go.step.sm/linkedca v0.20.1: NewContextWithAdmin, AdminFromContext, MustAdminFromContext

Clean-room public code sample — generation instructions

Write a brand-new, minimal, self-contained code sample in this clean-room directory.
Do not copy, paraphrase, or reference any existing project source. Work only from this spec.

A csx.json manifest scaffold already exists. Do not recreate it from memory. Preserve its case.goal, packages and symbols; fill its empty case.contract with exact assertions and correct its environment, commands and verifierAdapter for the files you generate.

Goal: verify pkg:golang/go.step.sm/linkedca@v0.20.1
Kind: HOW

Use EXACTLY these public packages and versions:
  - pkg:golang/go.step.sm/linkedca@v0.20.1
Constraints:
  - executionContext: node
Required runtime conditions:
  - ecosystem: npm
  - language: javascript
  - moduleSystem: cjs
  - packageManager: npm@10.9.8
  - runtime: node@22.23.2

Rules:
  - One focused purpose; the smallest project that proves the goal.
  - Include a contract test (test/contract.*) that runs OFFLINE and exits 0 exactly when the goal behavior works.
  - Pin every dependency with a lockfile so resolution is reproducible.
  - No secrets, credentials, or tokens. No real URLs (only example.com or localhost). No absolute paths.
  - No personal names, emails, company names, or project identifiers of any kind.
  - No binaries and no generated output (node_modules, dist, target, venv, .git, .env).
  - Keep it under 200 files and 256KB packed.

package sample_test

import (
	"context"
	"reflect"
	"testing"

	"go.step.sm/linkedca"
)

func TestContextAdmin(t *testing.T) {
	ctx := context.Background()

	// 1. Initially empty context
	if admin, ok := linkedca.AdminFromContext(ctx); ok || admin != nil {
		t.Fatalf("expected no admin in empty context, got %+v", admin)
	}

	// 2. Set Admin in context
	expectedAdmin := &linkedca.Admin{
		Id:          "admin-123",
		AuthorityId: "auth-456",
		Subject:     "admin@example.com",
		Type:        linkedca.Admin_SUPER_ADMIN,
	}
	ctxWithAdmin := linkedca.NewContextWithAdmin(ctx, expectedAdmin)

	gotAdmin, ok := linkedca.AdminFromContext(ctxWithAdmin)
	if !ok || gotAdmin == nil {
		t.Fatalf("AdminFromContext returned ok=%v, admin=%+v", ok, gotAdmin)
	}
	if gotAdmin.Id != expectedAdmin.Id || gotAdmin.Subject != expectedAdmin.Subject || gotAdmin.Type != expectedAdmin.Type {
		t.Fatalf("AdminFromContext mismatch: got %+v, want %+v", gotAdmin, expectedAdmin)
	}

	// 3. MustAdminFromContext
	mustAdmin := linkedca.MustAdminFromContext(ctxWithAdmin)
	if mustAdmin != expectedAdmin {
		t.Fatalf("MustAdminFromContext returned %+v, want %+v", mustAdmin, expectedAdmin)
	}

	// 4. MustAdminFromContext panics on nil
	defer func() {
		if r := recover(); r == nil {
			t.Fatal("expected MustAdminFromContext to panic on context without Admin")
		}
	}()
	_ = linkedca.MustAdminFromContext(ctx)
}

func TestContextProvisioner(t *testing.T) {
	ctx := context.Background()

	// 1. Initially empty context
	if prov, ok := linkedca.ProvisionerFromContext(ctx); ok || prov != nil {
		t.Fatalf("expected no provisioner in empty context, got %+v", prov)
	}

	// 2. Set Provisioner in context
	expectedProv := &linkedca.Provisioner{
		Id:          "prov-789",
		AuthorityId: "auth-456",
		Name:        "acme-provisioner",
		Type:        linkedca.Provisioner_ACME,
	}
	ctxWithProv := linkedca.NewContextWithProvisioner(ctx, expectedProv)

	gotProv, ok := linkedca.ProvisionerFromContext(ctxWithProv)
	if !ok || gotProv == nil {
		t.Fatalf("ProvisionerFromContext returned ok=%v, prov=%+v", ok, gotProv)
	}
	if gotProv.Id != expectedProv.Id || gotProv.Name != expectedProv.Name || gotProv.Type != expectedProv.Type {
		t.Fatalf("ProvisionerFromContext mismatch: got %+v, want %+v", gotProv, expectedProv)
	}

	// 3. MustProvisionerFromContext
	mustProv := linkedca.MustProvisionerFromContext(ctxWithProv)
	if mustProv != expectedProv {
		t.Fatalf("MustProvisionerFromContext returned %+v, want %+v", mustProv, expectedProv)
	}

	// 4. MustProvisionerFromContext panics on nil
	defer func() {
		if r := recover(); r == nil {
			t.Fatal("expected MustProvisionerFromContext to panic on context without Provisioner")
		}
	}()
	_ = linkedca.MustProvisionerFromContext(ctx)
}

func TestContextExternalAccountKey(t *testing.T) {
	ctx := context.Background()

	// 1. Initially empty context
	if key, ok := linkedca.ExternalAccountKeyFromContext(ctx); ok || key != nil {
		t.Fatalf("expected no EABKey in empty context, got %+v", key)
	}

	// 2. Set EABKey in context
	expectedKey := &linkedca.EABKey{
		Id:          "key-001",
		Provisioner: "acme-provisioner",
		Reference:   "ref-001",
		Account:     "acct-xyz",
		HmacKey:     []byte("test-secret-key"),
	}
	ctxWithKey := linkedca.NewContextWithExternalAccountKey(ctx, expectedKey)

	gotKey, ok := linkedca.ExternalAccountKeyFromContext(ctxWithKey)
	if !ok || gotKey == nil {
		t.Fatalf("ExternalAccountKeyFromContext returned ok=%v, key=%+v", ok, gotKey)
	}
	if gotKey.Id != expectedKey.Id || gotKey.Provisioner != expectedKey.Provisioner || gotKey.Account != expectedKey.Account {
		t.Fatalf("ExternalAccountKeyFromContext mismatch: got %+v, want %+v", gotKey, expectedKey)
	}

	// 3. MustExternalAccountKeyFromContext
	mustKey := linkedca.MustExternalAccountKeyFromContext(ctxWithKey)
	if mustKey != expectedKey {
		t.Fatalf("MustExternalAccountKeyFromContext returned %+v, want %+v", mustKey, expectedKey)
	}

	// 4. MustExternalAccountKeyFromContext panics on nil
	defer func() {
		if r := recover(); r == nil {
			t.Fatal("expected MustExternalAccountKeyFromContext to panic on context without EABKey")
		}
	}()
	_ = linkedca.MustExternalAccountKeyFromContext(ctx)
}

func TestPolicyDeduplicate(t *testing.T) {
	// 1. Nil policy handles safely without panic
	var nilPolicy *linkedca.Policy
	nilPolicy.Deduplicate()

	// 2. X509 and SSH policy deduplication
	policy := &linkedca.Policy{
		X509: &linkedca.X509Policy{
			Allow: &linkedca.X509Names{
				Dns:         []string{"example.com", "foo.example.com", "example.com", "bar.example.com"},
				Ips:         []string{"192.0.2.1", "192.0.2.2", "192.0.2.1"},
				Emails:      []string{"user@example.com", "admin@example.com", "user@example.com"},
				Uris:        []string{"urn:uuid:1", "urn:uuid:2", "urn:uuid:1"},
				CommonNames: []string{"test-cn", "test-cn", "other-cn"},
			},
			Deny: &linkedca.X509Names{
				Dns:         []string{"blocked.com", "blocked.com"},
				Ips:         []string{"10.0.0.1", "10.0.0.1"},
				Emails:      []string{"bad@example.com", "bad@example.com"},
				Uris:        []string{"urn:blocked", "urn:blocked"},
				CommonNames: []string{"bad-cn", "bad-cn"},
			},
		},
		Ssh: &linkedca.SSHPolicy{
			Host: &linkedca.SSHHostPolicy{
				Allow: &linkedca.SSHHostNames{
					Dns:        []string{"host1.example.com", "host2.example.com", "host1.example.com"},
					Ips:        []string{"10.1.1.1", "10.1.1.1"},
					Principals: []string{"host-p1", "host-p1"},
				},
				Deny: &linkedca.SSHHostNames{
					Dns:        []string{"deny-host", "deny-host"},
					Ips:        []string{"10.2.2.2", "10.2.2.2"},
					Principals: []string{"deny-p1", "deny-p1"},
				},
			},
			User: &linkedca.SSHUserPolicy{
				Allow: &linkedca.SSHUserNames{
					Emails:     []string{"alice@example.com", "bob@example.com", "alice@example.com"},
					Principals: []string{"root", "root", "ubuntu"},
				},
				Deny: &linkedca.SSHUserNames{
					Emails:     []string{"eve@example.com", "eve@example.com"},
					Principals: []string{"guest", "guest"},
				},
			},
		},
	}

	policy.Deduplicate()

	// Verify X509 Allow deduplication
	if expected := []string{"example.com", "foo.example.com", "bar.example.com"}; !reflect.DeepEqual(policy.X509.Allow.Dns, expected) {
		t.Fatalf("X509 Allow DNS deduplication failed: got %v, want %v", policy.X509.Allow.Dns, expected)
	}
	if expected := []string{"192.0.2.1", "192.0.2.2"}; !reflect.DeepEqual(policy.X509.Allow.Ips, expected) {
		t.Fatalf("X509 Allow IPs deduplication failed: got %v, want %v", policy.X509.Allow.Ips, expected)
	}
	if expected := []string{"user@example.com", "admin@example.com"}; !reflect.DeepEqual(policy.X509.Allow.Emails, expected) {
		t.Fatalf("X509 Allow Emails deduplication failed: got %v, want %v", policy.X509.Allow.Emails, expected)
	}
	if expected := []string{"urn:uuid:1", "urn:uuid:2"}; !reflect.DeepEqual(policy.X509.Allow.Uris, expected) {
		t.Fatalf("X509 Allow URIs deduplication failed: got %v, want %v", policy.X509.Allow.Uris, expected)
	}
	if expected := []string{"test-cn", "other-cn"}; !reflect.DeepEqual(policy.X509.Allow.CommonNames, expected) {
		t.Fatalf("X509 Allow CommonNames deduplication failed: got %v, want %v", policy.X509.Allow.CommonNames, expected)
	}

	// Verify SSH Host Allow deduplication
	if expected := []string{"host1.example.com", "host2.example.com"}; !reflect.DeepEqual(policy.Ssh.Host.Allow.Dns, expected) {
		t.Fatalf("SSH Host Allow DNS deduplication failed: got %v, want %v", policy.Ssh.Host.Allow.Dns, expected)
	}
	// Verify SSH User Allow deduplication
	if expected := []string{"alice@example.com", "bob@example.com"}; !reflect.DeepEqual(policy.Ssh.User.Allow.Emails, expected) {
		t.Fatalf("SSH User Allow Emails deduplication failed: got %v, want %v", policy.Ssh.User.Allow.Emails, expected)
	}
	if expected := []string{"root", "ubuntu"}; !reflect.DeepEqual(policy.Ssh.User.Allow.Principals, expected) {
		t.Fatalf("SSH User Allow Principals deduplication failed: got %v, want %v", policy.Ssh.User.Allow.Principals, expected)
	}
}

{"case":{"caseId":"case:sha256:f60fbffe01c6fb14093655f289875cdcad79bcb08bb4a14cd0d89dda983bbfd5","contract":["NewContextWithAdmin attaches an Admin to context and AdminFromContext or MustAdminFromContext retrieves it","NewContextWithProvisioner attaches a Provisioner to context and ProvisionerFromContext or MustProvisionerFromContext retrieves it","NewContextWithExternalAccountKey attaches an EABKey to context and ExternalAccountKeyFromContext or MustExternalAccountKeyFromContext retrieves it","Policy.Deduplicate removes duplicate DNS, IP, email, URI, common name, and principal entries while preserving order"],"goal":"verify pkg:golang/go.step.sm/linkedca@v0.20.1","kind":"HOW","packages":["pkg:golang/go.step.sm/linkedca@v0.20.1"],"schemaVersion":1,"symbols":["go.step.sm/linkedca.NewContextWithAdmin","go.step.sm/linkedca.AdminFromContext","go.step.sm/linkedca.MustAdminFromContext","go.step.sm/linkedca.NewContextWithProvisioner","go.step.sm/linkedca.ProvisionerFromContext","go.step.sm/linkedca.MustProvisionerFromContext","go.step.sm/linkedca.NewContextWithExternalAccountKey","go.step.sm/linkedca.ExternalAccountKeyFromContext","go.step.sm/linkedca.MustExternalAccountKeyFromContext","go.step.sm/linkedca.Policy.Deduplicate"]},"contractCommand":["go","test","-v","./..."],"environment":{"arch":"x64","distro":"ubuntu","ecosystem":"golang","language":"go","libc":"glibc","libcVersion":"2.39","os":"linux","osVersionBucket":"24","packageManager":"go","packageManagerVersion":"1.26.6","runtime":"go","runtimeVersion":"1.26.6","schemaVersion":1},"license":"MIT-0","packages":["pkg:golang/go.step.sm/linkedca@v0.20.1"],"schemaVersion":1,"subject":"pkg:golang/go.step.sm/linkedca@v0.20.1","symbols":["go.step.sm/linkedca.NewContextWithAdmin","go.step.sm/linkedca.AdminFromContext","go.step.sm/linkedca.MustAdminFromContext","go.step.sm/linkedca.NewContextWithProvisioner","go.step.sm/linkedca.ProvisionerFromContext","go.step.sm/linkedca.MustProvisionerFromContext","go.step.sm/linkedca.NewContextWithExternalAccountKey","go.step.sm/linkedca.ExternalAccountKeyFromContext","go.step.sm/linkedca.MustExternalAccountKeyFromContext","go.step.sm/linkedca.Policy.Deduplicate"],"verifierAdapter":"golang@1"}

module sample

go 1.22

require go.step.sm/linkedca v0.20.1

require (
	github.com/golang/protobuf v1.5.3 // indirect
	golang.org/x/net v0.12.0 // indirect
	golang.org/x/sys v0.10.0 // indirect
	golang.org/x/text v0.11.0 // indirect
	google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
	google.golang.org/grpc v1.58.1 // indirect
	google.golang.org/protobuf v1.31.0 // indirect
)

github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
github.com/golang/protobuf v1.5.3 h1:KhyjKVUg7Usr/dYsdSqoFveMYd5ko72D+zANwlG1mmg=
github.com/golang/protobuf v1.5.3/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk=
github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
go.step.sm/linkedca v0.20.1 h1:bHDn1+UG1NgRrERkWbbCiAIvv4lD5NOFaswPDTyO5vU=
go.step.sm/linkedca v0.20.1/go.mod h1:Vaq4+Umtjh7DLFI1KuIxeo598vfBzgSYZUjgVJ7Syxw=
golang.org/x/net v0.12.0 h1:cfawfvKITfUsFCeJIHJrbSxpeu/E81khclypR0GVT50=
golang.org/x/net v0.12.0/go.mod h1:zEVYFnQC7m/vmpQFELhcD1EWkZlX69l4oqgmer6hfKA=
golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4=
golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 h1:bVf09lpb+OJbByTj913DRJioFFAjf/ZGxEz7MajTp2U=
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98/go.mod h1:TUfxEVdsvPg18p6AslUXFoLdpED4oBnGwyqk3dV1XzM=
google.golang.org/grpc v1.58.1 h1:OL+Vz23DTtrrldqHK49FUOPHyY75rvFqJfXC84NYW58=
google.golang.org/grpc v1.58.1/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
google.golang.org/protobuf v1.31.0 h1:g0LDEJHgrBl9N9r17Ru3sqWhkIx2NB67okBHPwC7hs8=
google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

{
  "schemaVersion": 1,
  "goal": "verify pkg:golang/go.step.sm/linkedca@v0.20.1",
  "kind": "HOW",
  "packages": [
    "pkg:golang/go.step.sm/linkedca@v0.20.1"
  ],
  "constraints": {
    "executionContext": "node"
  },
  "runtimeConditions": {
    "ecosystem": "npm",
    "language": "javascript",
    "moduleSystem": "cjs",
    "packageManager": "npm@10.9.8",
    "runtime": "node@22.23.2"
  }
}