Repository: hashicorp/nomad
File: acl/policy_test.go (Go)

Code before:
			name:              "policy invalid",
			inputPluginPolicy: &PluginPolicy{Policy: "invalid"},
			expectedOutput:    false,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			actualOutput := tc.inputPluginPolicy.isValid()
			must.Eq(t, tc.expectedOutput, actualOutput)
		})
	}
}

// TestPolicy_isCapabilityValid reads through the source to get all our
// fine-grained capability constants and makes sure they're all marked as
// valid. This prevents us from adding a new capability without marking it as
// valid
func TestPolicy_isCapabilityValid(t *testing.T) {
	filename := "policy.go"
	src, err := os.ReadFile(filename)
	must.NoError(t, err)

	// namespace
	caps := []string{}
	re := regexp.MustCompile(`(?m)^(?:\tNamespaceCapability[A-Za-z]+\s+= ")(.*)"$`)
	subs := re.FindAllSubmatch(src, -1)
	for _, sub := range subs {
		if len(sub) > 1 {
			caps = append(caps, string(sub[1]))
		}
	}
	must.Greater(t, 0, len(caps)) // prevents us from breaking the regex later
	for _, cap := range caps {
		cap = strings.TrimSpace(cap)
		test.True(t, isNamespaceCapabilityValid(cap))
	}

	// variables
	caps = []string{}
	re = regexp.MustCompile(`(?m)^(?:\tVariablesCapability[A-Za-z]+\s+= ")(.*)"$`)
	subs = re.FindAllSubmatch(src, -1)
	for _, sub := range subs {
		if len(sub) > 1 {
			caps = append(caps, string(sub[1]))
		}
	}
	must.Greater(t, 0, len(caps))
	for _, cap := range caps {
		cap = strings.TrimSpace(cap)
		test.True(t, isPathCapabilityValid(cap))

Review comment (suggestion):
We're confident this regex will hold? I don't imagine we'd add any numbers `[0-9]`, for example, but if we did, then they'd slip through the cracks here.

I might prefer a greedier regex that's more prone to false errors than missing things, but this is an imaginary problem.

Code after:
			name:              "policy invalid",
			inputPluginPolicy: &PluginPolicy{Policy: "invalid"},
			expectedOutput:    false,
		},
	}

	for _, tc := range testCases {
		t.Run(tc.name, func(t *testing.T) {
			actualOutput := tc.inputPluginPolicy.isValid()
			must.Eq(t, tc.expectedOutput, actualOutput)
		})
	}
}

// TestPolicy_isCapabilityValid reads through the source to get all our
// fine-grained capability constants and makes sure they're all marked as
// valid. This prevents us from adding a new capability without marking it as
// valid
func TestPolicy_isCapabilityValid(t *testing.T) {
	filename := "policy.go"
	src, err := os.ReadFile(filename)
	must.NoError(t, err)

	// namespace
	caps := []string{}
	re := regexp.MustCompile(`(?m)^(?:\tNamespaceCapability[A-Za-z0-9]+\s+= ")(.*)"$`)
	subs := re.FindAllSubmatch(src, -1)
	for _, sub := range subs {
		if len(sub) > 1 {
			caps = append(caps, string(sub[1]))
		}
	}
	must.Greater(t, 0, len(caps), must.Sprint("no constants match NamespaceCapability regex"))
	for _, cap := range caps {
		cap = strings.TrimSpace(cap)
		test.True(t, isNamespaceCapabilityValid(cap), test.Sprintf("%q not valid", cap))
	}

	// variables
	caps = []string{}
	re = regexp.MustCompile(`(?m)^(?:\tVariablesCapability[A-Za-z0-9]+\s+= ")(.*)"$`)
	subs = re.FindAllSubmatch(src, -1)
	for _, sub := range subs {
		if len(sub) > 1 {
			caps = append(caps, string(sub[1]))
		}
	}
	must.Greater(t, 0, len(caps), must.Sprint("no constants match VariablesCapability regex"))
	for _, cap := range caps {
		cap = strings.TrimSpace(cap)
		test.True(t, isPathCapabilityValid(cap), test.Sprintf("%q not valid", cap))