A new module from a repository nothing registered is built from registers on the operator's Approve of its merge (issue 1146, ADR 0432)

2026-10-18 19:04:38 +02:00
parent 6746ab6492
commit 8c0fa40e65
6 changed files with 277 additions and 10 deletions
@@ -0,0 +1,112 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"strings"
+	"testing"
+	"time"
+
+	"git.novox.be/novox/mesh-sdk/go/asks"
+	"github.com/novox/mesh-controller/internal/catalogue"
+	"github.com/novox/mesh-controller/internal/inventory"
+)
+
+// **The operator's Approve of a merge registers a new module from its repository** (novox/hq ADR 0432, issue 1146).
+// The mesh as the decision reads it, with nothing registered from the repository, and the build request and merge the
+// controller kept.
+type anEmptyMesh struct {
+	request inventory.BuildRequest
+	asked   bool
+	merge   inventory.BatchedMerge
+}
+
+func (m *anEmptyMesh) Catalogue(context.Context) (map[string]catalogue.Manifest, error) {
+	return nil, nil
+}
+func (m *anEmptyMesh) SourceOf(context.Context, string) (inventory.Source, error) {
+	return inventory.Source{}, inventory.ErrNoSuchModule
+}
+func (m *anEmptyMesh) SourceIdentity(context.Context, string) (int64, error) { return 0, nil }
+func (m *anEmptyMesh) Catalogued(context.Context) ([]inventory.Entry, error) { return nil, nil }
+func (m *anEmptyMesh) BuildRequestByID(_ context.Context, id string) (inventory.BuildRequest, bool, error) {
+	return m.request, m.asked && id == m.request.ID, nil
+}
+func (m *anEmptyMesh) MergeOf(context.Context, string, string) (inventory.BatchedMerge, bool, error) {
+	return m.merge, true, nil
+}
+
+func TestANewModuleIsRegisteredOnTheOperatorsApproveOfItsMergeAndRefusedOtherwise(t *testing.T) {
+	const commit, head = "c0ffee0123456789", "a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1a1"
+	built := inventory.Source{Repository: "novox/mesh-delivery", Seat: "git"}
+	for _, c := range []struct {
+		what     string
+		change   func(*anApprovedMerge)
+		request  string // "merge", or "build" through a verb
+		unkept   bool
+		forge    any // what the forge says of the repository; nil is protected
+		built    *inventory.Source
+		accepted bool
+		ac       string
+	}{
+		{what: "the Approve of the merged head, a protected trunk on the forge", request: "merge", accepted: true, ac: "1146/AC1"},
+		{what: "a build asked through a verb", request: "build", ac: "1146/AC2"},
+		{what: "a merge with no warrant", request: "merge", unkept: true, ac: "1146/AC2"},
+		{what: "a warrant of another head", request: "merge", ac: "1146/AC2", change: func(a *anApprovedMerge) {
+			a.merge.Heads = map[string]string{"novox/mesh-host@aaaaaaaaaaaa": "e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5e5"}
+		}},
+		{what: "a repository not on the mesh's forge", request: "merge", ac: "1146/AC3",
+			built: &inventory.Source{Repository: "http://elsewhere.example/x/y.git"}},
+		{what: "a forge that cannot be asked", request: "merge", ac: "1146/AC3", forge: errors.New("connection refused")},
+		{what: "an unprotected trunk", request: "merge", ac: "1146/AC3", forge: forgeFacts{ID: 9, Guarded: false, Why: "direct push"}},
+	} {
+		t.Run(c.ac+" "+c.what, func(t *testing.T) {
+			a := approvedMerge(t)
+			a.merge.Owner, a.merge.Repo, a.merge.Number, a.merge.HeadSHA = "novox", "mesh-delivery", 7, head
+			if c.change != nil {
+				c.change(&a)
+			}
+			wasKept, wasAsk := keptDeliveryMerge, routerAskOf
+			t.Cleanup(func() { keptDeliveryMerge, routerAskOf = wasKept, wasAsk })
+			keptDeliveryMerge = func(context.Context, string, string, int, string) (deliveryMerge, bool, error) {
+				return a.merge, !c.unkept, nil
+			}
+			routerAskOf = func(context.Context, catalogueReader, string) (*asks.Ask, *asks.Warrant, error) {
+				return &a.ask, &a.warrant, nil
+			}
+			if c.forge != nil {
+				theForge.Store("novox/mesh-delivery", c.forge)
+				t.Cleanup(func() { theForge.Delete("novox/mesh-delivery") })
+			}
+			event, _ := json.Marshal(map[string]any{"owner": "novox", "repo": "mesh-delivery", "base": "main", "number": 7,
+				"head_sha": head, "merge_commit_sha": commit})
+			mesh := &anEmptyMesh{asked: true, merge: inventory.BatchedMerge{Repository: "novox/mesh-delivery", Branch: "main",
+				Commit: commit, Merged: time.Now(), Event: event},
+				request: inventory.BuildRequest{ID: "build-1", Repository: "novox/mesh-delivery", Seat: "git", Path: "",
+					Ref: "main", Commit: commit, For: c.request}}
+			forms := &sourceForms{bases: map[string]string{}, base: func(seat string) string {
+				if seat == "git" {
+					return "http://forge.internal:20000"
+				}
+				return ""
+			}}
+			src := built
+			if c.built != nil {
+				src = *c.built
+			}
+			id, err := mayRegisterIn(t.Context(), mesh, forms, "mesh-delivery-view", src, "build-1", "", "main")
+			switch {
+			case c.accepted && err != nil:
+				t.Fatalf("%s: the Approved merge's new module was refused: %v", c.ac, err)
+			case c.accepted && id == 0:
+				t.Fatalf("%s: registered with no forge identity to record", c.ac)
+			case !c.accepted && !errors.Is(err, errNotItsSource):
+				t.Fatalf("%s: %s was not refused: %v", c.ac, c.what, err)
+			case !c.accepted && c.ac == "1146/AC2" &&
+				(!strings.Contains(err.Error(), "controller's terminal") || !strings.Contains(err.Error(), "Approve")):
+				t.Fatalf("%s: the refusal does not name both ways in: %v", c.ac, err)
+			}
+		})
+	}
+}