||
|
||||
return notices.Reader.ReadAsync(cancellationToken);
|
||||
}
|
||||
|
||||
/// <inheritdoc />
|
||||
public bool TryRead(out VaultEvent notice) => notices.Reader.TryRead(out notice!);
|
||||
|
||||
/// <inheritdoc />
|
||||
public void Dispose() => notices.Writer.TryComplete();
|
||||
}
|
||||
@@ -39,6 +39,16 @@ internal sealed partial class FakeVaultServer : IVaultServer, IAccountApi, ISync
|
||||
|
||||
internal int PushCount { get; private set; }
|
||||
|
||||
/// <summary>
|
||||
/// How many delta reads this server has served.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// The one observable a synchronisation pass always produces. <see cref="PushCount"/> only moves when
|
||||
/// there is something queued, so a test asking "did a pass run" — which is what the push channel's
|
||||
/// whole purpose comes down to — has to count pulls.
|
||||
/// </remarks>
|
||||
internal int PullCount { get; private set; }
|
||||
|
||||
internal bool IsEnrolled => statement is not null;
|
||||
|
||||
/// <summary>
|
||||
@@ -99,6 +109,19 @@ internal sealed partial class FakeVaultServer : IVaultServer, IAccountApi, ISync
|
||||
/// <inheritdoc />
|
||||
public IKeyBindingAuthorizer KeyBinding => this;
|
||||
|
||||
/// <summary>
|
||||
/// The push channel, which a test drives by hand.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// A real queue rather than an idle stand-in, because the behaviour worth covering here is the one
|
||||
/// the socket exists for: a notice arriving makes the background loop synchronise without waiting
|
||||
/// out its minute. See <see cref="FakeVaultEventStream.Push"/>.
|
||||
/// </remarks>
|
||||
internal FakeVaultEventStream Notices { get; } = new();
|
||||
|
||||
/// <inheritdoc />
|
||||
public IVaultEventStream Events => Notices;
|
||||
|
||||
/// <inheritdoc />
|
||||
public SyncOptions SyncOptions => SyncOptions.Default;
|
||||
|
||||
@@ -238,6 +261,8 @@ internal sealed partial class FakeVaultServer : IVaultServer, IAccountApi, ISync
|
||||
SyncPullRequest request,
|
||||
CancellationToken cancellationToken)
|
||||
{
|
||||
PullCount++;
|
||||
|
||||
if (SyncFailure is { } failure)
|
||||
{
|
||||
return Task.FromException<SyncPullResponse>(failure);
|
||||
|
||||
@@ -523,6 +523,90 @@ public sealed class ShellFlowTests : IAsyncLifetime
|
||||
vault.Status.ShouldContain("bad day");
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// The whole point of the push channel: a pass that did not wait for the minute.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The timing is what makes this an assertion rather than a hope. The background timer is a full
|
||||
/// minute and the wait below gives up in ten seconds, so a pull that arrives can only have been
|
||||
/// caused by the notice — there is no interval at which the timer could have produced it.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The vault id in the notice is arbitrary, and deliberately so: a pass synchronises every vault
|
||||
/// this session can reach, so the loop reads the notice as "there is something to fetch" and never
|
||||
/// as "fetch this one". A test that seeded a real id would imply a targeting this does not do.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task APushedNotice_SynchronisesWithoutWaitingForTheTimer()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
// The unlock starts the loop, whose first act is a pass; waited out so the count below is a
|
||||
// baseline rather than a race with it.
|
||||
await EventuallyAsync(
|
||||
() => server.PullCount > 0,
|
||||
"the pass on open should have run");
|
||||
|
||||
var before = server.PullCount;
|
||||
|
||||
server.Notices.Push(Guid.CreateVersion7());
|
||||
|
||||
await EventuallyAsync(
|
||||
() => server.PullCount > before,
|
||||
"a notice should have woken the loop long before the one-minute timer");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The half that is easy to get wrong. The loop selects between two waits, and both have to survive
|
||||
/// losing: <c>PeriodicTimer</c> throws if a second wait is started while one is outstanding, and an
|
||||
/// abandoned channel read stays registered and swallows the next notice written. Either defect
|
||||
/// leaves the first notice working and every one after it silently lost, which is why one notice is
|
||||
/// not enough to prove this.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task NoticesKeepWakingTheLoop_NotJustTheFirst()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
await EventuallyAsync(() => server.PullCount > 0, "the pass on open should have run");
|
||||
|
||||
for (var round = 1; round <= 3; round++)
|
||||
{
|
||||
var before = server.PullCount;
|
||||
|
||||
server.Notices.Push(Guid.CreateVersion7());
|
||||
|
||||
await EventuallyAsync(
|
||||
() => server.PullCount > before,
|
||||
$"notice {round} should have woken the loop as the first one did");
|
||||
}
|
||||
}
|
||||
|
||||
/// <summary>Waits for something a background loop is expected to do, or fails saying what.</summary>
|
||||
/// <remarks>
|
||||
/// Polled rather than signalled because the thing under test is a loop nobody hands a completion
|
||||
/// source to. The bound is generous — this is not measuring latency, only proving that the timer
|
||||
/// cannot be what caused the result.
|
||||
/// </remarks>
|
||||
private static async Task EventuallyAsync(Func<bool> condition, string because)
|
||||
{
|
||||
var deadline = TimeProvider.System.GetUtcNow().AddSeconds(10);
|
||||
|
||||
while (TimeProvider.System.GetUtcNow() < deadline)
|
||||
{
|
||||
if (condition())
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
await Task.Delay(TimeSpan.FromMilliseconds(20), Token);
|
||||
}
|
||||
|
||||
throw new ShouldAssertException(because);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The page's own <c>term.focus()</c> focuses the textarea inside the document, which does nothing
|
||||
@@ -3801,13 +3885,20 @@ public sealed class ShellFlowTests : IAsyncLifetime
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// Deleting a group deliberately does not rewrite the hosts in it — one delete would otherwise become N
|
||||
/// writes, N outbox rows and N chances to merge against a change nobody made — so those hosts keep an id
|
||||
/// that resolves to nothing. "The group is gone" and "this host is in no group" have to look the same,
|
||||
/// because to the person reading the list they are the same thing.
|
||||
/// <para>
|
||||
/// Deleting a group leaves the machines under it alone <em>and</em> stops them naming it. It used to do
|
||||
/// only the first: the reference was left dangling and the list resolved it to nothing, which looked
|
||||
/// identical and cost no writes. The tick is what changed that — a deletion that can take the hosts with
|
||||
/// it has to be a deletion that knows which hosts it means, and once it knows, leaving them holding the
|
||||
/// id of something that has gone is a state kept for no reason.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The tick is deliberately not touched here, which is the point of the assertions: the default answer
|
||||
/// is the one that keeps the machines.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task DeletingAGroup_LeavesItsHostsUnderTheUngroupedHeading()
|
||||
public async Task DeletingAGroup_UnfilesItsHostsRatherThanLeavingThemNamingIt()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
@@ -3816,32 +3907,136 @@ public sealed class ShellFlowTests : IAsyncLifetime
|
||||
await AddGroupAsync(vault, "production");
|
||||
await FileAsync(vault, "prod-db", "production");
|
||||
|
||||
var groupId = vault.Groups.Single().EntityId;
|
||||
|
||||
vault.SelectedGroup = vault.Groups.Single();
|
||||
vault.DeleteGroupCommand.Execute(null);
|
||||
|
||||
vault.PendingDeletion.ShouldNotBeNull().Usage
|
||||
var question = vault.PendingDeletion.ShouldNotBeNull();
|
||||
|
||||
question.Usage
|
||||
.ShouldContain("1 host", Case.Sensitive, "the count is what makes the question worth reading");
|
||||
|
||||
question.HasChoice.ShouldBeTrue("a group with a host under it has a second question");
|
||||
vault.DeletionTakesTheHostsToo.ShouldBeFalse("the safe answer is the one nobody has to choose");
|
||||
|
||||
// The pass that follows every write on this screen reports what it moved and supersedes the
|
||||
// confirmation, for a deletion as much as for a save — so it is made to fail, and what the sentence
|
||||
// says is asserted in the state where somebody actually reads it.
|
||||
server.SyncFailure = new HttpRequestException("The server is having a bad day.");
|
||||
|
||||
await vault.ConfirmDeleteCommand.ExecuteAsync(null);
|
||||
|
||||
vault.Groups.ShouldBeEmpty();
|
||||
vault.HasGroups.ShouldBeFalse();
|
||||
|
||||
// The host keeps the id, which is what makes this cheap; the list is what resolves it to nothing.
|
||||
vault.Hosts.Single().Host.GroupId.ShouldBe(groupId);
|
||||
vault.Hosts.Single().Host.GroupId.ShouldBeNull(vault.Status);
|
||||
vault.Hosts.Single().GroupLabel.ShouldBeEmpty();
|
||||
vault.SidebarRows.ShouldAllBe(row => row is HostRowViewModel);
|
||||
|
||||
// The card says the same thing the phone's list does: nothing. An id nobody can name is drawn as no
|
||||
// group rather than as a GUID on a chip.
|
||||
vault.Hosts.Single().GroupLabel.ShouldBeEmpty();
|
||||
vault.Status.ShouldContain("UNGROUPED", Case.Sensitive);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The picker keeps a placeholder entry for a group the vault no longer has, exactly as the
|
||||
/// The other answer, and the reason the question is asked at all: a group is sometimes a heading being
|
||||
/// tidied away and sometimes a project that has been decommissioned, and nothing in the view model can
|
||||
/// tell which of the two it is looking at.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task DeletingAGroupWithTheTickSet_TakesItsHostsWithIt()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await AddHostAsync(vault, "prod-db");
|
||||
await AddHostAsync(vault, "prod-web");
|
||||
await AddGroupAsync(vault, "production");
|
||||
await FileAsync(vault, "prod-db", "production");
|
||||
|
||||
vault.SelectedGroup = vault.Groups.Single();
|
||||
vault.DeleteGroupCommand.Execute(null);
|
||||
|
||||
vault.PendingDeletion.ShouldNotBeNull().Choice.ShouldContain("host");
|
||||
vault.DeletionTakesTheHostsToo = true;
|
||||
|
||||
await vault.ConfirmDeleteCommand.ExecuteAsync(null);
|
||||
|
||||
vault.Groups.ShouldBeEmpty();
|
||||
|
||||
// Only the machine that was filed under it. A deletion aimed at a heading must not reach the hosts
|
||||
// that were never on it.
|
||||
vault.Hosts.Select(row => row.Label).ShouldBe(["prod-web"], vault.Status);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The answer is not carried from one question to the next. A tick left standing would delete the next
|
||||
/// group's machines on the strength of a decision about the last one's, and there is no undo on either
|
||||
/// side of that.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task AskingAboutASecondGroup_StartsFromKeepingItsHosts()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await AddHostAsync(vault, "prod-db");
|
||||
await AddGroupAsync(vault, "production");
|
||||
await AddGroupAsync(vault, "staging");
|
||||
await FileAsync(vault, "prod-db", "production");
|
||||
|
||||
vault.SelectedGroup = vault.Groups.Single(
|
||||
row => string.Equals(row.Label, "production", StringComparison.Ordinal));
|
||||
|
||||
vault.DeleteGroupCommand.Execute(null);
|
||||
vault.DeletionTakesTheHostsToo = true;
|
||||
vault.CancelDeleteCommand.Execute(null);
|
||||
|
||||
vault.SelectedGroup = vault.Groups.Single(
|
||||
row => string.Equals(row.Label, "staging", StringComparison.Ordinal));
|
||||
|
||||
vault.DeleteGroupCommand.Execute(null);
|
||||
|
||||
vault.DeletionTakesTheHostsToo.ShouldBeFalse("every question starts from keeping the machines");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// Unfiling rewrites every host under the heading, so it is refused with a host editor open for the
|
||||
/// reason a drop onto a group card is: rewriting the saved host under a half-typed edit of it would be a
|
||||
/// save nobody asked for, and one they could then not cancel. Deleting a single host is not refused,
|
||||
/// because that one writes nothing to a form anybody is looking at.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task DeletingAGroupWhileTheHostEditorIsOpen_IsRefused()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await AddHostAsync(vault, "prod-db");
|
||||
await AddGroupAsync(vault, "production");
|
||||
await FileAsync(vault, "prod-db", "production");
|
||||
|
||||
vault.SelectedHost = vault.Hosts.Single();
|
||||
vault.EditSelectedHostCommand.Execute(null);
|
||||
vault.EditorLabel = "half-typed";
|
||||
|
||||
vault.SelectedGroup = vault.Groups.Single();
|
||||
vault.DeleteGroupCommand.Execute(null);
|
||||
|
||||
vault.PendingDeletion.ShouldBeNull("the question was never put");
|
||||
vault.IsEditing.ShouldBeTrue("and the edit is still there to finish");
|
||||
vault.Status.ShouldContain("editing");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The picker keeps a placeholder entry for a group the vault does not have, exactly as the
|
||||
/// authentication picker does for a deleted key. Without it the picker would open on "No group" and
|
||||
/// somebody editing the host's port would unfile it by saving.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The dangling id is imported rather than produced by deleting the group, and that is a consequence of
|
||||
/// the change above rather than a contrivance: a group deleted <em>here</em> now unfiles its hosts on the
|
||||
/// way out, so the only way a host still names one is that the group went on another machine and this
|
||||
/// client has yet to be told — which is exactly what a host arriving with an id nothing resolves is.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task EditingAHostWhoseGroupIsGone_DoesNotUnfileItBySaving()
|
||||
@@ -3849,15 +4044,13 @@ public sealed class ShellFlowTests : IAsyncLifetime
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await AddHostAsync(vault, "prod-db");
|
||||
await AddGroupAsync(vault, "production");
|
||||
await FileAsync(vault, "prod-db", "production");
|
||||
var groupId = Guid.CreateVersion7();
|
||||
|
||||
var groupId = vault.Groups.Single().EntityId;
|
||||
await vault.ImportHostsAsync(
|
||||
[new HostSecret { Label = "prod-db", Hostname = "db.internal", GroupId = groupId }],
|
||||
Token);
|
||||
|
||||
vault.SelectedGroup = vault.Groups.Single();
|
||||
vault.DeleteGroupCommand.Execute(null);
|
||||
await vault.ConfirmDeleteCommand.ExecuteAsync(null);
|
||||
vault.Groups.ShouldBeEmpty("nothing in this keychain answers to that id");
|
||||
|
||||
vault.SelectedHost = vault.Hosts.Single();
|
||||
vault.EditSelectedHostCommand.Execute(null);
|
||||
@@ -4333,6 +4526,35 @@ public sealed class ShellFlowTests : IAsyncLifetime
|
||||
vault.GroupEditorLabel.ShouldBe("production", "the heading pressed, not the group selected");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The heading hands its group to the editor rather than selecting it first, and this is why. A group
|
||||
/// selection clears the host selection — the desktop's two grids share one mark — and the phone draws no
|
||||
/// group cards at all, so selecting one here would take the highlight off the machine in the list with
|
||||
/// nothing on screen to say where it had gone, or how to get it back.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task AGroupsHeading_LeavesTheChosenMachineChosen()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await AddHostAsync(vault, "prod-db");
|
||||
await AddGroupAsync(vault, "production");
|
||||
await FileAsync(vault, "prod-db", "production");
|
||||
|
||||
var host = vault.Hosts.Single();
|
||||
vault.SelectedHost = host;
|
||||
|
||||
var heading = vault.SidebarRows.OfType<SidebarGroupHeader>().Single(
|
||||
row => string.Equals(row.Label, "production", StringComparison.Ordinal));
|
||||
|
||||
vault.EditGroupFromHeadingCommand.Execute(heading);
|
||||
|
||||
vault.IsEditingGroup.ShouldBeTrue("the editor still opens on the group the heading names");
|
||||
vault.GroupEditorLabel.ShouldBe("production");
|
||||
vault.SelectedHost.ShouldBeSameAs(host, "and the list is still on the machine it was on");
|
||||
}
|
||||
|
||||
[Fact]
|
||||
public async Task TheUngroupedHeading_OpensNothing()
|
||||
{
|
||||
|
||||
@@ -532,6 +532,121 @@ public sealed class VaultSharingTests : IAsyncLifetime
|
||||
row.VaultId.ShouldBe(sharedVaultId);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Moving a host into a shared vault, which is the operation that used to require deleting it and
|
||||
/// typing it again: the two vaults are encrypted under different keys, so what happens underneath is a
|
||||
/// re-seal into one and a tombstone in the other. The host has to arrive intact, be gone from where it
|
||||
/// was, and carry a new id — one entity id in two vaults would make the destination's row and the
|
||||
/// source's tombstone the same row.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The group is asserted cleared, and that is the half worth a test rather than a comment. A group is
|
||||
/// an item of the vault the host is leaving, so a host that carried the reference across would resolve
|
||||
/// it on this machine — groups are resolved over every readable vault — and dangle for everybody else
|
||||
/// in the destination. The mover and their colleagues would be looking at two different hosts.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task MovingAHostToAnotherVault_ReSealsItThereAndLeavesItsGroupBehind()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vaults = shell.Vaults;
|
||||
|
||||
await CreateVaultAsync(vaults, "Platform secrets");
|
||||
|
||||
var vault = shell.Vault!;
|
||||
var sharedVaultId = vaults.SelectedVault!.VaultId;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
// In the personal vault, under a group of its own, which is what the move has to leave behind.
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
vault.GroupEditorLabel = "Production";
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
|
||||
vault.NewHostCommand.Execute(null);
|
||||
vault.EditorLabel = "prod-db";
|
||||
vault.EditorHostname = "db.internal";
|
||||
vault.EditorUsername = "deploy";
|
||||
vault.EditorSelectedGroup = vault.EditorGroupChoices.Single(
|
||||
choice => string.Equals(choice.Label, "Production", StringComparison.Ordinal));
|
||||
|
||||
await vault.SaveHostCommand.ExecuteAsync(null);
|
||||
|
||||
var before = vault.Hosts.Single(
|
||||
host => string.Equals(host.Label, "prod-db", StringComparison.Ordinal));
|
||||
|
||||
before.VaultId.ShouldNotBe(sharedVaultId);
|
||||
before.Host.GroupId.ShouldNotBeNull("the host was filed under a group before the move");
|
||||
|
||||
vault.SelectedHost = before;
|
||||
vault.CanMoveSelectedHost.ShouldBeTrue("there is a second vault this session can write to");
|
||||
|
||||
vault.MoveHostCommand.Execute(null);
|
||||
|
||||
vault.IsMovingHost.ShouldBeTrue(vault.Status);
|
||||
vault.MoveVaultChoices.ShouldNotContain(choice => choice.VaultId == before.VaultId);
|
||||
|
||||
vault.SelectedMoveVault =
|
||||
vault.MoveVaultChoices.Single(choice => choice.VaultId == sharedVaultId);
|
||||
|
||||
// The pass that follows every write on this screen is made to fail, so that the move's own sentence
|
||||
// is still on the status line to be read. That is not a contrivance to dodge a race: a successful
|
||||
// pass reports what it moved and supersedes the confirmation of every save, delete and move alike —
|
||||
// pre-existing behaviour of the whole screen — and the state asserted here is the one where the
|
||||
// sentence matters most, because nothing has reached the server yet.
|
||||
server.SyncFailure = new IOException("The server is not answering.");
|
||||
|
||||
await vault.ConfirmMoveHostCommand.ExecuteAsync(null);
|
||||
|
||||
var after = vault.Hosts.Single(
|
||||
host => string.Equals(host.Label, "prod-db", StringComparison.Ordinal));
|
||||
|
||||
after.VaultId.ShouldBe(sharedVaultId, vault.Status);
|
||||
after.EntityId.ShouldNotBe(before.EntityId, "an id belongs to one vault");
|
||||
after.Host.Hostname.ShouldBe("db.internal");
|
||||
after.Host.Username.ShouldBe("deploy");
|
||||
after.Host.GroupId.ShouldBeNull("a group belongs to the vault the host came from");
|
||||
|
||||
vault.SelectedHost?.EntityId.ShouldBe(after.EntityId, "the pane follows the host it moved");
|
||||
vault.Status.ShouldContain("Platform secrets");
|
||||
vault.Status.ShouldContain("group", Case.Insensitive);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The move is refused where it would have nowhere to go, by the command rather than by an empty
|
||||
/// picker — and the phone reads the same question to decide whether to draw the button at all.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task MovingAHostWithNowhereToMoveIt_SaysSoRatherThanOpeningAnEmptyPicker()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
vault.NewHostCommand.Execute(null);
|
||||
vault.EditorLabel = "prod-db";
|
||||
vault.EditorHostname = "db.internal";
|
||||
vault.EditorUsername = "deploy";
|
||||
|
||||
await vault.SaveHostCommand.ExecuteAsync(null);
|
||||
|
||||
vault.SelectedHost = vault.Hosts.Single(
|
||||
host => string.Equals(host.Label, "prod-db", StringComparison.Ordinal));
|
||||
|
||||
vault.CanMoveSelectedHost.ShouldBeFalse("the personal vault is the only one there is");
|
||||
|
||||
vault.MoveHostCommand.Execute(null);
|
||||
|
||||
vault.IsMovingHost.ShouldBeFalse();
|
||||
vault.MoveVaultChoices.ShouldBeEmpty();
|
||||
vault.Status.ShouldContain("only vault you can write to");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The picker the host editor grew, and the thing it is for: choosing at the moment a host is created,
|
||||
@@ -612,12 +727,364 @@ public sealed class VaultSharingTests : IAsyncLifetime
|
||||
vault.ShowsEditorVaultChoice.ShouldBeFalse("an item cannot be moved between vaults");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// A group is a shelf, and a shared vault is what makes it everybody's shelf. The assertions are the
|
||||
/// three things that were missing while the group list was the active vault's alone: it is listed at
|
||||
/// all, the row says which vault it is in, and a rename typed into it goes back to that vault rather
|
||||
/// than forking a second group of the new name into the personal one.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Reloaded between the write and the read, so what is asserted is what came back out of the vault
|
||||
/// rather than the row the save left behind.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task AGroupFiledIntoASharedVault_IsListedThereAndRenamedThere()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vaults = shell.Vaults;
|
||||
|
||||
await CreateVaultAsync(vaults, "Platform secrets");
|
||||
|
||||
var vault = shell.Vault!;
|
||||
var sharedVaultId = vaults.SelectedVault!.VaultId;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
|
||||
vault.ShowsGroupEditorVaultChoice.ShouldBeTrue("there are two vaults to choose between");
|
||||
|
||||
vault.GroupEditorSelectedVault =
|
||||
vault.GroupEditorVaultChoices.Single(choice => choice.VaultId == sharedVaultId);
|
||||
|
||||
vault.GroupEditorLabel = "production";
|
||||
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
var group = vault.Groups.ShouldHaveSingleItem();
|
||||
|
||||
group.VaultId.ShouldBe(sharedVaultId, vault.Status);
|
||||
group.VaultBadge.ShouldBe("PLATFORM SECRETS", "a card in a session holding two vaults says which");
|
||||
|
||||
vault.SelectedGroup = group;
|
||||
vault.EditGroupCommand.Execute(null);
|
||||
|
||||
vault.ShowsGroupEditorVaultChoice.ShouldBeFalse("an item cannot be moved between vaults");
|
||||
|
||||
vault.DrawerSubtitle.ShouldBe(
|
||||
"Platform secrets", "with no picker drawn, the header is what says whose shelf this is");
|
||||
|
||||
vault.GroupEditorLabel = "live";
|
||||
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
var renamed = vault.Groups.ShouldHaveSingleItem();
|
||||
|
||||
renamed.Label.ShouldBe("live");
|
||||
renamed.VaultId.ShouldBe(sharedVaultId, "a rename must not fork a copy into the personal vault");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The group editor's picker is the group's, exactly as the host editor's is the host's: moving it must
|
||||
/// not move the keychain screen's standing preference, and moving that one must not move a group
|
||||
/// half-typed here.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The second half is the one worth the test. The picker is read when the form opens and the vault is
|
||||
/// captured there, so a click on the other screen between typing the name and pressing ADD cannot
|
||||
/// redirect the group somebody was making.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task TheGroupEditorChoosesItsOwnVault_WithoutMovingTheKeychainScreensPicker()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vaults = shell.Vaults;
|
||||
|
||||
await CreateVaultAsync(vaults, "Platform secrets");
|
||||
|
||||
var vault = shell.Vault!;
|
||||
var sharedVaultId = vaults.SelectedVault!.VaultId;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
var personal = vault.SelectedTargetVault!;
|
||||
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
|
||||
vault.GroupEditorSelectedVault =
|
||||
vault.GroupEditorVaultChoices.Single(choice => choice.VaultId == sharedVaultId);
|
||||
|
||||
vault.GroupEditorLabel = "production";
|
||||
|
||||
// Moved back after the editor opened, the way a click on the keychain screen would. The group must
|
||||
// still land in the shared vault.
|
||||
vault.SelectedTargetVault = personal;
|
||||
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
|
||||
vault.Groups.ShouldHaveSingleItem().VaultId.ShouldBe(sharedVaultId, vault.Status);
|
||||
|
||||
vault.SelectedTargetVault.ShouldBe(
|
||||
personal, "the editor's picker is the group's, not the screen's standing preference");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// A parent belongs to one vault, and a group filed under one in another vault would be a level half
|
||||
/// the people holding the key cannot resolve — their hosts would inherit a port and a username from
|
||||
/// nothing. The same rule the host editor's group picker follows, one level up the same tree.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task AGroupsParentPicker_OffersOnlyTheVaultItIsGoingInto()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vaults = shell.Vaults;
|
||||
|
||||
await CreateVaultAsync(vaults, "Platform secrets");
|
||||
|
||||
var vault = shell.Vault!;
|
||||
var sharedVaultId = vaults.SelectedVault!.VaultId;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
// In the personal vault, which is where the standing preference points.
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
vault.GroupEditorLabel = "estate";
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
|
||||
vault.Groups.ShouldHaveSingleItem().Label.ShouldBe("estate", vault.Status);
|
||||
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
|
||||
vault.GroupEditorParentChoices
|
||||
.Any(choice => string.Equals(choice.Label, "estate", StringComparison.Ordinal))
|
||||
.ShouldBeTrue("a group in the personal vault may be filed under a personal group");
|
||||
|
||||
vault.GroupEditorSelectedVault =
|
||||
vault.GroupEditorVaultChoices.Single(choice => choice.VaultId == sharedVaultId);
|
||||
|
||||
vault.GroupEditorParentChoices.ShouldHaveSingleItem()
|
||||
.EntityId.ShouldBeNull("only 'no parent' is left once the group is going somewhere else");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Moving the shelf rather than what is on it, which is the operation people were attempting one host at
|
||||
/// a time: a group cannot go anywhere alone, because the machines filed under it and the groups nested
|
||||
/// inside it are items of the vault it is leaving. All of them are re-sealed under the destination's key
|
||||
/// and all of them take new ids, so what this asserts is not only that they arrived but that the tree
|
||||
/// arrived — the child is still under the parent, and the host is still under the child, through two
|
||||
/// levels of ids that were rewritten on the way across.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// The parent the moved group was nested under is asserted <em>gone</em>, and that is the honest half. A
|
||||
/// parent belongs to the vault it is in, so carrying the reference would leave everybody else in the
|
||||
/// destination looking at a group hanging from nothing. It arrives at the top level and the sentence
|
||||
/// says so.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task MovingAGroupToAnotherVault_TakesItsHostsAndItsNestedGroupsWithIt()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vaults = shell.Vaults;
|
||||
|
||||
await CreateVaultAsync(vaults, "Platform secrets");
|
||||
|
||||
var vault = shell.Vault!;
|
||||
var sharedVaultId = vaults.SelectedVault!.VaultId;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
await SeedNestedShelfAsync(vault);
|
||||
|
||||
var production = Named(vault, "production");
|
||||
|
||||
production.VaultId.ShouldNotBe(sharedVaultId, "this test is meaningless with both in one vault");
|
||||
production.Group.ParentId.ShouldNotBeNull("it was nested, which is what has to stay behind");
|
||||
|
||||
// As the card's menu does before it runs the command; see HostsScreen.OnGroupContextRequested.
|
||||
vault.SelectedGroup = production;
|
||||
|
||||
vault.MoveGroupCommand.Execute(null);
|
||||
|
||||
vault.IsMovingGroup.ShouldBeTrue(vault.Status);
|
||||
vault.MoveGroupVaultChoices.ShouldNotContain(choice => choice.VaultId == production.VaultId);
|
||||
|
||||
vault.SelectedMoveGroupVault =
|
||||
vault.MoveGroupVaultChoices.Single(choice => choice.VaultId == sharedVaultId);
|
||||
|
||||
// The pass that follows every write on this screen is made to fail, so that the move's own sentence
|
||||
// is still on the status line to be read — the same arrangement, and for the same reason, as the
|
||||
// host's move test above.
|
||||
server.SyncFailure = new IOException("The server is not answering.");
|
||||
|
||||
await vault.ConfirmMoveGroupCommand.ExecuteAsync(null);
|
||||
|
||||
var moved = Named(vault, "production");
|
||||
var nested = Named(vault, "web");
|
||||
|
||||
moved.VaultId.ShouldBe(sharedVaultId, vault.Status);
|
||||
moved.EntityId.ShouldNotBe(production.EntityId, "an id belongs to one vault");
|
||||
moved.Group.ParentId.ShouldBeNull("a parent belongs to the vault the group came from");
|
||||
|
||||
nested.VaultId.ShouldBe(sharedVaultId, "a group inside it cannot be left in the other vault");
|
||||
nested.Group.ParentId.ShouldBe(moved.EntityId, "and it is still nested under the group it was in");
|
||||
|
||||
var host = vault.Hosts.Single(row => string.Equals(row.Label, "prod-db", StringComparison.Ordinal));
|
||||
|
||||
host.VaultId.ShouldBe(sharedVaultId, "the hosts came with the shelf");
|
||||
host.Host.GroupId.ShouldBe(nested.EntityId, "and are still filed where they were");
|
||||
|
||||
// The group it was nested under is the one thing that stayed, and it stayed where it was.
|
||||
Named(vault, "estate").VaultId.ShouldBe(production.VaultId);
|
||||
|
||||
vault.SelectedGroup?.EntityId.ShouldBe(moved.EntityId, "the buttons follow the group they moved");
|
||||
vault.Status.ShouldContain("Platform secrets");
|
||||
vault.Status.ShouldContain("top level");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The move is refused where it would have nowhere to go, by the command rather than by an empty picker
|
||||
/// — the same answer <c>MoveHostCommand</c> gives one level down, and the only place the question is
|
||||
/// asked. The menu entry is drawn either way, because a menu whose items came and went would be a menu
|
||||
/// whose items move.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task MovingAGroupWithNowhereToMoveIt_SaysSoRatherThanOpeningAnEmptyPicker()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
vault.GroupEditorLabel = "production";
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
|
||||
vault.SelectedGroup = vault.Groups.ShouldHaveSingleItem();
|
||||
|
||||
vault.MoveGroupCommand.Execute(null);
|
||||
|
||||
vault.IsMovingGroup.ShouldBeFalse();
|
||||
vault.MoveGroupVaultChoices.ShouldBeEmpty();
|
||||
vault.Status.ShouldContain("only vault you can write to");
|
||||
}
|
||||
|
||||
/// <summary>The group card with a given name, re-found because every row is replaced on every reload.</summary>
|
||||
private static HostGroupRowViewModel Named(VaultViewModel vault, string label) =>
|
||||
vault.Groups.Single(row => string.Equals(row.Label, label, StringComparison.Ordinal));
|
||||
|
||||
/// <summary>
|
||||
/// Builds estate › production › web in the personal vault, with prod-db on the innermost shelf.
|
||||
/// </summary>
|
||||
/// <remarks>
|
||||
/// Three levels, because two would not tell a subtree that was walked from one that was assumed a single
|
||||
/// level deep — the middle group is the one that has to arrive with a rewritten parent and a rewritten
|
||||
/// child at once.
|
||||
/// </remarks>
|
||||
private static async Task SeedNestedShelfAsync(VaultViewModel vault)
|
||||
{
|
||||
await AddGroupAsync(vault, "estate", under: null);
|
||||
await AddGroupAsync(vault, "production", under: "estate");
|
||||
await AddGroupAsync(vault, "web", under: "production");
|
||||
|
||||
vault.NewHostCommand.Execute(null);
|
||||
vault.EditorLabel = "prod-db";
|
||||
vault.EditorHostname = "db.internal";
|
||||
vault.EditorSelectedGroup = vault.EditorGroupChoices.Single(
|
||||
choice => string.Equals(choice.Label, "web", StringComparison.Ordinal));
|
||||
|
||||
await vault.SaveHostCommand.ExecuteAsync(null);
|
||||
}
|
||||
|
||||
/// <summary>Adds a group, optionally nested under one already there.</summary>
|
||||
private static async Task AddGroupAsync(VaultViewModel vault, string label, string? under)
|
||||
{
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
vault.GroupEditorLabel = label;
|
||||
|
||||
if (under is not null)
|
||||
{
|
||||
vault.GroupEditorSelectedParent = vault.GroupEditorParentChoices.Single(
|
||||
choice => string.Equals(choice.Label, under, StringComparison.Ordinal));
|
||||
}
|
||||
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// Dragging a host card onto a group card is the one gesture that files a host without opening its
|
||||
/// editor, and it can now be aimed across a vault boundary, because both grids draw every readable
|
||||
/// vault. The write it would make is the exact thing the host editor's group picker was fixed to
|
||||
/// prevent: an id only the other vault's holders can resolve.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Refused and said so, rather than quietly treated as "no group" — the user is plainly filing
|
||||
/// something, and unfiling it instead would be the wrong answer delivered silently.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task AHostDraggedOntoAnotherVaultsGroup_IsRefusedRatherThanFiledUnderIt()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
var vaults = shell.Vaults;
|
||||
|
||||
await CreateVaultAsync(vaults, "Platform secrets");
|
||||
|
||||
var vault = shell.Vault!;
|
||||
var sharedVaultId = vaults.SelectedVault!.VaultId;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
|
||||
vault.GroupEditorSelectedVault =
|
||||
vault.GroupEditorVaultChoices.Single(choice => choice.VaultId == sharedVaultId);
|
||||
|
||||
vault.GroupEditorLabel = "production";
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
|
||||
// The host stays in the personal vault, which is where a new one goes without being told otherwise.
|
||||
vault.NewHostCommand.Execute(null);
|
||||
vault.EditorLabel = "prod-db";
|
||||
vault.EditorHostname = "db.internal";
|
||||
await vault.SaveHostCommand.ExecuteAsync(null);
|
||||
|
||||
var host = vault.Hosts.Single(row => string.Equals(row.Label, "prod-db", StringComparison.Ordinal));
|
||||
var group = vault.Groups.Single(row => row.VaultId == sharedVaultId);
|
||||
|
||||
host.VaultId.ShouldNotBe(sharedVaultId, "this test is meaningless with both in one vault");
|
||||
|
||||
await vault.MoveHostToGroupCommand.ExecuteAsync(new HostGroupMove(host, group.EntityId));
|
||||
|
||||
vault.Status.ShouldContain("its own vault");
|
||||
|
||||
vault.Hosts
|
||||
.Single(row => string.Equals(row.Label, "prod-db", StringComparison.Ordinal))
|
||||
.Host.GroupId
|
||||
.ShouldBeNull("the host is left where it was rather than filed under an unresolvable group");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The mirror image of the host test above, and it goes the other way on purpose. A host filed into a
|
||||
/// shared vault has to stay there, because hosts are read across every readable vault and so come back.
|
||||
/// Tags are not — the editable list is the active vault's alone, like groups and buckets — so a tag
|
||||
/// filed anywhere else would be created, pushed, reported as added and then invisible, with nothing on
|
||||
/// the keychain screen able to rename or delete it and no active-vault switcher to go and find it with.
|
||||
/// shared vault has to stay there, because hosts are read across every readable vault and so come back;
|
||||
/// so does a group, since its list spans them too. Tags are not — the editable list is the active
|
||||
/// vault's alone, like buckets — so a tag filed anywhere else would be created, pushed, reported as
|
||||
/// added and then invisible, with nothing on the keychain screen able to rename or delete it and no
|
||||
/// active-vault switcher to go and find it with.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task ATagIgnoresTheTargetPicker_BecauseItsListOnlyEverShowsOneVault()
|
||||
|
||||
@@ -451,8 +451,10 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
|
||||
/// <remarks>
|
||||
/// It is drawn in the menu and ticked, because a vault missing from a list of vaults reads as something
|
||||
/// having gone wrong — and it cannot be switched off, because snippets, logs, buckets and the editable
|
||||
/// group and tag lists are all read from it alone. Switching it off would empty half the application
|
||||
/// rather than filter it, so the refusal says why instead of doing nothing.
|
||||
/// tag list are all read from it alone. Switching it off would empty half the application rather than
|
||||
/// filter it, so the refusal says why instead of doing nothing. The group list is no longer among them:
|
||||
/// it spans every readable vault, and hiding one drops that vault's cards and headings the way it drops
|
||||
/// its hosts.
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task ThePersonalVaultIsListedAndCannotBeHidden()
|
||||
@@ -471,6 +473,67 @@ public sealed class VaultVisibilityTests : IAsyncLifetime
|
||||
shell.StatusMessage.ShouldContain("always shown");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// <para>
|
||||
/// The two halves of a group, and hiding a vault has to move exactly one of them. The cards and
|
||||
/// headings are a list a person reads, so a hidden vault's group leaves it — a folder that cannot be
|
||||
/// opened onto anything is worse than no folder. What a group also is is a port, a username and a
|
||||
/// binding lent to the hosts beneath it, and that must not move: those hosts are still in
|
||||
/// <c>Hosts</c>, which is what the connect path and the transfers screen read.
|
||||
/// </para>
|
||||
/// <para>
|
||||
/// Asserted through the resolved port rather than through the map directly, because the resolved port
|
||||
/// is what a connection actually dials. A hidden vault whose hosts silently fell back to 22 would be
|
||||
/// this split having collapsed, and nothing on screen would say so.
|
||||
/// </para>
|
||||
/// </remarks>
|
||||
[Fact]
|
||||
public async Task HidingAVault_TakesItsGroupCardsButNotWhatItsHostsDial()
|
||||
{
|
||||
await UnlockedAsync();
|
||||
|
||||
await shell.Vaults.LoadAsync(Token);
|
||||
|
||||
var teamVaultId = await CreateVaultAsync("Platform secrets");
|
||||
var vault = shell.Vault!;
|
||||
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
vault.NewGroupCommand.Execute(null);
|
||||
|
||||
vault.GroupEditorSelectedVault =
|
||||
vault.GroupEditorVaultChoices.Single(choice => choice.VaultId == teamVaultId);
|
||||
|
||||
vault.GroupEditorLabel = "production";
|
||||
vault.GroupEditorDefaultPort = 2222;
|
||||
|
||||
await vault.SaveGroupCommand.ExecuteAsync(null);
|
||||
|
||||
await AddHostAsync(vault, teamVaultId, "prod-db", "db.internal");
|
||||
|
||||
vault.SelectedHost = vault.Hosts.Single(
|
||||
row => string.Equals(row.Label, "prod-db", StringComparison.Ordinal));
|
||||
|
||||
vault.EditSelectedHostCommand.Execute(null);
|
||||
|
||||
vault.EditorSelectedGroup = vault.EditorGroupChoices.Single(
|
||||
choice => string.Equals(choice.Label, "production", StringComparison.Ordinal));
|
||||
|
||||
await vault.SaveHostCommand.ExecuteAsync(null);
|
||||
|
||||
vault.Groups.ShouldHaveSingleItem().VaultId.ShouldBe(teamVaultId, vault.Status);
|
||||
|
||||
await HideAsync(teamVaultId);
|
||||
await vault.LoadAsync(Token);
|
||||
|
||||
vault.Groups.ShouldBeEmpty("a hidden vault's groups are cards onto hosts that are not drawn");
|
||||
|
||||
vault.Hosts
|
||||
.Single(row => string.Equals(row.Label, "prod-db", StringComparison.Ordinal))
|
||||
.Resolved.Port.Value
|
||||
.ShouldBe(2222, "hiding a vault must never change what one of its hosts dials");
|
||||
}
|
||||
|
||||
/// <remarks>
|
||||
/// The switches are the readable vaults, personal first. A vault whose grant awaits re-wrap has nothing
|
||||
/// that would decrypt, so a switch for it would do nothing at all.
|
||||
|
||||
Reference in New Issue
Block a user