Prove the client fills gitea's origins and keycloak's hostname from route-proxy's entry for a controller-shaped plan entry (issue 923)

modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go

@@ -0,0 +1,138 @@
+package main
+
+import (
+	"context"
+	"os"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/provider"
+	"github.com/nats-io/nats.go/jetstream"
+)
+
+// Issue 923: route-proxy serves a consumer of its route the names the controller composed, and the consumer's client
+// fills gitea's origins and keycloak's hostname.env from them. The route-proxy provider is run here as its module
+// runs it (the SDK helper, `route` offered with no credential and nothing served), over a plan entry shaped as the
+// controller writes it (mesh-controller handed.go PlanProvision: `at`, `from`, `as` and `names`), and the entry it
+// writes is the one the client reads.
+
+// memBus is the provider helper's bus over in-memory buckets.
+type memBus struct {
+	mu      sync.Mutex
+	buckets map[string]map[string][]byte
+}
+
+func (m *memBus) Watch(_ context.Context, bucket string, handle func(string, []byte)) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	for k, v := range m.buckets[bucket] {
+		handle(k, v)
+	}
+	return nil
+}
+
+func (m *memBus) Put(_ context.Context, bucket, key string, value []byte) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	if m.buckets[bucket] == nil {
+		m.buckets[bucket] = map[string][]byte{}
+	}
+	m.buckets[bucket][key] = append([]byte(nil), value...)
+	return nil
+}
+
+func (m *memBus) Delete(_ context.Context, bucket, key string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	delete(m.buckets[bucket], key)
+	return nil
+}
+
+// routeEntryFor is the entry route-proxy's helper writes for module's plan entry on the route provision.
+func routeEntryFor(t *testing.T, module, planEntry string) string {
+	t.Helper()
+	bus := &memBus{buckets: map[string]map[string][]byte{provider.AssignmentsBucket: {
+		node + "." + module: []byte(`{"node":"` + node + `","module":"` + module + `","provisioning":{"provisions":[` +
+			planEntry + `]}}`)}}}
+	p := provider.New(provider.Options{Node: "novox", Module: "route-proxy", Bus: bus, Logf: t.Logf,
+		Offers: map[string]provider.Offer{"route": {Credential: provider.NoCredential, Serves: map[string]any{}}}})
+	out, err := p.Pass(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(out) != 1 || out[0].Status != provider.Answered {
+		t.Fatalf("the provider did %+v", out)
+	}
+	return string(bus.buckets[provider.BucketOf("route-proxy")][node+"."+module+".route"])
+}
+
+func routeRun(t *testing.T, module, id, path, templatePath, entryKey, firstEntry string) (*engine, *aBus, *reports) {
+	t.Helper()
+	raw, err := os.ReadFile(templatePath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	b := startBus(t)
+	registryOf679(t, b)
+	startVault(t, b)
+	heard := b.listen(t)
+	e := startEngine(t, map[string]string{path: "owned"})
+	tpl, _ := templates(t, map[string]string{id: string(raw)})
+	b.assign(t, module, Plan{Templates: tpl, Files: []PlannedFile{{ID: id, Path: path, Template: id,
+		OwnerAtRuntime: "owned"}},
+		Provisions: []PlannedProvision{{Provision: "route", Provider: "novox", ProviderModule: "route-proxy"}}})
+	kv, err := b.domain.CreateKeyValue(context.Background(), jetstream.KeyValueConfig{Bucket: "route-proxy_bound"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	b.kv["route-proxy_bound"] = kv
+	if firstEntry != "" {
+		b.put(t, "route-proxy_bound", node+"."+entryKey, firstEntry)
+	}
+	aClient(t, b, e, t.TempDir(), time.Hour)
+	return e, b, heard
+}
+
+// gitea's plan entry for its `web` route, as the controller writes it for a node whose public domain is example.org.
+const giteaRoutePlanEntry = `{"provision":"route","provider":"novox","provider-module":"route-proxy",` +
+	`"at":"novox.internal","from":"novox","as":"mesh_g14_gitea",` +
+	`"names":{"name-web":"git.example.org","internal-name-web":"git.novox.internal",` +
+	`"name-internal-api-refused":"git.example.org","internal-name-internal-api-refused":"git.novox.internal"}}`
+
+const keycloakRoutePlanEntry = `{"provision":"route","provider":"novox","provider-module":"route-proxy",` +
+	`"at":"novox.internal","from":"novox","as":"mesh_g14_keycloak",` +
+	`"names":{"name":"keycloak.example.org","internal-name":"keycloak.novox.internal"}}`
+
+func TestNatsGiteasOriginsAreFilledFromRouteProxysEntryForThePlanEntryTheControllerWrites(t *testing.T) {
+	e, _, _ := routeRun(t, "gitea", "origins", "/etc/gitea/origins", "../../../gitea/files/origins", "gitea.route",
+		routeEntryFor(t, "gitea", giteaRoutePlanEntry))
+	eventually(t, "origins is filled with the public name", func() bool {
+		return e.read(t, "/etc/gitea/origins") == "https://git.example.org\n"
+	})
+}
+
+func TestNatsKeycloaksHostnameIsFilledFromRouteProxysEntryForThePlanEntryTheControllerWrites(t *testing.T) {
+	e, _, _ := routeRun(t, "keycloak", "hostname", "/etc/keycloak/hostname.env", "../../../keycloak/files/hostname.env",
+		"keycloak.route", routeEntryFor(t, "keycloak", keycloakRoutePlanEntry))
+	eventually(t, "hostname.env is filled with the public name", func() bool {
+		return e.read(t, "/etc/keycloak/hostname.env") == "KC_HOSTNAME=https://keycloak.example.org\n"
+	})
+}
+
+// A module that failed on a missing name is filled once the provider's entry carries it: the entry first held no
+// names (as the provider wrote it before the controller composed them), then the controller's plan entry arrives.
+func TestNatsAModuleThatFailedOnAMissingNameIsFilledWhenTheNameArrives(t *testing.T) {
+	bare := routeEntryFor(t, "gitea", `{"provision":"route","provider":"novox","provider-module":"route-proxy",`+
+		`"as":"mesh_g14_gitea"}`)
+	e, b, heard := routeRun(t, "gitea", "origins", "/etc/gitea/origins", "../../../gitea/files/origins", "gitea.route", bare)
+	eventually(t, "the module fails for the missing name", func() bool {
+		r, _ := heard.last("gitea")
+		return r.Status == StatusFailed && strings.Contains(r.Reason, `no "name-web"`)
+	})
+	b.put(t, "route-proxy_bound", node+".gitea.route", routeEntryFor(t, "gitea", giteaRoutePlanEntry))
+	eventually(t, "origins is filled once the name arrives", func() bool {
+		return e.read(t, "/etc/gitea/origins") == "https://git.example.org\n"
+	})
+}