Converge only on the preview the operator saw, named by its digest, and never on an account older than 15 minutes (hq ADR 0100)

cmd/mesh-controller/adopting_test.go

@@ -115,7 +115,7 @@ func TestTakingAModuleNotOnTheNodeIsRefused(t *testing.T) {
 
 func TestConvergingIsRefusedOnAPreviewThatWouldBeStale(t *testing.T) {
 	open, sent := anAdoptedAnchor(t)
-	_, err := converge(t.Context(), open, "anchor", false, "")
+	_, err := converge(t.Context(), open, "anchor", false, "", "")
 	if err == nil || !strings.Contains(err.Error(), "has not reported") {
 		t.Fatalf("a node that never reported was previewed: %v", err)
 	}
@@ -127,7 +127,7 @@ func TestConvergingIsRefusedOnAPreviewThatWouldBeStale(t *testing.T) {
 func TestTheFlipIsRefusedWhileAFoundContainerIsHeld(t *testing.T) {
 	open, sent := anAdoptedAnchor(t)
 	reportsHolding(t, open, heldContainer, heldFile)
-	_, err := converge(t.Context(), open, "anchor", true, "")
+	_, err := converge(t.Context(), open, "anchor", true, "", "")
 	if err == nil || !strings.Contains(err.Error(), "take anchor hello-web once its data has moved") {
 		t.Fatalf("the flip was not refused while hello-web holds its found container: %v", err)
 	}
@@ -157,7 +157,7 @@ func TestConvergingPreviewsThenChangesAndAdoptingKeepsWhatWasTaken(t *testing.T)
 	}
 	reportsHolding(t, open, heldFile)
 
-	preview, err := converge(ctx, open, "anchor", false, "")
+	preview, err := converge(ctx, open, "anchor", false, "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -191,7 +191,7 @@ func TestConvergingPreviewsThenChangesAndAdoptingKeepsWhatWasTaken(t *testing.T)
 		t.Fatal("the preview changed something")
 	}
 
-	if _, err := converge(ctx, open, "anchor", true, ""); err != nil {
+	if _, err := converge(ctx, open, "anchor", true, digestIn(t, preview), ""); err != nil {
 		t.Fatal(err)
 	}
 	n, _ := open.inventory.NodeByName(ctx, "anchor")
@@ -245,7 +245,7 @@ func hasID(resources []map[string]any, id string) bool {
 func TestTheApiRefusesTheFlipInTheCommandLinesWords(t *testing.T) {
 	open, _ := anAdoptedAnchor(t)
 	reportsHolding(t, open, heldContainer)
-	_, direct := converge(t.Context(), open, "anchor", true, "")
+	_, direct := converge(t.Context(), open, "anchor", true, "", "")
 	if direct == nil {
 		t.Fatal("the flip was not refused")
 	}
@@ -283,7 +283,7 @@ func TestThePreviewSaysWhatNarrowsToTheMeshCloses(t *testing.T) {
 		{Protocol: "tcp", Address: "0.0.0.0", Port: 8080, By: "hello-web", Published: true,
 			ContainerPort: 80},
 	})
-	preview, err := converge(ctx, open, "anchor", false, "")
+	preview, err := converge(ctx, open, "anchor", false, "", "")
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -307,3 +307,81 @@ func TestThePreviewSaysWhatNarrowsToTheMeshCloses(t *testing.T) {
 		t.Errorf("a port open to everywhere is not said to stay:\n%s", preview)
 	}
 }
+
+// digestIn is the digest a converge preview printed.
+func digestIn(t *testing.T, preview string) string {
+	t.Helper()
+	for _, line := range strings.Split(preview, "\n") {
+		if fields := strings.Fields(line); len(fields) == 2 && fields[0] == "preview" {
+			return fields[1]
+		}
+	}
+	t.Fatalf("the preview printed no digest:\n%s", preview)
+	return ""
+}
+
+// The flip acts on the preview the operator saw: it names that preview's digest, and it is refused
+// when the digest is missing, when anything the preview says has changed since, or when the node's
+// account of itself is too old to be the machine as it is.
+func TestTheFlipActsOnlyOnThePreviewTheOperatorSaw(t *testing.T) {
+	open, sent := anAdoptedAnchor(t)
+	ctx := t.Context()
+	if _, err := take(ctx, open, "anchor", "hello-web"); err != nil {
+		t.Fatal(err)
+	}
+	reportsHolding(t, open, heldFile)
+	preview, err := converge(ctx, open, "anchor", false, "", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	saw := digestIn(t, preview)
+	if !strings.Contains(preview, "converge anchor --yes "+saw) {
+		t.Fatalf("the preview does not say how to act on it:\n%s", preview)
+	}
+	unchanged := func() {
+		t.Helper()
+		if n, _ := open.inventory.NodeByName(ctx, "anchor"); !n.Adopted || len(*sent) != 0 {
+			t.Fatal("a refused flip changed something")
+		}
+	}
+
+	if _, err := converge(ctx, open, "anchor", true, "", ""); err == nil ||
+		!strings.Contains(err.Error(), "--yes "+saw) {
+		t.Fatalf("a flip naming no preview was not refused: %v", err)
+	}
+	unchanged()
+
+	// Something new is reachable: the preview the operator saw is not what would happen.
+	reportsReaching(t, open, []link.Reach{
+		{Protocol: "tcp", Address: "0.0.0.0", Port: 22, By: "sshd"},
+		{Protocol: "tcp", Address: "0.0.0.0", Port: 8080, By: "hello-web", Published: true,
+			ContainerPort: 80},
+		{Protocol: "tcp", Address: "0.0.0.0", Port: 6000, By: "something-new"},
+	}, heldFile)
+	_, err = converge(ctx, open, "anchor", true, saw, "")
+	if err == nil || !strings.Contains(err.Error(), "has changed since preview "+saw) {
+		t.Fatalf("a flip on a changed preview was not refused: %v", err)
+	}
+	unchanged()
+
+	// An account older than the flip trusts is refused, whatever digest is named.
+	again, err := converge(ctx, open, "anchor", false, "", "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	saved := reportFreshFor
+	reportFreshFor = time.Nanosecond
+	_, err = converge(ctx, open, "anchor", true, digestIn(t, again), "")
+	reportFreshFor = saved
+	if err == nil || !strings.Contains(err.Error(), "wait for its next report") {
+		t.Fatalf("a flip on an old account was not refused: %v", err)
+	}
+	unchanged()
+
+	if _, err := converge(ctx, open, "anchor", true, digestIn(t, again), ""); err != nil {
+		t.Fatalf("the flip on the preview just seen was refused: %v", err)
+	}
+	if n, _ := open.inventory.NodeByName(ctx, "anchor"); n.Adopted {
+		t.Fatal("the flip did not converge the node")
+	}
+}