WIP: recheck a take's filesystem, follow only the module's branch, count users in an access change, hold the identity until its data is taken (hq ADR 0325 review)

2026-10-12 21:49:30 +02:00
parent e1c2b74442
commit 344af664b2
12 changed files with 310 additions and 26 deletions
@@ -78,7 +78,7 @@ func TestAModuleRunsAsItsIdentityTheSameOnEveryMachine(t *testing.T) {
 	var seen []string
 	for _, node := range []string{"ace", "novox"} {
 		r := Resolution{Node: node, Account: "jochen", Modules: []Manifest{aLibrarian(t), aPlayer(t), theRuntime(t)}}
-		composed := composeFolders(t, r, keepingFolders(identities))
+		composed := composeFolders(t, r, keepingFolders(identities, "/storage/media/movies")) // its read-write folder taken: switched
 		got := byID(composed.Resources)

 		app := got["librarian.app"]
@@ -331,3 +331,40 @@ func TestAModuleWithoutIdentityIsWarnedNotRefused(t *testing.T) {
 		t.Error("an identity module was warned rather than refused")
 	}
 }
+
+// A container is not switched to its identity while a read-write folder it mounts holds data the mesh has not taken
+// (the operator's question on ADR 0325): the app would run as the new uid before the take adds its entry, and lose
+// write on the existing files. Its identity is held — no `identity` sent, its directories keep their owner — while
+// the take's users already name the identity, so the entries exist before the switch; once every such folder is
+// taken (or kept by the engine), the identity is sent in one apply.
+func TestAContainerKeepsItsOldIdentityUntilItsDataIsTaken(t *testing.T) {
+	r := Resolution{Node: "ace", Account: "jochen", Modules: []Manifest{aLibrarian(t), theRuntime(t)}}
+	held := byID(composeFolders(t, r, keepingFolders(identities)).Resources)
+	if _, has := held["librarian.app"][IdentityField]; has {
+		t.Fatalf("the container was told its identity while its movies are not taken: %v", held["librarian.app"][IdentityField])
+	}
+	if owner, has := held["librarian.config"]["owner"]; has {
+		t.Fatalf("its directory was given the owner %v while its identity is held", owner)
+	}
+	users, _ := json.Marshal(held["librarian."+AccessID("/storage/media/movies")]["users"])
+	if !strings.Contains(string(users), `"identity":"mesh-librarian","uid":50001`) {
+		t.Fatalf("the access does not name the identity to come, so the take would not add its entry: %s", users)
+	}
+
+	for name, with := range map[string]Rendering{
+		"taken": keepingFolders(identities, "/storage/media/movies"),
+		"kept by the engine": func() Rendering {
+			w := keepingFolders(identities)
+			w.ReadyFolders = map[string]bool{"/storage/media/movies": true}
+			return w
+		}(),
+	} {
+		got := byID(composeFolders(t, r, with).Resources)
+		if _, has := got["librarian.app"][IdentityField]; !has {
+			t.Errorf("%s: the container is not told its identity", name)
+		}
+		if got["librarian.config"]["owner"] != "50001:50001" {
+			t.Errorf("%s: its directory is owned by %v", name, got["librarian.config"]["owner"])
+		}
+	}
+}