Sign the hand-over ask, and fail the line on the engine's refusal (hq issue 356, review)

The subject proved nothing: the bus lets any principal allowed to answer reply to a message it received on the reply subject that message named, so a tool server — the operator's account, every agent — could deliver a hand-over to an engine. The controller now signs the ask with the mesh's key over a fixed context (node, path, who asked, a minute's expiry, a fresh nonce), as declarations are signed, and the engine verifies it. The writers table gains the row for mesh.node.*.ask.hand-over; the subject's comment no longer claims who the engine hears. The line's known-node check and the refusal branch are tested; every check was removed in turn and a test failed.

cmd/mesh-controller/handover_test.go

@@ -1,6 +1,8 @@
 package main
 
 import (
+	"bytes"
+	"errors"
 	"strings"
 	"testing"
 	"time"
@@ -88,3 +90,45 @@ func TestTheUsedAsFoundConditionNamesTheOperatorsLine(t *testing.T) {
 		t.Fatalf("the module's health reads %v %q; want the operator's line", h, why)
 	}
 }
+
+// **Nothing is asked of a node the mesh does not know, and the engine's refusal is the command's failure**
+// (review of issue 356): a refused hand-over never exits as a success.
+func TestAHandOverAsksOnlyAKnownNodeAndFailsOnARefusal(t *testing.T) {
+	t.Setenv(link.CallerVar, "jo through mesh-cli on anchor")
+	asked := 0
+	ask := func(answer link.HandOverAnswer) func(node, path, by string) (link.HandOverAnswer, error) {
+		return func(node, path, by string) (link.HandOverAnswer, error) {
+			asked++
+			if node != "laptop" || path != "/srv/notes" || by != "jo through mesh-cli on anchor" {
+				t.Fatalf("asked %q %q %q", node, path, by)
+			}
+			return answer, nil
+		}
+	}
+	unknown := func(string) error { return errors.New("no node called laptop") }
+	known := func(string) error { return nil }
+	var out bytes.Buffer
+	err := handOverAsked([]string{"laptop", "/srv/notes"}, unknown, ask(link.HandOverAnswer{Said: "x"}), &out)
+	if err == nil || asked != 0 || !strings.Contains(err.Error(), "nothing was asked") {
+		t.Fatalf("an unknown node: %v, asked %d", err, asked)
+	}
+	err = handOverAsked([]string{"laptop", "/srv/../etc"}, known, ask(link.HandOverAnswer{Said: "x"}), &out)
+	if err == nil || asked != 0 {
+		t.Fatalf("a refused line was asked: %v, asked %d", err, asked)
+	}
+	err = handOverAsked([]string{"laptop", "/srv/notes"}, known,
+		ask(link.HandOverAnswer{Refused: "/srv/notes is not used as found; nothing was handed over"}), &out)
+	if err == nil || !strings.Contains(err.Error(), "laptop refused: /srv/notes is not used as found") || out.Len() != 0 {
+		t.Fatalf("a refusal: %v, printed %q", err, out.String())
+	}
+	err = handOverAsked([]string{"laptop", "/srv/notes"}, known, ask(link.HandOverAnswer{Said: "handed over"}), &out)
+	if err != nil || !strings.HasPrefix(out.String(), "handed over\n") || !strings.Contains(out.String(), "`nox push laptop`") {
+		t.Fatalf("a record: %v, printed %q", err, out.String())
+	}
+	failing := func(string, string, string) (link.HandOverAnswer, error) {
+		return link.HandOverAnswer{}, errors.New("no engine")
+	}
+	if err := handOverAsked([]string{"laptop", "/srv/notes"}, known, failing, &out); err == nil {
+		t.Fatal("an ask that failed was a success")
+	}
+}

cmd/mesh-controller/nodes.go

@@ -118,7 +118,7 @@ func nodeCommand(ctx context.Context, args []string) error {
 		// A directory the node-engine uses as found, handed to the mesh (novox/hq issue 356, issue 339). Here, at
 		// the controller's terminal, and nowhere else: at the next apply root gives the directory to the account
 		// the module declares, and whoever may call a verb includes agents.
-		return nodeHandOver(ctx, inv, args[1:])
+		return nodeHandOver(ctx, open, args[1:])
 
 	default:
 		return fmt.Errorf("node has no %q; it has add, list, show, public-domain, account, agent-account and hand-over", args[0])
@@ -160,33 +160,53 @@ func handOverBy() string {
 
 // nodeHandOver asks the node's engine to take a directory it uses as found as the mesh's, and says what came of
 // it. The engine records the hand-over or refuses; nothing is recorded here, because the directory is the
-// machine's and the engine is the one that reads it.
-func nodeHandOver(ctx context.Context, inv *inventory.Inventory, args []string) error {
+// machine's and the engine is the one that reads it. The ask is signed with the mesh's key (issue 356's review).
+func nodeHandOver(ctx context.Context, open *stores, args []string) error {
+	known := func(node string) error {
+		_, err := open.inventory.NodeByName(ctx, node)
+		return err
+	}
+	ask := func(node, path, by string) (link.HandOverAnswer, error) {
+		ident, err := open.Identity(ctx)
+		if err != nil {
+			return link.HandOverAnswer{}, fmt.Errorf("the mesh's signing key cannot be read, so nothing was asked of %s: %w",
+				node, err)
+		}
+		address, err := broker.BusAddress()
+		if err != nil {
+			return link.HandOverAnswer{}, err
+		}
+		js, err := broker.Dial(address)
+		if err != nil {
+			return link.HandOverAnswer{}, fmt.Errorf("cannot reach the bus, so nothing was asked of %s: %w", node, err)
+		}
+		defer js.Close()
+		return link.AskHandOver(ctx, js.Conn(), ident, node, path, by, link.HandOverWithin)
+	}
+	return handOverAsked(args, known, ask, os.Stdout)
+}
+
+// handOverAsked is the hand-over's line with its two acts given: whether the mesh knows the node, and the ask.
+// Nothing is asked of a line or a node that is refused, and the engine's refusal is this command's failure —
+// never a success with the refusal printed.
+func handOverAsked(args []string, known func(node string) error,
+	ask func(node, path, by string) (link.HandOverAnswer, error), out io.Writer) error {
 	node, path, err := handOverLine(args)
 	if err != nil {
 		return err
 	}
-	if _, err := inv.NodeByName(ctx, node); err != nil {
-		return err
+	if err := known(node); err != nil {
+		return fmt.Errorf("nothing was asked: %w", err)
 	}
-	address, err := broker.BusAddress()
-	if err != nil {
-		return err
-	}
-	js, err := broker.Dial(address)
-	if err != nil {
-		return fmt.Errorf("cannot reach the bus, so nothing was asked of %s: %w", node, err)
-	}
-	defer js.Close()
-	answer, err := link.AskHandOver(ctx, js.Conn(), node, path, handOverBy(), link.HandOverWithin)
+	answer, err := ask(node, path, handOverBy())
 	if err != nil {
 		return err
 	}
 	if answer.Refused != "" {
 		return fmt.Errorf("%s refused: %s", node, answer.Refused)
 	}
-	fmt.Println(answer.Said)
-	fmt.Printf("  the module's condition clears once %s applies; `nox push %s` applies it now\n", node, node)
+	fmt.Fprintln(out, answer.Said)
+	fmt.Fprintf(out, "  the module's condition clears once %s applies; `nox push %s` applies it now\n", node, node)
 	return nil
 }