Refuse any change through a verb to a module with a trusted mergeable file

A mergeable file takes any key, not only those its content names, so an
empty runtime configuration a provider reads took a url of the caller's
through the settings verb (hq issue 340 review).

cmd/mesh-controller/terminal_settings_test.go

@@ -282,3 +282,65 @@ func TestTheAgentsManagedSettingsAreRefusedThroughAVerb(t *testing.T) {
 		t.Fatalf("reading through the verb: %v", err)
 	}
 }
+
+// A mergeable file takes any key, not only those its content names (novox/hq issue 340): an empty runtime
+// configuration that a provider reads would take a `url` of the caller's, and the provider would send its admin
+// login there. So a module with a mergeable file not marked `"trusted": false` has its whole layer set at the
+// terminal: through a verb, any change is refused, whatever the key.
+func TestAnyKeyOfAModuleWithATrustedMergeableFileIsRefusedThroughAVerb(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "keycloak", Version: "1",
+		Resources: []map[string]any{{"id": "runtime-config", "type": "file", "path": "/var/lib/kc/runtime.json",
+			"mode": "0600", "merge": "json", "content": "{}"}}})
+	register(t, open, catalogue.Manifest{Module: "notifier", Version: "1",
+		Resources: []map[string]any{{"id": "look", "type": "file", "path": "/var/lib/notifier/look.json",
+			"mode": "0644", "merge": "json", "trusted": false, "content": "{}"}}})
+	for _, m := range []string{"keycloak", "notifier"} {
+		if _, err := assign(ctx, open, "anchor", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	layer := func(module string) string {
+		t.Helper()
+		values, _, err := open.inventory.Layer(ctx, "anchor", module)
+		if err != nil {
+			t.Fatal(err)
+		}
+		raw, _ := json.Marshal(values)
+		return string(raw)
+	}
+	refused := func(what string, err error) {
+		t.Helper()
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") || !strings.Contains(err.Error(), "issue 340") {
+			t.Fatalf("%s: %v", what, err)
+		}
+	}
+	refused("a new url through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak", "node": "anchor",
+		"values": `{"url":"http://listener.example:8080"}`}))
+	refused("a new url for the mesh through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak",
+		"values": `{"url":"http://listener.example:8080"}`}))
+	if err := throughVerb(t, "command", map[string]any{"command": `settings set keycloak '{"url":"http://x"}' --node anchor`}); err == nil {
+		t.Fatal("the command verb set a key of a trusted mergeable file")
+	}
+	if got := layer("keycloak"); got != "null" && got != "{}" {
+		t.Fatalf("a refused call kept a layer: %s", got)
+	}
+	if err := atTheTerminal(t, "settings", "set", "keycloak", `{"url":"https://id.example"}`, "--node", "anchor"); err != nil {
+		t.Fatalf("at the terminal: %v", err)
+	}
+	kept := layer("keycloak")
+	refused("changed", throughVerb(t, "settings", map[string]any{"module": "keycloak", "node": "anchor",
+		"values": `{"url":"http://listener.example"}`}))
+	refused("cleared", throughVerb(t, "settings", map[string]any{"module": "keycloak", "node": "anchor", "clear": "true"}))
+	if got := layer("keycloak"); got != kept {
+		t.Fatalf("a refused call changed the layer: %s, was %s", got, kept)
+	}
+	if err := throughVerb(t, "settings", map[string]any{"module": "keycloak", "node": "anchor"}); err != nil {
+		t.Fatalf("reading through the verb: %v", err)
+	}
+	// A mergeable file that says out loud nothing trusts it stays the verb's.
+	if err := throughVerb(t, "settings", map[string]any{"module": "notifier", "node": "anchor", "values": `{"font":13}`}); err != nil {
+		t.Fatalf("a file marked untrusted through the verb: %v", err)
+	}
+}