Land feature 57's controller work on its release branch

The controller plans config, templates and moved providers' provisions, hands bus accounts to the vault and judges the new manifest words, on the feature's SDK and node-engine validator (feature 57, config and provisioning).
2026-10-15 21:27:33 +00:00
parent fcdecb4361
commit 97a2d841c7
349 changed files with 42440 additions and 786 deletions
@@ -529,3 +529,59 @@ func TestAModuleOfItsOwnAccountIsRefusedTheOperatorsAndTheAgentsAccount(t *testi
 		}
 	}
 }
+
+// Issue 723: the vault runs as its own account, so what the mesh writes for it — the export it keeps, the grant
+// files it holds for its consumers, and what its words name — belongs to that account, never the operator's.
+func TestWhatAModuleOfItsOwnAccountReadsIsItsAccounts(t *testing.T) {
+	with := Rendering{ArtifactStore: "anchor.internal:5101",
+		Needed: map[string]map[string]string{RuntimeModule: {"broker": "sealed-credential"}, "vault": {"broker": "own"}},
+		Kept:   &KeptExport{Export: 1, OperatorKey: "k"},
+		Grants: []Grant{{Provision: "secret", Consumer: "anchor", From: "telegram",
+			Values: map[string]any{"name": "telegram"}}}}
+	goRuntime := Manifest{Module: RuntimeModule, Version: "1",
+		OwnSecrets: OwnSecrets{"broker": {Path: "/var/lib/mesh/" + RuntimeModule + "/broker"}},
+		Build: &Build{Artifacts: []Artifact{{Name: "runtime", Kind: ArtifactBundle, Language: "go",
+			System: "arch", From: "cmd/node-tools"}}}}
+	goRuntime, err := goRuntime.Resolve([]Built{{Name: "runtime", Kind: ArtifactBundle,
+		Reference: ArtifactStoreScheme + RuntimeModule + "/runtime/blobs/" + bundleDigest, Digest: bundleDigest}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	vault := aToolsModule(t, "vault", "tools/index.js")
+	vault.RunsAs, vault.SecretsOwner = "vault", "vault"
+	vault.OwnSecrets = OwnSecrets{"broker": {Path: "/var/lib/vault/broker"}}
+	vault.Keeps = "/var/lib/vault/root"
+	vault.Grants = map[string]string{"secret": "/var/lib/vault/grants"}
+	vault.Receives = map[string]string{"secret": "/var/lib/vault/grants/mesh.json"}
+	vault.Bundles[0].Env = map[string]string{"MESH_RECEIVES": "/var/lib/vault/grants/mesh.json"}
+	out, err2 := Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{vault, goRuntime}}.Declaration(with)
+	if err = err2; err != nil {
+		t.Fatal(err)
+	}
+	seen := 0
+	for _, r := range out {
+		path := fmt.Sprint(r["path"])
+		if !strings.HasPrefix(path, "/var/lib/vault/") || r["type"] != "file" {
+			continue
+		}
+		seen++
+		if r["owner"] != "vault" {
+			t.Errorf("%s (%v) belongs to %v, not the vault's own account", path, r["id"], r["owner"])
+		}
+	}
+	if seen < 4 {
+		t.Errorf("only %d of the vault's files were composed: %v", seen, ids(out))
+	}
+	// Carried by the machine's runtime instead, nothing of it changes: the operator's account reads them.
+	carried := vault
+	carried.RunsAs, carried.SecretsOwner = "", ""
+	out, err = Resolution{Node: "anchor", Account: "ops", Modules: []Manifest{carried, goRuntime}}.Declaration(with)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out {
+		if path := fmt.Sprint(r["path"]); strings.HasPrefix(path, "/var/lib/vault/") && r["owner"] == "vault" {
+			t.Errorf("%s belongs to the vault's account though it runs as none", path)
+		}
+	}
+}