Refuse a port given for the whole mesh where it is set, not at every node's composition (hq ADR 0100)

internal/inventory/catalogue.go

@@ -585,6 +585,17 @@ func (i *Inventory) SetSettings(ctx context.Context, nodeName, module string, va
 		return err
 	}
 	if nodeName == "" {
+		// A port is a fact about one machine (novox/hq ADR 0100). Refused here, in composition's
+		// words: stored, it refuses every node running the module at composition, and the mesh
+		// cannot be pushed at all until somebody finds the layer that did it.
+		given, err := givenIn(module, raw)
+		if err != nil {
+			return err
+		}
+		if len(given) > 0 {
+			return fmt.Errorf("%s: %s is given per node — a port is a fact about one machine; "+
+				"set it with --node", module, catalogue.PortsSetting)
+		}
 		_, err = i.store.Pool().Exec(ctx,
 			`insert into settings (node, module, values) values (null, $1, $2)
 			 on conflict (module) where node is null

internal/inventory/ports_test.go

@@ -2,6 +2,7 @@ package inventory
 
 import (
 	"errors"
+	"strings"
 	"testing"
 
 	"github.com/novox/mesh-controller/internal/catalogue"
@@ -318,3 +319,28 @@ func TestAGivenPortHasOneHolderAndReplacesTheAssignment(t *testing.T) {
 		t.Fatalf("the released port %d was not free again (got %d)", assigned.Machine, other.Machine)
 	}
 }
+
+// novox/hq ADR 0100: a port is a fact about one machine, so a layer for the whole mesh cannot give
+// one. Refused where it is set — stored, it refuses every node running the module at composition,
+// and the mesh cannot be pushed until somebody finds the layer that did it.
+func TestAPortGivenForTheWholeMeshIsRefusedWhereItIsSet(t *testing.T) {
+	inv, node := aNodeWithModules(t, "postgres")
+	ctx := t.Context()
+	err := inv.SetSettings(ctx, "", "postgres",
+		map[string]any{catalogue.PortsSetting: map[string]any{"5432": 5433}})
+	if err == nil || !strings.Contains(err.Error(), "per node") {
+		t.Fatalf("a port given for the whole mesh was accepted: %v", err)
+	}
+	layers, err := inv.SettingsFor(ctx, node, "postgres")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(layers) != 0 {
+		t.Fatalf("the refused layer was stored: %v", layers)
+	}
+	// The same values for one machine are the ordinary setting.
+	if err := inv.SetSettings(ctx, node, "postgres",
+		map[string]any{catalogue.PortsSetting: map[string]any{"5432": 5433}}); err != nil {
+		t.Fatal(err)
+	}
+}