w4c-workflows-api/w4c-workflows-api.Tests/NodeCredentialValidationTests.cs
2026-09-12 01:02:46 +03:00

77 lines
2.3 KiB
C#

using w4c_workflows.Services.Nodes;
using Xunit;
namespace w4c_workflows.Tests;
/// <summary>
/// Compile-time credential checks: a step may only reference aliases its
/// blueprint declares, and one alias cannot be bound to two different
/// credentials in the same workflow (so the run can resolve them once).
/// </summary>
public class NodeCredentialValidationTests
{
private static NodeGraphCompileResult Compile(string yaml)
=> new NodeGraphCompiler(NodeTestData.CoreCatalog()).Compile(NodeTestData.Parse(yaml));
[Fact]
public void Records_the_alias_to_reference_map()
{
var yaml = """
name: cred-demo
tasks:
- id: fetch
node: { type: core.httpRequest }
parameters: { url: "https://api.example.com" }
credentials:
httpAuth: my-api
""";
var result = Compile(yaml);
Assert.True(result.Success, string.Join("\n", result.Errors));
Assert.Equal("my-api", result.Graph!.Find("fetch")!.CredentialRefs["httpAuth"]);
}
[Fact]
public void Rejects_an_alias_the_blueprint_does_not_declare()
{
var yaml = """
name: cred-unknown
tasks:
- id: fetch
node: { type: core.httpRequest }
parameters: { url: "https://api.example.com" }
credentials:
nope: my-api
""";
var result = Compile(yaml);
Assert.False(result.Success);
Assert.Contains(result.Errors, e => e.Contains("has no credential alias 'nope'"));
}
[Fact]
public void Rejects_one_alias_bound_to_two_different_credentials()
{
var yaml = """
name: cred-conflict
tasks:
- id: a
node: { type: core.httpRequest }
parameters: { url: "https://a.example.com" }
credentials: { httpAuth: cred-one }
next: b
- id: b
node: { type: core.httpRequest }
parameters: { url: "https://b.example.com" }
credentials: { httpAuth: cred-two }
""";
var result = Compile(yaml);
Assert.False(result.Success);
Assert.Contains(result.Errors, e => e.Contains("bound to two different credentials"));
}
}