Keep the mesh's trust anchors at the terminal, refuse containerd's tree, and read a found directory as a wait

The review of #170: step-ca's root, roots and path and the identity
provider's issuer are what every consumer trusts, and any caller of the
settings verb could replace them; they are now terminal keys like places and
accesses (hq issue 339). /var/lib/containerd joins the runtimes' data. And a
directory the node-engine uses as found failed its module's gate and rolled
its builds back; found before the send, it is now a wait for a person the
gate passes with, as a relogin is (ADR 0254), and only one the send itself
found holds the module.

cmd/mesh-controller/terminal_settings_test.go

@@ -150,3 +150,47 @@ func TestPlacesAndAccessesAreRefusedThroughEveryVerb(t *testing.T) {
 		t.Fatalf("a refused call changed the layer: %s, was %s", got, kept)
 	}
 }
+
+// The mesh's trust anchors are set at the terminal alone (novox/hq issue 339): through the settings verb, a caller
+// could replace the internal authority's root every consumer trusts, or the issuer every login is checked against.
+func TestATrustAnchorIsRefusedThroughAVerb(t *testing.T) {
+	open := aMesh(t)
+	ctx := t.Context()
+	register(t, open, catalogue.Manifest{Module: "step-ca", Version: "1",
+		Provides: catalogue.FromAnywhere("acme-ca"),
+		Serves:   map[string]map[string]any{"acme-ca": {"root": "", "path": "/acme/acme/directory"}},
+		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/step.conf", "mode": "0644",
+			"content": "x = ${setting:x}\n"}}})
+	register(t, open, catalogue.Manifest{Module: "keycloak", Version: "1",
+		Provides: catalogue.FromAnywhere("oidc-client"),
+		Serves:   map[string]map[string]any{"oidc-client": {"issuer": "${setting:issuer}"}},
+		Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/kc.conf", "mode": "0644",
+			"content": "issuer = ${setting:issuer}\nx = ${setting:x}\n"}}})
+	for _, m := range []string{"step-ca", "keycloak"} {
+		if _, err := assign(ctx, open, "anchor", m); err != nil {
+			t.Fatal(err)
+		}
+	}
+	refused := func(what string, err error) {
+		t.Helper()
+		if err == nil || !strings.Contains(err.Error(), "controller's terminal") {
+			t.Fatalf("%s: %v", what, err)
+		}
+	}
+	if err := atTheTerminal(t, "settings", "set", "keycloak", `{"issuer":"https://id.example/realms/mesh","x":0}`,
+		"--node", "anchor"); err != nil {
+		t.Fatalf("the issuer at the terminal: %v", err)
+	}
+	refused("the issuer through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak",
+		"node": "anchor", "values": `{"issuer":"https://evil.example/realms/mesh","x":0}`}))
+	refused("the authority's root path through the verb", throughVerb(t, "settings", map[string]any{"module": "step-ca",
+		"node": "anchor", "values": `{"path":"/evil","x":0}`}))
+	refused("the authority's root path, mesh-wide, through the verb", throughVerb(t, "settings",
+		map[string]any{"module": "step-ca", "values": `{"path":"/evil"}`}))
+	refused("clearing the issuer through the verb", throughVerb(t, "settings", map[string]any{"module": "keycloak",
+		"node": "anchor", "clear": "true"}))
+	if err := throughVerb(t, "settings", map[string]any{"module": "keycloak", "node": "anchor",
+		"values": `{"issuer":"https://id.example/realms/mesh","x":1}`}); err != nil {
+		t.Fatalf("another key through the verb, the issuer kept: %v", err)
+	}
+}