From 33b285ce09aa5a4114b42cfb1f5e9d2b63c114ba Mon Sep 17 00:00:00 2001 From: mesh-tools Date: Tue, 20 Oct 2026 11:30:55 +0000 Subject: [PATCH] Make the credentials in four integration tests by a send, not a question, and name the refusal each now meets --- .../compose_input_credentials_integration_test.go | 4 ++-- .../grant_follows_binding_integration_test.go | 12 ++++++++++-- .../provisioner_account_integration_test.go | 9 +++++++-- 3 files changed, 19 insertions(+), 6 deletions(-) diff --git a/cmd/mesh-controller/compose_input_credentials_integration_test.go b/cmd/mesh-controller/compose_input_credentials_integration_test.go index c9bcd5d9..411ea852 100644 --- a/cmd/mesh-controller/compose_input_credentials_integration_test.go +++ b/cmd/mesh-controller/compose_input_credentials_integration_test.go @@ -82,8 +82,8 @@ func TestAPairCredentialNoRowHoldsIsAWouldMakeAndNoRowIsInserted(t *testing.T) { if _, err := inv.Assign(ctx, "laptop", "reports"); err != nil { t.Fatal(err) } - // The controller's own planning makes the credentials of files and reports. - if _, _, err := resolveNode(ctx, open, "laptop"); err != nil { + // A send makes the credentials of files and reports; a question makes none. + if _, err := composeSend(ctx, open, "laptop"); err != nil { t.Fatal(err) } register(t, open, aConsumerOfTheBucket("metrics")) diff --git a/cmd/mesh-controller/grant_follows_binding_integration_test.go b/cmd/mesh-controller/grant_follows_binding_integration_test.go index 100d3bb4..0aed7741 100644 --- a/cmd/mesh-controller/grant_follows_binding_integration_test.go +++ b/cmd/mesh-controller/grant_follows_binding_integration_test.go @@ -39,6 +39,10 @@ func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) { if err != nil { t.Fatal(err) } + // Only a send makes a credential; a question makes nothing. + if _, err := composeSend(ctx, open, "laptop"); err != nil { + t.Fatal(err) + } if n := need(t, plan, "board", "postgres-database"); n.From != "anchor" { t.Fatalf("pinned to the anchor and bound to %s", n.From) } @@ -61,6 +65,9 @@ func TestAConsumerPinnedBackIsNoLongerGrantedByTheProviderItLeft(t *testing.T) { if err != nil { t.Fatal(err) } + if _, err := composeSend(ctx, open, "laptop"); err != nil { + t.Fatal(err) + } if n := need(t, plan, "board", "postgres-database"); n.From != "laptop" { t.Fatalf("pinned back to the laptop and bound to %s", n.From) } @@ -131,7 +138,7 @@ func TestAConsumerWhoseResolutionCannotBeReadIsNotWithdrawn(t *testing.T) { t.Fatalf("assign %s %s: %v", a[0], a[1], err) } } - if _, _, err := resolveNode(ctx, open, "laptop"); err != nil { + if _, err := composeSend(ctx, open, "laptop"); err != nil { t.Fatal(err) } @@ -151,7 +158,8 @@ func TestAConsumerWhoseResolutionCannotBeReadIsNotWithdrawn(t *testing.T) { if err == nil { t.Fatalf("an unreadable consumer was answered: grants %+v, unbound %+v", grants, unbound) } - if !strings.Contains(err.Error(), "what laptop asked of postgres-database cannot be read") { + // mesh-sdk names the provider's node where the controller's own words named the provision. + if !strings.Contains(err.Error(), "what laptop asked of") || !strings.Contains(err.Error(), "cannot be read") { t.Fatalf("the error does not say whose resolution could not be read: %v", err) } } diff --git a/cmd/mesh-controller/provisioner_account_integration_test.go b/cmd/mesh-controller/provisioner_account_integration_test.go index 67750cd7..61f2515a 100644 --- a/cmd/mesh-controller/provisioner_account_integration_test.go +++ b/cmd/mesh-controller/provisioner_account_integration_test.go @@ -22,8 +22,13 @@ func TestTheProvisionerClientsAccountIsIssuedForItsServiceAndNeverInvented(t *te if _, err := assign(ctx, open, "laptop", m.Module); err != nil { t.Fatal(err) } + // The module's own account exists, so the only account missing is the client's. + if _, err := inv.MintBusPassword(ctx, inventory.BusUser{ + Username: "laptop.mesh-provisioner", Kind: inventory.BusModule, Node: "laptop", Module: "mesh-provisioner"}); err != nil { + t.Fatal(err) + } // The composition refuses it in the send's words (mesh-sdk's go/compose: TestTheSendsRefusalsAreRefusedInTheSendsWords). - if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err == nil || !strings.Contains(err.Error(), "has no bus credential") { + if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err == nil || !strings.Contains(err.Error(), "provisioner.laptop") { t.Fatalf("a push would seal a placeholder for the client's account before it was issued: %v", err) } @@ -40,7 +45,7 @@ func TestTheProvisionerClientsAccountIsIssuedForItsServiceAndNeverInvented(t *te if !slices.ContainsFunc(states, func(s inventory.SecretState) bool { return s.Name == broker.ProvisionerSecret }) { t.Fatalf("the client's account is not sealed to the machine for its service: %+v", states) } - if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err != nil && strings.Contains(err.Error(), "has no bus credential") { + if _, _, err := composeQuestion(ctx, open, "laptop", compose.Foreseeing, false); err != nil && strings.Contains(err.Error(), "provisioner.laptop") { t.Fatalf("an issued client account is refused: %v", err) } if !runsTheProvisionerClient(m) {