From 0b056edaaae9448ae0bbf619e5f5852e44540a97 Mon Sep 17 00:00:00 2001 From: "fix-cat-pas@novox" Date: Fri, 16 Oct 2026 19:29:30 +0200 Subject: [PATCH] Prove the client fills gitea's origins and keycloak's hostname from route-proxy's entry for a controller-shaped plan entry (issue 923) --- .../route_names_test.go | 138 ++++++++++++++++++ 1 file changed, 138 insertions(+) create mode 100644 modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go diff --git a/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go new file mode 100644 index 00000000..42b27ecf --- /dev/null +++ b/modules/mesh-provisioner-client/cmd/mesh-provisioner-client/route_names_test.go @@ -0,0 +1,138 @@ +package main + +import ( + "context" + "os" + "strings" + "sync" + "testing" + "time" + + "git.novox.be/novox/mesh-sdk/go/provider" + "github.com/nats-io/nats.go/jetstream" +) + +// Issue 923: route-proxy serves a consumer of its route the names the controller composed, and the consumer's client +// fills gitea's origins and keycloak's hostname.env from them. The route-proxy provider is run here as its module +// runs it (the SDK helper, `route` offered with no credential and nothing served), over a plan entry shaped as the +// controller writes it (mesh-controller handed.go PlanProvision: `at`, `from`, `as` and `names`), and the entry it +// writes is the one the client reads. + +// memBus is the provider helper's bus over in-memory buckets. +type memBus struct { + mu sync.Mutex + buckets map[string]map[string][]byte +} + +func (m *memBus) Watch(_ context.Context, bucket string, handle func(string, []byte)) error { + m.mu.Lock() + defer m.mu.Unlock() + for k, v := range m.buckets[bucket] { + handle(k, v) + } + return nil +} + +func (m *memBus) Put(_ context.Context, bucket, key string, value []byte) error { + m.mu.Lock() + defer m.mu.Unlock() + if m.buckets[bucket] == nil { + m.buckets[bucket] = map[string][]byte{} + } + m.buckets[bucket][key] = append([]byte(nil), value...) + return nil +} + +func (m *memBus) Delete(_ context.Context, bucket, key string) error { + m.mu.Lock() + defer m.mu.Unlock() + delete(m.buckets[bucket], key) + return nil +} + +// routeEntryFor is the entry route-proxy's helper writes for module's plan entry on the route provision. +func routeEntryFor(t *testing.T, module, planEntry string) string { + t.Helper() + bus := &memBus{buckets: map[string]map[string][]byte{provider.AssignmentsBucket: { + node + "." + module: []byte(`{"node":"` + node + `","module":"` + module + `","provisioning":{"provisions":[` + + planEntry + `]}}`)}}} + p := provider.New(provider.Options{Node: "novox", Module: "route-proxy", Bus: bus, Logf: t.Logf, + Offers: map[string]provider.Offer{"route": {Credential: provider.NoCredential, Serves: map[string]any{}}}}) + out, err := p.Pass(context.Background()) + if err != nil { + t.Fatal(err) + } + if len(out) != 1 || out[0].Status != provider.Answered { + t.Fatalf("the provider did %+v", out) + } + return string(bus.buckets[provider.BucketOf("route-proxy")][node+"."+module+".route"]) +} + +func routeRun(t *testing.T, module, id, path, templatePath, entryKey, firstEntry string) (*engine, *aBus, *reports) { + t.Helper() + raw, err := os.ReadFile(templatePath) + if err != nil { + t.Fatal(err) + } + b := startBus(t) + registryOf679(t, b) + startVault(t, b) + heard := b.listen(t) + e := startEngine(t, map[string]string{path: "owned"}) + tpl, _ := templates(t, map[string]string{id: string(raw)}) + b.assign(t, module, Plan{Templates: tpl, Files: []PlannedFile{{ID: id, Path: path, Template: id, + OwnerAtRuntime: "owned"}}, + Provisions: []PlannedProvision{{Provision: "route", Provider: "novox", ProviderModule: "route-proxy"}}}) + kv, err := b.domain.CreateKeyValue(context.Background(), jetstream.KeyValueConfig{Bucket: "route-proxy_bound"}) + if err != nil { + t.Fatal(err) + } + b.kv["route-proxy_bound"] = kv + if firstEntry != "" { + b.put(t, "route-proxy_bound", node+"."+entryKey, firstEntry) + } + aClient(t, b, e, t.TempDir(), time.Hour) + return e, b, heard +} + +// gitea's plan entry for its `web` route, as the controller writes it for a node whose public domain is example.org. +const giteaRoutePlanEntry = `{"provision":"route","provider":"novox","provider-module":"route-proxy",` + + `"at":"novox.internal","from":"novox","as":"mesh_g14_gitea",` + + `"names":{"name-web":"git.example.org","internal-name-web":"git.novox.internal",` + + `"name-internal-api-refused":"git.example.org","internal-name-internal-api-refused":"git.novox.internal"}}` + +const keycloakRoutePlanEntry = `{"provision":"route","provider":"novox","provider-module":"route-proxy",` + + `"at":"novox.internal","from":"novox","as":"mesh_g14_keycloak",` + + `"names":{"name":"keycloak.example.org","internal-name":"keycloak.novox.internal"}}` + +func TestNatsGiteasOriginsAreFilledFromRouteProxysEntryForThePlanEntryTheControllerWrites(t *testing.T) { + e, _, _ := routeRun(t, "gitea", "origins", "/etc/gitea/origins", "../../../gitea/files/origins", "gitea.route", + routeEntryFor(t, "gitea", giteaRoutePlanEntry)) + eventually(t, "origins is filled with the public name", func() bool { + return e.read(t, "/etc/gitea/origins") == "https://git.example.org\n" + }) +} + +func TestNatsKeycloaksHostnameIsFilledFromRouteProxysEntryForThePlanEntryTheControllerWrites(t *testing.T) { + e, _, _ := routeRun(t, "keycloak", "hostname", "/etc/keycloak/hostname.env", "../../../keycloak/files/hostname.env", + "keycloak.route", routeEntryFor(t, "keycloak", keycloakRoutePlanEntry)) + eventually(t, "hostname.env is filled with the public name", func() bool { + return e.read(t, "/etc/keycloak/hostname.env") == "KC_HOSTNAME=https://keycloak.example.org\n" + }) +} + +// A module that failed on a missing name is filled once the provider's entry carries it: the entry first held no +// names (as the provider wrote it before the controller composed them), then the controller's plan entry arrives. +func TestNatsAModuleThatFailedOnAMissingNameIsFilledWhenTheNameArrives(t *testing.T) { + bare := routeEntryFor(t, "gitea", `{"provision":"route","provider":"novox","provider-module":"route-proxy",`+ + `"as":"mesh_g14_gitea"}`) + e, b, heard := routeRun(t, "gitea", "origins", "/etc/gitea/origins", "../../../gitea/files/origins", "gitea.route", bare) + eventually(t, "the module fails for the missing name", func() bool { + r, _ := heard.last("gitea") + return r.Status == StatusFailed && strings.Contains(r.Reason, `no "name-web"`) + }) + b.put(t, "route-proxy_bound", node+".gitea.route", routeEntryFor(t, "gitea", giteaRoutePlanEntry)) + eventually(t, "origins is filled once the name arrives", func() bool { + return e.read(t, "/etc/gitea/origins") == "https://git.example.org\n" + }) +}