Seal core credentials by the controller while the vault does not hold them, so the bus is never left out of a declaration (issue 908, ADR 0396)

cmd/mesh-controller/core_box_test.go

@@ -19,7 +19,7 @@ import (
 // The core's own credentials travel sealed by the vault to their machine (novox/hq ADR 0349 §16, issue 755; the lead's
 // decision, issue 755 notes 4 and 5): to an engine that opens the vault's box, the send carries the box the vault
 // answered the controller and never the controller's own seal; when the vault does not answer, a kept box is carried
-// again and a module with none is not placed, with a condition naming the vault and the machine. An engine below the
+// again and a module with none is sealed by the controller (ADR 0396, issue 908), with a condition naming the vault and the machine. An engine below the
 // contract composes exactly as before, and the vault is not asked.
 
 // coreStandIn answers `get` with a box per name and generation, or its silence.
@@ -141,7 +141,7 @@ func TestASilentVaultHoldsTheKeptBoxAndSaysSo(t *testing.T) {
 	}
 }
 
-func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsNotPlaced(t *testing.T) {
+func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsSealedByTheController(t *testing.T) {
 	open, vault := aCoreMesh(t, link.VaultBoxContract)
 	vault.silent = errors.New("no responders")
 	plan, settings, err := planFor(t.Context(), open, "laptop")
@@ -152,20 +152,44 @@ func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsNotPlaced(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	for _, r := range declared.Resources {
-		if strings.HasPrefix(r["id"].(string), "mesh-provisioner-client.") {
-			t.Fatalf("a core module was placed though the vault gave nothing for it: %v", r)
-		}
+	f := clientsBroker(declared.Resources)
+	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
+		t.Fatalf("the core credential is composed as %v: the controller's own seal, until the vault holds it", f)
 	}
-	if why := declared.leftOutWhy["mesh-provisioner-client"]; !strings.Contains(why, "never seals it itself") {
-		t.Fatalf("left out %v", declared.leftOutWhy)
+	if why, left := declared.leftOutWhy["mesh-provisioner-client"]; left {
+		t.Fatalf("the core module was left out: %v", why)
 	}
 	c, found := vaultSilence(t, "laptop")
-	if !found || c.Severity != conditions.Urgent || !strings.Contains(c.Summary, "not placed") {
+	if !found || !strings.Contains(c.Summary, "sealed by the controller until the vault holds it") {
 		t.Fatalf("the condition does not say why: %+v", c)
 	}
 }
 
+// Issue 908: a machine at the vault-box contract, the vault silent, no kept box: nats is composed with the
+// controller's own seal, never left out, and the vault-silent condition names it.
+func TestReplay908(t *testing.T) {
+	key := "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
+	core := map[string][]string{"nats": {"password"}}
+	ask := func(name, publicKey string) (coreAnswer, error) { return coreAnswer{}, errors.New("no responders") }
+	got := coreBoxesOf("novox", key, core, nil, Allocating, ask)
+	if _, sealed := got.sealed["nats"]; sealed || len(got.notPlaced) != 0 {
+		t.Fatalf("nats is vault-sealed %v or not placed %v", got.sealed, got.notPlaced)
+	}
+	if !reflect.DeepEqual(got.byController, []string{"nats"}) {
+		t.Fatalf("nats is not left to the controller's seal: %+v", got)
+	}
+	o := vaultSilentObservation("novox", got)
+	if o.Severity != conditions.Warning || !strings.Contains(o.Summary, "sealed by the controller until the vault holds it: nats") {
+		t.Fatalf("the condition does not name nats: %+v", o)
+	}
+	// A kept box is still carried while the vault is silent.
+	kept := map[string]map[string]inventory.CoreBox{"nats": {"password": {SealedTo: key, Box: json.RawMessage(`{"v":1}`)}}}
+	got = coreBoxesOf("novox", key, core, kept, Allocating, ask)
+	if string(got.sealed["nats"]["password"]) != `{"v":1}` || len(got.byController) != 0 {
+		t.Fatalf("the kept box was not held: %+v", got)
+	}
+}
+
 // An engine below VaultBoxContract is sent the controller's own seal, as before, and the vault is not asked.
 func TestAnEngineBelowTheContractIsSentTheControllersSealAsBefore(t *testing.T) {
 	open, vault := aCoreMesh(t, link.HandedContract)
@@ -200,7 +224,7 @@ func TestOnlyASendAsksTheVault(t *testing.T) {
 	// A box kept for another key of the machine is never carried.
 	other := coreBoxesOf("anchor", aPublicKey(t), core, kept, Allocating,
 		func(string, string) (coreAnswer, error) { return coreAnswer{}, errors.New("silent") })
-	if _, left := other.notPlaced["nats"]; !left {
+	if _, vaultSealed := other.sealed["nats"]; vaultSealed || !reflect.DeepEqual(other.byController, []string{"nats"}) {
 		t.Fatalf("a box sealed to the machine's old key was carried: %+v", other)
 	}
 }