Complete autonomous recovery controls

internal/registry/registry_test.go

@@ -34,3 +34,13 @@ func TestNewRejectsBrokenReferences(t *testing.T) {
 		t.Fatalf("err=%v", err)
 	}
 }
+
+func TestProjectSafeOperationsAreNarrowAndAudited(t *testing.T) {
+	_, err := New(Config{Projects: []Project{{ID: "p", MachineAffinity: []string{"m"}, SafeOperations: []string{"read", "network"}}}, Machines: []Machine{{ID: "m", Address: "m:1"}}})
+	if err == nil {
+		t.Fatal("network operation was accepted into no-grant policy")
+	}
+	if _, err := New(Config{Projects: []Project{{ID: "p", MachineAffinity: []string{"m"}, SafeOperations: []string{"read", "edit", "test", "git"}}}, Machines: []Machine{{ID: "m", Address: "m:1"}}}); err != nil {
+		t.Fatalf("safe policy rejected: %v", err)
+	}
+}