Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions, hands bus accounts to the vault and judges the new manifest words, on the feature's SDK and node-engine validator (feature 57, config and provisioning).
2026-10-15 21:27:33 +00:00
parent fcdecb4361
commit 97a2d841c7
349 changed files with 42440 additions and 786 deletions
@@ -0,0 +1,58 @@
+package broker
+
+import "testing"
+
+// Issue 786 (novox/hq ADR 0372): each machine's node-engine may ask the vault's node-key in its own name, the
+// subject that names it and no other machine's, once the vault's holder serves it; and nothing else of the vault's
+// is granted by it. A vault that does not serve it grants nothing.
+func TestANodeEngineMayStateItsSealingKeyToTheVaultInItsOwnNameAlone(t *testing.T) {
+	vault := Declared{Module: "mesh-vault", Holds: []Seat{{Name: "mesh-vault", Serves: []string{"get", "node-key"}}}}
+	users, err := Users(Records{Nodes: []string{"anchor", "shanks"}, Assigned: map[string][]Declared{"anchor": {vault}}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	var anchor Principal
+	for _, u := range users {
+		if u.Kind == KindNode && u.Node == "anchor" {
+			anchor = u
+		}
+	}
+	p, err := PermissionsFor(anchor)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !MayPublish(p, CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.anchor")) {
+		t.Error("anchor's node-engine may not state its key to the vault in its own name")
+	}
+	for _, s := range []string{CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.shanks"),
+		CalledSubject("mesh.seat.mesh-vault.tool.node-key", ControllerName),
+		CalledSubject("mesh.seat.mesh-vault.tool.get", "node.anchor"),
+		CalledSubject("mesh.seat.mesh-vault.tool.move-in", "node.anchor"),
+		"mesh.seat.mesh-vault.tool.node-key"} {
+		if MayPublish(p, s) {
+			t.Errorf("anchor's node-engine may publish %s", s)
+		}
+	}
+	for _, u := range users {
+		if u.Kind == KindModule && u.Module == "mesh-vault" {
+			h, err := PermissionsFor(u)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if !MaySubscribe(h, CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.anchor")) {
+				t.Error("the vault's holder does not hear node-key asked by a node-engine")
+			}
+		}
+	}
+	older := Declared{Module: "mesh-vault", Holds: []Seat{{Name: "mesh-vault", Serves: []string{"get", "move-in"}}}}
+	users, _ = Users(Records{Nodes: []string{"anchor"}, Assigned: map[string][]Declared{"anchor": {older}}})
+	for _, u := range users {
+		if u.Kind != KindNode {
+			continue
+		}
+		q, _ := PermissionsFor(u)
+		if MayPublish(q, CalledSubject("mesh.seat.mesh-vault.tool.node-key", "node.anchor")) {
+			t.Error("a node-engine may state its key while the vault does not serve node-key")
+		}
+	}
+}