395 lines
14 KiB
Go
395 lines
14 KiB
Go
package main
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"reflect"
|
|
"sync"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.novox.be/novox/mesh-sdk/go/provider"
|
|
)
|
|
|
|
const testIssuer = "https://id.example.org/realms/Novox"
|
|
|
|
// bucketBus is the helper's bus over in-memory buckets.
|
|
type bucketBus struct {
|
|
mu sync.Mutex
|
|
buckets map[string]map[string][]byte
|
|
}
|
|
|
|
func (b *bucketBus) Watch(_ context.Context, bucket string, handle func(string, []byte)) error {
|
|
b.mu.Lock()
|
|
defer b.mu.Unlock()
|
|
for k, v := range b.buckets[bucket] {
|
|
handle(k, v)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (b *bucketBus) Put(_ context.Context, bucket, key string, value []byte) error {
|
|
b.mu.Lock()
|
|
defer b.mu.Unlock()
|
|
if b.buckets[bucket] == nil {
|
|
b.buckets[bucket] = map[string][]byte{}
|
|
}
|
|
b.buckets[bucket][key] = append([]byte(nil), value...)
|
|
return nil
|
|
}
|
|
|
|
func (b *bucketBus) Delete(_ context.Context, bucket, key string) error {
|
|
b.mu.Lock()
|
|
defer b.mu.Unlock()
|
|
delete(b.buckets[bucket], key)
|
|
return nil
|
|
}
|
|
|
|
// bind is one consumer's assignment, whose plan names this machine's keycloak as the provider and carries what the
|
|
// consumer contributes (issue 776).
|
|
func (b *bucketBus) bind(node, module string, contributes map[string]any) {
|
|
b.bindNamed(node, module, contributes, nil)
|
|
}
|
|
|
|
// bindNamed is bind with the names the controller composed for the consumer (issue 792).
|
|
func (b *bucketBus) bindNamed(node, module string, contributes map[string]any, names map[string]string) {
|
|
plan, _ := json.Marshal(map[string]any{"node": node, "module": module, "provisioning": map[string]any{
|
|
"provisions": []any{map[string]any{"provision": ProvisionName, "provider": "novox", "provider-module": "keycloak",
|
|
"contributes": contributes, "names": names}}}})
|
|
if err := b.Put(context.Background(), provider.AssignmentsBucket, node+"."+module, plan); err != nil {
|
|
panic(err)
|
|
}
|
|
}
|
|
|
|
// consumersFile writes the file the machine's client fills: one credential per consumer.
|
|
func consumersFile(t *testing.T, bound map[[2]string]string) string {
|
|
var list []provider.ConsumerCredential
|
|
for k, password := range bound {
|
|
list = append(list, provider.ConsumerCredential{Consumer: k[0], Module: k[1],
|
|
Credential: provider.PairName("novox", ProvisionName, k[0], k[1], ""), Value: password})
|
|
}
|
|
raw, _ := json.Marshal(list)
|
|
at := filepath.Join(t.TempDir(), "consumers.json")
|
|
if err := os.WriteFile(at, raw, 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return at
|
|
}
|
|
|
|
// movedWorld is keycloak on the helper over an in-memory bus, with a recorder for a server and a clock to move.
|
|
type movedWorld struct {
|
|
t *testing.T
|
|
a *recorder
|
|
bus *bucketBus
|
|
h *Harness
|
|
run *movedRun
|
|
p *provider.Provider
|
|
now time.Time
|
|
file string
|
|
}
|
|
|
|
func newMovedWorld(t *testing.T, bound map[[2]string]string) *movedWorld {
|
|
w := &movedWorld{t: t, a: &recorder{}, bus: &bucketBus{buckets: map[string]map[string][]byte{}},
|
|
now: time.Date(2026, 10, 15, 12, 0, 0, 0, time.UTC)}
|
|
w.file = consumersFile(t, bound)
|
|
w.h = &Harness{Resource: ProvisionName, Adapter: w.a, Node: "novox", Now: func() time.Time { return w.now },
|
|
Log: func(string, ...any) {}}
|
|
var bus provider.Bus
|
|
w.run, w.p, bus, _ = moved(w.file, w.h, testIssuer)
|
|
_ = bus
|
|
if err := w.run.watch(ctx, w.bus); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
return w
|
|
}
|
|
|
|
// pass is one helper pass and one retirement pass, five seconds after the last.
|
|
func (w *movedWorld) pass() []provider.Outcome {
|
|
w.now = w.now.Add(5 * time.Second)
|
|
// the plans as the bus holds them now, as the watch would hand them
|
|
w.run.assignments = map[string][]byte{}
|
|
for k, v := range w.bus.buckets[provider.AssignmentsBucket] {
|
|
w.run.assignments[k] = v
|
|
}
|
|
// the helper reads its buckets from the in-memory bus
|
|
w.p = provider.New(provider.Options{Node: "novox", Module: "keycloak", Bus: w.bus,
|
|
Vault: provider.ConsumersFile{Paths: []string{w.file}},
|
|
Offers: map[string]provider.Offer{ProvisionName: {Credential: provider.PerConsumer,
|
|
Serves: servedValues(testIssuer)}},
|
|
Make: w.run.Make, Gone: w.run.Gone, Logf: func(string, ...any) {}})
|
|
out, err := w.p.Pass(ctx)
|
|
if err != nil {
|
|
w.t.Fatal(err)
|
|
}
|
|
w.run.retire(ctx)
|
|
return out
|
|
}
|
|
|
|
func bindings(n int) (map[[2]string]string, []string) {
|
|
bound := map[[2]string]string{}
|
|
var logins []string
|
|
for i := 1; i <= n; i++ {
|
|
module := fmt.Sprintf("app%d", i)
|
|
bound[[2]string{"ace", module}] = "pw-" + module
|
|
logins = append(logins, provider.ConsumerIdentity("ace", module))
|
|
}
|
|
return bound, logins
|
|
}
|
|
|
|
// grafanaContributes and grafanaNames are what grafana's plan entry carries for keycloak: its contribution, and the
|
|
// names the controller composed for it (issues 776, 792).
|
|
var grafanaContributes = map[string]any{"label": "grafana", "endpoint": "web", "callback": "/login/generic_oauth"}
|
|
var grafanaNames = map[string]string{"name": "grafana.example.org", "internal-name": "grafana.home.internal"}
|
|
|
|
// The consumers' file makes the same call on the adapter as the equivalent grant file does (the harness): the same
|
|
// client id, secret, and the values the redirect URIs are made from.
|
|
func TestTheConsumersFileMakesWhatTheGrantFileMakes(t *testing.T) {
|
|
grafana := provider.ConsumerIdentity("home", "grafana")
|
|
values := map[string]any{"name": grafanaNames["name"], "internal-name": grafanaNames["internal-name"]}
|
|
for k, v := range grafanaContributes {
|
|
values[k] = v
|
|
}
|
|
|
|
// Today: the grant file, through the harness.
|
|
g := newWorld(t)
|
|
g.give(map[string]any{"as": grafana, "node": "home", "values": values})
|
|
g.h.Reconcile(ctx)
|
|
|
|
// The consumers' file, through the provider helper.
|
|
w := newMovedWorld(t, map[[2]string]string{{"home", "grafana"}: "pw-" + grafana})
|
|
w.bus.bindNamed("home", "grafana", grafanaContributes, grafanaNames)
|
|
for _, o := range w.pass() {
|
|
if o.Status != provider.Answered {
|
|
t.Fatalf("%+v", o)
|
|
}
|
|
}
|
|
if len(w.a.created) != 1 || len(g.a.created) != 1 {
|
|
t.Fatalf("created %d through the helper, %d through the harness, want 1 each", len(w.a.created), len(g.a.created))
|
|
}
|
|
c, want := w.a.created[0], g.a.created[0]
|
|
if c.As != want.As || c.Password != want.Password || c.Consumer != want.Consumer ||
|
|
!reflect.DeepEqual(orEmpty(c.Values), orEmpty(want.Values)) {
|
|
t.Fatalf("made %+v, the grant file makes %+v", c, want)
|
|
}
|
|
if _, redirects, err := RedirectsOf(c.Values); err != nil ||
|
|
!reflect.DeepEqual(redirects, []string{"https://grafana.example.org/login/generic_oauth", "https://grafana.home.internal/login/generic_oauth"}) {
|
|
t.Fatalf("redirects %v, %v", redirects, err)
|
|
}
|
|
// The entry tells grafana what keycloak serves, the issuer from its own config.
|
|
var entry provider.Entry
|
|
if err := json.Unmarshal(w.bus.buckets[provider.BucketOf("keycloak")]["home.grafana.oidc-client"], &entry); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if entry.Values["issuer"] != testIssuer || entry.Values["token-path"] != "/protocol/openid-connect/token" ||
|
|
entry.Values["authorization-path"] != "/protocol/openid-connect/auth" || entry.Values["userinfo-path"] != "/protocol/openid-connect/userinfo" {
|
|
t.Fatalf("served %v", entry.Values)
|
|
}
|
|
|
|
// Unchanged, and held: nothing is made again, within a minute or after it. No longer held: made again.
|
|
w.a.held = true
|
|
w.pass()
|
|
w.now = w.now.Add(2 * time.Minute)
|
|
w.pass()
|
|
if len(w.a.created) != 1 {
|
|
t.Fatalf("an unchanged pass created again: %d", len(w.a.created))
|
|
}
|
|
w.a.held = false
|
|
w.now = w.now.Add(2 * time.Minute)
|
|
w.pass()
|
|
if len(w.a.created) != 2 {
|
|
t.Fatalf("not made again: %d", len(w.a.created))
|
|
}
|
|
}
|
|
|
|
// Against a Keycloak, both paths leave the same client.
|
|
func TestBothPathsLeaveTheSameClientInKeycloak(t *testing.T) {
|
|
grafana := provider.ConsumerIdentity("home", "grafana")
|
|
values := map[string]any{"name": grafanaNames["name"], "internal-name": grafanaNames["internal-name"]}
|
|
for k, v := range grafanaContributes {
|
|
values[k] = v
|
|
}
|
|
made := func(through func(p provisioner)) Rep {
|
|
f, o := oidcWorld(t)
|
|
through(provisioner{clients: o, announce: func(string, map[string]any) {}, log: func(string, ...any) {}})
|
|
return only(t, f, grafana)
|
|
}
|
|
viaGrant := made(func(p provisioner) {
|
|
g := newWorld(t)
|
|
g.h.Adapter = p
|
|
g.give(map[string]any{"as": grafana, "node": "home", "values": values})
|
|
g.h.Reconcile(ctx)
|
|
})
|
|
viaFile := made(func(p provisioner) {
|
|
w := newMovedWorld(t, map[[2]string]string{{"home", "grafana"}: "pw-" + grafana})
|
|
w.h.Adapter = p
|
|
w.bus.bindNamed("home", "grafana", grafanaContributes, grafanaNames)
|
|
w.pass()
|
|
})
|
|
// Keycloak's own ids differ between two runs; nothing the mesh sets does.
|
|
for _, c := range []Rep{viaGrant, viaFile} {
|
|
delete(c, "id")
|
|
raw, _ := json.Marshal(c)
|
|
var again Rep
|
|
_ = json.Unmarshal(raw, &again)
|
|
for k := range c {
|
|
delete(c, k)
|
|
}
|
|
for k, v := range again {
|
|
c[k] = v
|
|
}
|
|
if mappers, ok := c["protocolMappers"].([]any); ok {
|
|
for _, m := range mappers {
|
|
delete(m.(map[string]any), "id")
|
|
}
|
|
}
|
|
}
|
|
if !reflect.DeepEqual(viaGrant, viaFile) {
|
|
t.Fatalf("through the file %v, through the grant %v", viaFile, viaGrant)
|
|
}
|
|
}
|
|
|
|
// A consumer that is no longer bound is kept until the harness's retirement is stable, then retired, never deleted.
|
|
func TestAConsumerMissingFromOneReadRetiresNothing(t *testing.T) {
|
|
bound, logins := bindings(2)
|
|
w := newMovedWorld(t, bound)
|
|
w.bus.bindNamed("ace", "app1", grafanaContributes, grafanaNames)
|
|
w.bus.bindNamed("ace", "app2", grafanaContributes, grafanaNames)
|
|
w.pass()
|
|
|
|
saved := w.bus.buckets[provider.AssignmentsBucket]["ace.app2"]
|
|
w.bus.Delete(ctx, provider.AssignmentsBucket, "ace.app2")
|
|
w.pass()
|
|
if len(w.a.removed) != 0 {
|
|
t.Fatalf("retired %v on one read", w.a.removed)
|
|
}
|
|
w.bus.Put(ctx, provider.AssignmentsBucket, "ace.app2", saved)
|
|
for i := 0; i < 8; i++ {
|
|
w.pass()
|
|
}
|
|
w.now = w.now.Add(15 * time.Minute)
|
|
w.pass()
|
|
if len(w.a.removed) != 0 {
|
|
t.Fatalf("retired %v", w.a.removed)
|
|
}
|
|
|
|
w.bus.Delete(ctx, provider.AssignmentsBucket, "ace.app2")
|
|
for i := 0; i < 6; i++ {
|
|
w.pass()
|
|
}
|
|
if len(w.a.removed) != 0 {
|
|
t.Fatalf("retired %v before the time was out", w.a.removed)
|
|
}
|
|
w.now = w.now.Add(11 * time.Minute)
|
|
w.pass()
|
|
w.pass()
|
|
if !reflect.DeepEqual(w.a.removed, []string{logins[1]}) || len(w.a.deleted) != 0 {
|
|
t.Fatalf("retired %v, deleted %v", w.a.removed, w.a.deleted)
|
|
}
|
|
if _, kept := w.bus.buckets[provider.BucketOf("keycloak")]["ace.app2.oidc-client"]; kept {
|
|
t.Fatal("the entry stayed after the client was retired")
|
|
}
|
|
}
|
|
|
|
// A plan list that was never read is not nobody asking.
|
|
func TestNoPlansReadRetiresNothing(t *testing.T) {
|
|
bound, _ := bindings(1)
|
|
w := newMovedWorld(t, bound)
|
|
w.bus.bindNamed("ace", "app1", grafanaContributes, grafanaNames)
|
|
w.pass()
|
|
w.bus.Delete(ctx, provider.AssignmentsBucket, "ace.app1")
|
|
for i := 0; i < 8; i++ {
|
|
w.pass()
|
|
}
|
|
w.now = w.now.Add(20 * time.Minute)
|
|
w.pass()
|
|
if len(w.a.removed) != 0 {
|
|
t.Fatalf("retired %v with no plans read", w.a.removed)
|
|
}
|
|
}
|
|
|
|
// A consumer whose credential is not in the file yet is waited for: nothing is made for it.
|
|
func TestAConsumerWithoutACredentialIsWaitedFor(t *testing.T) {
|
|
w := newMovedWorld(t, map[[2]string]string{})
|
|
w.bus.bindNamed("home", "grafana", grafanaContributes, grafanaNames)
|
|
outcomes := w.pass()
|
|
if len(outcomes) != 1 || outcomes[0].Status != provider.Waiting || len(w.a.created) != 0 {
|
|
t.Fatalf("%+v, created %v", outcomes, w.a.created)
|
|
}
|
|
}
|
|
|
|
// A consumer whose plan names its client id (a slugged module) keeps it, and the retirement counts it as asked for.
|
|
func TestAConsumerNamedByItsPlanKeepsItsClientId(t *testing.T) {
|
|
agent := provider.ConsumerIdentity("home", "dashboard")
|
|
w := newMovedWorld(t, map[[2]string]string{{"home", "grafana-2"}: "pw"})
|
|
plan, _ := json.Marshal(map[string]any{"node": "home", "module": "grafana-2", "provisioning": map[string]any{
|
|
"provisions": []any{map[string]any{"provision": ProvisionName, "provider": "novox", "provider-module": "keycloak",
|
|
"as": agent, "contributes": grafanaContributes, "names": grafanaNames}}}})
|
|
if err := w.bus.Put(ctx, provider.AssignmentsBucket, "home.grafana-2", plan); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, o := range w.pass() {
|
|
if o.Status != provider.Answered {
|
|
t.Fatalf("%+v", o)
|
|
}
|
|
}
|
|
if len(w.a.created) != 1 || w.a.created[0].As != agent {
|
|
t.Fatalf("made %+v, want one under %s", w.a.created, agent)
|
|
}
|
|
for i := 0; i < 8; i++ {
|
|
w.pass()
|
|
}
|
|
w.now = w.now.Add(15 * time.Minute)
|
|
w.pass()
|
|
w.pass()
|
|
if len(w.a.removed) != 0 {
|
|
t.Fatalf("retired %v: the plan's client id was counted unasked", w.a.removed)
|
|
}
|
|
}
|
|
|
|
// Where the file is not there, keycloak takes the grant directory, as before; where it is, the helper.
|
|
func TestTheGrantPathIsTakenWhereTheConsumersFileIsAbsent(t *testing.T) {
|
|
dir := t.TempDir()
|
|
at := filepath.Join(dir, "consumers.json")
|
|
env := func(k string) string {
|
|
if k == "MESH_CONSUMERS_FILE" {
|
|
return at
|
|
}
|
|
return ""
|
|
}
|
|
if got := handedConsumersFile(env, os.Stat); got != "" {
|
|
t.Fatalf("took %q for a file that is not there", got)
|
|
}
|
|
if got := handedConsumersFile(func(string) string { return "" }, os.Stat); got != "" {
|
|
t.Fatalf("took %q with no environment", got)
|
|
}
|
|
if err := os.WriteFile(at, []byte("[]"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got := handedConsumersFile(env, os.Stat); got != at {
|
|
t.Fatalf("took %q, want %q", got, at)
|
|
}
|
|
}
|
|
|
|
// The grant path restarts itself when the consumers file is first filled.
|
|
func TestTheGrantPathLeavesWhenTheConsumersFileIsFilled(t *testing.T) {
|
|
at := filepath.Join(t.TempDir(), "consumers.json")
|
|
done := make(chan struct{})
|
|
go exitWhenFilled(at, os.Stat, time.Millisecond, func() { close(done) })
|
|
select {
|
|
case <-done:
|
|
t.Fatal("left before the file was there")
|
|
case <-time.After(20 * time.Millisecond):
|
|
}
|
|
if err := os.WriteFile(at, []byte("[]"), 0o600); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
select {
|
|
case <-done:
|
|
case <-time.After(2 * time.Second):
|
|
t.Fatal("did not leave when the file was filled")
|
|
}
|
|
}
|