Split the unit level from the integration level in cmd, builder, link, catalogue, inventory; cheap fixtures for the archive-entry bound, the registry waits and the catalogue copy (issue 895)

cmd/mesh-controller/core_box_test.go

@@ -7,13 +7,11 @@ import (
 	"reflect"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/novox/mesh-controller/internal/broker"
 	"github.com/novox/mesh-controller/internal/catalogue"
 	"github.com/novox/mesh-controller/internal/conditions"
 	"github.com/novox/mesh-controller/internal/inventory"
-	"github.com/novox/mesh-controller/internal/link"
 )
 
 // The core's own credentials travel sealed by the vault to their machine (novox/hq ADR 0349 §16, issue 755; the lead's
@@ -46,28 +44,6 @@ func withVault(t *testing.T, v *coreStandIn) {
 	t.Cleanup(func() { coreVault = before })
 }
 
-func aCoreMesh(t *testing.T, contract int) (*stores, *coreStandIn) {
-	t.Helper()
-	open := aMesh(t)
-	ctx := t.Context()
-	client := aClientModule()
-	register(t, open, client)
-	if _, err := assign(ctx, open, "laptop", client.Module); err != nil {
-		t.Fatal(err)
-	}
-	if err := issueProvisionerClient(ctx, open.inventory, client, "laptop", broker.Broker{Fingerprint: "ab"},
-		"10.0.0.1:4222"); err != nil {
-		t.Fatal(err)
-	}
-	if _, err := open.inventory.RecordHealth(ctx, inventory.NodeHealth{Node: "laptop", Contract: contract,
-		SaidAt: time.Now()}); err != nil {
-		t.Fatal(err)
-	}
-	v := &coreStandIn{generation: 1}
-	withVault(t, v)
-	return open, v
-}
-
 func clientsBroker(resources []map[string]any) map[string]any {
 	for _, r := range resources {
 		if r["id"] == "mesh-provisioner-client.needs-"+broker.ProvisionerSecret {
@@ -86,85 +62,6 @@ func vaultSilence(t *testing.T, node string) (conditions.Condition, bool) {
 	return c, found
 }
 
-func TestTheSendCarriesTheVaultsBoxForACoreCredentialAndKeepsIt(t *testing.T) {
-	open, vault := aCoreMesh(t, link.VaultBoxContract)
-	key, err := open.inventory.SealingKeyOf(t.Context(), "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	f := clientsBroker(sentTo(t, open, "laptop"))
-	if f == nil || f["sealed"] != nil || f[catalogue.VaultSealedField] == nil {
-		t.Fatalf("the core credential is sent as %v: the vault's box, never the controller's seal", f)
-	}
-	if want := []string{"own/laptop/mesh-provisioner-client/" + broker.ProvisionerSecret}; !reflect.DeepEqual(vault.asked, want) {
-		t.Fatalf("the vault was asked %v", vault.asked)
-	}
-	if want, _ := sealingKeyPEM(key); vault.keys[0] != want {
-		t.Fatalf("the vault was asked to seal to %q, not the machine's key", vault.keys[0])
-	}
-	first, _ := json.Marshal(f[catalogue.VaultSealedField])
-
-	// The vault answers afresh with the same generation: the kept box is carried again, so the declaration is stable.
-	again, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
-	if string(again) != string(first) {
-		t.Fatalf("a fresh box of the same generation changed the declaration: %s, then %s", first, again)
-	}
-	// A rotation in the vault (a newer generation) is carried.
-	vault.generation = 2
-	rotated, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
-	if string(rotated) == string(first) {
-		t.Fatal("a newer generation was not carried")
-	}
-	if _, found := vaultSilence(t, "laptop"); found {
-		t.Fatal("a send the vault answered raised its silence")
-	}
-}
-
-func TestASilentVaultHoldsTheKeptBoxAndSaysSo(t *testing.T) {
-	open, vault := aCoreMesh(t, link.VaultBoxContract)
-	first, _ := json.Marshal(clientsBroker(sentTo(t, open, "laptop"))[catalogue.VaultSealedField])
-	vault.silent = errors.New("no responders")
-	held := clientsBroker(sentTo(t, open, "laptop"))
-	got, _ := json.Marshal(held[catalogue.VaultSealedField])
-	if held == nil || held["sealed"] != nil || string(got) != string(first) {
-		t.Fatalf("a silent vault's credential is sent as %v: the box kept, never the controller's seal", held)
-	}
-	c, found := vaultSilence(t, "laptop")
-	if !found || !strings.Contains(c.Summary, "vault") || !strings.Contains(c.Summary, "laptop") {
-		t.Fatalf("no condition names the vault and the machine: %+v", c)
-	}
-	// The vault answers again: the condition clears.
-	vault.silent = nil
-	sentTo(t, open, "laptop")
-	if _, found := vaultSilence(t, "laptop"); found {
-		t.Fatal("the condition stayed after the vault answered")
-	}
-}
-
-func TestACoreModuleFirstPlacedWhileTheVaultIsSilentIsSealedByTheController(t *testing.T) {
-	open, vault := aCoreMesh(t, link.VaultBoxContract)
-	vault.silent = errors.New("no responders")
-	plan, settings, err := planFor(t.Context(), open, "laptop")
-	if err != nil {
-		t.Fatal(err)
-	}
-	declared, err := declarationFor(t.Context(), open, "laptop", plan, settings)
-	if err != nil {
-		t.Fatal(err)
-	}
-	f := clientsBroker(declared.Resources)
-	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
-		t.Fatalf("the core credential is composed as %v: the controller's own seal, until the vault holds it", f)
-	}
-	if why, left := declared.leftOutWhy["mesh-provisioner-client"]; left {
-		t.Fatalf("the core module was left out: %v", why)
-	}
-	c, found := vaultSilence(t, "laptop")
-	if !found || !strings.Contains(c.Summary, "sealed by the controller until the vault holds it") {
-		t.Fatalf("the condition does not say why: %+v", c)
-	}
-}
-
 // Issue 908: a machine at the vault-box contract, the vault silent, no kept box: nats is composed with the
 // controller's own seal, never left out, and the vault-silent condition names it.
 func TestReplay908(t *testing.T) {
@@ -191,16 +88,6 @@ func TestReplay908(t *testing.T) {
 }
 
 // An engine below VaultBoxContract is sent the controller's own seal, as before, and the vault is not asked.
-func TestAnEngineBelowTheContractIsSentTheControllersSealAsBefore(t *testing.T) {
-	open, vault := aCoreMesh(t, link.HandedContract)
-	f := clientsBroker(sentTo(t, open, "laptop"))
-	if f == nil || f["sealed"] == nil || f[catalogue.VaultSealedField] != nil {
-		t.Fatalf("an older engine is sent %v", f)
-	}
-	if len(vault.asked) != 0 {
-		t.Fatalf("the vault was asked %v for an older engine", vault.asked)
-	}
-}
 
 // Every question but a send reads the kept box and asks nothing; with none kept, a stand-in the next send asks for.
 func TestOnlyASendAsksTheVault(t *testing.T) {