sshkeys: Tests restricted command branch sawing

Signed-off-by: Ian Jackson <ijackson@chiark.greenend.org.uk>

diff --git a/apitest/at-otter.rs b/apitest/at-otter.rs
index 6d826e85c8f57abde2efb93477b446baf6edfd0f..a4f68041dd59f0186a8ae28fc19c1e2c67880dae 100644 (file)
--- a/apitest/at-otter.rs
+++ b/apitest/at-otter.rs
@@ -266,6 +266,13 @@ impl Ctx {
     self.otter(&mk_restricted("ssh:other:", "list-accounts")?)
       .expect_err("unath");
     self.otter(&mk_restricted("ssh:test:", "list-accounts")?)?;
+
+    self.otter(&mk_restricted(
+      "ssh:test:", "set-ssh-keys /dev/null")?).expect_err("saw own branch");
+    self.otter(&mk_restricted(
+      "ssh:test:", "set-ssh-keys --allow-remove-current /dev/null")?)?;
+    self.otter(&mk_restricted("ssh:test:sub", "list-accounts")?)
+      .expect_err("sawn off");
   }
 }