Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 jochen
|
19173aeb07 |
@@ -1,145 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"sort"
|
||||
"strings"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
)
|
||||
|
||||
// A provision whose credential only a person outside the mesh can give (novox/hq ADR 0337, issue 164, issue 165):
|
||||
// given once for its provider, at the controller's terminal, and sealed in one act to every consumer that binds the
|
||||
// provision from that provider now. The value is never read back, printed or kept.
|
||||
|
||||
// outsideOffer is the provider module's own name when `secret accept <node> <module> <name>` names a provision that
|
||||
// module offers with a credential issued outside the mesh, and "" when it names anything else (an own secret, or a
|
||||
// pair with --provider).
|
||||
func outsideOffer(ctx context.Context, module, name, provider string) (string, error) {
|
||||
if provider != "" {
|
||||
return "", nil
|
||||
}
|
||||
open, err := openStores(ctx)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer open.Close()
|
||||
shelf, err := open.inventory.Catalogue(ctx)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
if m, known := shelf[module]; known && m.IssuedOutsideOf(name) {
|
||||
return module, nil
|
||||
}
|
||||
return "", nil
|
||||
}
|
||||
|
||||
// offeredOutsideBy is a module that offers the provision with a credential issued outside the mesh, or "".
|
||||
func offeredOutsideBy(ctx context.Context, provision string) (string, error) {
|
||||
open, err := openStores(ctx)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer open.Close()
|
||||
shelf, err := open.inventory.Catalogue(ctx)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
module, _ := catalogue.OffersIssuedOutside(shelf, provision)
|
||||
return module, nil
|
||||
}
|
||||
|
||||
// consumersFrom is every consumer that binds a provision from one provider now, found by resolving every machine as
|
||||
// its next send would, and the machines that could not be resolved, with why.
|
||||
func consumersFrom(ctx context.Context, open *stores, provider, providerModule, provision string) (
|
||||
[]inventory.PairEnd, []string, error) {
|
||||
nodes, err := open.inventory.Nodes(ctx)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
var out []inventory.PairEnd
|
||||
var unresolved []string
|
||||
for _, n := range nodes {
|
||||
plan, _, err := planFor(ctx, open, n.Name)
|
||||
if err != nil {
|
||||
unresolved = append(unresolved, fmt.Sprintf("%s: %s", n.Name, oneLine(err.Error())))
|
||||
continue
|
||||
}
|
||||
out = append(out, bindsFrom(plan, n.Name, provider, providerModule, provision)...)
|
||||
}
|
||||
return out, unresolved, nil
|
||||
}
|
||||
|
||||
// bindsFrom is every consumer on one machine whose resolution answers the provision from that provider. Pure.
|
||||
func bindsFrom(plan catalogue.Resolution, machine, provider, providerModule, provision string) []inventory.PairEnd {
|
||||
var out []inventory.PairEnd
|
||||
for _, need := range plan.Needs {
|
||||
if need.ByRecord || need.Name != provision || need.From != provider {
|
||||
continue
|
||||
}
|
||||
if need.Module != "" && need.Module != providerModule {
|
||||
continue
|
||||
}
|
||||
out = append(out, inventory.PairEnd{Consumer: machine, ConsumerModule: need.For, Local: need.Local})
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool {
|
||||
return out[i].ConsumerModule+"\x00"+out[i].Local < out[j].ConsumerModule+"\x00"+out[j].Local
|
||||
})
|
||||
return out
|
||||
}
|
||||
|
||||
// acceptForProvision gives a provision's credential issued outside the mesh, once for its provider (ADR 0337 §3).
|
||||
func acceptForProvision(ctx context.Context, provider, providerModule, provision, value string) error {
|
||||
open, err := openStores(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
defer open.Close()
|
||||
consumers, unresolved, err := consumersFrom(ctx, open, provider, providerModule, provision)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
accepted, err := open.inventory.AcceptSecretForProvision(ctx, provision, provider, providerModule, value, consumers)
|
||||
value = ""
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
fmt.Print(acceptedSaid(provider, providerModule, provision, accepted, unresolved))
|
||||
if len(accepted.Sealed) == 0 {
|
||||
return nil
|
||||
}
|
||||
if err := sendTo(ctx, open, accepted.Machines); err != nil {
|
||||
return fmt.Errorf("%s is sealed and could not be sent: %w; `push %s` sends it", provision, err,
|
||||
strings.Join(accepted.Machines, "`, `push "))
|
||||
}
|
||||
fmt.Printf(" sent %s; each consumer starts again on it\n", strings.Join(accepted.Machines, ", "))
|
||||
return nil
|
||||
}
|
||||
|
||||
// acceptedSaid is what one accept for a provider did, in words that never carry the value. Pure.
|
||||
func acceptedSaid(provider, providerModule, provision string, a inventory.ProvisionAccepted, unresolved []string) string {
|
||||
var b strings.Builder
|
||||
if len(a.Sealed) == 0 {
|
||||
fmt.Fprintf(&b, "%s from %s on %s: no consumer binds it now, so nothing was sealed; a consumer that binds "+
|
||||
"later waits for it, and this line given again seals it to every consumer then\n", provision,
|
||||
providerModule, provider)
|
||||
} else {
|
||||
var names []string
|
||||
for _, c := range a.Sealed {
|
||||
names = append(names, fmt.Sprintf("%s on %s%s", c.ConsumerModule, c.Consumer, asLocal(c.Local)))
|
||||
}
|
||||
fmt.Fprintf(&b, "%s from %s on %s is given, sealed to %s and to %s\n", provision, providerModule, provider,
|
||||
strings.Join(names, ", "), provider)
|
||||
fmt.Fprintf(&b, " the mesh cannot read it back, never makes one of its own for it, and will not rotate it\n")
|
||||
}
|
||||
for _, c := range a.Unsealable {
|
||||
fmt.Fprintf(&b, " not sealed to %s on %s: no sealing key on that machine; give it again once it has one\n",
|
||||
c.ConsumerModule, c.Consumer)
|
||||
}
|
||||
for _, u := range unresolved {
|
||||
fmt.Fprintf(&b, " not known whether a consumer on %s binds it, which did not resolve; give it again once it does\n", u)
|
||||
}
|
||||
return b.String()
|
||||
}
|
||||
@@ -203,9 +203,8 @@ func seatDependenciesOnAssign(ctx context.Context, open *stores, node string, mo
|
||||
if _, err := catalogue.AssignRefusal(shelf, node, assigned, adding); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
// Two modules declaring one path or unit, or one package present and absent, is refused before anything
|
||||
// is recorded (novox/hq ADR 0210, ADR 0303, 04-ISSUES/235): kept, the node would not resolve until one came
|
||||
// off again. Two modules declaring one package present is not a collision (ADR 0303, issue 628).
|
||||
// Two modules declaring one package, path or unit is refused before anything is recorded
|
||||
// (novox/hq ADR 0210, 04-ISSUES/235): kept, the node would not resolve until one came off again.
|
||||
if err := catalogue.CollisionRefusal(shelf, node, assigned, adding); err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
|
||||
@@ -722,7 +722,7 @@ func converge(ctx context.Context, open *stores, node string, yes bool, digest s
|
||||
return "", err
|
||||
}
|
||||
derived := derivedFilter{rules: rules, foundation: with.Foundation, mesh: with.Mesh,
|
||||
outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks, local: with.LocalNetworks}
|
||||
outward: plan.PublicDomain != "", outwardLinks: with.OutwardLinks}
|
||||
filtering, err := inv.FilteringOf(ctx, node)
|
||||
if err != nil {
|
||||
return "", err
|
||||
@@ -930,9 +930,6 @@ type derivedFilter struct {
|
||||
// The filter constrains what arrives on them; everything arriving elsewhere is this machine's
|
||||
// own guest and is not filtered.
|
||||
outwardLinks []string
|
||||
// local is the machine's local networks, which a port from `local-network` stays open to (novox/hq
|
||||
// ADR 0340).
|
||||
local []string
|
||||
}
|
||||
|
||||
// closesOutside is what a narrowing from everywhere to the private network is called: it closes.
|
||||
@@ -980,17 +977,6 @@ func (d derivedFilter) fate(r inventory.Reach) string {
|
||||
if !onMesh {
|
||||
return fmt.Sprintf("%s — declared by %s from the mesh only", closesOutside, by)
|
||||
}
|
||||
case catalogue.FromLocalNetwork:
|
||||
// The private network and this machine's local networks (novox/hq ADR 0340): it closes to
|
||||
// everything else outside, and says which local networks stay.
|
||||
if !onMesh {
|
||||
if len(d.local) == 0 {
|
||||
return fmt.Sprintf("%s — declared by %s from the local network, and this machine "+
|
||||
"reported none", closesOutside, by)
|
||||
}
|
||||
return fmt.Sprintf("WILL CLOSE to everything outside the private network and %s — declared "+
|
||||
"by %s from the local network", strings.Join(d.local, ", "), by)
|
||||
}
|
||||
}
|
||||
return fmt.Sprintf("declared by %s (from %s)", by, rule.From)
|
||||
}
|
||||
|
||||
@@ -55,7 +55,7 @@ func TestARepairByHandCarriesItsReason(t *testing.T) {
|
||||
want string
|
||||
}{
|
||||
{"push", map[string]any{"node": "anchor", "why": "stuck", "cause": "sent-not-reported"},
|
||||
"push anchor --wait 0s --why stuck --cause sent-not-reported"},
|
||||
"push anchor --wait 0 --why stuck --cause sent-not-reported"},
|
||||
{"plans", map[string]any{"close": "plan-1", "why": "the report will not come"},
|
||||
"plans close plan-1 --why the report will not come"},
|
||||
{"plans", map[string]any{"retry": "plan-1"}, "plans retry plan-1"},
|
||||
|
||||
@@ -1,87 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
)
|
||||
|
||||
// A tier whose module is no move — made from the source every machine running it runs, so nothing is
|
||||
// sent — is not waited on for a report after its marking (novox/hq issue 648). Its machines answered the
|
||||
// send that last carried that build before the walk got there, and nothing will make them report again:
|
||||
// the walk asks the next tier in the same step, rather than "waiting for app on anchor, laptop" for ever.
|
||||
func TestANoMoveTierWaitsForNoNewReport(t *testing.T) {
|
||||
judgeLeavesAsTheCore(t)
|
||||
g := aGateMesh(t)
|
||||
ctx := t.Context()
|
||||
inv := g.open.inventory
|
||||
|
||||
// app is the build machine, so a module of the next tier is built by it: the tier gates the next on app
|
||||
// running on its machines.
|
||||
for _, m := range []catalogue.Manifest{
|
||||
{Module: "app", Version: "c2", Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}},
|
||||
{Module: "web", Version: "w1"},
|
||||
} {
|
||||
if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: "novox/mesh-catalog", Seat: "git",
|
||||
Path: "modules/" + m.Module, BuiltFrom: m.Version, Head: m.Version, Asked: time.Now().Add(-time.Minute)}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
// What anchor and laptop were last sent (c1) was made from the source the plan's build of c2 is.
|
||||
for _, b := range []inventory.Build{
|
||||
{ID: "build-1s", Module: "app", Commit: "c1", SourceFingerprint: "src1:app",
|
||||
Asked: time.Now().Add(-30 * time.Second), At: time.Now().Add(-30 * time.Second)},
|
||||
{ID: "build-2s", Module: "app", Commit: "c2", SourceFingerprint: "src1:app", Asked: time.Now(), At: time.Now()},
|
||||
} {
|
||||
b.Manifest, _ = json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
|
||||
if err := inv.RecordBuild(ctx, b); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
// Each machine answered that send, applied, before the walk's tier was built.
|
||||
for _, n := range []string{"anchor", "laptop"} {
|
||||
if _, err := inv.RecordDoing(ctx, nodeID(t, g.open, n), inventory.Doing{Node: n,
|
||||
Outcome: inventory.OutcomeApplied, Declared: "d-" + n + "-c1", Applied: 1,
|
||||
At: time.Now().Add(-10 * time.Second)}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
built := time.Now().UTC()
|
||||
p := g.plan(t)
|
||||
p.Tiers = [][]string{{"app"}, {"web"}}
|
||||
p.Modules["app"].Build, p.Modules["app"].BuiltAt = "build-2s", &built
|
||||
if err := inv.SavePlan(ctx, &p); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
advancePlans(ctx, g.open)
|
||||
|
||||
if len(g.sent) != 0 {
|
||||
t.Fatalf("a no-move build was sent: %v", g.sent)
|
||||
}
|
||||
p = g.plan(t)
|
||||
if s := p.Modules["app"]; s == nil || !strings.HasPrefix(s.Why, "no move") {
|
||||
t.Fatalf("the build was not marked no move: %+v", s)
|
||||
}
|
||||
if p.Tier < 1 || strings.Contains(p.Note, "waiting for app") {
|
||||
t.Fatalf("the walk waits on a no-move tier for a report nothing will cause: tier %d, %s %q", p.Tier, p.State, p.Note)
|
||||
}
|
||||
|
||||
// A machine that has not answered its last send is still waited on: no move is not "never sent".
|
||||
p.Tier, p.State, p.Note = 0, inventory.PlanRolling, ""
|
||||
if err := inv.RecordSent(ctx, nodeID(t, g.open, "laptop"), "d-laptop-later", map[string]string{"app": "c1"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.SavePlan(ctx, &p); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
advancePlans(ctx, g.open)
|
||||
p = g.plan(t)
|
||||
if p.Tier != 0 || !strings.Contains(p.Note, "waiting for app on laptop") {
|
||||
t.Fatalf("a machine that has not answered its last send was not waited on: tier %d, %q", p.Tier, p.Note)
|
||||
}
|
||||
}
|
||||
@@ -1,67 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
"github.com/novox/mesh-controller/internal/overlay"
|
||||
)
|
||||
|
||||
// localNetworksOf is a machine's attached networks judged (novox/hq ADR 0340): which count as its local
|
||||
// network, from what it last said of itself and the links it said face outside it. A machine that has
|
||||
// said none judges to nothing, and a port reached from `local-network` is then admitted from the private
|
||||
// network only, and said so.
|
||||
func localNetworksOf(ctx context.Context, inv *inventory.Inventory, node string) ([]catalogue.LocalNetwork, error) {
|
||||
account, had, err := inv.MachineOf(ctx, node)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
outward, err := inv.OutwardLinksOf(ctx, node)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return judgedNetworks(account, had, outward, overlay.Interface), nil
|
||||
}
|
||||
|
||||
// judgedNetworks is the judging alone, from what was read.
|
||||
func judgedNetworks(account inventory.MachineAccount, had bool, outward []string, tunnel string) []catalogue.LocalNetwork {
|
||||
if !had || account.Machine == nil {
|
||||
return nil
|
||||
}
|
||||
attached := make([]catalogue.AttachedNetwork, 0, len(account.Machine.Networks))
|
||||
for _, n := range account.Machine.Networks {
|
||||
attached = append(attached, catalogue.AttachedNetwork{Link: n.Link, Network: n.Network})
|
||||
}
|
||||
return catalogue.JudgeLocalNetworks(attached, outward, tunnel)
|
||||
}
|
||||
|
||||
// localNetworkLines is what `node` shows of a machine's attached networks (ADR 0340 §8): each one, with
|
||||
// whether it counts as the local network and why, or why none is shown.
|
||||
func localNetworkLines(account inventory.MachineAccount, had bool, judged []catalogue.LocalNetwork) []string {
|
||||
out := []string{" its local network (what a port reached from local-network is admitted from):"}
|
||||
switch {
|
||||
case !had || account.Machine == nil:
|
||||
return append(out, " not said — this machine has not reported what it is attached to")
|
||||
case len(account.Machine.Networks) == 0:
|
||||
why := account.Machine.Unknown["networks"]
|
||||
if why == "" {
|
||||
why = "its node-engine is older than the one that says it"
|
||||
}
|
||||
return append(out, " not said — "+why)
|
||||
}
|
||||
counted := 0
|
||||
for _, j := range judged {
|
||||
verdict := "not counted"
|
||||
if j.Counts {
|
||||
verdict = "counts"
|
||||
counted++
|
||||
}
|
||||
out = append(out, fmt.Sprintf(" %-22s on %-10s %s: %s", j.Network, j.Link, verdict, j.Why))
|
||||
}
|
||||
if counted == 0 {
|
||||
out = append(out, " none counts: a port reached from local-network is admitted from the private network only")
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -1,65 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
)
|
||||
|
||||
// **node shows what the local network resolved to** (novox/hq ADR 0340 §8): every attached network,
|
||||
// whether it counts, and why the others do not — the public subnet named as never counted.
|
||||
func TestNodeShowsWhichAttachedNetworksCountAndWhy(t *testing.T) {
|
||||
account := inventory.MachineAccount{Architecture: "amd64", Kernel: "linux", Machine: &inventory.MadeOf{
|
||||
Networks: []inventory.AttachedNetwork{
|
||||
{Link: "eth0", Network: "192.168.1.10/24"},
|
||||
{Link: "eth1", Network: "203.0.113.7/24"},
|
||||
{Link: "wg-mesh", Network: "10.10.0.4/24"},
|
||||
}}}
|
||||
judged := judgedNetworks(account, true, []string{"eth0", "eth1"}, "wg-mesh")
|
||||
text := strings.Join(localNetworkLines(account, true, judged), "\n")
|
||||
for _, want := range []string{
|
||||
"192.168.1.0/24", "counts: in a private range (RFC 1918, 192.168.0.0/16)",
|
||||
"203.0.113.0/24", "not counted: public, never counted",
|
||||
"10.10.0.0/24", "the private network's own link",
|
||||
} {
|
||||
if !strings.Contains(text, want) {
|
||||
t.Errorf("node does not say %q:\n%s", want, text)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// A machine that said none, or whose node-engine is older, is said as that — never as an empty list
|
||||
// that reads like a machine on no network.
|
||||
func TestNodeSaysWhenNoNetworkWasSaid(t *testing.T) {
|
||||
older := inventory.MachineAccount{Machine: &inventory.MadeOf{}}
|
||||
if text := strings.Join(localNetworkLines(older, true, nil), "\n"); !strings.Contains(text, "older than the one that says it") {
|
||||
t.Errorf("an older node-engine is not said:\n%s", text)
|
||||
}
|
||||
public := inventory.MachineAccount{Machine: &inventory.MadeOf{
|
||||
Networks: []inventory.AttachedNetwork{{Link: "eth0", Network: "198.51.100.9/24"}}}}
|
||||
judged := judgedNetworks(public, true, []string{"eth0"}, "wg-mesh")
|
||||
if text := strings.Join(localNetworkLines(public, true, judged), "\n"); !strings.Contains(text, "none counts") {
|
||||
t.Errorf("a machine on a public network only is not said to have no local network:\n%s", text)
|
||||
}
|
||||
if text := strings.Join(localNetworkLines(inventory.MachineAccount{}, false, nil), "\n"); !strings.Contains(text, "not said") {
|
||||
t.Errorf("a machine that never reported is not said:\n%s", text)
|
||||
}
|
||||
}
|
||||
|
||||
// The preview of a flip says what a port from the local network keeps: the local networks it stays
|
||||
// open to, or that the machine reported none (ADR 0340 §6).
|
||||
func TestTheFlipPreviewSaysWhatALocalNetworkPortKeeps(t *testing.T) {
|
||||
rules := []catalogue.Rule{{Port: 1883, Protocol: "tcp", From: catalogue.FromLocalNetwork, Because: []string{"mosquitto"}}}
|
||||
at := inventory.Reach{Protocol: "tcp", Address: "0.0.0.0", Port: 1883}
|
||||
with := derivedFilter{rules: rules, mesh: []string{"10.10.0.1"}, outwardLinks: []string{"eth0"},
|
||||
local: []string{"192.168.1.0/24"}}
|
||||
if fate := with.fate(at); !strings.Contains(fate, "192.168.1.0/24") {
|
||||
t.Errorf("the preview says %q, without the local network it stays open to", fate)
|
||||
}
|
||||
with.local = nil
|
||||
if fate := with.fate(at); !strings.Contains(fate, "reported none") {
|
||||
t.Errorf("the preview says %q, without saying no local network was reported", fate)
|
||||
}
|
||||
}
|
||||
@@ -75,7 +75,7 @@ func stateHealth(ctx context.Context, inv *inventory.Inventory, k *conditions.Ke
|
||||
State: r.State, Reason: r.Reason, Since: r.Since, Streak: r.Streak, Restarts: r.Restarts,
|
||||
Check: r.Check, Needs: r.Needs, Account: r.Account, Root: r.Root}
|
||||
for _, w := range r.Waits {
|
||||
kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Secret: w.Secret, Setting: w.Setting, Provision: w.Provision, What: w.What})
|
||||
kept.Waits = append(kept.Waits, inventory.Wait{Part: w.Part, Secret: w.Secret, Setting: w.Setting, What: w.What})
|
||||
}
|
||||
resources = append(resources, kept)
|
||||
}
|
||||
|
||||
@@ -684,7 +684,7 @@ func artifactStoreOnNetwork(ctx context.Context, inv *inventory.Inventory,
|
||||
if !offers {
|
||||
continue
|
||||
}
|
||||
serves, _, err := servedOnNode(ctx, inv, machine, m, catalogue.ArtifactStoreProvision)
|
||||
serves, err := servedOnNode(ctx, inv, machine, m, catalogue.ArtifactStoreProvision)
|
||||
if err != nil {
|
||||
return "", "", false, fmt.Errorf("reading where %s puts the artifact store: %w", machine, err)
|
||||
}
|
||||
|
||||
@@ -19,7 +19,6 @@ import (
|
||||
"github.com/novox/mesh-controller/internal/conditions"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
"github.com/novox/mesh-controller/internal/link"
|
||||
"github.com/novox/mesh-controller/internal/overlay"
|
||||
"github.com/novox/mesh-controller/internal/token"
|
||||
)
|
||||
|
||||
@@ -885,16 +884,6 @@ func showNode(ctx context.Context, stored *stores, name string) error {
|
||||
for _, line := range machineLines(account, had, time.Now()) {
|
||||
fmt.Println(line)
|
||||
}
|
||||
// And which of the networks it is attached to count as its local network, and why the others
|
||||
// do not (novox/hq ADR 0340 §8).
|
||||
outward, err := inv.OutwardLinksOf(ctx, name)
|
||||
if err != nil {
|
||||
fmt.Printf(" its local network could NOT be judged: %v\n", err)
|
||||
} else {
|
||||
for _, line := range localNetworkLines(account, had, judgedNetworks(account, had, outward, overlay.Interface)) {
|
||||
fmt.Println(line)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
held, err := inv.Profile(ctx, name)
|
||||
|
||||
@@ -3,7 +3,6 @@ package main
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"slices"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
@@ -45,28 +44,6 @@ func needsOperatorKey(module, node string) string {
|
||||
type operatorWaitFacts struct {
|
||||
manifests map[string]catalogue.Manifest
|
||||
given map[string]map[string]time.Time
|
||||
// outside is, per provision some module offers with a credential issued outside the mesh, that provider module
|
||||
// and the machines it is assigned to (novox/hq ADR 0337); pairsGiven, per "<module>@<machine>", the provisions
|
||||
// it holds a value a person gave for, sealed to the keys both ends have now. Absent is not known: no wait for a
|
||||
// provision of it is excused.
|
||||
outside map[string]outsideProvider
|
||||
pairsGiven map[string]map[string]bool
|
||||
}
|
||||
|
||||
// outsideProvider is the module offering a provision whose credential only a person gives, and where it runs.
|
||||
type outsideProvider struct {
|
||||
Module string
|
||||
Machines []string
|
||||
}
|
||||
|
||||
// acceptLine is the one line that gives an outside provision's credential for every consumer of its provider: on
|
||||
// the provider's machine when it runs on one, named as <machine> when on several or none.
|
||||
func (p outsideProvider) acceptLine(provision string) string {
|
||||
machine := "<its machine>"
|
||||
if len(p.Machines) == 1 {
|
||||
machine = p.Machines[0]
|
||||
}
|
||||
return inventory.AcceptLine(machine, p.Module, provision)
|
||||
}
|
||||
|
||||
// checkWait is nil when a wait is excused, and otherwise why not, in words. Pure.
|
||||
@@ -75,18 +52,9 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
|
||||
if !known {
|
||||
return fmt.Errorf("says it waits for %s, and the mesh holds no manifest of %s to check it against", waitNames(w), module)
|
||||
}
|
||||
named := 0
|
||||
for _, n := range []string{w.Secret, w.Setting, w.Provision} {
|
||||
if n != "" {
|
||||
named++
|
||||
}
|
||||
}
|
||||
switch {
|
||||
case named != 1:
|
||||
return fmt.Errorf("says it waits, naming %s, where a wait names one secret, one setting or one provision",
|
||||
waitNames(w))
|
||||
case w.Provision != "":
|
||||
return checkProvisionWait(module, machine, w, m, f)
|
||||
case w.Secret != "" && w.Setting != "", w.Secret == "" && w.Setting == "":
|
||||
return fmt.Errorf("says it waits, naming %s, where a wait names one secret or one setting", waitNames(w))
|
||||
case w.Setting != "":
|
||||
if _, declared := m.Settings[w.Setting]; !declared {
|
||||
return fmt.Errorf("says it waits for the setting %s, which %s does not declare", w.Setting, module)
|
||||
@@ -112,46 +80,20 @@ func checkWait(module, machine string, w inventory.Wait, f operatorWaitFacts) er
|
||||
return nil
|
||||
}
|
||||
|
||||
// checkProvisionWait excuses a wait for a provision's credential only when the store bears it out (novox/hq ADR 0337
|
||||
// §6): the module requires the provision, a provider offers it with a credential issued outside the mesh, and the
|
||||
// module on this machine holds no value a person gave for it under the keys both ends have now.
|
||||
func checkProvisionWait(module, machine string, w inventory.Wait, m catalogue.Manifest, f operatorWaitFacts) error {
|
||||
if !slices.Contains(m.Requires, w.Provision) {
|
||||
return fmt.Errorf("says it waits for the provision %s, which %s does not require", w.Provision, module)
|
||||
}
|
||||
if _, outside := f.outside[w.Provision]; !outside {
|
||||
return fmt.Errorf("says it waits for the provision %s, whose credential the mesh gives itself: only a "+
|
||||
"credential issued outside the mesh waits for the operator", w.Provision)
|
||||
}
|
||||
given, readable := f.pairsGiven[module+"@"+machine]
|
||||
if !readable {
|
||||
return fmt.Errorf("says it waits for the provision %s, and what was given on %s could not be read", w.Provision, machine)
|
||||
}
|
||||
if given[w.Provision] {
|
||||
return fmt.Errorf("says it waits for the provision %s, whose credential was given", w.Provision)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// waitRefusedPrefix opens every reason checkWait gives, so the words of a refused wait are told from a check's own.
|
||||
const waitRefusedPrefix = "says it waits"
|
||||
|
||||
// waitNames is what a wait names, as "the secret x" or "the setting y".
|
||||
func waitNames(w inventory.Wait) string {
|
||||
var names []string
|
||||
if w.Secret != "" {
|
||||
names = append(names, "the secret "+w.Secret)
|
||||
switch {
|
||||
case w.Secret != "" && w.Setting != "":
|
||||
return "the secret " + w.Secret + " and the setting " + w.Setting
|
||||
case w.Secret != "":
|
||||
return "the secret " + w.Secret
|
||||
case w.Setting != "":
|
||||
return "the setting " + w.Setting
|
||||
}
|
||||
if w.Setting != "" {
|
||||
names = append(names, "the setting "+w.Setting)
|
||||
}
|
||||
if w.Provision != "" {
|
||||
names = append(names, "the provision "+w.Provision)
|
||||
}
|
||||
if len(names) == 0 {
|
||||
return "nothing"
|
||||
}
|
||||
return strings.Join(names, " and ")
|
||||
return "nothing"
|
||||
}
|
||||
|
||||
// checkWaiting reads one machine's resources against the facts: every waiting resource whose waits all check out is
|
||||
@@ -165,17 +107,11 @@ func checkWaiting(machine string, rs []inventory.ResourceHealth, f operatorWaitF
|
||||
if len(r.Waits) == 0 {
|
||||
why = fmt.Errorf("says it waits, and names nothing it waits for")
|
||||
}
|
||||
waits := make([]inventory.Wait, 0, len(r.Waits))
|
||||
for _, w := range r.Waits {
|
||||
if why == nil {
|
||||
why = checkWait(r.Module, machine, w, f)
|
||||
}
|
||||
if p, outside := f.outside[w.Provision]; outside && w.Provision != "" {
|
||||
w.Act = p.acceptLine(w.Provision)
|
||||
}
|
||||
waits = append(waits, w)
|
||||
}
|
||||
r.Waits = waits
|
||||
if why != nil {
|
||||
r.State, r.Reason = link.StateUnhealthy, why.Error()
|
||||
}
|
||||
@@ -214,10 +150,6 @@ func operatorWaitSaid(module, machine string, waits []inventory.Wait) string {
|
||||
if w.Secret != "" {
|
||||
part += fmt.Sprintf(", given with `nox secret ask %s %s %s`", machine, module, w.Secret)
|
||||
}
|
||||
if w.Provision != "" && w.Act != "" {
|
||||
// One line for the provider, which seals it to every consumer of it (ADR 0337 §3, §7).
|
||||
part += fmt.Sprintf(", given for every consumer with `%s`", w.Act)
|
||||
}
|
||||
parts = append(parts, part+")")
|
||||
}
|
||||
return fmt.Sprintf("%s on %s waits for the operator: %s", module, machine, strings.Join(parts, "; "))
|
||||
@@ -240,7 +172,7 @@ func needsOperatorObservation(module, node string, waits []inventory.Wait, rs []
|
||||
func needsOperatorWords(module, node string, waits []inventory.Wait) words {
|
||||
var acts []string
|
||||
seen := map[string]bool{}
|
||||
secret, provision := false, false
|
||||
secret := false
|
||||
for _, w := range waits {
|
||||
var act string
|
||||
switch {
|
||||
@@ -248,9 +180,6 @@ func needsOperatorWords(module, node string, waits []inventory.Wait) words {
|
||||
act, secret = fmt.Sprintf("type %s at %s's desk prompt", w.What, node), true
|
||||
case w.Setting != "":
|
||||
act = fmt.Sprintf("approve %s of %s on %s when it is proposed to you", w.Setting, module, node)
|
||||
case w.Provision != "":
|
||||
// ADR 0337 §7: "give <what> of <provider> on <machine>"; the line is in the summary.
|
||||
act, provision = "give "+w.What, true
|
||||
}
|
||||
if act != "" && !seen[act] {
|
||||
seen[act] = true
|
||||
@@ -268,10 +197,6 @@ func needsOperatorWords(module, node string, waits []inventory.Wait) words {
|
||||
explanation += " A hidden prompt opens at the desk when the secret is asked for, and what you type there " +
|
||||
"is sealed to the machine."
|
||||
}
|
||||
if provision {
|
||||
explanation += " A key only you can give is given once for the app that issued it, and reaches every " +
|
||||
"module that uses it."
|
||||
}
|
||||
explanation += " Its update is in place and nothing was undone; it carries on by itself once it is given."
|
||||
return words{
|
||||
Headline: fmt.Sprintf("%s waits for you on %s", module, node),
|
||||
@@ -292,12 +217,6 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
|
||||
if f.given == nil {
|
||||
f.given = map[string]map[string]time.Time{}
|
||||
}
|
||||
if f.outside == nil {
|
||||
f.outside = map[string]outsideProvider{}
|
||||
}
|
||||
if f.pairsGiven == nil {
|
||||
f.pairsGiven = map[string]map[string]bool{}
|
||||
}
|
||||
if inv == nil {
|
||||
return
|
||||
}
|
||||
@@ -319,59 +238,15 @@ func readWaitFacts(ctx context.Context, inv *inventory.Inventory, machine string
|
||||
}
|
||||
}
|
||||
}
|
||||
if _, read := f.given[module+"@"+machine]; !read {
|
||||
if given, err := inv.GivenOwnSecrets(ctx, machine, module); err == nil {
|
||||
f.given[module+"@"+machine] = given
|
||||
}
|
||||
}
|
||||
if _, read := f.pairsGiven[module+"@"+machine]; !read {
|
||||
if given, err := inv.GivenPairsOf(ctx, machine, module); err == nil {
|
||||
f.pairsGiven[module+"@"+machine] = given
|
||||
}
|
||||
}
|
||||
// The provisions it requires whose credential only a person gives, and where their provider runs (ADR 0337).
|
||||
m, known := f.manifests[module]
|
||||
if !known {
|
||||
if _, read := f.given[module+"@"+machine]; read {
|
||||
continue
|
||||
}
|
||||
for _, provision := range m.Requires {
|
||||
if _, read := f.outside[provision]; read {
|
||||
continue
|
||||
}
|
||||
if shelf == nil {
|
||||
var err error
|
||||
if shelf, err = inv.Catalogue(ctx); err != nil {
|
||||
shelf = map[string]catalogue.Manifest{}
|
||||
}
|
||||
}
|
||||
provider, outside := catalogue.OffersIssuedOutside(shelf, provision)
|
||||
if !outside {
|
||||
continue
|
||||
}
|
||||
f.outside[provision] = outsideProvider{Module: provider, Machines: machinesRunning(ctx, inv, provider)}
|
||||
if given, err := inv.GivenOwnSecrets(ctx, machine, module); err == nil {
|
||||
f.given[module+"@"+machine] = given
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// machinesRunning is every machine a module is assigned to, by name; a read that fails is left out.
|
||||
func machinesRunning(ctx context.Context, inv *inventory.Inventory, module string) []string {
|
||||
nodes, err := inv.Nodes(ctx)
|
||||
if err != nil {
|
||||
// Only the summary's accept line reads it, which then names the provider's machine "<its machine>".
|
||||
// empty-on-error: no wait is excused or refused by it
|
||||
return nil
|
||||
}
|
||||
var out []string
|
||||
for _, n := range nodes {
|
||||
assigned, err := inv.Assigned(ctx, n.Name)
|
||||
if err == nil && slices.Contains(assigned, module) {
|
||||
out = append(out, n.Name)
|
||||
}
|
||||
}
|
||||
sort.Strings(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// waitingModules is every module with a waiting resource in a statement.
|
||||
func waitingModules(rs []inventory.ResourceHealth) []string {
|
||||
seen := map[string]bool{}
|
||||
|
||||
@@ -55,8 +55,8 @@ func TestAWaitIsExcusedOnlyWhenItChecksOut(t *testing.T) {
|
||||
{"a secret the mesh makes", inventory.Wait{Part: "p", Secret: "made", What: "w"}, factsGiven(nil), "mesh makes itself"},
|
||||
{"the bus account", inventory.Wait{Part: "p", Secret: "broker", What: "w"}, factsGiven(nil), "mesh makes itself"},
|
||||
{"a setting not declared", inventory.Wait{Part: "p", Setting: "logins", What: "w"}, factsGiven(nil), "does not declare"},
|
||||
{"both", inventory.Wait{Part: "p", Secret: "licence", Setting: "smb-users", What: "w"}, factsGiven(nil), "one secret, one setting or one provision"},
|
||||
{"neither", inventory.Wait{Part: "p", What: "w"}, factsGiven(nil), "one secret, one setting or one provision"},
|
||||
{"both", inventory.Wait{Part: "p", Secret: "licence", Setting: "smb-users", What: "w"}, factsGiven(nil), "one secret or one setting"},
|
||||
{"neither", inventory.Wait{Part: "p", What: "w"}, factsGiven(nil), "one secret or one setting"},
|
||||
{"no manifest known", passwordWait, operatorWaitFacts{}, "no manifest"},
|
||||
{"what was given cannot be read", passwordWait,
|
||||
operatorWaitFacts{manifests: map[string]catalogue.Manifest{"mounts": mountsManifest}}, "could not be read"},
|
||||
|
||||
@@ -1,83 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
)
|
||||
|
||||
// One accept for a provider reaches every consumer that binds the provision from it, and each consumer's send
|
||||
// places it; the per-pair form naming a consumer is refused for such a provision, naming the provider's form; a
|
||||
// value the mesh made before the rule is not placed (novox/hq ADR 0337 §2, §3, §4, issue 164, issue 165). Needs the
|
||||
// store (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
|
||||
func TestOneAcceptForAProviderIsPlacedForEveryConsumer(t *testing.T) {
|
||||
open := aMesh(t)
|
||||
ctx := t.Context()
|
||||
// Before the rule: tv's offer said nothing of its credential, and the send made one per pair.
|
||||
register(t, open, catalogue.Manifest{Module: "tv", Version: "1",
|
||||
Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh}}})
|
||||
for _, m := range []string{"requests", "indexer"} {
|
||||
register(t, open, catalogue.Manifest{Module: m, Version: "1", Requires: []string{"tv-api"},
|
||||
Secrets: map[string]string{"tv-api": "/var/lib/mesh/" + m + "/tv-api.secret"}})
|
||||
}
|
||||
for _, a := range [][2]string{{"anchor", "tv"}, {"laptop", "requests"}, {"laptop", "indexer"}} {
|
||||
if _, err := assign(ctx, open, a[0], a[1]); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
placed := func(module string) bool {
|
||||
t.Helper()
|
||||
plan, settings, err := planFor(ctx, open, "laptop")
|
||||
if err != nil {
|
||||
t.Fatalf("laptop was refused: %v", err)
|
||||
}
|
||||
declared, err := declarationFor(ctx, open, "laptop", plan, settings)
|
||||
if err != nil {
|
||||
t.Fatalf("laptop did not compose: %v", err)
|
||||
}
|
||||
for _, r := range declared.Resources {
|
||||
if r["path"] == "/var/lib/mesh/"+module+"/tv-api.secret" && r["sealed"] != nil {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
if !placed("requests") || !placed("indexer") {
|
||||
t.Fatal("before the rule, the send made and placed a credential per pair")
|
||||
}
|
||||
// The offer now says only a person gives it: the values the mesh made are not placed.
|
||||
register(t, open, catalogue.Manifest{Module: "tv", Version: "2",
|
||||
Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
|
||||
Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}})
|
||||
if placed("requests") || placed("indexer") {
|
||||
t.Fatal("a credential nobody gave was placed")
|
||||
}
|
||||
|
||||
// The per-pair form is refused, naming the provider's form, and reads nothing.
|
||||
file := filepath.Join(t.TempDir(), "key")
|
||||
if err := os.WriteFile(file, []byte("the app's key\n"), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
err := secretCommand(ctx, []string{"accept", "laptop", "requests", "tv-api", "--provider", "anchor", "--from", file})
|
||||
if err == nil || !strings.Contains(err.Error(), "secret accept anchor tv tv-api") {
|
||||
t.Fatalf("the per-pair form was not refused naming the provider's: %v", err)
|
||||
}
|
||||
|
||||
consumers, unresolved, err := consumersFrom(ctx, open, "anchor", "tv", "tv-api")
|
||||
if err != nil || len(unresolved) != 0 {
|
||||
t.Fatalf("the consumers of tv on anchor could not be found: %v %v", err, unresolved)
|
||||
}
|
||||
if len(consumers) != 2 {
|
||||
t.Fatalf("the consumers of tv on anchor are %+v; want requests and indexer on laptop", consumers)
|
||||
}
|
||||
if _, err := open.inventory.AcceptSecretForProvision(ctx, "tv-api", "anchor", "tv", "the app's key", consumers); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !placed("requests") || !placed("indexer") {
|
||||
t.Fatal("the value given once for the provider was not placed for every consumer")
|
||||
}
|
||||
}
|
||||
@@ -1,113 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/conditions"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
"github.com/novox/mesh-controller/internal/link"
|
||||
)
|
||||
|
||||
// A consumer may wait for a provision's credential only a person gives (novox/hq ADR 0337 §5–§7, issue 164).
|
||||
|
||||
var requestsManifest = catalogue.Manifest{Module: "requests", Version: "1", Requires: []string{"tv-api", "db"},
|
||||
Secrets: map[string]string{"tv-api": "/s/tv-api", "db": "/s/db"}}
|
||||
|
||||
var tvKeyWait = inventory.Wait{Part: "the tv library", Provision: "tv-api", What: "the API key of tv"}
|
||||
|
||||
func outsideFacts(given map[string]bool) operatorWaitFacts {
|
||||
return operatorWaitFacts{manifests: map[string]catalogue.Manifest{"requests": requestsManifest},
|
||||
outside: map[string]outsideProvider{"tv-api": {Module: "tv", Machines: []string{"media"}}},
|
||||
pairsGiven: map[string]map[string]bool{"requests@laptop": given}}
|
||||
}
|
||||
|
||||
// §6: excused only when the module requires the provision, its provider says it is issued outside, and no value a
|
||||
// person gave is held for the pair under the keys both ends have now.
|
||||
func TestAWaitForAProvisionIsExcusedOnlyWhenTheStoreBearsItOut(t *testing.T) {
|
||||
for _, c := range []struct {
|
||||
name string
|
||||
w inventory.Wait
|
||||
f operatorWaitFacts
|
||||
says string
|
||||
}{
|
||||
{"required, issued outside, not given", tvKeyWait, outsideFacts(nil), ""},
|
||||
{"given", tvKeyWait, outsideFacts(map[string]bool{"tv-api": true}), "was given"},
|
||||
{"not required", inventory.Wait{Part: "p", Provision: "music-api", What: "w"}, outsideFacts(nil), "does not require"},
|
||||
{"a credential the mesh gives itself", inventory.Wait{Part: "p", Provision: "db", What: "w"}, outsideFacts(nil),
|
||||
"mesh gives itself"},
|
||||
{"what was given cannot be read", tvKeyWait, operatorWaitFacts{
|
||||
manifests: map[string]catalogue.Manifest{"requests": requestsManifest},
|
||||
outside: map[string]outsideProvider{"tv-api": {Module: "tv"}}}, "could not be read"},
|
||||
{"a provision and a secret", inventory.Wait{Part: "p", Provision: "tv-api", Secret: "x", What: "w"},
|
||||
outsideFacts(nil), "one secret, one setting or one provision"},
|
||||
} {
|
||||
err := checkWait("requests", "laptop", c.w, c.f)
|
||||
switch {
|
||||
case c.says == "" && err != nil:
|
||||
t.Errorf("%s: refused: %v", c.name, err)
|
||||
case c.says != "" && (err == nil || !strings.Contains(err.Error(), c.says)):
|
||||
t.Errorf("%s: %v; want a refusal saying %q", c.name, err, c.says)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// §7: an excused wait is the consumer's needs-operator condition, in plain words, its summary naming the one line
|
||||
// that gives the credential for every consumer of the provider; the wait as kept is not changed.
|
||||
func TestAWaitForAProvisionNamesTheOneAcceptForItsProvider(t *testing.T) {
|
||||
r := inventory.ResourceHealth{Module: "requests", Resource: "requests.app", Kind: "container", Target: "requests",
|
||||
State: link.StateWaiting, Check: "tool", Waits: []inventory.Wait{tvKeyWait}}
|
||||
kept := []inventory.ResourceHealth{r}
|
||||
got := checkWaiting("laptop", kept, outsideFacts(nil))
|
||||
if got[0].State != link.StateWaiting {
|
||||
t.Fatalf("an excused wait for a provision was judged: %+v", got[0])
|
||||
}
|
||||
if kept[0].Waits[0].Act != "" {
|
||||
t.Fatal("checking the wait changed the statement as kept")
|
||||
}
|
||||
waits, waiting := operatorWait("requests", got)
|
||||
if !waiting {
|
||||
t.Fatal("the module does not read as waiting for the operator")
|
||||
}
|
||||
o := needsOperatorObservation("requests", "laptop", waits, got)
|
||||
if !strings.Contains(o.Summary, "secret accept media tv tv-api") {
|
||||
t.Fatalf("the summary does not name the accept for the provider: %q", o.Summary)
|
||||
}
|
||||
if !strings.HasPrefix(o.Needs, "give the API key of tv") {
|
||||
t.Fatalf("the needs do not name the act: %q", o.Needs)
|
||||
}
|
||||
if why, ok := conditions.PlainWords(conditions.Words{Headline: o.Headline, Explanation: o.Explanation,
|
||||
Resolved: o.Resolved, Needs: o.Needs, Actions: o.Actions}, "laptop"); !ok {
|
||||
t.Fatalf("the condition is not in plain words: %s", why)
|
||||
}
|
||||
// A provider on several machines, or none: the line names its machine as a place to fill.
|
||||
if line := (outsideProvider{Module: "tv", Machines: []string{"a", "b"}}).acceptLine("tv-api"); line !=
|
||||
"secret accept <its machine> tv tv-api" {
|
||||
t.Fatalf("a provider on two machines reads %q", line)
|
||||
}
|
||||
}
|
||||
|
||||
// §3: the consumers one accept reaches are those whose resolution answers the provision from that provider.
|
||||
func TestTheConsumersOfAProviderAreThoseItAnswers(t *testing.T) {
|
||||
plan := catalogue.Resolution{Needs: []catalogue.Needed{
|
||||
{Name: "tv-api", From: "media", Module: "tv", For: "requests"},
|
||||
{Name: "tv-api", From: "media", Module: "tv", For: "indexer", Local: "main"},
|
||||
{Name: "tv-api", From: "other", Module: "tv", For: "elsewhere"},
|
||||
{Name: "tv-api", From: "media", Module: "another-tv", For: "not-this-module"},
|
||||
{Name: "db", From: "media", Module: "tv", For: "requests"},
|
||||
{Name: "tv-api", ByRecord: true, For: "by-record"},
|
||||
}}
|
||||
got := bindsFrom(plan, "laptop", "media", "tv", "tv-api")
|
||||
if len(got) != 2 || got[0].ConsumerModule != "indexer" || got[0].Local != "main" || got[1].ConsumerModule != "requests" {
|
||||
t.Fatalf("the consumers from tv on media are %+v", got)
|
||||
}
|
||||
said := acceptedSaid("media", "tv", "tv-api", inventory.ProvisionAccepted{
|
||||
Sealed: []inventory.PairEnd{{Consumer: "laptop", ConsumerModule: "requests"}},
|
||||
Unsealable: []inventory.PairEnd{{Consumer: "new", ConsumerModule: "indexer"}}}, []string{"down: refused"})
|
||||
for _, want := range []string{"sealed to requests on laptop", "no sealing key", "down: refused"} {
|
||||
if !strings.Contains(said, want) {
|
||||
t.Errorf("what the accept says lacks %q:\n%s", want, said)
|
||||
}
|
||||
}
|
||||
}
|
||||
+10
-71
@@ -182,21 +182,12 @@ func planFor(ctx context.Context, open *stores, nodeName string) (catalogue.Reso
|
||||
}
|
||||
var secret inventory.Secret
|
||||
var err error
|
||||
if outsideModule, outside := issuedOutsideBy(shelf, n); outside {
|
||||
// Only a person can give it (novox/hq ADR 0337, issue 164): read as given, never made.
|
||||
secret, err = inv.GivenPairSecret(ctx, n.Name, nodeName, n.For, n.From, outsideModule, n.Local)
|
||||
} else if n.SharedOwn != "" {
|
||||
if n.SharedOwn != "" {
|
||||
// The provider's one credential, sealed to this consumer too (novox/hq ADR 0158).
|
||||
secret, err = inv.SharedSecretFor(ctx, n.Name, nodeName, n.For, n.From, providerModuleOf(resolved, open, ctx, n), n.Local, n.SharedOwn)
|
||||
} else {
|
||||
secret, err = inv.SecretFor(ctx, n.Name, nodeName, n.For, n.From, n.Local)
|
||||
}
|
||||
if inventory.IsNotGiven(err) {
|
||||
// **Not given, and the rest of the consumer runs** (ADR 0337 §4): no credential file, so the module can
|
||||
// tell it was not given and says it waits for it; the machine is not refused for what only a person can
|
||||
// give, and nothing the mesh made stands in for it.
|
||||
continue
|
||||
}
|
||||
if err != nil {
|
||||
// Said rather than skipped. A machine that resolves cleanly and receives no
|
||||
// credential is one that will fail to authenticate at some later, less obvious
|
||||
@@ -289,14 +280,9 @@ func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
|
||||
continue
|
||||
}
|
||||
caps, _ := inv.ProfileOf(ctx, n.Name)
|
||||
// Its public domain too (novox/hq ADR 0346): a provider elsewhere serves its own composed names,
|
||||
// and composes them as its own plan does, under its own domain.
|
||||
// Read as its profile is: a machine whose domain cannot be read (removed since the list was read)
|
||||
// composes no public name, which leaves the key out and says so, and fails no other machine's plan.
|
||||
domain, _ := inv.PublicDomainOf(ctx, n.Name)
|
||||
others = append(others, candidate{
|
||||
catalogue.Node{Name: n.Name, Site: siteOf[n.Name], Capabilities: caps,
|
||||
At: onNetwork[n.Name], PublicDomain: domain}, theirs})
|
||||
At: onNetwork[n.Name]}, theirs})
|
||||
}
|
||||
|
||||
offered := map[string][]catalogue.Provider{}
|
||||
@@ -315,18 +301,12 @@ func theRestOfTheMesh(ctx context.Context, inv *inventory.Inventory,
|
||||
// What that module says a consumer needs to know, with that node's settings on
|
||||
// it: a port somebody moved on the provider is a port its consumers must be told
|
||||
// about, and the two coming from different places is how they come to disagree.
|
||||
serves, layers, err := servedOnNode(ctx, inv, o.node.Name, m, name)
|
||||
if err != nil {
|
||||
return catalogue.World{}, err
|
||||
}
|
||||
// And its own composed names, as that node composes them (novox/hq ADR 0346): a name it
|
||||
// does not compose leaves the key out, said under each consumer's need.
|
||||
serves, leftOut, err := got.ServedOwnNames(m, name, serves, catalogue.WithDefaults(m, layers))
|
||||
serves, err := servedOnNode(ctx, inv, o.node.Name, m, name)
|
||||
if err != nil {
|
||||
return catalogue.World{}, err
|
||||
}
|
||||
offered[name] = append(offered[name], catalogue.Provider{
|
||||
Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module, LeftOut: leftOut})
|
||||
Node: o.node.Name, At: o.node.At, Serves: serves, Module: m.Module})
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -462,12 +442,6 @@ func declarationWith(ctx context.Context, open *stores, node string,
|
||||
if err != nil {
|
||||
return sendable{}, err
|
||||
}
|
||||
// Which ports the filter admits from the local network, and from which networks, for plan to say
|
||||
// (novox/hq ADR 0340 §8). The same rules the composition rendered, never sent.
|
||||
rules, err := plan.Rules(with)
|
||||
if err != nil {
|
||||
return sendable{}, err
|
||||
}
|
||||
// And what was taken on it, said in every declaration it is sent from this one place.
|
||||
adoption, err := adoptionOf(ctx, open.inventory, record, plan, composed)
|
||||
if err != nil {
|
||||
@@ -477,8 +451,7 @@ func declarationWith(ctx context.Context, open *stores, node string,
|
||||
Received: composed.Received, Mesh: with.Mesh, BusUsers: with.BusUsers,
|
||||
LeftOut: sortedKeysOf(composed.LeftOut), leftOutWhy: composed.LeftOut, withheld: with.Withheld,
|
||||
unbound: with.Unbound, foreseen: composed.Foreseen, unplaced: composed.Unplaced,
|
||||
modules: namedModules(plan, composed.LeftOut),
|
||||
localNetwork: catalogue.LocalNetworkPorts(rules, with.LocalNetworks)}
|
||||
modules: namedModules(plan, composed.LeftOut)}
|
||||
// And which build of each module it carries, for the send to record (novox/hq issue 259, ADR
|
||||
// 0221). Read only on the send path: a question about what would be sent records nothing.
|
||||
if choosing == Allocating {
|
||||
@@ -987,12 +960,6 @@ func renderingFor(ctx context.Context, open *stores, node string,
|
||||
if err != nil {
|
||||
return catalogue.Rendering{}, inventory.Node{}, err
|
||||
}
|
||||
// And which of the networks it is attached to count as its local network (novox/hq ADR 0340):
|
||||
// private ranges only, on a link facing outside it. Reported by the machine, never set.
|
||||
local, err := localNetworksOf(ctx, inv, node)
|
||||
if err != nil {
|
||||
return catalogue.Rendering{}, inventory.Node{}, err
|
||||
}
|
||||
// Where this machine reaches each mesh seat's holder, for ${seat:<seat>:reach} (novox/hq ADR
|
||||
// 0222): the artifact store as this network reaches it, which the container runtime is told to
|
||||
// trust (ADR 0082). The same address composed into every reference the mesh built.
|
||||
@@ -1017,8 +984,7 @@ func renderingFor(ctx context.Context, open *stores, node string,
|
||||
Machines: machines, Zones: zones, Holders: replicas,
|
||||
Suffix: overlay.Suffix(), MeshRange: meshRange, TunnelInterface: overlay.Interface, Accounts: accounts, Foundation: foundation,
|
||||
Kept: kept, Adopted: record.Adopted, OutwardLinks: outwardLinks,
|
||||
LocalNetworks: catalogue.CountedLocalNetworks(local),
|
||||
Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
|
||||
Given: given, Taken: taken, Seats: seats, ArtifactStore: artifactStore, SeatReach: reach, Built: built,
|
||||
BusUsers: busUsers, Withheld: withheld, Unbound: unbound,
|
||||
}, record, nil
|
||||
}
|
||||
@@ -1437,16 +1403,6 @@ func planCommand(ctx context.Context, args []string) error {
|
||||
// in this output would have told anybody that.
|
||||
for _, n := range plan.Needs {
|
||||
fmt.Printf(" needs %s from %s, for %s\n", n.Name, n.From, n.For)
|
||||
// And a served key the provider left out, because its machine composes no name it asks for
|
||||
// (novox/hq ADR 0346 §3).
|
||||
for _, line := range n.LeftOut {
|
||||
fmt.Printf(" %s\n", line)
|
||||
}
|
||||
}
|
||||
// What the providers on this machine leave out of what they serve, and why: said where the remedy
|
||||
// is (novox/hq ADR 0346 §3).
|
||||
for _, line := range plan.ServedLeftOut(settings) {
|
||||
fmt.Printf("%s: %s\n", args[0], line)
|
||||
}
|
||||
for _, line := range unboundLines(plan) {
|
||||
fmt.Println(line)
|
||||
@@ -1461,11 +1417,6 @@ func planCommand(ctx context.Context, args []string) error {
|
||||
fmt.Printf(" %-20s settings from %s\n", module, layer.From)
|
||||
}
|
||||
}
|
||||
// What each port reached from the local network resolved to on this machine (novox/hq ADR 0340 §8),
|
||||
// or that it resolved to none.
|
||||
for _, p := range declared.localNetwork {
|
||||
fmt.Println(" " + p.Said())
|
||||
}
|
||||
fmt.Printf("\n%d resource(s)\n", len(resources))
|
||||
|
||||
if *show {
|
||||
@@ -1587,20 +1538,19 @@ func managerPublicKeyFor(
|
||||
// artifact store's trust and the references composed through it (04-ISSUES/102). Unreadable
|
||||
// given ports are that node's refusal to report, not this reader's.
|
||||
func servedOnNode(ctx context.Context, inv *inventory.Inventory, node string,
|
||||
m catalogue.Manifest, provision string) (map[string]any, []catalogue.Layer, error) {
|
||||
m catalogue.Manifest, provision string) (map[string]any, error) {
|
||||
ports, layers, err := portsGivenOn(ctx, inv, node, m)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
return nil, err
|
||||
}
|
||||
serves := catalogue.ServedOn(m, provision, ports)
|
||||
if len(serves) > 0 {
|
||||
serves, err = catalogue.Settle(serves, catalogue.WithDefaults(m, layers))
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
// The layers too, read once, for what is filled after (novox/hq ADR 0346).
|
||||
return serves, layers, nil
|
||||
return serves, nil
|
||||
}
|
||||
|
||||
// portsGivenOn is where a node puts a module's ports — assigned, then given over them — and the
|
||||
@@ -1792,17 +1742,6 @@ func busUserList(ctx context.Context, inv *inventory.Inventory,
|
||||
|
||||
// providerModuleOf is which module answers a need on the providing node: the one in this node's
|
||||
// own set when the provider is here, else the one the catalogue says offers it.
|
||||
// issuedOutsideBy is whether a need's provision is offered by its provider with a credential issued outside the
|
||||
// mesh (novox/hq ADR 0337), and that provider module: the one answering it when known, else any that offers it so.
|
||||
func issuedOutsideBy(shelf map[string]catalogue.Manifest, n catalogue.Needed) (string, bool) {
|
||||
if n.Module != "" {
|
||||
if m, known := shelf[n.Module]; known {
|
||||
return n.Module, m.IssuedOutsideOf(n.Name)
|
||||
}
|
||||
}
|
||||
return catalogue.OffersIssuedOutside(shelf, n.Name)
|
||||
}
|
||||
|
||||
func providerModuleOf(resolved catalogue.Resolution, open *stores, ctx context.Context, n catalogue.Needed) string {
|
||||
for _, m := range resolved.Modules {
|
||||
if _, shared := m.SharedCredentialOf(n.Name); shared {
|
||||
|
||||
@@ -18,9 +18,8 @@ package main
|
||||
// it beside the layer (`settings` says it back), and records the warrant in the hand-act log on the bus, where a
|
||||
// person's decisions are read; the router edits the ask on every channel to its outcome. No seat event of its
|
||||
// own: nothing consumes one, and the installer's first user list in the node-engine's repository names every
|
||||
// controller event, so one would cost a node-engine change for a fact without a reader. No push is left for
|
||||
// afterwards: the warrant that sets the layer opens the walk that sends it (novox/hq ADR 0344, settings_walk.go),
|
||||
// so the operator's one Approve is the act that makes the change take effect.
|
||||
// controller event, so one would cost a node-engine change for a fact without a reader. The push afterwards is a
|
||||
// separate act, as it is for a layer set at the terminal.
|
||||
//
|
||||
// **What the operator reads** is the module, the machine, each key with its exact new value and, for a changed
|
||||
// key, the value it replaces. A value that may not leave the mesh (an address, a path, a secret's shape: the
|
||||
@@ -28,13 +27,6 @@ package main
|
||||
// ask says so, and the whole is read with `settings proposals <id>` — whose fingerprint must be the one on the
|
||||
// phone. Fail closed: a proposal nothing can carry to the operator is refused at once, in words, and never left
|
||||
// waiting for an answer that cannot come.
|
||||
//
|
||||
// **On a channel that proves who answers, the values are shown WHOLE** (novox/hq issue 383, the operator's
|
||||
// decision of 2026-10-10): a mount point, a share name or a private address is the thing being approved and must
|
||||
// be readable, so the ask carries them whole beside the explanation (asks.Ask.Whole), the router shows that only
|
||||
// on a kind that verifies its sender, and only a value shaped like a secret is withheld there. The message is the
|
||||
// headline, one line per key, who proposed it and when; the fingerprint and how to read the proposal whole are
|
||||
// the Details answer's (asks.Ask.Details). The masking stays for conditions and for channels that prove nothing.
|
||||
|
||||
import (
|
||||
"context"
|
||||
@@ -55,7 +47,6 @@ import (
|
||||
"git.novox.be/novox/mesh-sdk/go/asks"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/conditions"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
"github.com/novox/mesh-controller/internal/link"
|
||||
"github.com/novox/mesh-controller/internal/outward"
|
||||
)
|
||||
@@ -163,48 +154,47 @@ func (p settingsProposal) ask(id string, machines []string) (asks.Ask, map[strin
|
||||
if len([]rune(headline)) > asks.HeadlineLength {
|
||||
headline = verb + " settings?"
|
||||
}
|
||||
// The message reads at a glance (issues 383 and 639): a summary of what changes where, then at most three
|
||||
// points, a key each; every key with its whole value, who proposed it, the fingerprint and how to read it at the
|
||||
// terminal are its Details, which the router notes after the answers.
|
||||
shown, shownAll, shownWhole := p.change(machines, false)
|
||||
whole, wholeAll, _ := p.change(machines, true)
|
||||
summary := p.summary()
|
||||
compose := func(points []string) string {
|
||||
return strings.Join(append([]string{summary}, points...), "\n")
|
||||
shown, whole := p.change(machines)
|
||||
var b strings.Builder
|
||||
if p.Clear {
|
||||
fmt.Fprintf(&b, "Clear the settings of %s on %s, back to what the module says?\n\n", p.Module, p.where())
|
||||
} else {
|
||||
fmt.Fprintf(&b, "Set the settings of %s on %s to these values?\n\n", p.Module, p.where())
|
||||
}
|
||||
// The Details: every setting it sets, one line each, uncut — whole where the sender is proven (WholeDetails),
|
||||
// masked elsewhere — then who proposed it, the fingerprint and how to read it at the terminal.
|
||||
details := func(lines []string) string {
|
||||
var d strings.Builder
|
||||
d.WriteString(strings.Join(lines, "\n") + "\n")
|
||||
d.WriteString(p.onApprove() + "\n")
|
||||
fmt.Fprintf(&d, "Proposed by %s at %s. Fingerprint %s.\n", sayable(p.From, machines), p.At.Local().Format("15:04 on 2 Jan"),
|
||||
fingerprint(p.Digest))
|
||||
if !shownWhole {
|
||||
d.WriteString("Where who answers is not proven, its values are shown as ‹address›, ‹path› or ‹withheld›.\n")
|
||||
}
|
||||
fmt.Fprintf(&d, "Read it whole, with this fingerprint: settings proposals %s at the controller's terminal, or the "+
|
||||
"controller's settings verb with proposal %s through the mesh MCP server.", id, id)
|
||||
return d.String()
|
||||
fmt.Fprintf(&b, "Proposed by %s, at %s. ", sayable(p.From, machines), p.At.Local().Format("15:04 on 2 Jan"))
|
||||
switch {
|
||||
case p.Clear && p.HadLayer:
|
||||
b.WriteString("The layer it removes:\n\n")
|
||||
case p.Clear:
|
||||
b.WriteString("There is no layer to remove; approving changes nothing.")
|
||||
case !p.HadLayer:
|
||||
b.WriteString("There is no layer yet; this is the whole of it:\n\n")
|
||||
default:
|
||||
b.WriteString("The layer is replaced whole; what changes against it:\n\n")
|
||||
}
|
||||
q := asks.Ask{ID: id, Headline: headline, Explanation: compose(shown), Who: asks.Operator,
|
||||
b.WriteString(shown)
|
||||
fmt.Fprintf(&b, "\n\nFingerprint %s.", fingerprint(p.Digest))
|
||||
if !whole {
|
||||
b.WriteString(" Parts shown as ‹address›, ‹path› or ‹withheld› may not leave the mesh: read it whole, with " +
|
||||
"this fingerprint, through the mesh MCP server (mesh-controller.settings, proposal " + id + ") or with " +
|
||||
"mesh-cli settings proposals " + id + ".")
|
||||
}
|
||||
if p.Clear {
|
||||
b.WriteString(" Approved, the layer is removed at once and the machine takes it at its next push.")
|
||||
} else {
|
||||
b.WriteString(" Approved, the layer is set at once and the machine takes it at its next push.")
|
||||
}
|
||||
q := asks.Ask{ID: id, Headline: headline, Explanation: b.String(), Who: asks.Operator,
|
||||
Expires: p.At.Add(askApproveFor), OnExpiry: "the proposal is discarded; nothing changes",
|
||||
About: p.about(), Details: details(shownAll)}
|
||||
// Only where a value was masked: an ask whose values all pass the content rule shows the same everywhere.
|
||||
if w := compose(whole); w != q.Explanation {
|
||||
q.Whole = w
|
||||
}
|
||||
if w := details(wholeAll); w != q.Details {
|
||||
q.WholeDetails = w
|
||||
}
|
||||
About: p.about()}
|
||||
options := map[string]int{}
|
||||
for i, act := range p.actions(id) {
|
||||
binds, _ := asks.ActDigest(boundAct(act))
|
||||
oid := optionID(act.Label)
|
||||
options[oid] = i
|
||||
does := "the settings are set and sent to " + p.reaches() + " at once, each machine judged"
|
||||
does := "the settings are set; nothing is pushed yet"
|
||||
if p.Clear {
|
||||
does = "the layer is removed and that is sent to " + p.reaches() + " at once, each machine judged"
|
||||
does = "the layer is removed; nothing is pushed yet"
|
||||
}
|
||||
if act.Arguments["answer"] == answerDecline {
|
||||
does = "nothing changes; the proposal is discarded"
|
||||
@@ -215,141 +205,55 @@ func (p settingsProposal) ask(id string, machines []string) (asks.Ask, map[strin
|
||||
return q, options
|
||||
}
|
||||
|
||||
// summary is the proposal's first line, what changes where: how many settings, how many stay, and that Approve sends
|
||||
// the layer at once by a walk, one machine at a time (novox/hq ADR 0344); the rest of what Approve does
|
||||
// (onApprove) is the Details'.
|
||||
func (p settingsProposal) summary() string {
|
||||
if p.Clear {
|
||||
if !p.HadLayer {
|
||||
return "There is no layer to remove; approving changes nothing."
|
||||
}
|
||||
return fmt.Sprintf("Removes the %d setting(s) of %s set on %s; approved, the layer is removed and that is sent at once "+
|
||||
"by a walk to %s, one machine at a time, each judged.", len(leaves(p.Before, "")), p.Module, p.where(), p.reaches())
|
||||
}
|
||||
added, changed, removed := settingsChange(p.Before, p.Values)
|
||||
n := len(added) + len(changed) + len(removed)
|
||||
unchanged := len(leaves(p.Values, "")) - len(added) - len(changed)
|
||||
if n == 0 {
|
||||
return fmt.Sprintf("Nothing changes: the %d setting(s) of %s on %s are as they stand.", unchanged, p.Module, p.where())
|
||||
}
|
||||
stay := ""
|
||||
if unchanged > 0 {
|
||||
stay = fmt.Sprintf(", and %d stay as they are", unchanged)
|
||||
}
|
||||
return fmt.Sprintf("Changes %d setting(s) of %s on %s%s; approved, the layer is set and sent at once by a walk to %s, "+
|
||||
"one machine at a time, each judged.", n, p.Module, p.where(), stay, p.reaches())
|
||||
}
|
||||
// shownMost is the most of a change the phone is shown, in bytes; the rest is read whole with `settings proposals`.
|
||||
const shownMost = 1400
|
||||
|
||||
// change is what changes: as at most asks.MostPoints points for the glance, as every line whole for the note, and
|
||||
// whether every value was shown exactly: "+ key: value"
|
||||
// added, "~ key: value (was: old)" changed, "- key (was: old)" removed. Each value is shown under the content rule
|
||||
// (sayableValue), or — exact, for a channel that proves who answers — as it is, withheld only when shaped like a
|
||||
// secret (wholeValue). More changes than points: the first two, and the keys of the rest; a point longer than a
|
||||
// phone shows at a glance is cut and says so. The note carries every line uncut (the review of #304: Approve sets
|
||||
// exactly what the operator can read).
|
||||
func (p settingsProposal) change(machines []string, exact bool) ([]string, []string, bool) {
|
||||
// change is what changes, line by line, each value shown under the content rule, and whether every value was
|
||||
// shown whole: "+ key: value" added, "~ key: value (was: old)" changed, "- key (was: old)" removed, and the
|
||||
// count of keys unchanged.
|
||||
func (p settingsProposal) change(machines []string) (string, bool) {
|
||||
whole := true
|
||||
say := func(v any) string {
|
||||
s, w := sayableValue(v, machines)
|
||||
if exact {
|
||||
s, w = wholeValue(v, machines)
|
||||
}
|
||||
whole = whole && w
|
||||
return s
|
||||
}
|
||||
type line struct{ key, text string }
|
||||
var lines []line
|
||||
var lines []string
|
||||
if p.Clear {
|
||||
was := leaves(p.Before, "")
|
||||
for _, k := range layerKeys(was) {
|
||||
lines = append(lines, line{k, fmt.Sprintf("- %s: %s", k, say(was[k]))})
|
||||
lines = append(lines, fmt.Sprintf("- %s: %s", k, say(was[k])))
|
||||
}
|
||||
} else {
|
||||
added, changed, removed := settingsChange(p.Before, p.Values)
|
||||
was, now := leaves(p.Before, ""), leaves(p.Values, "")
|
||||
for _, k := range added {
|
||||
lines = append(lines, line{k, fmt.Sprintf("+ %s: %s", k, say(now[k]))})
|
||||
lines = append(lines, fmt.Sprintf("+ %s: %s", k, say(now[k])))
|
||||
}
|
||||
for _, k := range changed {
|
||||
lines = append(lines, line{k, fmt.Sprintf("~ %s: %s (was: %s)", k, say(now[k]), say(was[k]))})
|
||||
lines = append(lines, fmt.Sprintf("~ %s: %s (was: %s)", k, say(now[k]), say(was[k])))
|
||||
}
|
||||
for _, k := range removed {
|
||||
lines = append(lines, line{k, fmt.Sprintf("- %s (was: %s)", k, say(was[k]))})
|
||||
lines = append(lines, fmt.Sprintf("- %s (was: %s)", k, say(was[k])))
|
||||
}
|
||||
unchanged := len(now) - len(added) - len(changed)
|
||||
switch {
|
||||
case len(lines) == 0 && unchanged > 0:
|
||||
lines = append(lines, fmt.Sprintf("= nothing changes: the %d key(s) are as they stand", unchanged))
|
||||
case unchanged > 0:
|
||||
lines = append(lines, fmt.Sprintf("= %d key(s) unchanged", unchanged))
|
||||
}
|
||||
}
|
||||
// **Each line is judged as the router will judge it** (the review of #304, ADR 0347 §1 and §3): a line the
|
||||
// content rule (masked) or the secret rule (whole) would refuse — a value given to a secret's name, say
|
||||
// "+ password: hunter2" — is said with its key still named and its value withheld, never left for the
|
||||
// router to withhold whole and unnamed. A line refused even so is the propose's refusal (judgeLines).
|
||||
for i, l := range lines {
|
||||
if lineLeaves(l.text, exact, machines) {
|
||||
continue
|
||||
out := strings.Join(lines, "\n")
|
||||
if len(out) > shownMost {
|
||||
cut := shownMost
|
||||
for cut > 0 && out[cut] != '\n' {
|
||||
cut--
|
||||
}
|
||||
lines[i].text = l.text[:2] + l.key + " (value withheld)"
|
||||
out = out[:cut] + fmt.Sprintf("\n… NOT SHOWN IN FULL here: %d more bytes", len(strings.Join(lines, "\n"))-cut)
|
||||
whole = false
|
||||
}
|
||||
all := make([]string, len(lines))
|
||||
for i, l := range lines {
|
||||
all[i] = l.text
|
||||
}
|
||||
// What the note holds of a value: whole where the glance is the whole one (shown only where the sender is
|
||||
// proven, with the whole details beside it), under the content rule elsewhere — so the marker says no more than
|
||||
// the note it points to (the review of ADR 0347).
|
||||
inNote := "in the note"
|
||||
if exact {
|
||||
inNote = "whole in the note"
|
||||
}
|
||||
var out []string
|
||||
for i, l := range lines {
|
||||
if len(lines) > asks.MostPoints && i == asks.MostPoints-1 {
|
||||
var rest []string
|
||||
for _, r := range lines[i:] {
|
||||
rest = append(rest, r.key)
|
||||
}
|
||||
out = append(out, fmt.Sprintf("and %d more, each %s: %s", len(rest), inNote, strings.Join(rest, ", ")))
|
||||
break
|
||||
}
|
||||
out = append(out, l.text)
|
||||
}
|
||||
// A point too long for a glance is cut, and says so: its value is the note's.
|
||||
cut := "… (cut: " + inNote + ")"
|
||||
for i, l := range out {
|
||||
if r := []rune(l); len(r) > asks.PointLength {
|
||||
out[i] = string(r[:asks.PointLength-len([]rune(cut))]) + cut
|
||||
}
|
||||
}
|
||||
return out, all, whole
|
||||
}
|
||||
|
||||
// lineLeaves says whether a line may leave the mesh as the router judges it: under the content rule for the masked
|
||||
// form, the secret rule alone for the whole one.
|
||||
func lineLeaves(line string, exact bool, machines []string) bool {
|
||||
if exact {
|
||||
_, ok := outward.Secret(line, machines...)
|
||||
return ok
|
||||
}
|
||||
_, ok := outward.Check(line, machines...)
|
||||
return ok
|
||||
}
|
||||
|
||||
// judgeLines is the first line of an ask's details the router would refuse, or withhold, and why: masked under
|
||||
// the content rule line by line, whole under the secret rule. Empty when every line may leave.
|
||||
func judgeLines(details string, exact bool, machines []string) (string, string) {
|
||||
for _, line := range strings.Split(details, "\n") {
|
||||
if strings.TrimSpace(line) == "" {
|
||||
continue
|
||||
}
|
||||
if exact {
|
||||
if refusal, ok := outward.Secret(line, machines...); !ok {
|
||||
return line, refusal.String()
|
||||
}
|
||||
continue
|
||||
}
|
||||
if refusal, ok := outward.Check(line, machines...); !ok {
|
||||
return line, refusal.String()
|
||||
}
|
||||
}
|
||||
return "", ""
|
||||
return out, whole
|
||||
}
|
||||
|
||||
func layerKeys(m map[string]any) []string {
|
||||
@@ -396,27 +300,6 @@ func sayableValue(v any, machines []string) (string, bool) {
|
||||
return out, out == text
|
||||
}
|
||||
|
||||
// wholeValue is a value as a channel that proves who answers is shown it (asks.Ask.Whole), and whether it was
|
||||
// shown whole: as it is, unless it is shaped like a secret (outward.Secret), which is withheld whole — never in
|
||||
// part, so no half of a key reaches the phone.
|
||||
func wholeValue(v any, machines []string) (string, bool) {
|
||||
text, ok := v.(string)
|
||||
if !ok {
|
||||
raw, err := json.Marshal(v)
|
||||
if err != nil {
|
||||
return markWithheld, false
|
||||
}
|
||||
text = string(raw)
|
||||
}
|
||||
if text == "" {
|
||||
return `""`, true
|
||||
}
|
||||
if _, ok := outward.Secret(text, machines...); !ok {
|
||||
return markWithheld, false
|
||||
}
|
||||
return text, true
|
||||
}
|
||||
|
||||
// sayable is a text with what may not leave the mesh replaced in place by a marker; what the markers cannot make
|
||||
// pass is withheld whole.
|
||||
func sayable(text string, machines []string) string {
|
||||
@@ -549,23 +432,6 @@ func (pr proposer) propose(ctx context.Context, in proposeInput) (string, error)
|
||||
return refuse("the ask's words would carry %s, which may not leave the mesh, and the change could not be "+
|
||||
"shown without it; %s", refusal, atTheTerminalInstead(in))
|
||||
}
|
||||
// The whole words are shown only where the sender is proven, and never a secret's shape: wholeValue withholds
|
||||
// one, and the router would refuse the ask if one were left, so it is refused here first, in words.
|
||||
if refusal, ok := outward.Secret(q.Whole, machines...); !ok {
|
||||
return refuse("the change shown whole would carry %s, which may not leave the mesh on any channel; %s",
|
||||
refusal, atTheTerminalInstead(in))
|
||||
}
|
||||
// So are the details (ADR 0347 §1, §3): every line the router would withhold from the note, or refuse the ask
|
||||
// for, is refused here, in the controller's own words, naming the line's key — Approve never sets a value the
|
||||
// operator was shown nothing of.
|
||||
if line, why := judgeLines(q.Details, false, machines); line != "" {
|
||||
return refuse("the change's line %q would carry %s, which the operator's note may not show; %s",
|
||||
keyOfLine(line), why, atTheTerminalInstead(in))
|
||||
}
|
||||
if line, why := judgeLines(q.WholeDetails, true, machines); line != "" {
|
||||
return refuse("the change's line %q shown whole would carry %s, which may not leave the mesh on any channel; %s",
|
||||
keyOfLine(line), why, atTheTerminalInstead(in))
|
||||
}
|
||||
// Fail closed, before anything is kept: no router, no grant, no channel means no ask.
|
||||
if pr.routerHere != nil {
|
||||
here, err := pr.routerHere(ctx)
|
||||
@@ -653,29 +519,15 @@ func (pr proposer) propose(ctx context.Context, in proposeInput) (string, error)
|
||||
fingerprint(p.Digest))
|
||||
fmt.Fprintf(&b, " until %s nothing changes: the layer is set only on Approve, and discarded on Decline or at expiry\n",
|
||||
q.Expires.Local().Format("2006-01-02 15:04"))
|
||||
fmt.Fprintf(&b, " `settings proposals %s` shows it whole; once approved, a walk sends it to %s at once, one machine at "+
|
||||
"a time, each judged, and its end is told as every walk's is (novox/hq ADR 0344)", id, p.reaches())
|
||||
fmt.Fprintf(&b, " `settings proposals %s` shows it whole; once approved, `push %s` sends it", id, pushWord(p.Node))
|
||||
return b.String(), nil
|
||||
}
|
||||
|
||||
// reaches is the machines an approved layer is sent to, in words: the one it names, or every machine running the
|
||||
// module.
|
||||
func (p settingsProposal) reaches() string {
|
||||
if p.Node == "" {
|
||||
return "every machine running " + p.Module
|
||||
func pushWord(node string) string {
|
||||
if node == "" {
|
||||
return "--behind"
|
||||
}
|
||||
return p.Node
|
||||
}
|
||||
|
||||
// onApprove is what the ask says Approve does (novox/hq ADR 0344 §4): the one Approve sets the layer and sends it.
|
||||
func (p settingsProposal) onApprove() string {
|
||||
what := "the layer is set"
|
||||
if p.Clear {
|
||||
what = "the layer is removed"
|
||||
}
|
||||
return fmt.Sprintf("Approved, %s and sent at once to %s, one machine at a time, each judged, every build there "+
|
||||
"kept; its end is told as every walk's is. A module that reads its settings only when it starts takes them at "+
|
||||
"its next start.", what, p.reaches())
|
||||
return node
|
||||
}
|
||||
|
||||
func newProposalID() string {
|
||||
@@ -936,40 +788,6 @@ func setLayerIn(open *stores) setOnWarrant {
|
||||
changed = "nothing changed"
|
||||
}
|
||||
}
|
||||
// **And sends it** (novox/hq ADR 0344): the layer the operator approved is walked to the machines it reaches
|
||||
// at once. A walk that cannot be opened is said as the act's failure — the layer is set and nothing sends it.
|
||||
walked, err := openSettingsWalk(ctx, open, inventory.PlanSettings{Module: p.Module, Node: p.Node, Ask: askID,
|
||||
Change: changed})
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("%s (ask %s) is set, and the walk that sends it could not be opened: %v — `push %s` sends it",
|
||||
changed, askID, err, pushTo(p.Node))
|
||||
}
|
||||
return changed + " (ask " + askID + "); " + walked, nil
|
||||
return changed + " (ask " + askID + ")", nil
|
||||
}
|
||||
}
|
||||
|
||||
// pushTo is the push that sends a layer by hand when its walk could not: the machine, or every one behind.
|
||||
func pushTo(node string) string {
|
||||
if node == "" {
|
||||
return "--behind"
|
||||
}
|
||||
return node
|
||||
}
|
||||
|
||||
// keyOfLine is what a refusal names of a line: the key of a change's line ("+ key: …"), or the line's first words.
|
||||
func keyOfLine(line string) string {
|
||||
if len(line) > 2 && strings.ContainsRune("+~-=", rune(line[0])) && line[1] == ' ' {
|
||||
rest := line[2:]
|
||||
if i := strings.IndexAny(rest, ": "); i > 0 {
|
||||
rest = rest[:i]
|
||||
}
|
||||
if _, ok := outward.Secret(rest); !ok {
|
||||
return "whose key is shaped like a secret"
|
||||
}
|
||||
return rest
|
||||
}
|
||||
if r := []rune(line); len(r) > 40 {
|
||||
return string(r[:40]) + "…"
|
||||
}
|
||||
return line
|
||||
}
|
||||
|
||||
@@ -4,7 +4,6 @@ import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"slices"
|
||||
@@ -117,43 +116,24 @@ func TestAProposalAsksAtTheLevelApproveWithTheExactChange(t *testing.T) {
|
||||
if q.Options[0].Binds == q.Options[1].Binds {
|
||||
t.Error("Approve and Decline bind the same act")
|
||||
}
|
||||
// The message reads at a glance (issues 383 and 639): a summary, then one point per key — and nothing else:
|
||||
// who proposed it, the fingerprint and the how-to are the Details, which the router notes after the answers.
|
||||
summary := "Changes 3 setting(s) of mounts on shanks; approved, the layer is set and sent at once by a walk to shanks, one machine at a time, each judged."
|
||||
if q.Explanation != summary+"\n+ sources: recalbox=‹address›@‹path›:ro\n~ shares: library=‹path› (was: none)\n- old (was: x)" {
|
||||
t.Errorf("the explanation:\n%s", q.Explanation)
|
||||
}
|
||||
if err := asks.Glance(q.Explanation); err != nil {
|
||||
t.Error(err)
|
||||
for _, line := range []string{
|
||||
"Set the settings of mounts on shanks to these values?",
|
||||
"Proposed by g14/claude-code, through the mesh-controller seat, at " + r.now.Local().Format("15:04 on 2 Jan") + ".",
|
||||
"+ sources: recalbox=‹address›@‹path›:ro",
|
||||
"~ shares: library=‹path› (was: none)",
|
||||
"- old (was: x)",
|
||||
"Fingerprint " + fingerprint(layerDigest(mountsSources)) + ".",
|
||||
"read it whole, with this fingerprint",
|
||||
} {
|
||||
if !strings.Contains(q.Explanation, line) {
|
||||
t.Errorf("the explanation lacks %q:\n%s", line, q.Explanation)
|
||||
}
|
||||
}
|
||||
for _, leak := range []string{"nas.lan", "/mnt/recalbox", "/mnt/library", "smb://"} {
|
||||
if strings.Contains(q.Explanation, leak) {
|
||||
t.Errorf("the explanation carries %q, which may not leave the mesh", leak)
|
||||
}
|
||||
}
|
||||
// Where the sender is proven, the values whole: the mount point and the share are what is approved.
|
||||
if q.Whole != summary+"\n+ sources: recalbox=smb://nas.lan/recalbox@/mnt/recalbox:ro\n~ shares: library=/mnt/library (was: none)\n- old (was: x)" ||
|
||||
asks.Glance(q.Whole) != nil {
|
||||
t.Errorf("the whole words:\n%s", q.Whole)
|
||||
}
|
||||
for _, line := range []string{
|
||||
"Proposed by g14/claude-code, through the mesh-controller seat at " + r.now.Local().Format("15:04 on 2 Jan") +
|
||||
". Fingerprint " + fingerprint(layerDigest(mountsSources)) + ".",
|
||||
"Where who answers is not proven, its values are shown as ‹address›, ‹path› or ‹withheld›.",
|
||||
"Read it whole, with this fingerprint: settings proposals " + kept(r).ID + " at the controller's terminal",
|
||||
} {
|
||||
if !strings.Contains(q.Details, line) {
|
||||
t.Errorf("Details lack %q:\n%s", line, q.Details)
|
||||
}
|
||||
}
|
||||
if refusal, ok := outward.Check(q.Details, "anchor", "laptop", "shanks"); !ok {
|
||||
t.Errorf("the router would withhold a line of the details: %s", refusal)
|
||||
}
|
||||
for _, howTo := range []string{"ingerprint", "settings proposals", "settings verb", "not proven", "Proposed by"} {
|
||||
if strings.Contains(q.Explanation, howTo) || strings.Contains(q.Whole, howTo) {
|
||||
t.Errorf("the message carries the how-to %q", howTo)
|
||||
}
|
||||
}
|
||||
all := []string{q.Headline, q.Explanation, q.OnExpiry}
|
||||
for _, o := range q.Options {
|
||||
all = append(all, o.Label, o.Does)
|
||||
@@ -161,9 +141,6 @@ func TestAProposalAsksAtTheLevelApproveWithTheExactChange(t *testing.T) {
|
||||
if refusal, ok := outward.Check(strings.Join(all, "\n"), "anchor", "laptop", "shanks"); !ok {
|
||||
t.Errorf("the router would refuse the ask: %s", refusal)
|
||||
}
|
||||
if refusal, ok := outward.Secret(q.Whole, "anchor", "laptop", "shanks"); !ok {
|
||||
t.Errorf("the router would refuse the whole words: %s", refusal)
|
||||
}
|
||||
// Kept as the controller's own ask, about no condition, with the proposal whole and its digests.
|
||||
kept := r.theProposal(t)
|
||||
p := kept.Proposal
|
||||
@@ -196,98 +173,11 @@ func TestAMeshWideLayerIsProposed(t *testing.T) {
|
||||
}
|
||||
q := r.askSent(t)
|
||||
if q.Headline != "Set notes on the whole mesh?" || q.About != "settings.notes.mesh" ||
|
||||
q.Explanation != "Changes 1 setting(s) of notes on the whole mesh; approved, the layer is set and sent at once by a walk to every machine running notes, one machine at a time, each judged.\n+ x: 1" ||
|
||||
q.Whole != "" {
|
||||
!strings.Contains(q.Explanation, "Set the settings of notes on the whole mesh to these values?") {
|
||||
t.Errorf("%+v", q)
|
||||
}
|
||||
}
|
||||
|
||||
// kept is the one proposal the rig keeps.
|
||||
func kept(r *proposerRig) asked {
|
||||
for _, a := range r.store {
|
||||
if a.Proposal != nil {
|
||||
return a
|
||||
}
|
||||
}
|
||||
return asked{}
|
||||
}
|
||||
|
||||
// The switch between the masked and the whole change (issue 383): the same change, under the content rule and
|
||||
// exact, differs in the masked values alone; a value shaped like a secret is withheld in both, whole, with its
|
||||
// key still named; and a change no value of which is masked carries no whole words of its own.
|
||||
func TestAProposalShowsItsValuesWholeOnlyWhereTheSenderIsProvenAndNeverASecret(t *testing.T) {
|
||||
machines := []string{"anchor", "laptop", "shanks"}
|
||||
r := newProposerRig(t)
|
||||
values := map[string]any{"shares": "media=/storage/media", "sources": "recalbox=smb://nas.lan/recalbox@/mnt/recalbox", "font": "Inter 13"}
|
||||
if _, err := r.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: values}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
q := r.askSent(t)
|
||||
masked, _, _ := kept(r).Proposal.change(machines, false)
|
||||
whole, _, _ := kept(r).Proposal.change(machines, true)
|
||||
if !strings.HasSuffix(q.Explanation, "\n"+strings.Join(masked, "\n")) || !strings.HasSuffix(q.Whole, "\n"+strings.Join(whole, "\n")) {
|
||||
t.Fatalf("the ask does not carry the change masked and whole:\n%s\n--\n%s", q.Explanation, q.Whole)
|
||||
}
|
||||
if want := []string{"+ font: Inter 13", "+ shares: media=‹path›", "+ sources: recalbox=‹address›@‹path›"}; strings.Join(masked, "\n") != strings.Join(want, "\n") {
|
||||
t.Errorf("masked: %q", masked)
|
||||
}
|
||||
if want := []string{"+ font: Inter 13", "+ shares: media=/storage/media", "+ sources: recalbox=smb://nas.lan/recalbox@/mnt/recalbox"}; strings.Join(whole, "\n") != strings.Join(want, "\n") {
|
||||
t.Errorf("whole: %q", whole)
|
||||
}
|
||||
if _, ok := outward.Secret(q.Whole, "shanks"); !ok {
|
||||
t.Error("the router would refuse the whole words")
|
||||
}
|
||||
// Mutation: the masked and the whole change differ in exactly the lines whose value was masked.
|
||||
differ := 0
|
||||
for i := range masked {
|
||||
if masked[i] != whole[i] {
|
||||
differ++
|
||||
if !strings.Contains(masked[i], "‹") || strings.Contains(whole[i], "‹") {
|
||||
t.Errorf("the lines differ otherwise than by the mask:\n%s\n%s", masked[i], whole[i])
|
||||
}
|
||||
}
|
||||
}
|
||||
if differ != 2 {
|
||||
t.Errorf("%d lines differ, and the mask covered 2", differ)
|
||||
}
|
||||
// A value shaped like a secret is withheld in both, whole, with its key still named.
|
||||
r1 := newProposerRig(t)
|
||||
secrets := map[string]any{"github": "ghp_abcdefghijklmnopqrstuvwxyz0123456789", "cert": "-----BEGIN CERTIFICATE-----"}
|
||||
if _, err := r1.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: secrets}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
q1 := r1.askSent(t)
|
||||
for _, line := range []string{"+ cert: ‹withheld›", "+ github: ‹withheld›"} {
|
||||
if !strings.Contains(q1.Explanation, line) {
|
||||
t.Errorf("lacks %q:\n%s", line, q1.Explanation)
|
||||
}
|
||||
}
|
||||
for _, secret := range []string{"ghp_", "BEGIN CERTIFICATE"} {
|
||||
if strings.Contains(q1.Explanation, secret) || strings.Contains(q1.Whole, secret) || strings.Contains(q1.Details, secret) {
|
||||
t.Errorf("the secret %q reaches the phone", secret)
|
||||
}
|
||||
}
|
||||
// More keys than points (issue 639): the first two, then the keys of the rest, read whole at the terminal.
|
||||
r3 := newProposerRig(t)
|
||||
five := map[string]any{"a": "1", "b": "2", "c": "3", "d": "4", "e": "5"}
|
||||
if _, err := r3.pr.propose(context.Background(), proposeInput{module: "notes", node: "laptop", values: five}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if q3 := r3.askSent(t); !strings.HasSuffix(q3.Explanation, "\n+ a: 1\n+ b: 2\nand 3 more, each in the note: c, d, e") || asks.Glance(q3.Explanation) != nil ||
|
||||
!strings.Contains(q3.Details, "settings proposals") {
|
||||
t.Errorf("five keys:\n%s", q3.Explanation)
|
||||
}
|
||||
// No value masked: the message is the same everywhere, and the ask says no whole words.
|
||||
r2 := newProposerRig(t)
|
||||
if _, err := r2.pr.propose(context.Background(), proposeInput{module: "dunst", node: "laptop", values: map[string]any{"font-size": 13, "width": 500}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if q2 := r2.askSent(t); q2.Whole != "" || !strings.HasSuffix(q2.Explanation, "\n+ font-size: 13\n+ width: 500") ||
|
||||
strings.Contains(q2.Details, "not proven") {
|
||||
t.Errorf("%+v", q2)
|
||||
}
|
||||
}
|
||||
|
||||
// A proposal expired unanswered is kept so by the reconciling, and a warrant for it afterwards sets nothing.
|
||||
func TestAnExpiredProposalIsKeptExpired(t *testing.T) {
|
||||
r := newAskerRig(t)
|
||||
@@ -315,8 +205,7 @@ func TestAClearIsProposedAndShowsWhatItRemoves(t *testing.T) {
|
||||
}
|
||||
q := r.askSent(t)
|
||||
if q.Headline != "Clear notes on laptop?" || !strings.Contains(q.Explanation, "- places.data.owner: 1001:1001") ||
|
||||
!strings.Contains(q.Explanation, "- places.data.path: ‹path›") || !strings.Contains(q.Whole, "- places.data.path: /srv/notes") ||
|
||||
!strings.HasPrefix(q.Explanation, "Removes the 2 setting(s) of notes set on laptop; approved, the layer is removed and that is sent at once by a walk to laptop, one machine at a time") {
|
||||
!strings.Contains(q.Explanation, "- places.data.path: ‹path›") {
|
||||
t.Errorf("%+v", q)
|
||||
}
|
||||
if p := r.theProposal(t).Proposal; !p.Clear || p.Digest != layerDigest(r.before) || len(r.judged) != 0 {
|
||||
@@ -855,125 +744,3 @@ func captureStdout(t *testing.T, f func()) string {
|
||||
_ = w.Close()
|
||||
return <-done
|
||||
}
|
||||
|
||||
// The review of #304: Approve sets exactly what the operator can read. A proposal of five keys, one value 300
|
||||
// characters long, shows two keys at a glance, says what it cut, and carries every key with its whole value in its
|
||||
// Details for a channel that proves who answers (WholeDetails), and every key masked for one that does not.
|
||||
func TestEveryKeyAndItsWholeValueReachTheOperator(t *testing.T) {
|
||||
var long strings.Builder
|
||||
long.WriteString("library=/storage")
|
||||
for i := 0; long.Len() < 300; i++ {
|
||||
long.WriteString(fmt.Sprintf("/album-%02d", i))
|
||||
}
|
||||
value := long.String()[:300]
|
||||
values := map[string]any{"a": "1", "b": "2", "c": "3", "d": "4", "shares": value}
|
||||
r := newProposerRig(t)
|
||||
if _, err := r.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: values}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
q := r.askSent(t)
|
||||
if err := q.Check(r.now); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// What the operator reads on a proving channel: the whole words, then the note's whole details.
|
||||
visible := q.Whole + "\n" + q.WholeDetails
|
||||
if q.Whole == "" {
|
||||
visible = q.Explanation + "\n" + q.WholeDetails
|
||||
}
|
||||
for k, v := range values {
|
||||
if !strings.Contains(visible, "+ "+k+": "+v.(string)) {
|
||||
t.Errorf("the operator never reads %s whole:\n%s", k, visible)
|
||||
}
|
||||
}
|
||||
// The masked glance points to a note that holds the values masked, and says no more; the whole glance, shown only
|
||||
// beside the whole details, says they are whole there.
|
||||
if asks.Glance(q.Explanation) != nil || !strings.HasSuffix(q.Explanation, "\nand 3 more, each in the note: c, d, shares") ||
|
||||
strings.Contains(q.Explanation, "whole in the note") || !strings.HasSuffix(q.Whole, "\nand 3 more, each whole in the note: c, d, shares") {
|
||||
t.Errorf("the glance:\n%s", q.Explanation)
|
||||
}
|
||||
for k := range values {
|
||||
if !strings.Contains(q.Details, "+ "+k+": ") {
|
||||
t.Errorf("the masked details lack %s:\n%s", k, q.Details)
|
||||
}
|
||||
}
|
||||
if strings.Contains(q.Details, "/storage") {
|
||||
t.Errorf("the masked details show a path:\n%s", q.Details)
|
||||
}
|
||||
if refusal, ok := outward.Check(q.Details, "shanks"); !ok {
|
||||
t.Errorf("the router would withhold the masked details: %s", refusal)
|
||||
}
|
||||
if _, ok := outward.Secret(q.WholeDetails, "shanks"); !ok {
|
||||
t.Error("the router would refuse the whole details")
|
||||
}
|
||||
// A value too long for a glance is cut there, and says so.
|
||||
r2 := newProposerRig(t)
|
||||
if _, err := r2.pr.propose(context.Background(), proposeInput{module: "mounts", node: "shanks", values: map[string]any{"shares": value}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
q2 := r2.askSent(t)
|
||||
// The cut point is 160 characters, its marker inside the bound.
|
||||
if last := q2.Whole[strings.LastIndex(q2.Whole, "\n")+1:]; len([]rune(last)) != asks.PointLength {
|
||||
t.Errorf("the cut point is %d characters, not %d: %q", len([]rune(last)), asks.PointLength, last)
|
||||
}
|
||||
if !strings.HasSuffix(q2.Whole, "… (cut: whole in the note)") || !strings.HasSuffix(q2.Explanation, "‹path›") && !strings.HasSuffix(q2.Explanation, "… (cut: in the note)") || !strings.Contains(q2.WholeDetails, "+ shares: "+value) || asks.Glance(q2.Whole) != nil {
|
||||
t.Errorf("the cut is not said, or the note lacks the whole:\n%s\n--\n%s", q2.Whole, q2.WholeDetails)
|
||||
}
|
||||
}
|
||||
|
||||
// The review of #304: a value given to a secret's name, past the second key, is said with its key named and its
|
||||
// value withheld, in the note on every channel; the router has nothing left to withhold unnamed or refuse. A line
|
||||
// the router would refuse even so is refused at propose, in the controller's words.
|
||||
func TestASecretNamedKeyIsNamedAndItsValueWithheld(t *testing.T) {
|
||||
r := newProposerRig(t)
|
||||
values := map[string]any{"a": "1", "b": "2", "c": "3", "password": "hunter2"}
|
||||
if _, err := r.pr.propose(context.Background(), proposeInput{module: "notes", node: "laptop", values: values}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
q := r.askSent(t)
|
||||
for _, form := range []string{q.Details, q.WholeDetails, q.Explanation, q.Whole} {
|
||||
if strings.Contains(form, "hunter2") {
|
||||
t.Errorf("the value reaches the phone:\n%s", form)
|
||||
}
|
||||
}
|
||||
if !strings.Contains(q.Details, "+ password (value withheld)") {
|
||||
t.Errorf("the key is not named with its value withheld:\n%s", q.Details)
|
||||
}
|
||||
if q.WholeDetails != "" && !strings.Contains(q.WholeDetails, "+ password (value withheld)") {
|
||||
t.Errorf("the whole details do not name the key:\n%s", q.WholeDetails)
|
||||
}
|
||||
if line, why := judgeLines(q.Details, false, nil); line != "" {
|
||||
t.Errorf("the router would withhold %q: %s", line, why)
|
||||
}
|
||||
if line, why := judgeLines(q.WholeDetails, true, nil); line != "" {
|
||||
t.Errorf("the router would refuse %q: %s", line, why)
|
||||
}
|
||||
if !strings.HasSuffix(q.Explanation, "\nand 2 more, each in the note: c, password") {
|
||||
t.Errorf("the glance:\n%s", q.Explanation)
|
||||
}
|
||||
// A key shaped like a secret cannot be named on any channel: refused at propose, in the controller's words, and
|
||||
// the key itself not echoed.
|
||||
r2 := newProposerRig(t)
|
||||
secretKey := "ghp_abcdefghijklmnopqrstuvwxyz0123456789"
|
||||
_, err := r2.pr.propose(context.Background(), proposeInput{module: "notes", node: "laptop",
|
||||
values: map[string]any{"a": "1", "b": "2", secretKey: "3"}})
|
||||
if err == nil || !strings.Contains(err.Error(), "Nothing was proposed") || strings.Contains(err.Error(), secretKey) {
|
||||
t.Errorf("a secret-shaped key: %v", err)
|
||||
}
|
||||
if len(r2.sent) != 0 {
|
||||
t.Errorf("the refused proposal was asked")
|
||||
}
|
||||
}
|
||||
|
||||
// keyOfLine names a change's key, and never one shaped like a secret.
|
||||
func TestARefusalNamesTheKeyAndNeverASecret(t *testing.T) {
|
||||
for line, want := range map[string]string{
|
||||
"+ password (value withheld)": "password",
|
||||
"~ shares: ‹path› (was: none)": "shares",
|
||||
"+ ghp_abcdefghijklmnopqrstuvwxyz0123456789: 1": "whose key is shaped like a secret",
|
||||
"Proposed by g14 at 15:04.": "Proposed by g14 at 15:04.",
|
||||
} {
|
||||
if got := keyOfLine(line); got != want {
|
||||
t.Errorf("%q: %q, want %q", line, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -740,14 +740,7 @@ func waitForApplied(ctx context.Context, inv *inventory.Inventory, node, digest
|
||||
fmt.Printf("%s applied it\n", node)
|
||||
return nil
|
||||
case inventory.OutcomeFailed:
|
||||
// Each failed resource by id with the machine's own words, so the answer says what to fix
|
||||
// without a second look (novox/hq issue 629).
|
||||
var each []string
|
||||
for _, f := range doing.Failed {
|
||||
each = append(each, f.ID+": "+f.Error)
|
||||
}
|
||||
return fmt.Errorf("%s applied what it was sent but %d resource(s) failed: %s", node, len(doing.Failed),
|
||||
strings.Join(each, "; "))
|
||||
return fmt.Errorf("%s applied what it was sent but %d resource(s) failed", node, len(doing.Failed))
|
||||
case inventory.OutcomeRefused:
|
||||
return fmt.Errorf("%s refused what it was sent: %s", node, doing.Refused)
|
||||
}
|
||||
|
||||
@@ -2,7 +2,6 @@ package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"sort"
|
||||
|
||||
@@ -84,27 +83,6 @@ func everyBuildKept(ctx context.Context, node string) bool {
|
||||
return on != "" && on == node
|
||||
}
|
||||
|
||||
type keepForSettingsKey struct{}
|
||||
|
||||
// keepingBuildsForSettings is a context whose sends compose every module of one machine — recorded or rolling out —
|
||||
// at the build that machine was last sent, as keepingEveryBuild does, for a settings walk's send (novox/hq ADR 0344):
|
||||
// the layer the operator approved, and nothing of any module's new code. A build held for a person, or waiting
|
||||
// for a gate, stays where it is; the walk that is its own carries it.
|
||||
func keepingBuildsForSettings(ctx context.Context, node string) context.Context {
|
||||
return context.WithValue(ctx, keepForSettingsKey{}, node)
|
||||
}
|
||||
|
||||
// errSettingsCannotKeep is a settings walk's send refused because a build of its machine cannot be kept: what the
|
||||
// machine was last sent is not known, or a build it runs is gone from the records. It does not clear by itself, so
|
||||
// the walk fails on it rather than trying again (ADR 0344).
|
||||
var errSettingsCannotKeep = errors.New("the settings cannot be sent with every build kept")
|
||||
|
||||
// settingsKeptOn is whether this context is a settings walk's send to this machine.
|
||||
func settingsKeptOn(ctx context.Context, node string) bool {
|
||||
on, _ := ctx.Value(keepForSettingsKey{}).(string)
|
||||
return on != "" && on == node
|
||||
}
|
||||
|
||||
// recordedKept is, for a send under keepingRecorded, every recorded module the machine was last sent a
|
||||
// build of that the mesh's build is not identical to: module → the commit it keeps. Nil when the context
|
||||
// keeps nothing, or when what the machine was last sent is not known (it is then held whole elsewhere —
|
||||
@@ -114,7 +92,7 @@ func settingsKeptOn(ctx context.Context, node string) bool {
|
||||
// 490), and a machine whose last send is not known refuses the send: there is nothing to keep it at, and
|
||||
// composing the mesh's builds would be the very move the grants step must not make.
|
||||
func recordedKept(ctx context.Context, open *stores, node string) (map[string]string, error) {
|
||||
every := everyBuildKept(ctx, node) || settingsKeptOn(ctx, node)
|
||||
every := everyBuildKept(ctx, node)
|
||||
skip, on := keptExcept(ctx)
|
||||
if !on && !every {
|
||||
return nil, nil
|
||||
@@ -128,9 +106,6 @@ func recordedKept(ctx context.Context, open *stores, node string) (map[string]st
|
||||
return nil, err
|
||||
}
|
||||
if !known {
|
||||
if settingsKeptOn(ctx, node) {
|
||||
return nil, fmt.Errorf("%w: what %s was last sent is not known (novox/hq ADR 0344)", errSettingsCannotKeep, node)
|
||||
}
|
||||
if every {
|
||||
return nil, fmt.Errorf("what %s was last sent is not known, so the bus's user list cannot be sent "+
|
||||
"there alone with every build kept (novox/hq issue 490)", node)
|
||||
@@ -191,10 +166,6 @@ func keepRecorded(ctx context.Context, open *stores, node string, shelf map[stri
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !found && settingsKeptOn(ctx, node) {
|
||||
return nil, fmt.Errorf("%w: %s runs %s's build %s, which the build records no longer hold (novox/hq ADR 0344)",
|
||||
errSettingsCannotKeep, node, m, short(kept[m]))
|
||||
}
|
||||
if !found && everyBuildKept(ctx, node) {
|
||||
return nil, fmt.Errorf("%s runs %s's build %s, which the build records no longer hold: the bus's user "+
|
||||
"list cannot be sent there alone with it kept (novox/hq issue 490)", node, m, short(kept[m]))
|
||||
|
||||
@@ -616,10 +616,6 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
|
||||
}
|
||||
for _, p := range plans {
|
||||
if p.Release != nil {
|
||||
if by != "" && p.Release.Settings != nil {
|
||||
return nil, fmt.Errorf("%s is sending %s; what waits is released once it ends — `plans %s` says where it is",
|
||||
p.ID, p.Repository, p.ID)
|
||||
}
|
||||
if by != "" {
|
||||
return nil, fmt.Errorf("%s is already releasing what waits; `plans %s` says where it is", p.ID, p.ID)
|
||||
}
|
||||
@@ -645,9 +641,7 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
|
||||
return nil, err
|
||||
}
|
||||
for _, p := range recent {
|
||||
// A settings walk that failed holds nothing back (novox/hq ADR 0344 §6): its failure is its module's
|
||||
// settings on one machine, said on its own, not a build no gate passed.
|
||||
if p.Release == nil || p.Release.Settings != nil {
|
||||
if p.Release == nil {
|
||||
continue
|
||||
}
|
||||
if p.State == inventory.PlanFailed {
|
||||
@@ -708,9 +702,6 @@ func releaseBacklog(ctx context.Context, open *stores, by string) (*inventory.Pl
|
||||
// gate, or the machine being judged judged once more; the plan done when every machine is.
|
||||
func advanceRelease(ctx context.Context, open *stores, p *inventory.Plan) (bool, error) {
|
||||
r := p.Release
|
||||
if r.Settings != nil {
|
||||
return advanceSettingsWalk(ctx, open, p)
|
||||
}
|
||||
now := time.Now().UTC()
|
||||
if r.Gate == nil {
|
||||
heard, err := releaseHeard(ctx, open)
|
||||
|
||||
@@ -250,16 +250,6 @@ func gates(p inventory.Plan, edges []inventory.Edge, rollsOut func(string) bool)
|
||||
return out
|
||||
}
|
||||
|
||||
// noMoveWhy is what a plan says of a module of its tier whose build was made from the source every machine
|
||||
// running it runs (novox/hq issue 280): nothing is sent for it.
|
||||
const noMoveWhy = "no move: made from the source every machine running it runs"
|
||||
|
||||
// noMove is whether the plan marked the module no move and sent it nothing. Read from what the plan says,
|
||||
// so a plan kept before the mark had a name of its own is read the same (novox/hq issue 648).
|
||||
func noMove(s *inventory.PlanModule) bool {
|
||||
return s != nil && s.FirstAt == nil && s.Gate == nil && strings.HasPrefix(s.Why, "no move")
|
||||
}
|
||||
|
||||
// applied says whether every machine running the module has reported since the module was built.
|
||||
// appliedEach is applied with a moment of its own for each machine: the reports that count are the ones
|
||||
// after that machine was sent the build (novox/hq issue 256).
|
||||
@@ -725,7 +715,7 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
|
||||
} else if same {
|
||||
now := time.Now().UTC()
|
||||
state.SentAt = &now
|
||||
state.Why = noMoveWhy
|
||||
state.Why = "no move: made from the source every machine running it runs"
|
||||
fmt.Printf("%s: %s built from the source every machine running it runs: no move, nothing sent\n", p.ID, m)
|
||||
continue
|
||||
}
|
||||
@@ -915,25 +905,6 @@ func advanceOnce(ctx context.Context, open *stores, p *inventory.Plan,
|
||||
if state.BuiltAt != nil {
|
||||
since = *state.BuiltAt
|
||||
}
|
||||
// **A build that is no move is waited on by the send that last carried it** (novox/hq issue 648).
|
||||
// Nothing was sent for it, so no report follows its marking or its build: a machine that does not
|
||||
// happen to report again held the walk for ever. Each machine runs it once it answered its last
|
||||
// send — the one whose builds made it no move — whenever that was.
|
||||
if noMove(state) {
|
||||
byNode := map[string]inventory.Reported{}
|
||||
for _, r := range reports {
|
||||
byNode[r.Node] = r
|
||||
}
|
||||
if ok, on := appliedEach(m, func(node string) time.Time {
|
||||
if s := byNode[node].Sent; s != nil {
|
||||
return *s
|
||||
}
|
||||
return time.Time{}
|
||||
}, running, reports); !ok {
|
||||
waiting = append(waiting, fmt.Sprintf("%s on %s", m, strings.Join(on, ", ")))
|
||||
}
|
||||
continue
|
||||
}
|
||||
// **Each machine from its own send** (novox/hq issue 256). With one machine first (ADR 0218)
|
||||
// a module is sent twice — the first machine, then the rest — and SentAt is the second.
|
||||
// Asked of every machine, the first machine's report, made between the two sends, read as
|
||||
|
||||
@@ -1,74 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
)
|
||||
|
||||
// TestReplay164 replays novox/hq issue 164 (found provisioning the media machine's modules, re-checked
|
||||
// 2026-10-08): a Servarr app's API key, an indexer's key and a downloader's password are values the provider's
|
||||
// software holds and only a person can give, and for a consumer of such a provision the send made a random pair
|
||||
// credential, sealed it to both ends and placed it; the provider refused it, and a consumer retrying it could be
|
||||
// banned by the provider. The outcome asserted (ADR 0337): for a provision whose offer says its credential is
|
||||
// issued outside the mesh, the send makes no value and places none, the consumer's machine still composes, and a
|
||||
// value a person gave for the pair is placed. Written with only what the controller had before its fix —
|
||||
// register, assign, planFor, declarationFor, AcceptSecretForPair and the inventory's secret reads — so it is laid
|
||||
// over the commit before. Needs the store (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
|
||||
func TestReplay164(t *testing.T) {
|
||||
open := aMesh(t)
|
||||
ctx := t.Context()
|
||||
const secretFile = "/var/lib/mesh/requests/tv-api.secret"
|
||||
register(t, open, catalogue.Manifest{Module: "tv", Version: "1",
|
||||
Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
|
||||
Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}},
|
||||
Serves: map[string]map[string]any{"tv-api": {"port": 8989}}})
|
||||
register(t, open, catalogue.Manifest{Module: "requests", Version: "1", Requires: []string{"tv-api"},
|
||||
Secrets: map[string]string{"tv-api": secretFile}})
|
||||
for _, a := range [][2]string{{"anchor", "tv"}, {"laptop", "requests"}} {
|
||||
if _, err := assign(ctx, open, a[0], a[1]); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
sent := func() []map[string]any {
|
||||
t.Helper()
|
||||
plan, settings, err := planFor(ctx, open, "laptop")
|
||||
if err != nil {
|
||||
t.Fatalf("the consumer's machine was refused for a credential only a person gives: %v", err)
|
||||
}
|
||||
declared, err := declarationFor(ctx, open, "laptop", plan, settings)
|
||||
if err != nil {
|
||||
t.Fatalf("the send to laptop did not compose: %v", err)
|
||||
}
|
||||
return declared.Resources
|
||||
}
|
||||
placed := func(resources []map[string]any) map[string]any {
|
||||
for _, r := range resources {
|
||||
if r["path"] == secretFile && r["sealed"] != nil {
|
||||
return r
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
if got := placed(sent()); got != nil {
|
||||
t.Errorf("the send placed a credential for tv-api (%v), which only a person can give and nobody gave", got["id"])
|
||||
}
|
||||
held, err := open.inventory.SecretsOf(ctx, "laptop", "requests")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, s := range held {
|
||||
if s.Name == "tv-api" {
|
||||
t.Fatalf("the mesh holds a value for tv-api that nobody gave (origin %q)", s.Origin)
|
||||
}
|
||||
}
|
||||
|
||||
// Given by a person for the pair, it is placed, as given.
|
||||
if err := open.inventory.AcceptSecretForPair(ctx, "tv-api", "laptop", "requests", "anchor", "", "the app's key"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if placed(sent()) == nil {
|
||||
t.Fatal("the value a person gave for tv-api was not placed")
|
||||
}
|
||||
}
|
||||
@@ -1,71 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"reflect"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
)
|
||||
|
||||
// **A new SDK plans the toolchain, and then every bundle compiled in it** (novox/hq issue 614), reasoned
|
||||
// as `mesh-controller.delivery-plan` reasons it: the modules registered as a build registers them —
|
||||
// resolved, so carrying no `build` — their builds recorded with what they stood on and what they made,
|
||||
// the graph read by theGraph and the change scoped by pullScope. On 2026-10-13 mesh-sdk 0.1.14 planned
|
||||
// "builds mesh-sdk, sent nowhere": mesh-tools' `build.on` naming the SDK's package and the providers'
|
||||
// TypeScript bundles were edges only while their manifests were unbuilt.
|
||||
//
|
||||
// **The replay of issue 614** (mesh-lab R614): written only with what the controller had before its fix — a
|
||||
// store, modules registered and builds recorded, theGraph and pullScope — so it is laid over the commit before
|
||||
// and fails there with the plan of that day, [[mesh-sdk]]. Needs a store: MESH_TEST_POSTGRES.
|
||||
func TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles(t *testing.T) {
|
||||
inv := inventory.ForTest(t)
|
||||
ctx := t.Context()
|
||||
asked := time.Now().Add(-time.Hour)
|
||||
digest := func(c string) string { return "@sha256:" + strings.Repeat(c, 64) }
|
||||
register := func(m catalogue.Manifest, repository, path string, against []string, made []inventory.Artifact) {
|
||||
t.Helper()
|
||||
if err := inv.RegisterModule(ctx, m, inventory.Source{Repository: repository, Seat: "git", Path: path,
|
||||
Ref: "main", BuiltFrom: "old", Asked: asked}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-" + m.Module, Repository: repository, Ref: "main",
|
||||
Module: m.Module, Commit: "old", On: "builder", Path: path, Against: against, Made: made, Asked: asked}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
bundle := func(module, language string) catalogue.Manifest {
|
||||
return catalogue.Manifest{Module: module, Version: "1", Bundles: []catalogue.Bundle{{
|
||||
Name: "code", Language: language, Source: catalogue.ArtifactStoreScheme + module + "/code" + digest("2"),
|
||||
Entrypoints: []string{"tools/index.js"}}}}
|
||||
}
|
||||
register(catalogue.Manifest{Module: "build-agent", Version: "1",
|
||||
Claims: []catalogue.Claim{{Name: "node-build-agent", Scope: catalogue.ScopeNode}}},
|
||||
"novox/mesh-catalog", "modules/build-agent", nil, nil)
|
||||
register(catalogue.Manifest{Module: "mesh-sdk", Version: "1"}, "novox/mesh-sdk", "", nil,
|
||||
[]inventory.Artifact{{Name: "lib", Kind: "package", Reference: "@novox/mesh-sdk@0.1.13"}})
|
||||
register(catalogue.Manifest{Module: "mesh-tools", Version: "1"}, "novox/mesh-tools", "",
|
||||
[]string{"@novox/mesh-sdk@0.1.13", catalogue.ArtifactStoreScheme + "upstream/docker.io/library/node" + digest("0")},
|
||||
[]inventory.Artifact{{Name: "build", Kind: "image", Reference: catalogue.ArtifactStoreScheme + "mesh-tools/build" + digest("1")}})
|
||||
register(catalogue.Manifest{Module: "mesh-tools-go", Version: "1"}, "novox/mesh-tools", "go", nil, nil)
|
||||
register(bundle("minio", "typescript"), "novox/mesh-catalog", "modules/minio", nil, nil)
|
||||
register(bundle("umami", "typescript"), "novox/mesh-catalog", "modules/umami", nil, nil)
|
||||
register(bundle("dnsmasq", "go"), "novox/mesh-catalog", "modules/dnsmasq", nil, nil)
|
||||
|
||||
entries, read, edges, err := theGraph(ctx, inv)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
m := orderMember{ID: "novox/mesh-sdk@new", Repository: "novox/mesh-sdk", Head: "new",
|
||||
Paths: []string{"src/provisioner/index.ts", "package.json"}}
|
||||
s := pullScope(m.pull(), entries, read, edges)
|
||||
want := [][]string{{"mesh-sdk"}, {"mesh-tools"}, {"minio", "umami"}}
|
||||
if !reflect.DeepEqual(s.Reach.Plan.Tiers, want) {
|
||||
t.Fatalf("a new SDK plans %v, want %v (edges %v)", s.Reach.Plan.Tiers, want, edges)
|
||||
}
|
||||
if !reflect.DeepEqual(s.Dependents, []string{"mesh-tools", "minio", "umami"}) {
|
||||
t.Errorf("dependents %v", s.Dependents)
|
||||
}
|
||||
}
|
||||
@@ -13,7 +13,6 @@ import (
|
||||
"slices"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/broker"
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
@@ -520,13 +519,9 @@ func (a *verbArguments) commandLine() ([]string, error) {
|
||||
}
|
||||
return []string{"unpin", str("node"), str("provision")}, nil
|
||||
case "push":
|
||||
// A push to a named machine waits for that machine's own answer, so the call's record says
|
||||
// how it went: applied, refused with the machine's reason, or which resources failed and why
|
||||
// (novox/hq issue 629). How long is the call's `wait`, else the controller's setting `push-wait`;
|
||||
// neither given waits for nothing, as before. The caller is answered before the push starts
|
||||
// (answersFirst) and the machines are released once sent, so the wait holds nobody; it is what
|
||||
// `calls` then shows. A sweep (--behind) does not wait: the slowest machine would hold back
|
||||
// what is said of the others.
|
||||
// Sent and not waited for: the asker reads `status` for what the machine did, which is
|
||||
// what a person at a shell does too. A tool call that blocked for a push's whole apply would
|
||||
// time out on every machine that takes a minute, and say nothing about the ones that did not.
|
||||
// A push through the seat is a push by hand, and says why (novox/hq to-be 45 §7).
|
||||
if err := need("why"); err != nil {
|
||||
return nil, fmt.Errorf("%w: a push by hand is a repair, recorded in the hand-act log with why", err)
|
||||
@@ -539,11 +534,7 @@ func (a *verbArguments) commandLine() ([]string, error) {
|
||||
// behind is not read here: given with a machine, it is refused as passed over — naming
|
||||
// a machine and asking for every machine behind are two requests, and guessing one
|
||||
// would push a machine nobody named, or not push one somebody did.
|
||||
wait, err := pushWait(str("wait"))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
argv := []string{"push", n, "--wait", wait.String()}
|
||||
argv := []string{"push", n, "--wait", "0"}
|
||||
// A running module's data moving is sent only when said, per module (novox/hq ADR 0217).
|
||||
if m := str("move"); m != "" {
|
||||
argv = append(argv, "--move", m)
|
||||
@@ -1337,47 +1328,6 @@ var inProcess = map[string]bool{"tools": true, "calls": true, "doctor": true,
|
||||
// 0259 §8): the router asks it before an approval.
|
||||
"root-free": true}
|
||||
|
||||
// pushFileVar names the file the controller's push settings are written to (module.json, `push-wait`).
|
||||
const pushFileVar = "MESH_PUSH_FILE"
|
||||
|
||||
// pushWait is how long a push to a named machine waits for its answer (novox/hq issue 629): the call's own
|
||||
// `wait` when given, else the controller's setting `push-wait`, else nothing. No length is written here: the
|
||||
// setting's default is the module's, and a setting that cannot be read waits for nothing, as a push did
|
||||
// before, and is said.
|
||||
func pushWait(given string) (time.Duration, error) {
|
||||
if strings.TrimSpace(given) != "" {
|
||||
d, ok := durationSetting(given)
|
||||
if !ok {
|
||||
return 0, fmt.Errorf("push: wait %q is no duration: say it as \"90s\", \"2m\", or \"0\" to wait for nothing", given)
|
||||
}
|
||||
return d, nil
|
||||
}
|
||||
path := os.Getenv(pushFileVar)
|
||||
if path == "" {
|
||||
return 0, nil
|
||||
}
|
||||
raw, err := os.ReadFile(path)
|
||||
if err != nil {
|
||||
fmt.Fprintf(os.Stderr, "the push settings cannot be read (%v); a push waits for nothing\n", err)
|
||||
return 0, nil
|
||||
}
|
||||
var values map[string]any
|
||||
if err := json.Unmarshal(raw, &values); err != nil {
|
||||
fmt.Fprintf(os.Stderr, "the push settings are not JSON (%v); a push waits for nothing\n", err)
|
||||
return 0, nil
|
||||
}
|
||||
v, has := values["push-wait"]
|
||||
if !has || v == "" {
|
||||
return 0, nil
|
||||
}
|
||||
d, ok := durationSetting(v)
|
||||
if !ok {
|
||||
fmt.Fprintf(os.Stderr, "the setting push-wait=%v is no duration; a push waits for nothing\n", v)
|
||||
return 0, nil
|
||||
}
|
||||
return d, nil
|
||||
}
|
||||
|
||||
// answersFirst is a command line whose caller is answered before it runs: a push, by its verb or
|
||||
// through `command`. A push sends the machine holding the bus first when its user list changed, the
|
||||
// broker reloads, and a reload forgets every answer the bus was about to permit — so an answer
|
||||
|
||||
@@ -146,7 +146,7 @@ func TestAnArgumentAVerbDoesNotDeclareIsRefused(t *testing.T) {
|
||||
// naming one beside behind is refused rather than one of the two guessed.
|
||||
func TestAPushIsOneMachineOrSaysItIsTheWholeMesh(t *testing.T) {
|
||||
argv, err := argvFor("push", map[string]any{"node": "g1", "why": "w"})
|
||||
if err != nil || strings.Join(argv, " ") != "push g1 --wait 0s --why w" {
|
||||
if err != nil || strings.Join(argv, " ") != "push g1 --wait 0 --why w" {
|
||||
t.Fatalf("a named push: %v %v", argv, err)
|
||||
}
|
||||
for _, args := range []map[string]any{{"why": "w"}, {"behind": "true", "why": "w"}} {
|
||||
|
||||
@@ -5,8 +5,6 @@ import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"github.com/novox/mesh-controller/internal/link"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
@@ -166,14 +164,12 @@ func TestAVerbMissingWhatItNeedsIsRefused(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// Acts do not block the call. A build is sent, not waited for: the asker reads the build's log by its id.
|
||||
// A push answers its caller before it starts (answersFirst), so a named push waits for the machine's own
|
||||
// answer without holding anybody, and the call's record says how it went (novox/hq issue 629). A
|
||||
// repository given as a forge path is said to be one (issue 176).
|
||||
// A push and a build are sent, not waited for: the asker reads status, or the build's log by its
|
||||
// id, for what happened. A repository given as a forge path is said to be one (issue 176).
|
||||
func TestActsDoNotBlockTheCall(t *testing.T) {
|
||||
argv, _ := argvFor("push", map[string]any{"node": "one", "why": "w"})
|
||||
if strings.Join(argv, " ") != "push one --wait 0s --why w" || !answersFirst(argv) {
|
||||
t.Fatalf("a named push with no setting waits, or holds its caller: %v", argv)
|
||||
if strings.Join(argv, " ") != "push one --wait 0 --why w" {
|
||||
t.Fatalf("push waits: %v", argv)
|
||||
}
|
||||
argv, _ = argvFor("build", map[string]any{"repository": "novox/x", "path": "modules/x"})
|
||||
if strings.Join(argv, " ") != "build novox/x --wait 0 --self --path modules/x" {
|
||||
@@ -464,40 +460,3 @@ func TestAQuotedValueRoundTrips(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// A named push waits as long as the call says, else as long as the controller's setting push-wait says, else
|
||||
// not at all: no length is the code's own (novox/hq issue 629).
|
||||
func TestAPushWaitsAsTheCallOrTheSettingSays(t *testing.T) {
|
||||
file := filepath.Join(t.TempDir(), "push.json")
|
||||
if err := os.WriteFile(file, []byte(`{"push-wait": "2m"}`), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
t.Setenv(pushFileVar, file)
|
||||
argv, err := argvFor("push", map[string]any{"node": "one", "why": "w"})
|
||||
if err != nil || strings.Join(argv, " ") != "push one --wait 2m0s --why w" {
|
||||
t.Fatalf("the setting was not the default: %v %v", argv, err)
|
||||
}
|
||||
argv, err = argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "30s"})
|
||||
if err != nil || strings.Join(argv, " ") != "push one --wait 30s --why w" {
|
||||
t.Fatalf("the call's wait did not win over the setting: %v %v", argv, err)
|
||||
}
|
||||
argv, err = argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "0"})
|
||||
if err != nil || strings.Join(argv, " ") != "push one --wait 0s --why w" {
|
||||
t.Fatalf("a wait of 0 did not wait for nothing: %v %v", argv, err)
|
||||
}
|
||||
if _, err := argvFor("push", map[string]any{"node": "one", "why": "w", "wait": "soon"}); err == nil ||
|
||||
!strings.Contains(err.Error(), "no duration") {
|
||||
t.Fatalf("a wait that is no duration was taken: %v", err)
|
||||
}
|
||||
if err := os.WriteFile(file, []byte(`{"push-wait": "later"}`), 0o600); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
argv, err = argvFor("push", map[string]any{"node": "one", "why": "w"})
|
||||
if err != nil || strings.Join(argv, " ") != "push one --wait 0s --why w" {
|
||||
t.Fatalf("an unreadable setting did not fall back to waiting for nothing: %v %v", argv, err)
|
||||
}
|
||||
argv, _ = argvFor("push", map[string]any{"why": "w"})
|
||||
if strings.Join(argv, " ") != "push --behind --wait 0 --why w" {
|
||||
t.Fatalf("a sweep waits: %v", argv)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -79,37 +79,6 @@ func secretCommand(ctx context.Context, args []string) error {
|
||||
return fmt.Errorf("a secret's value is given at the controller's terminal or at the desk (`give`), never "+
|
||||
"through a verb (this line came through %q): nothing was read or sealed", verb)
|
||||
}
|
||||
// **A provision's credential issued outside the mesh is given once, for its provider** (novox/hq ADR 0337 §3,
|
||||
// issue 165): `secret accept <provider's machine> <provider module> <provision>`, sealed to every consumer of
|
||||
// that provider; the per-pair form naming a consumer is refused for it, naming this one.
|
||||
outsideAt, err := outsideOffer(ctx, module, name, *provider)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if outsideAt == "" && *provider != "" {
|
||||
if offered, err := offeredOutsideBy(ctx, name); err != nil {
|
||||
return err
|
||||
} else if offered != "" {
|
||||
return fmt.Errorf("%s is issued outside the mesh and given once for its provider, which seals it to "+
|
||||
"every consumer of it (ADR 0337): `secret accept %s %s %s`; nothing was read or sealed",
|
||||
name, *provider, offered, name)
|
||||
}
|
||||
}
|
||||
if outsideAt != "" {
|
||||
if *desk != "" || *local != "" {
|
||||
return errors.New("a provision's credential issued outside the mesh is given at the controller's " +
|
||||
"terminal, for every consumer of its provider; it takes neither --at-desk nor --local")
|
||||
}
|
||||
value, err := valueFor(node, module, name, *from)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
value = asSupplied(value)
|
||||
if value == "" {
|
||||
return errors.New("there is nothing to seal")
|
||||
}
|
||||
return acceptForProvision(ctx, node, module, name, value)
|
||||
}
|
||||
if *desk != "" {
|
||||
if *from != "" || *provider != "" {
|
||||
return errors.New("--at-desk gives a module's own secret, and takes neither --from nor --provider")
|
||||
@@ -204,7 +173,6 @@ const secretUsage = "secret rotate <node> <module> <name> [--why <text> [--cause
|
||||
"secret ask <node> <module> <name> [--at <machine>]\n" +
|
||||
"secret issued <provision>\n" +
|
||||
"secret accept <node> <module> <name> [--from <file> | --at-desk <machine>] [--provider <node> [--local <name>]]\n" +
|
||||
"secret accept <provider's node> <provider module> <provision> [--from <file>] (a credential issued outside the mesh, for every consumer)\n" +
|
||||
"secret recover <node> <module> <name> --key <operator-key> [--out <file>] [--from-export <file>] [--provider <node>]\n" +
|
||||
"secret export [--out <file>]"
|
||||
|
||||
|
||||
@@ -40,9 +40,6 @@ type sendable struct {
|
||||
actingEpoch uint64
|
||||
// modules are the modules this declaration names, for the record of the send; never on the wire.
|
||||
modules []string
|
||||
// localNetwork is every port admitted from the local network and what it resolved to (novox/hq ADR
|
||||
// 0340 §8), for plan to say; never on the wire.
|
||||
localNetwork []catalogue.LocalNetworkPort
|
||||
// Adoption is nil for a converged node, and then the body is byte for byte what it was before
|
||||
// adoption existed: an older host parses the envelope strictly and would refuse the key.
|
||||
Adoption *adoptionEnvelope
|
||||
|
||||
@@ -1,60 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
)
|
||||
|
||||
// novox/hq ADR 0346, issue 624: a provider on another machine serves its consumers its own composed
|
||||
// names, as that machine composes them; one it does not compose is left out, said under the need.
|
||||
func TestAProviderElsewhereServesItsOwnComposedName(t *testing.T) {
|
||||
open := aMesh(t)
|
||||
ctx := t.Context()
|
||||
forge, err := catalogue.ParseManifest([]byte(`{"module":"forge","version":"1","requires":["route"],
|
||||
"provides":[{"name":"npm-package-registry","scope":"mesh"}],
|
||||
"contributes":{"route":{"web":{"label":"git","port":3000}}},
|
||||
"serves":{"npm-package-registry":{"scheme":"http","port":3000,"npm-path":"/api/packages/novox/npm/",
|
||||
"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"}}}`))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
register(t, open, catalogue.Manifest{Module: "proxy", Version: "1", Provides: catalogue.FromAnywhere("route"),
|
||||
Receives: map[string]string{"route": "/var/lib/proxy/routes.json"}})
|
||||
register(t, open, forge)
|
||||
register(t, open, catalogue.Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
|
||||
Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}})
|
||||
for _, a := range [][2]string{{"anchor", "proxy"}, {"anchor", "forge"}, {"laptop", "lab"}} {
|
||||
if _, err := assign(ctx, open, a[0], a[1]); err != nil {
|
||||
t.Fatalf("assign %s %s: %v", a[0], a[1], err)
|
||||
}
|
||||
}
|
||||
|
||||
if err := open.inventory.SetPublicDomain(ctx, "anchor", "example.test"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
plan, _, err := planFor(ctx, open, "laptop")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
n := need(t, plan, "lab", "npm-package-registry")
|
||||
if n.Serves["public-root"] != "https://git.example.test/api/packages/novox/npm/" || len(n.LeftOut) != 0 {
|
||||
t.Fatalf("the consumer elsewhere is served the forge's public root: %v, left out %v", n.Serves, n.LeftOut)
|
||||
}
|
||||
|
||||
if err := open.inventory.SetPublicDomain(ctx, "anchor", ""); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
plan, _, err = planFor(ctx, open, "laptop")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
n = need(t, plan, "lab", "npm-package-registry")
|
||||
if _, there := n.Serves["public-root"]; there {
|
||||
t.Fatalf("anchor composes no public name, so the key is left out: %v", n.Serves)
|
||||
}
|
||||
if len(n.LeftOut) != 1 || !strings.Contains(n.LeftOut[0], `without "public-root"`) {
|
||||
t.Fatalf("and the need says so: %v", n.LeftOut)
|
||||
}
|
||||
}
|
||||
@@ -1,281 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"slices"
|
||||
"sort"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
)
|
||||
|
||||
// An approved settings change is sent by a walk at once, and the operator's one Approve is its push (novox/hq ADR
|
||||
// 0344, issue 641).
|
||||
//
|
||||
// On 2026-10-13 the operator approved a betterbird proposal on Telegram and nothing happened: the warrant set the
|
||||
// layer, and the push stayed a separate act (ADR 0277 §18) that nobody took. Now the warrant that sets the layer
|
||||
// opens a **settings walk**: the walk ADR 0236 opens for builds waiting for a gate, with a layer in place of the
|
||||
// builds. Its order is every machine running the module that the layer reaches, the control node last; each is
|
||||
// sent and its module judged there, from the machine's report on that send, before the next is sent. The send is
|
||||
// the layer alone: every module there stays at the build its machine was last sent (keepingBuildsForSettings), so a
|
||||
// build held for a person (ADR 0242) or waiting for a gate stays where it is — a policy of `record` holds a build,
|
||||
// never a setting — and a send that would move a running module's data stops the walk (ADR 0217 §3). The walk says its start and end on `plan-moved` (ADR 0308), and the holder of the operator's
|
||||
// channel tells its end once. A failure stops the walk and leaves the layer as approved; it holds back nothing
|
||||
// else.
|
||||
|
||||
// settingsWalkPrefix names a settings walk's id.
|
||||
const settingsWalkPrefix = "settings-"
|
||||
|
||||
// settingsWalkFor is what a settings walk says it is for, where a merge's walk says its repository.
|
||||
func settingsWalkFor(s inventory.PlanSettings) string {
|
||||
where := s.Node
|
||||
if where == "" {
|
||||
where = "the whole mesh"
|
||||
}
|
||||
return fmt.Sprintf("the settings of %s on %s", s.Module, where)
|
||||
}
|
||||
|
||||
// settingsWalkOrder is the machines a layer reaches, in the order a settings walk sends them: every machine
|
||||
// running the module, or the one the layer names when it runs it there, sorted, the control node last. Pure.
|
||||
func settingsWalkOrder(node string, running, controllers []string) []string {
|
||||
var order, last []string
|
||||
for _, n := range running {
|
||||
if node != "" && n != node {
|
||||
continue
|
||||
}
|
||||
if slices.Contains(controllers, n) {
|
||||
last = append(last, n)
|
||||
} else {
|
||||
order = append(order, n)
|
||||
}
|
||||
}
|
||||
sort.Strings(order)
|
||||
sort.Strings(last)
|
||||
return append(order, last...)
|
||||
}
|
||||
|
||||
// openSettingsWalk opens the walk that sends an approved layer, and answers the words of what it does: the
|
||||
// machines it sends, or that no machine runs the module and nothing is sent. Called on the operator's warrant,
|
||||
// after the layer is set.
|
||||
var openSettingsWalk = func(ctx context.Context, open *stores, s inventory.PlanSettings) (string, error) {
|
||||
inv := open.inventory
|
||||
running, err := inv.Running(ctx, s.Module)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
controllers, err := inv.Running(ctx, catalogue.ControllerSeatName)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
order := settingsWalkOrder(s.Node, running, controllers)
|
||||
if len(order) == 0 {
|
||||
return fmt.Sprintf("no machine runs %s there, so there is nothing to send", s.Module), nil
|
||||
}
|
||||
release, err := inv.HoldPlans(ctx, true)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
defer release()
|
||||
now := time.Now().UTC()
|
||||
p := inventory.Plan{ID: fmt.Sprintf("%s%d", settingsWalkPrefix, now.UnixNano()), Repository: settingsWalkFor(s),
|
||||
Created: now, State: inventory.PlanRolling, Tiers: [][]string{{s.Module}}, Modules: map[string]*inventory.PlanModule{},
|
||||
Release: &inventory.PlanRelease{Order: order, Settings: &s},
|
||||
Note: fmt.Sprintf("approved (ask %s): sent to %s, one machine at a time, each judged", s.Ask,
|
||||
strings.Join(order, ", "))}
|
||||
if err := inv.SavePlan(ctx, &p); err != nil {
|
||||
return "", err
|
||||
}
|
||||
fmt.Printf("%s: %s — %s\n", p.ID, p.Repository, p.Note)
|
||||
return fmt.Sprintf("%s sends it to %s, one machine at a time, each judged", p.ID, strings.Join(order, ", ")), nil
|
||||
}
|
||||
|
||||
// settingsDataMoves is what a settings walk's send to a machine would move of a running module's data: composed as
|
||||
// that send composes it, every build kept, and compared with what the machine was last sent (ADR 0217 §3).
|
||||
var settingsDataMoves = func(ctx context.Context, open *stores, node string) ([]dataMove, error) {
|
||||
keeping := keepingBuildsForSettings(keepingRecorded(ctx), node)
|
||||
gens, err := generators(keeping, open)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
plan, settings, err := planFor(keeping, open, node)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
declared, err := declarationWith(keeping, open, node, plan, settings, gens, Reading)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
body, err := declared.Body()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return heldMoves(keeping, open.inventory, node, body, nil)
|
||||
}
|
||||
|
||||
// judgingOn is the open walk, other than the one named, whose gate is judging on a machine; empty when none is. A
|
||||
// settings walk sends a machine only when no other walk judges there: its send would set aside the declaration
|
||||
// that walk's gate reads the machine's report against.
|
||||
var judgingOn = func(ctx context.Context, open *stores, self, node string) (string, error) {
|
||||
plans, err := open.inventory.OpenPlans(ctx)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
return judgingIn(plans, self, node), nil
|
||||
}
|
||||
|
||||
// judgingIn is judgingOn over plans read. Pure.
|
||||
func judgingIn(plans []inventory.Plan, self, node string) string {
|
||||
judging := func(g *inventory.PlanGate) bool {
|
||||
return g != nil && g.Verdict == "" && slices.Contains(g.Machines, node)
|
||||
}
|
||||
for _, p := range plans {
|
||||
if p.ID == self || !p.Open() {
|
||||
continue
|
||||
}
|
||||
if p.Release != nil {
|
||||
if judging(p.Release.Gate) {
|
||||
return p.ID
|
||||
}
|
||||
continue
|
||||
}
|
||||
for _, s := range p.Modules {
|
||||
if s != nil && judging(s.Gate) {
|
||||
return p.ID
|
||||
}
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
// advanceSettingsWalk takes one step of a settings walk: the next machine sent and its module judged there, or the
|
||||
// machine being judged judged once more; done when every machine is.
|
||||
func advanceSettingsWalk(ctx context.Context, open *stores, p *inventory.Plan) (bool, error) {
|
||||
r, s := p.Release, p.Release.Settings
|
||||
now := time.Now().UTC()
|
||||
wait := func(note string) (bool, error) {
|
||||
changed := p.Note != note
|
||||
p.Note = note
|
||||
return changed, nil
|
||||
}
|
||||
if r.Gate == nil {
|
||||
heard, err := releaseHeard(ctx, open)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
for r.Next < len(r.Order) {
|
||||
node := r.Order[r.Next]
|
||||
if !heard[node] {
|
||||
r.Skipped = append(r.Skipped, node)
|
||||
r.Next++
|
||||
continue
|
||||
}
|
||||
if id, err := judgingOn(ctx, open, p.ID, node); err != nil {
|
||||
return false, err
|
||||
} else if id != "" {
|
||||
return wait(fmt.Sprintf("waiting before %s: %s is judging there", node, id))
|
||||
}
|
||||
// **A running module's data that would move is a person's word** (ADR 0217 §3): the walk stops before
|
||||
// that machine, failed and said, and `push --move` sends it.
|
||||
held, err := settingsDataMoves(ctx, open, node)
|
||||
if errors.Is(err, errSettingsCannotKeep) {
|
||||
return failBefore(p, node, err.Error())
|
||||
}
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("whether %s's data would move could not be read: %w", node, err)
|
||||
}
|
||||
if len(held) > 0 {
|
||||
var said strings.Builder
|
||||
sayDataHeld(&said, node, held)
|
||||
return failBefore(p, node, "a running module's data would move there — "+
|
||||
strings.Join(strings.Fields(said.String()), " "))
|
||||
}
|
||||
// A build that cannot be kept is refused by the composition above, which is the send's own, and fails the
|
||||
// walk there: the send flattens its refusals into words, so it is not looked for again here.
|
||||
sent, grants, err := sendJudged(keepingBuildsForSettings(ctx, node), open, node)
|
||||
if err != nil {
|
||||
return false, fmt.Errorf("sending %s %s: %w", node, settingsWalkFor(*s), err)
|
||||
}
|
||||
// **The module's build is the one the gate judges** (issue 641 review): kept by this send, it is what a
|
||||
// crossing send — a merge's walk sending the machine a new build of the module — supersedes, so this gate
|
||||
// never reads that send's report as its own.
|
||||
kept := ""
|
||||
if builds, known, err := open.inventory.SentBuilds(ctx, node); err == nil && known {
|
||||
kept = builds[s.Module]
|
||||
}
|
||||
r.Gate = &inventory.PlanGate{Component: coreComponent(s.Module), Machines: sent, Since: &now,
|
||||
From: kept, To: kept, Sent: sentNow(ctx, open.inventory, sent), Grants: grants}
|
||||
p.Note = fmt.Sprintf("sent %s %s (ask %s), every build there kept; judging %s there", node,
|
||||
settingsWalkFor(*s), s.Ask, s.Module)
|
||||
if said := grantsSaid(grants); said != "" {
|
||||
p.Note += "; " + said
|
||||
}
|
||||
fmt.Printf("%s: %s\n", p.ID, p.Note)
|
||||
return true, nil
|
||||
}
|
||||
p.State, p.Tier = inventory.PlanDone, len(p.Tiers)
|
||||
p.Note = fmt.Sprintf("%s (ask %s) delivered on %s", settingsWalkFor(*s), s.Ask, strings.Join(r.Done, ", "))
|
||||
if len(r.Done) == 0 {
|
||||
// Sent nowhere is not delivered: said as the walk's failure, so the operator is not told it landed.
|
||||
p.State = inventory.PlanFailed
|
||||
p.Note = fmt.Sprintf("%s (ask %s) was sent to no machine", settingsWalkFor(*s), s.Ask)
|
||||
}
|
||||
if len(r.Skipped) > 0 {
|
||||
p.Note += "; not heard from, left as they were, their next send carries it: " + strings.Join(r.Skipped, ", ")
|
||||
}
|
||||
fmt.Printf("%s: %s\n", p.ID, p.Note)
|
||||
return true, nil
|
||||
}
|
||||
g := r.Gate
|
||||
node := r.Order[r.Next]
|
||||
verdict, err := judgeMoves(ctx, open, g, []judged{{module: s.Module, node: node}}, now)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
switch verdict {
|
||||
case "":
|
||||
return wait(fmt.Sprintf("judging %s on %s: %s", s.Module, node, gateLine(g)))
|
||||
case inventory.GatePassed:
|
||||
r.Done = append(r.Done, node)
|
||||
r.Next++
|
||||
r.Gate = nil
|
||||
return true, nil
|
||||
case inventory.GateSuperseded:
|
||||
p.State = inventory.PlanSuperseded
|
||||
p.Note = fmt.Sprintf("superseded on %s: %s — nothing judged, nothing put back; the layer is set, and the "+
|
||||
"machines not yet sent take it at their next send", node, g.Why)
|
||||
fmt.Printf("%s: %s\n", p.ID, p.Note)
|
||||
return true, nil
|
||||
}
|
||||
p.State = inventory.PlanFailed
|
||||
p.Note = fmt.Sprintf("%s failed its gate on %s: %s — the layer stays as the operator approved it, and the one it "+
|
||||
"replaced is in `settings %s` history", settingsWalkFor(*s), node, g.Why, s.Module) + unreached(r)
|
||||
fmt.Printf("%s: %s\n", p.ID, p.Note)
|
||||
return true, nil
|
||||
}
|
||||
|
||||
// failBefore ends a settings walk failed before it sent a machine, saying why, and that the layer stays.
|
||||
func failBefore(p *inventory.Plan, node, why string) (bool, error) {
|
||||
r, s := p.Release, p.Release.Settings
|
||||
p.State = inventory.PlanFailed
|
||||
p.Note = fmt.Sprintf("%s not sent to %s: %s; the layer stays as the operator approved it", settingsWalkFor(*s),
|
||||
node, why) + unreached(r)
|
||||
fmt.Printf("%s: %s\n", p.ID, p.Note)
|
||||
return true, nil
|
||||
}
|
||||
|
||||
// unreached is what a stopped settings walk left without the layer, in words: the machines after the one it stopped
|
||||
// at, and those passed over as away (ADR 0344 §6). Empty when there are none.
|
||||
func unreached(r *inventory.PlanRelease) string {
|
||||
var out string
|
||||
if r.Next+1 < len(r.Order) {
|
||||
out += "; not sent: " + strings.Join(r.Order[r.Next+1:], ", ")
|
||||
}
|
||||
if len(r.Skipped) > 0 {
|
||||
out += "; not heard from, left as they were: " + strings.Join(r.Skipped, ", ")
|
||||
}
|
||||
return out
|
||||
}
|
||||
@@ -1,568 +0,0 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
"reflect"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/inventory"
|
||||
"github.com/novox/mesh-controller/internal/lease"
|
||||
)
|
||||
|
||||
// novox/hq ADR 0344, issue 641: the operator's one Approve on a settings proposal is the act that makes it take
|
||||
// effect. The warrant sets the layer and opens a settings walk, which sends it to the machines it reaches one at a
|
||||
// time, judging the module on each; the ask says so before the Approve, and nothing names a push.
|
||||
|
||||
// The order: every machine running the module, or the one the layer names, the control node last.
|
||||
func TestASettingsWalkGoesToTheMachinesTheLayerReachesTheControlNodeLast(t *testing.T) {
|
||||
running := []string{"shanks", "novox", "g14", "ace"}
|
||||
for _, c := range []struct {
|
||||
node string
|
||||
want []string
|
||||
}{
|
||||
{"", []string{"ace", "g14", "shanks", "novox"}},
|
||||
{"g14", []string{"g14"}},
|
||||
{"novox", []string{"novox"}},
|
||||
{"elsewhere", nil},
|
||||
} {
|
||||
if got := settingsWalkOrder(c.node, running, []string{"novox"}); !reflect.DeepEqual(got, c.want) {
|
||||
t.Errorf("a layer on %q goes to %v, want %v", c.node, got, c.want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// A settings walk sends a machine only when no other walk judges there.
|
||||
func TestASettingsWalkWaitsWhileAnotherWalkJudgesOnTheMachine(t *testing.T) {
|
||||
judging := &inventory.PlanGate{Machines: []string{"g14"}}
|
||||
passed := &inventory.PlanGate{Machines: []string{"g14"}, Verdict: inventory.GatePassed}
|
||||
plans := []inventory.Plan{
|
||||
{ID: "settings-1", State: inventory.PlanRolling, Release: &inventory.PlanRelease{Gate: judging}},
|
||||
{ID: "release-2", State: inventory.PlanRolling, Release: &inventory.PlanRelease{Gate: passed}},
|
||||
{ID: "plan-3", State: inventory.PlanRolling, Modules: map[string]*inventory.PlanModule{"app": {Gate: judging}}},
|
||||
{ID: "plan-4", State: inventory.PlanDone, Modules: map[string]*inventory.PlanModule{"app": {Gate: judging}}},
|
||||
}
|
||||
if id := judgingIn(plans, "settings-1", "g14"); id != "plan-3" {
|
||||
t.Errorf("on g14 %q judges, want plan-3 (itself, a passed gate and an ended walk are not judging)", id)
|
||||
}
|
||||
if id := judgingIn(plans[1:2], "x", "g14"); id != "" {
|
||||
t.Errorf("a passed gate judges: %q", id)
|
||||
}
|
||||
if id := judgingIn(plans, "x", "shanks"); id != "" {
|
||||
t.Errorf("on shanks %q judges", id)
|
||||
}
|
||||
}
|
||||
|
||||
// The ask says, before the Approve, that the layer is sent at once and judged, and that its end is told as every
|
||||
// walk's is; neither the ask nor the proposer's answer names a push any more.
|
||||
func TestTheAskSaysAnApprovedLayerIsSentAtOnce(t *testing.T) {
|
||||
for _, c := range []struct {
|
||||
in proposeInput
|
||||
where string
|
||||
had bool
|
||||
}{
|
||||
{proposeInput{module: "mounts", node: "shanks", values: mountsSources}, "shanks", false},
|
||||
{proposeInput{module: "notes", values: map[string]any{"x": "1"}}, "every machine running notes", true},
|
||||
{proposeInput{module: "notes", node: "laptop", clear: true}, "laptop", true},
|
||||
} {
|
||||
r := newProposerRig(t)
|
||||
if c.had {
|
||||
r.before, r.had = map[string]any{"x": "0"}, true
|
||||
}
|
||||
words, err := r.pr.propose(context.Background(), c.in)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
q := r.askSent(t)
|
||||
if err := q.Check(r.now); err != nil {
|
||||
t.Fatalf("the ask is refused: %v", err)
|
||||
}
|
||||
// At a glance (ADR 0345): the summary says it is sent at once by a walk, one machine at a time; the rest of
|
||||
// what Approve does is the Details', which the router notes after the answers.
|
||||
if !strings.Contains(q.Explanation, "sent at once by a walk to "+c.where+", one machine at a time, each judged") ||
|
||||
!strings.Contains(q.Details, "and sent at once to "+c.where+", one machine at a time, each judged, "+
|
||||
"every build there kept; its end is told as every walk's is") {
|
||||
t.Errorf("the ask does not say the layer is sent at once to %s:\n%s", c.where, q.Explanation)
|
||||
}
|
||||
approve := q.Options[0]
|
||||
if approve.Label != "Approve" || !strings.Contains(approve.Does, "sent to "+c.where+" at once") {
|
||||
t.Errorf("Approve does %q", approve.Does)
|
||||
}
|
||||
if !strings.Contains(words, "a walk sends it to "+c.where+" at once") {
|
||||
t.Errorf("the proposer's answer:\n%s", words)
|
||||
}
|
||||
for _, said := range []string{q.Explanation, q.Whole, approve.Does, words} {
|
||||
if strings.Contains(said, "push") {
|
||||
t.Errorf("a push is still named, as if a second act were needed:\n%s", said)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// ---- on the real stores -----------------------------------------------------------------------------
|
||||
|
||||
// The warrant sets the layer and opens the walk that sends it, naming the machines it reaches; a layer for a
|
||||
// machine that does not run the module opens none and says so.
|
||||
func TestAnApprovedLayerOpensTheWalkThatSendsIt(t *testing.T) {
|
||||
open := aMesh(t)
|
||||
ctx := t.Context()
|
||||
register(t, open, catalogue.Manifest{Module: "notes", Version: "1",
|
||||
Resources: []map[string]any{{"id": "rc", "type": "file", "path": "/etc/notes.conf", "mode": "0644",
|
||||
"content": "x = ${setting:x}\n"}}})
|
||||
if _, err := assign(ctx, open, "laptop", "notes"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
// A layer set by hand opens no walk: it still waits for a push (ADR 0344 §7).
|
||||
if err := atTheTerminal(t, "settings", "set", "notes", `{"x":"0"}`, "--node", "laptop"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if plans, _ := open.inventory.OpenPlans(ctx); len(plans) != 0 {
|
||||
t.Fatalf("a layer set at the terminal opened %d walk(s)", len(plans))
|
||||
}
|
||||
set := setLayerIn(open)
|
||||
now := time.Now()
|
||||
values := map[string]any{"x": "1"}
|
||||
p := settingsProposal{Module: "notes", Values: values, From: "g14/claude-code", At: now,
|
||||
Digest: layerDigest(values), BeforeDigest: layerDigest(nil)}
|
||||
words, err := set(ctx, p, "s9", "approved by the operator (ask s9)")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !strings.Contains(words, "+ x (ask s9); settings-") || !strings.Contains(words, "sends it to laptop, one machine at a time") {
|
||||
t.Errorf("the warrant's words: %q", words)
|
||||
}
|
||||
plans, err := open.inventory.OpenPlans(ctx)
|
||||
if err != nil || len(plans) != 1 {
|
||||
t.Fatalf("open walks: %+v %v", plans, err)
|
||||
}
|
||||
w := plans[0]
|
||||
if w.Release == nil || w.Release.Settings == nil || w.Release.Settings.Module != "notes" || w.Release.Settings.Ask != "s9" ||
|
||||
!reflect.DeepEqual(w.Release.Order, []string{"laptop"}) || w.Repository != "the settings of notes on the whole mesh" ||
|
||||
!reflect.DeepEqual(w.Tiers, [][]string{{"notes"}}) {
|
||||
t.Fatalf("the settings walk: %+v %+v", w, w.Release)
|
||||
}
|
||||
|
||||
// A machine's layer where the module does not run: set, and nothing to send.
|
||||
q := settingsProposal{Module: "notes", Node: "anchor", Values: values, From: "g14/claude-code", At: now,
|
||||
Digest: layerDigest(values), BeforeDigest: layerDigest(nil)}
|
||||
words, err = set(ctx, q, "s10", "approved by the operator (ask s10)")
|
||||
if err != nil || !strings.Contains(words, "no machine runs notes there, so there is nothing to send") {
|
||||
t.Fatalf("a layer nobody runs: %q %v", words, err)
|
||||
}
|
||||
if plans, _ := open.inventory.OpenPlans(ctx); len(plans) != 1 {
|
||||
t.Fatalf("a walk was opened for a machine that does not run the module: %d open", len(plans))
|
||||
}
|
||||
|
||||
// A walk that cannot be opened is the act's failure, said with the push that sends it by hand.
|
||||
was := openSettingsWalk
|
||||
openSettingsWalk = func(context.Context, *stores, inventory.PlanSettings) (string, error) {
|
||||
return "", fmt.Errorf("the plans are not to be had")
|
||||
}
|
||||
t.Cleanup(func() { openSettingsWalk = was })
|
||||
again := map[string]any{"x": "2"}
|
||||
byHand := map[string]any{"x": "0"}
|
||||
r := settingsProposal{Module: "notes", Node: "laptop", Values: again, Before: byHand, HadLayer: true,
|
||||
From: "g14/claude-code", At: now, Digest: layerDigest(again), BeforeDigest: layerDigest(byHand)}
|
||||
if _, err := set(ctx, r, "s11", "approved"); err == nil || !strings.Contains(err.Error(), "is set, and the walk that "+
|
||||
"sends it could not be opened: the plans are not to be had — `push laptop` sends it") {
|
||||
t.Errorf("an unopened walk: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// walkMesh is a mesh where `app` runs c1 on anchor and laptop and nothing waits for a gate: every send applied at
|
||||
// once, recorded, and judged from the reports, with a machine named broken failing what it was sent.
|
||||
type walkMesh struct {
|
||||
open *stores
|
||||
sent [][]string
|
||||
broken map[string]bool
|
||||
// kept says, per send, whether it kept every build of its machine; moves is the data a machine's send would move.
|
||||
kept []bool
|
||||
moves map[string][]dataMove
|
||||
heard map[string]bool
|
||||
}
|
||||
|
||||
func aSettledMesh(t *testing.T) *walkMesh {
|
||||
t.Helper()
|
||||
open := aMesh(t)
|
||||
ctx := t.Context()
|
||||
inv := open.inventory
|
||||
w := &walkMesh{open: open, broken: map[string]bool{}, moves: map[string][]dataMove{},
|
||||
heard: map[string]bool{"anchor": true, "laptop": true}}
|
||||
withConditionsInMemory(t)
|
||||
was := doctorFrom
|
||||
doctorFrom = nil
|
||||
t.Cleanup(func() { doctorFrom = was })
|
||||
old := time.Now().Add(-2 * time.Hour)
|
||||
manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
|
||||
if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c1", Module: "app", Commit: "c1",
|
||||
Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: old, At: old,
|
||||
Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-1"}}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
|
||||
Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c1", Head: "c1", Asked: old}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, n := range []string{"anchor", "laptop"} {
|
||||
if _, err := inv.Assign(ctx, n, "app"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.RecordSent(ctx, nodeID(t, open, n), "d-"+n, map[string]string{"app": "c1"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
wasMoves, wasHeard, wasSend, wasGather, wasData := machineMoves, releaseHeard, sendRollout, gatherGateFacts, settingsDataMoves
|
||||
settingsDataMoves = func(_ context.Context, _ *stores, node string) ([]dataMove, error) { return w.moves[node], nil }
|
||||
machineMoves = func(ctx context.Context, open *stores, f moveFacts, node string, all bool) ([]inventory.CarriedMove, error) {
|
||||
modules, err := open.inventory.Assigned(ctx, node)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
sent, known, err := open.inventory.SentBuilds(ctx, node)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return f.moves(node, modules, sent, known, all), nil
|
||||
}
|
||||
releaseHeard = func(context.Context, *stores) (map[string]bool, error) { return w.heard, nil }
|
||||
n := 0
|
||||
sendRollout = func(ctx context.Context, open *stores, names []string) ([]string, error) {
|
||||
w.sent = append(w.sent, append([]string(nil), names...))
|
||||
w.kept = append(w.kept, len(names) == 1 && settingsKeptOn(ctx, names[0]))
|
||||
current, err := open.inventory.CurrentBuilds(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
for _, node := range names {
|
||||
modules, _ := open.inventory.Assigned(ctx, node)
|
||||
carried := map[string]string{}
|
||||
for _, m := range modules {
|
||||
carried[m] = current[m].Commit
|
||||
}
|
||||
n++
|
||||
digest := fmt.Sprintf("d-%s-%d", node, n)
|
||||
if err := open.inventory.RecordSent(ctx, nodeID(t, open, node), digest, carried); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if _, err := open.inventory.RecordDoing(ctx, nodeID(t, open, node), inventory.Doing{Node: node,
|
||||
Outcome: inventory.OutcomeApplied, Declared: digest, Applied: 1, At: time.Now()}); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
return names, nil
|
||||
}
|
||||
gatherGateFacts = func(ctx context.Context, open *stores, component string) (gateFacts, error) {
|
||||
f := gateFacts{now: time.Now(), reports: map[string]inventory.Reported{}, engines: map[string]string{},
|
||||
rolledBack: map[string][]lease.Rollback{}, served: map[string]served{}}
|
||||
reports, err := open.inventory.LastReports(ctx)
|
||||
if err != nil {
|
||||
return f, err
|
||||
}
|
||||
for _, r := range reports {
|
||||
if w.broken[r.Node] {
|
||||
r.Outcome = inventory.OutcomeFailed
|
||||
}
|
||||
f.reports[r.Node] = r
|
||||
}
|
||||
return f, nil
|
||||
}
|
||||
wasSettle, wasEvery, wasBound := gateSettle, gateEvery, gateBound
|
||||
gateSettle, gateEvery = 0, time.Hour
|
||||
t.Cleanup(func() {
|
||||
machineMoves, releaseHeard, sendRollout, gatherGateFacts = wasMoves, wasHeard, wasSend, wasGather
|
||||
settingsDataMoves = wasData
|
||||
gateSettle, gateEvery, gateBound = wasSettle, wasEvery, wasBound
|
||||
})
|
||||
return w
|
||||
}
|
||||
|
||||
func (w *walkMesh) walk(t *testing.T) inventory.Plan {
|
||||
t.Helper()
|
||||
plans, err := w.open.inventory.RecentPlans(t.Context(), 10)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, p := range plans {
|
||||
if p.Release != nil && p.Release.Settings != nil {
|
||||
return p
|
||||
}
|
||||
}
|
||||
t.Fatal("no settings walk")
|
||||
return inventory.Plan{}
|
||||
}
|
||||
|
||||
// The walk sends the first machine alone and judges the module there before it sends the next, and ends
|
||||
// delivered on both; nothing waited for a gate, so each send carried the layer alone.
|
||||
func TestASettingsWalkSendsOneMachineAtATimeEachJudged(t *testing.T) {
|
||||
judgeLeavesAsTheCore(t)
|
||||
w := aSettledMesh(t)
|
||||
ctx := t.Context()
|
||||
words, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s1", Change: "~ x"})
|
||||
if err != nil || !strings.Contains(words, "sends it to anchor, laptop") {
|
||||
t.Fatalf("%q %v", words, err)
|
||||
}
|
||||
advancePlans(ctx, w.open)
|
||||
if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
|
||||
t.Fatalf("sent %v: the first machine alone, before it is judged", w.sent)
|
||||
}
|
||||
p := w.walk(t)
|
||||
if p.Release.Gate == nil || p.Release.Next != 0 || !strings.Contains(p.Note, "judging app on anchor") {
|
||||
t.Fatalf("the walk after its first send: %s %+v", p.Note, p.Release)
|
||||
}
|
||||
gateEvery = 0
|
||||
for i := 0; i < 6; i++ {
|
||||
advancePlans(ctx, w.open)
|
||||
}
|
||||
if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}, {"laptop"}}) {
|
||||
t.Fatalf("sent %v", w.sent)
|
||||
}
|
||||
p = w.walk(t)
|
||||
if p.State != inventory.PlanDone || !reflect.DeepEqual(p.Release.Done, []string{"anchor", "laptop"}) ||
|
||||
p.Outcome() != inventory.WalkDelivered || !strings.Contains(p.Note, "delivered on anchor, laptop") {
|
||||
t.Fatalf("the walk is %s: %s %+v", p.State, p.Note, p.Release)
|
||||
}
|
||||
// It said its start and its end, so the operator is told once (ADR 0308).
|
||||
if p.Times == nil || p.Times.Started == nil || p.Times.Ended == nil {
|
||||
t.Fatalf("the walk's start and end are not marked: %+v", p.Times)
|
||||
}
|
||||
// Nothing waits, and no walk of waiting builds opened beside it.
|
||||
if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r != nil {
|
||||
t.Fatalf("%+v %v", r, err)
|
||||
}
|
||||
}
|
||||
|
||||
// A machine that fails what it was sent stops the walk there: the next is not sent, the layer stays, and the
|
||||
// failure holds back no walk of waiting builds.
|
||||
func TestAFailedSettingsWalkStopsAndHoldsNothingBack(t *testing.T) {
|
||||
w := aSettledMesh(t)
|
||||
ctx := t.Context()
|
||||
inv := w.open.inventory
|
||||
w.broken["anchor"] = true
|
||||
if err := inv.KeepSettings(ctx, "", "app", map[string]any{"x": "1"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s2"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for i := 0; i < 4; i++ {
|
||||
advancePlans(ctx, w.open)
|
||||
}
|
||||
p := w.walk(t)
|
||||
if p.State != inventory.PlanFailed || p.Outcome() != inventory.WalkFailed ||
|
||||
!strings.Contains(p.Note, "the settings of app on the whole mesh failed its gate on anchor") ||
|
||||
!strings.Contains(p.Note, "the layer stays as the operator approved it") || !strings.Contains(p.Note, "not sent: laptop") {
|
||||
t.Fatalf("the walk is %s: %s", p.State, p.Note)
|
||||
}
|
||||
if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
|
||||
t.Fatalf("sent %v: anchor alone, nothing to laptop", w.sent)
|
||||
}
|
||||
if layer, has, err := inv.Layer(ctx, "", "app"); err != nil || !has || layer["x"] != "1" {
|
||||
t.Fatalf("the layer after the failure: %v %v %v", layer, has, err)
|
||||
}
|
||||
// A build that waits for a gate is still walked: the failed settings walk holds nothing back.
|
||||
w.broken["anchor"] = false
|
||||
now := time.Now().Add(-time.Minute)
|
||||
manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
|
||||
if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
|
||||
Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
|
||||
Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
|
||||
Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r == nil {
|
||||
t.Fatalf("the waiting build is held back by a failed settings walk: %+v %v", r, err)
|
||||
}
|
||||
}
|
||||
|
||||
// Each send of a settings walk keeps every build of its machine: the layer goes, and a build held for a person or
|
||||
// waiting for a gate stays where it is (ADR 0344 §3).
|
||||
func TestASettingsWalkSendsTheLayerAloneEveryBuildKept(t *testing.T) {
|
||||
w := aSettledMesh(t)
|
||||
ctx := t.Context()
|
||||
inv := w.open.inventory
|
||||
gateEvery = 0
|
||||
if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s3"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for i := 0; i < 4; i++ {
|
||||
advancePlans(ctx, w.open)
|
||||
}
|
||||
if !reflect.DeepEqual(w.kept, []bool{true, true}) || w.walk(t).State != inventory.PlanDone {
|
||||
t.Fatalf("the sends kept every build: %v; the walk: %s", w.kept, w.walk(t).Note)
|
||||
}
|
||||
// What such a send keeps, on the store: a rolled-out build waiting there is kept at the one last sent.
|
||||
now := time.Now().Add(-time.Minute)
|
||||
manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
|
||||
if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
|
||||
Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
|
||||
Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
|
||||
Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
kept, err := recordedKept(keepingBuildsForSettings(ctx, "anchor"), w.open, "anchor")
|
||||
if err != nil || kept["app"] != "c1" {
|
||||
t.Fatalf("a settings send to anchor keeps %v (%v), want app at c1", kept, err)
|
||||
}
|
||||
if kept, _ := recordedKept(ctx, w.open, "anchor"); kept["app"] != "" {
|
||||
t.Fatalf("an ordinary send keeps a rolled-out build: %v", kept)
|
||||
}
|
||||
// And so the ungated build waiting on anchor is no move of the settings send's: nothing for a gate to see.
|
||||
f, err := readMoveFacts(ctx, inv)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
waiting, _ := machineMoves(ctx, w.open, f, "anchor", false)
|
||||
if len(waiting) != 1 || waiting[0].Module != "app" {
|
||||
t.Fatalf("anchor waits for %+v, want app's c2", waiting)
|
||||
}
|
||||
if moved, err := withoutKept(keepingBuildsForSettings(ctx, "anchor"), w.open, "anchor", waiting); err != nil || len(moved) != 0 {
|
||||
t.Fatalf("a settings send to anchor would move %+v (%v)", moved, err)
|
||||
}
|
||||
}
|
||||
|
||||
// A machine whose send would move a running module's data stops the walk there, failed and said with the push that
|
||||
// sends it on a person's word (ADR 0217 §3); one not heard from is passed over and named; and a walk that reached
|
||||
// no machine is not said delivered.
|
||||
func TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway(t *testing.T) {
|
||||
w := aSettledMesh(t)
|
||||
ctx := t.Context()
|
||||
gateEvery = 0
|
||||
w.moves["laptop"] = []dataMove{{Container: "app-server", Inside: "/data", From: "/srv/a", To: "/srv/b"}}
|
||||
if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s4"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for i := 0; i < 4; i++ {
|
||||
advancePlans(ctx, w.open)
|
||||
}
|
||||
p := w.walk(t)
|
||||
if p.State != inventory.PlanFailed || !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) ||
|
||||
!strings.Contains(p.Note, "not sent to laptop: a running module's data would move there") ||
|
||||
!strings.Contains(p.Note, "push laptop --move app") {
|
||||
t.Fatalf("sent %v; the walk is %s: %s", w.sent, p.State, p.Note)
|
||||
}
|
||||
|
||||
v := aSettledMesh(t)
|
||||
v.heard = map[string]bool{"laptop": true}
|
||||
gateEvery = 0
|
||||
if _, err := openSettingsWalk(ctx, v.open, inventory.PlanSettings{Module: "app", Ask: "s5"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for i := 0; i < 4; i++ {
|
||||
advancePlans(ctx, v.open)
|
||||
}
|
||||
p = v.walk(t)
|
||||
if p.State != inventory.PlanDone || !reflect.DeepEqual(p.Release.Skipped, []string{"anchor"}) ||
|
||||
!strings.Contains(p.Note, "delivered on laptop; not heard from, left as they were, their next send carries it: anchor") {
|
||||
t.Fatalf("the walk with anchor away is %s: %s", p.State, p.Note)
|
||||
}
|
||||
|
||||
u := aSettledMesh(t)
|
||||
u.heard = map[string]bool{}
|
||||
if _, err := openSettingsWalk(ctx, u.open, inventory.PlanSettings{Module: "app", Ask: "s6"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
advancePlans(ctx, u.open)
|
||||
if p := u.walk(t); p.State != inventory.PlanFailed || p.Outcome() != inventory.WalkFailed ||
|
||||
!strings.Contains(p.Note, "was sent to no machine") || len(u.sent) != 0 {
|
||||
t.Fatalf("a walk that reached nobody is %s: %s", p.State, p.Note)
|
||||
}
|
||||
}
|
||||
|
||||
// The gate keeps the module's build its send kept, so a crossing send — a merge's walk sending the machine a new
|
||||
// build of the module while the settings gate judges there — supersedes it, and its report is never read as the
|
||||
// settings send's (issue 641 review, finding 1).
|
||||
func TestACrossingSendSupersedesASettingsGate(t *testing.T) {
|
||||
judgeLeavesAsTheCore(t)
|
||||
w := aSettledMesh(t)
|
||||
ctx := t.Context()
|
||||
inv := w.open.inventory
|
||||
if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s7"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
advancePlans(ctx, w.open)
|
||||
p := w.walk(t)
|
||||
if g := p.Release.Gate; g == nil || g.To != "c1" || g.From != "c1" {
|
||||
t.Fatalf("the settings gate judges no build: %+v", p.Release.Gate)
|
||||
}
|
||||
// Another walk sends anchor app's c2 while the settings gate judges there.
|
||||
now := time.Now().Add(-time.Minute)
|
||||
manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
|
||||
if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
|
||||
Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
|
||||
Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.RecordSent(ctx, nodeID(t, w.open, "anchor"), "d-merge", map[string]string{"app": "c2"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := inv.RecordDoing(ctx, nodeID(t, w.open, "anchor"), inventory.Doing{Node: "anchor",
|
||||
Outcome: inventory.OutcomeApplied, Declared: "d-merge", Applied: 1, At: time.Now()}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
gateEvery = 0
|
||||
advancePlans(ctx, w.open)
|
||||
p = w.walk(t)
|
||||
if p.State != inventory.PlanSuperseded || p.Release.Gate == nil || p.Release.Gate.Verdict != inventory.GateSuperseded ||
|
||||
!strings.Contains(p.Note, "superseded on anchor") || len(p.Release.Done) != 0 {
|
||||
t.Fatalf("the settings walk after a crossing send is %s: %s %+v", p.State, p.Note, p.Release)
|
||||
}
|
||||
if !reflect.DeepEqual(w.sent, [][]string{{"anchor"}}) {
|
||||
t.Fatalf("sent %v: laptop was sent after a superseded judging", w.sent)
|
||||
}
|
||||
}
|
||||
|
||||
// A send refusal that cannot clear by itself — what the machine was last sent is not known, or a build it runs is
|
||||
// gone — fails the walk with why, rather than keeping it open and holding the walk of waiting builds; and a
|
||||
// failure names the machines passed over as away (issue 641 review, findings 2 and 3).
|
||||
func TestASettingsWalkFailsOnARefusalThatCannotClear(t *testing.T) {
|
||||
w := aSettledMesh(t)
|
||||
ctx := t.Context()
|
||||
inv := w.open.inventory
|
||||
// What a send to a machine never sent can keep: nothing, and said as the refusal the walk fails on.
|
||||
if _, err := inv.AddNode(ctx, "fresh"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := recordedKept(keepingBuildsForSettings(ctx, "fresh"), w.open, "fresh"); !errors.Is(err, errSettingsCannotKeep) {
|
||||
t.Fatalf("a settings send to a machine never sent: %v", err)
|
||||
}
|
||||
w.heard = map[string]bool{"laptop": true}
|
||||
settingsDataMoves = func(_ context.Context, _ *stores, node string) ([]dataMove, error) {
|
||||
return nil, fmt.Errorf("%w: what %s was last sent is not known", errSettingsCannotKeep, node)
|
||||
}
|
||||
if _, err := openSettingsWalk(ctx, w.open, inventory.PlanSettings{Module: "app", Ask: "s8"}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
advancePlans(ctx, w.open)
|
||||
p := w.walk(t)
|
||||
if p.State != inventory.PlanFailed || len(w.sent) != 0 ||
|
||||
!strings.Contains(p.Note, "not sent to laptop: the settings cannot be sent with every build kept: what laptop was last sent is not known") ||
|
||||
!strings.Contains(p.Note, "not heard from, left as they were: anchor") {
|
||||
t.Fatalf("the walk is %s: %s", p.State, p.Note)
|
||||
}
|
||||
// It is not open, so a build waiting for a gate is walked.
|
||||
now := time.Now().Add(-time.Minute)
|
||||
manifest, _ := json.Marshal(catalogue.Manifest{Module: "app", Version: "1"})
|
||||
if err := inv.RecordBuild(ctx, inventory.Build{ID: "build-app-c2", Module: "app", Commit: "c2",
|
||||
Repository: "novox/mesh-catalog", Path: "modules/app", Manifest: manifest, Asked: now, At: now,
|
||||
Made: []inventory.Artifact{{Name: "x", Kind: "bundle", Reference: "sha256:app-2"}}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "app", Version: "1"}, inventory.Source{
|
||||
Repository: "novox/mesh-catalog", Seat: "git", Path: "modules/app", BuiltFrom: "c2", Head: "c2", Asked: now}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if r, err := releaseBacklog(ctx, w.open, ""); err != nil || r == nil {
|
||||
t.Fatalf("the waiting build is held by the failed settings walk: %+v %v", r, err)
|
||||
}
|
||||
}
|
||||
@@ -160,7 +160,7 @@ func TestTheVerbsCarryReadReplaceAndMove(t *testing.T) {
|
||||
{"settings", map[string]any{"module": "plex", "history": "true"}, []string{"settings", "show", "plex", "--history"}},
|
||||
{"settings", map[string]any{"module": "plex", "values": "{}", "replace": "true"}, []string{"settings", "set", "plex", "{}", "--replace"}},
|
||||
{"push", map[string]any{"node": "home", "move": "plex", "why": "w"},
|
||||
[]string{"push", "home", "--wait", "0s", "--move", "plex", "--why", "w"}},
|
||||
[]string{"push", "home", "--wait", "0", "--move", "plex", "--why", "w"}},
|
||||
{"push", map[string]any{"why": "w"}, []string{"push", "--behind", "--wait", "0", "--why", "w"}},
|
||||
{"plan", map[string]any{"node": "home", "diff": "true"}, []string{"plan", "home", "--diff"}},
|
||||
} {
|
||||
|
||||
@@ -3,7 +3,7 @@ module github.com/novox/mesh-controller
|
||||
go 1.26.0
|
||||
|
||||
require (
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c
|
||||
github.com/jackc/pgx/v5 v5.10.0
|
||||
github.com/nats-io/nats-server/v2 v2.11.17
|
||||
github.com/nats-io/nats.go v1.54.0
|
||||
|
||||
@@ -2,12 +2,6 @@ git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f h1:8N5OW2mdTNIck
|
||||
git.novox.be/novox/mesh-host v0.0.0-20261011092230-20d5af9b2d5f/go.mod h1:tcTK4LMs1d6JpZUwy3hSHMFG/MIuDr/XFs7/nbeaW/c=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c h1:l5onJwoIeH8yE/PjVlEeoPyXBsHp2NQiWLllz2fwX7s=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013141520-9588871d6629 h1:7TYFV1Q6Mcz+lsLP/sds87tysET4rKCn3rRIQV8gNmA=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013141520-9588871d6629/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013145622-f4745447ba6d h1:HEJyqorKktrkJPeeJdwEo0kdrJjH3fm/YVS9MGftCqY=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013145622-f4745447ba6d/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44 h1:r5xIo5qWOXQdCSMxvqJy8kV4U+P/QWXFK6971Ha6wU8=
|
||||
git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
|
||||
github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op h1:Z/MZK75wC/NSrkgqeNIa7jexam9uWzhLmFTSCPI/kn0=
|
||||
github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
|
||||
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
|
||||
|
||||
@@ -87,11 +87,6 @@ func Openings(rules []Rule, foundation []int, published map[string]map[int]int)
|
||||
widen(key{rule.Protocol, rule.Port}, OpeningFromEverywhere)
|
||||
case FromMesh:
|
||||
widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
|
||||
case FromLocalNetwork:
|
||||
// The private network's part only (novox/hq ADR 0340). An adopted node's found firewall
|
||||
// stays, and it is what admits the machine's local network; an opening has no word for a
|
||||
// local network, and widening it to everywhere would open the port to the internet.
|
||||
widen(key{rule.Protocol, rule.Port}, OpeningFromMesh)
|
||||
}
|
||||
}
|
||||
for _, port := range foundation {
|
||||
|
||||
@@ -127,7 +127,6 @@ func boundNeed(n Needed, bound Chosen, catalogue map[string]Manifest, node Node,
|
||||
identity = pm.IdentityBoundOf(n.Name)
|
||||
}
|
||||
held.From, held.At, held.Module, held.Serves, held.Identity = p.Node, p.At, p.Module, p.Serves, identity
|
||||
held.LeftOut = p.LeftOut
|
||||
return held, true, ""
|
||||
}
|
||||
|
||||
|
||||
@@ -135,9 +135,6 @@ func CheckServes(m Manifest) []string {
|
||||
for _, key := range sortedAnyKeys(m.Serves[provision]) {
|
||||
text, ok := m.Serves[provision][key].(string)
|
||||
if !ok {
|
||||
// A provider's own name is filled only in a value of its own (novox/hq ADR 0346): one
|
||||
// nested in a list or an object would be served as the placeholder, unsaid.
|
||||
problems = append(problems, nestedOwnNames(m, provision, key, m.Serves[provision][key])...)
|
||||
continue
|
||||
}
|
||||
// A probe identity, because what is checked is the shape of the statement and not
|
||||
@@ -146,8 +143,6 @@ func CheckServes(m Manifest) []string {
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s serves %s, and the value it serves as %q %s", m.Module, provision, key, err))
|
||||
}
|
||||
// And the provider's own names it may serve (novox/hq ADR 0346).
|
||||
problems = append(problems, checkServedOwnNames(m, provision, key, text)...)
|
||||
// A label longer than DNS keeps is not truncated here (asDNSLabel), so the offer's own
|
||||
// bound has to keep the identity inside one (ADR 0225).
|
||||
if strings.Contains(text, "${consumer:as:dns}") {
|
||||
|
||||
@@ -135,12 +135,6 @@ type Rendering struct {
|
||||
// composes no filter for it rather than writing a rule around a link with no name.
|
||||
OutwardLinks []string
|
||||
|
||||
// LocalNetworks is this machine's local networks (novox/hq ADR 0340): the networks it reported on a
|
||||
// link facing outside it that lie wholly in a private range (JudgeLocalNetworks), which a port
|
||||
// reached from `local-network` is admitted from beside the private network. Empty when it reported
|
||||
// none, and the rule set then says so rather than widening the port or dropping it.
|
||||
LocalNetworks []string
|
||||
|
||||
// TunnelInterface is the interface the mesh's private network runs on, named here rather than
|
||||
// imported because the overlay package rests on this one. Traffic arriving on it is the mesh's,
|
||||
// not this machine's own guest, so the filter admits it only by a rule.
|
||||
@@ -533,8 +527,8 @@ func (r Resolution) compose(with Rendering, owner map[string]string,
|
||||
"`node show %s` says whether it has. Until then %s is not sent, and the machine "+
|
||||
"keeps the filter it has", r.Node, r.Node, filters)
|
||||
}
|
||||
filtering := AsNftablesWithLocal(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
|
||||
with.OutwardLinks, with.TunnelInterface, with.LocalNetworks)
|
||||
filtering := AsNftables(rules, with.Mesh, r.PublicDomain != "", with.Foundation,
|
||||
with.OutwardLinks, with.TunnelInterface)
|
||||
|
||||
// **A variable two modules set is refused whether or not anything places it** (novox/hq ADR
|
||||
// 0203 §5): the account has one environment, and a machine whose holder arrives later should not
|
||||
@@ -2039,13 +2033,7 @@ func (r Resolution) servedOnThisMachine(provision string, with Rendering) (map[s
|
||||
if err != nil {
|
||||
return nil, false, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
|
||||
}
|
||||
// And the provider's own names, as this machine composes them (novox/hq ADR 0346); one it does
|
||||
// not compose leaves its key out, said by the plan on this machine (ServedLeftOut).
|
||||
named, _, err := r.ServedOwnNames(m, provision, settled, WithDefaults(m, with.Settings[m.Module]))
|
||||
if err != nil {
|
||||
return nil, false, fmt.Errorf("%s serving %s: %w", m.Module, provision, err)
|
||||
}
|
||||
return named, true, nil
|
||||
return settled, true, nil
|
||||
}
|
||||
return nil, false, nil
|
||||
}
|
||||
@@ -2563,8 +2551,8 @@ func onlyGroups(r map[string]any) bool {
|
||||
|
||||
// generatedHere is what each computed module's generator answers for this machine, by module —
|
||||
// absent for a module whose machine is not yet part of what it generates — held to the rule every
|
||||
// module is held to: no two modules on a machine declare one path, unit or name, nor one package present
|
||||
// and absent (novox/hq issue 190, step 5; ADR 0222, ADR 0303).
|
||||
// module is held to: no two modules on a machine declare one path, unit, name or package (novox/hq
|
||||
// issue 190, step 5; ADR 0222).
|
||||
//
|
||||
// Resolution checks the catalogue's manifests, and a computed module's manifest has none of the
|
||||
// resources it will declare — they exist only once its generator has answered for this machine,
|
||||
|
||||
@@ -152,10 +152,9 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
|
||||
m.Module, port)
|
||||
}
|
||||
source, ok := value.(string)
|
||||
if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine &&
|
||||
source != FromLocalNetwork) {
|
||||
return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q, %q or %q",
|
||||
m.Module, port, value, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork)
|
||||
if !ok || (source != FromMesh && source != FromEverywhere && source != FromMachine) {
|
||||
return nil, fmt.Errorf("%s exposes port %d as %v; it is %q, %q or %q",
|
||||
m.Module, port, value, FromMesh, FromEverywhere, FromMachine)
|
||||
}
|
||||
out[port] = source
|
||||
}
|
||||
@@ -173,9 +172,7 @@ func Exposure(m Manifest, layers []Layer) (map[int]string, error) {
|
||||
// the appearance-of-restriction this mechanism exists to remove. The narrower rule's sources are
|
||||
// carried onto the wider one, so the module that wanted it is still named.
|
||||
func widest(rules []Rule) []Rule {
|
||||
// The local network is the private network and the machine's own local networks (novox/hq ADR
|
||||
// 0340 §4), so it covers `mesh` and is covered by `anywhere`.
|
||||
reach := map[string]int{FromMachine: 0, FromMesh: 1, FromLocalNetwork: 2, FromEverywhere: 3}
|
||||
reach := map[string]int{FromMachine: 0, FromMesh: 1, FromEverywhere: 2}
|
||||
var out []Rule
|
||||
for _, rule := range rules {
|
||||
covered := false
|
||||
@@ -235,15 +232,6 @@ const SSHPort = 22
|
||||
// any module asks for, and neither may be derived away.
|
||||
func AsNftables(rules []Rule, mesh []string, outward bool, foundation []int,
|
||||
outwardLinks []string, tunnel string) string {
|
||||
return AsNftablesWithLocal(rules, mesh, outward, foundation, outwardLinks, tunnel, nil)
|
||||
}
|
||||
|
||||
// AsNftablesWithLocal is AsNftables with the machine's local networks: the networks it reported on a
|
||||
// link facing outside that count (novox/hq ADR 0340, JudgeLocalNetworks), which a rule from
|
||||
// `local-network` admits on its own port alone, beside the private network. None is not widened to
|
||||
// anywhere and not dropped silently: the rule set says the port wanted the local network and found none.
|
||||
func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation []int,
|
||||
outwardLinks []string, tunnel string, local []string) string {
|
||||
// The links that are not this machine's own: the ones facing outside, and the mesh's tunnel.
|
||||
// Traffic arriving on any of them is admitted only by a rule below; traffic arriving anywhere
|
||||
// else is this machine's own guest and is not something the mesh has a position on.
|
||||
@@ -406,31 +394,6 @@ func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation [
|
||||
b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
|
||||
strings.Join(six, ", "), rule.Protocol, rule.Port))
|
||||
}
|
||||
case FromLocalNetwork:
|
||||
// The private network and the machine's own local networks, on this port alone (novox/hq
|
||||
// ADR 0340 §5).
|
||||
four, six := byFamily(mesh)
|
||||
lfour, lsix := byFamily(local)
|
||||
four, six = append(four, lfour...), append(six, lsix...)
|
||||
if len(lfour) == 0 && len(lsix) == 0 {
|
||||
b.WriteString(fmt.Sprintf(
|
||||
"\t\t# %s/%d wanted the local network, and this machine reported no private network "+
|
||||
"on a link facing outside; admitted from no local network\n", rule.Protocol, rule.Port))
|
||||
}
|
||||
if len(four) == 0 && len(six) == 0 {
|
||||
b.WriteString(fmt.Sprintf(
|
||||
"\t\t# %s/%d wanted the local network, and this node knows neither mesh addresses nor a "+
|
||||
"local network; closed\n", rule.Protocol, rule.Port))
|
||||
break
|
||||
}
|
||||
if len(four) > 0 {
|
||||
b.WriteString(fmt.Sprintf("\t\tip saddr { %s } %s dport %d accept\n",
|
||||
strings.Join(four, ", "), rule.Protocol, rule.Port))
|
||||
}
|
||||
if len(six) > 0 {
|
||||
b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } %s dport %d accept\n",
|
||||
strings.Join(six, ", "), rule.Protocol, rule.Port))
|
||||
}
|
||||
case FromEverywhere:
|
||||
b.WriteString(fmt.Sprintf("\t\t%s dport %d accept\n", rule.Protocol, rule.Port))
|
||||
}
|
||||
@@ -524,18 +487,6 @@ func AsNftablesWithLocal(rules []Rule, mesh []string, outward bool, foundation [
|
||||
b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
|
||||
strings.Join(six, ", "), rule.Port))
|
||||
}
|
||||
case FromLocalNetwork:
|
||||
four, six := byFamily(mesh)
|
||||
lfour, lsix := byFamily(local)
|
||||
four, six = append(four, lfour...), append(six, lsix...)
|
||||
if len(four) > 0 {
|
||||
b.WriteString(fmt.Sprintf("\t\tip saddr { %s } ct original proto-dst %d accept\n",
|
||||
strings.Join(four, ", "), rule.Port))
|
||||
}
|
||||
if len(six) > 0 {
|
||||
b.WriteString(fmt.Sprintf("\t\tip6 saddr { %s } ct original proto-dst %d accept\n",
|
||||
strings.Join(six, ", "), rule.Port))
|
||||
}
|
||||
case FromEverywhere:
|
||||
b.WriteString(fmt.Sprintf("\t\tct original proto-dst %d accept\n", rule.Port))
|
||||
}
|
||||
@@ -842,14 +793,10 @@ const (
|
||||
// are a subset of anywhere. What differs is the names, which is the whole reason reach is not
|
||||
// simply the filter's vocabulary with nicer words.
|
||||
ReachBoth = "both"
|
||||
// ReachLocalNetwork is `internal` with the machine's own local networks added to what the filter
|
||||
// opens (novox/hq ADR 0340 §4): the internal name and not the public one, the mesh's own authority,
|
||||
// and the port opened to the private network and to the private networks the machine is attached to.
|
||||
ReachLocalNetwork = "local-network"
|
||||
)
|
||||
|
||||
// reaches is every value, in the order a refusal lists them.
|
||||
var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth, ReachLocalNetwork}
|
||||
var reaches = []string{ReachMachine, ReachInternal, ReachPublic, ReachBoth}
|
||||
|
||||
// RoutedPorts are the ports a module serves through a proxy, taken from its route contributions.
|
||||
//
|
||||
@@ -898,8 +845,6 @@ func FilterSource(reach string) (string, bool) {
|
||||
return FromMesh, true
|
||||
case ReachPublic, ReachBoth:
|
||||
return FromEverywhere, true
|
||||
case ReachLocalNetwork:
|
||||
return FromLocalNetwork, true
|
||||
default:
|
||||
return "", false
|
||||
}
|
||||
@@ -909,9 +854,7 @@ func FilterSource(reach string) (string, bool) {
|
||||
func WantsPublicName(reach string) bool { return reach == ReachPublic || reach == ReachBoth }
|
||||
|
||||
// WantsInternalName is whether a reach asks for the route's internal name to be composed.
|
||||
func WantsInternalName(reach string) bool {
|
||||
return reach == ReachInternal || reach == ReachBoth || reach == ReachLocalNetwork
|
||||
}
|
||||
func WantsInternalName(reach string) bool { return reach == ReachInternal || reach == ReachBoth }
|
||||
|
||||
// Reaches reads a module's per-node reach settings: declared port → how far it reaches.
|
||||
//
|
||||
|
||||
@@ -6,8 +6,7 @@ import (
|
||||
)
|
||||
|
||||
// novox/hq issue 190, step 5 (ADR 0222): what the mesh computes for a module is held to the rule
|
||||
// every module is — no two modules on a machine declare one path, unit or name (a package may be declared by
|
||||
// several, novox/hq ADR 0303). The
|
||||
// every module is — no two modules on a machine declare one path, unit, name or package. The
|
||||
// private network once declared the container runtime's file and service beside the runtime's own
|
||||
// module, and nothing refused it, because the collision check only ever saw catalogue manifests.
|
||||
|
||||
|
||||
@@ -25,13 +25,13 @@ func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
|
||||
}
|
||||
|
||||
for want, raw := range map[string]string{
|
||||
"the issuers an offer may name": `{"module":"d","version":"1",
|
||||
"the one issuer an offer may name": `{"module":"d","version":"1",
|
||||
"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
|
||||
"names no tool that answers it": `{"module":"d","version":"1",
|
||||
"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
|
||||
"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
|
||||
"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
|
||||
"the issuers an offer may name ": `{"module":"d","version":"1",
|
||||
"the one issuer an offer may name ": `{"module":"d","version":"1",
|
||||
"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
|
||||
} {
|
||||
want = strings.TrimSpace(want)
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
package catalogue
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// A provision's credential may be one only a person outside the mesh can give (novox/hq ADR 0337 §1, issue 164):
|
||||
// the offer says `issued-by: outside` and names neither an own secret nor a tool, and the parser refuses it beside
|
||||
// either. An offer that says `software` keeps ADR 0305's shape.
|
||||
func TestAnOfferMaySayAPersonOutsideTheMeshIssuesItsCredential(t *testing.T) {
|
||||
m, err := ParseManifest([]byte(`{"module":"tv","version":"1",
|
||||
"provides":[{"name":"tv-api","scope":"mesh","credential":{"issued-by":"outside"}}],
|
||||
"serves":{"tv-api":{"port":8989}}}`))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if !m.IssuedOutsideOf("tv-api") {
|
||||
t.Fatal("the offer's credential issued outside was not read")
|
||||
}
|
||||
if m.IssuedOutsideOf("other") {
|
||||
t.Fatal("a provision the module does not offer reads as issued outside")
|
||||
}
|
||||
if _, issued := m.IssuedCredentialOf("tv-api"); issued {
|
||||
t.Fatal("a credential issued outside was read as issued by the software")
|
||||
}
|
||||
if _, shared := m.SharedCredentialOf("tv-api"); shared {
|
||||
t.Fatal("a credential issued outside was read as an own secret shared")
|
||||
}
|
||||
if who, offered := OffersIssuedOutside(map[string]Manifest{"tv": m}, "tv-api"); !offered || who != "tv" {
|
||||
t.Fatalf("the catalogue does not say tv offers tv-api issued outside: %q %v", who, offered)
|
||||
}
|
||||
|
||||
for want, raw := range map[string]string{
|
||||
"names its own secret": `{"module":"d","version":"1","own-secrets":{"key":{"path":"/p","taken":"at-start"}},
|
||||
"provides":[{"name":"d-api","credential":{"issued-by":"outside","own":"key"}}]}`,
|
||||
"names the tool": `{"module":"d","version":"1",
|
||||
"provides":[{"name":"d-api","credential":{"issued-by":"outside","tool":"d_key"}}]}`,
|
||||
"the issuers an offer may name": `{"module":"d","version":"1",
|
||||
"provides":[{"name":"d-api","credential":{"issued-by":"a-person"}}]}`,
|
||||
} {
|
||||
if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
|
||||
t.Errorf("expected a refusal saying %q, got %v", want, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,154 +0,0 @@
|
||||
package catalogue
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/netip"
|
||||
"slices"
|
||||
"sort"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// AttachedNetwork is one network a machine said it is directly attached to: the link it is on and the
|
||||
// network as address and prefix (novox/hq ADR 0340 §7), as the node-engine reports it among its facts.
|
||||
type AttachedNetwork struct {
|
||||
Link string `json:"link"`
|
||||
Network string `json:"network"`
|
||||
}
|
||||
|
||||
// LocalNetwork is one attached network judged: whether it counts as this machine's local network for a
|
||||
// port reached from `local-network`, and why — said for one that counts as well as for one that does
|
||||
// not, so `node` can show which counted and why the others did not (ADR 0340 §8).
|
||||
type LocalNetwork struct {
|
||||
Link string
|
||||
Network string
|
||||
Counts bool
|
||||
Why string
|
||||
}
|
||||
|
||||
// privateRanges are the only ranges a local network may lie in (ADR 0340 §2): RFC 1918 for IPv4 and the
|
||||
// unique local addresses for IPv6. A network counts only when it lies wholly inside one of them.
|
||||
var privateRanges = []struct {
|
||||
prefix netip.Prefix
|
||||
name string
|
||||
}{
|
||||
{netip.MustParsePrefix("10.0.0.0/8"), "a private range (RFC 1918, 10.0.0.0/8)"},
|
||||
{netip.MustParsePrefix("172.16.0.0/12"), "a private range (RFC 1918, 172.16.0.0/12)"},
|
||||
{netip.MustParsePrefix("192.168.0.0/16"), "a private range (RFC 1918, 192.168.0.0/16)"},
|
||||
{netip.MustParsePrefix("fc00::/7"), "the IPv6 unique local range (fc00::/7)"},
|
||||
}
|
||||
|
||||
// JudgeLocalNetworks says, for each network a machine reported, whether it counts as its local network.
|
||||
//
|
||||
// **A public subnet never counts** (ADR 0340 §2): a network counts only when it lies wholly in a private
|
||||
// range, so `local-network` can never open a port to the internet — a machine sitting on a public /24 has
|
||||
// that /24 judged and refused, never rendered. A link-local network does not count either. And only a
|
||||
// link the machine reported as facing outside it counts (§3): the private network's own link and a
|
||||
// container bridge are this machine's own, not its local network, whatever their addresses.
|
||||
//
|
||||
// Sorted by link and then network, one entry per (link, network), so what `node` shows and what the
|
||||
// filter is rendered from do not depend on the order a machine happened to say them in.
|
||||
func JudgeLocalNetworks(attached []AttachedNetwork, outward []string, tunnel string) []LocalNetwork {
|
||||
seen := map[[2]string]bool{}
|
||||
var out []LocalNetwork
|
||||
for _, a := range attached {
|
||||
key := [2]string{a.Link, a.Network}
|
||||
if seen[key] {
|
||||
continue
|
||||
}
|
||||
seen[key] = true
|
||||
out = append(out, judgeOne(a, outward, tunnel))
|
||||
}
|
||||
sort.Slice(out, func(i, j int) bool {
|
||||
if out[i].Link != out[j].Link {
|
||||
return out[i].Link < out[j].Link
|
||||
}
|
||||
return out[i].Network < out[j].Network
|
||||
})
|
||||
return out
|
||||
}
|
||||
|
||||
func judgeOne(a AttachedNetwork, outward []string, tunnel string) LocalNetwork {
|
||||
j := LocalNetwork{Link: a.Link, Network: a.Network}
|
||||
prefix, err := netip.ParsePrefix(strings.TrimSpace(a.Network))
|
||||
if err != nil {
|
||||
j.Why = "not a network the mesh can read (" + err.Error() + ")"
|
||||
return j
|
||||
}
|
||||
prefix = prefix.Masked()
|
||||
j.Network = prefix.String()
|
||||
switch {
|
||||
case tunnel != "" && a.Link == tunnel:
|
||||
j.Why = "the private network's own link, not the local network"
|
||||
return j
|
||||
case !slices.Contains(outward, a.Link):
|
||||
j.Why = fmt.Sprintf("%s does not face outside this machine (a bridge or a link of its own)", a.Link)
|
||||
return j
|
||||
case prefix.Addr().IsLoopback():
|
||||
j.Why = "loopback"
|
||||
return j
|
||||
case prefix.Addr().IsLinkLocalUnicast():
|
||||
j.Why = "link-local, never counted"
|
||||
return j
|
||||
}
|
||||
for _, r := range privateRanges {
|
||||
if r.prefix.Contains(prefix.Addr()) && prefix.Bits() >= r.prefix.Bits() {
|
||||
j.Counts = true
|
||||
j.Why = "in " + r.name
|
||||
return j
|
||||
}
|
||||
}
|
||||
if prefix.Addr().IsPrivate() {
|
||||
// Overlaps a private range without lying wholly inside it (a /7 around 10.0.0.0/8, say).
|
||||
j.Why = "not wholly in a private range, so never counted"
|
||||
return j
|
||||
}
|
||||
j.Why = "public, never counted: local-network may not open a port to the internet"
|
||||
return j
|
||||
}
|
||||
|
||||
// CountedLocalNetworks is the networks that count, as the filter renders them: sorted, without repeats.
|
||||
func CountedLocalNetworks(judged []LocalNetwork) []string {
|
||||
var out []string
|
||||
for _, j := range judged {
|
||||
if j.Counts && !slices.Contains(out, j.Network) {
|
||||
out = append(out, j.Network)
|
||||
}
|
||||
}
|
||||
sort.Strings(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// LocalNetworkPort is one port the filter admits from `local-network`, and what that resolved to on this
|
||||
// machine (ADR 0340 §8): what `plan` shows for it.
|
||||
type LocalNetworkPort struct {
|
||||
Port int
|
||||
Protocol string
|
||||
Because []string
|
||||
// Networks is the local networks it is admitted from; empty when the machine reported none (§6).
|
||||
Networks []string
|
||||
}
|
||||
|
||||
// LocalNetworkPorts is every rule admitted from `local-network`, with the networks it resolved to.
|
||||
func LocalNetworkPorts(rules []Rule, networks []string) []LocalNetworkPort {
|
||||
var out []LocalNetworkPort
|
||||
for _, rule := range rules {
|
||||
if rule.From != FromLocalNetwork {
|
||||
continue
|
||||
}
|
||||
out = append(out, LocalNetworkPort{Port: rule.Port, Protocol: rule.Protocol,
|
||||
Because: rule.Because, Networks: networks})
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// Said is how `plan` says one such port: the networks, or that there are none and the port is admitted
|
||||
// from the private network only.
|
||||
func (p LocalNetworkPort) Said() string {
|
||||
by := strings.Join(p.Because, ", ")
|
||||
if len(p.Networks) == 0 {
|
||||
return fmt.Sprintf("%s/%d (%s) from the local network: none — this machine reported no private "+
|
||||
"network on a link facing outside, so it is admitted from the private network only", p.Protocol, p.Port, by)
|
||||
}
|
||||
return fmt.Sprintf("%s/%d (%s) from the local network: %s, and the private network", p.Protocol, p.Port, by,
|
||||
strings.Join(p.Networks, ", "))
|
||||
}
|
||||
@@ -1,195 +0,0 @@
|
||||
package catalogue
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// The home server's case (novox/hq issue 154): it sits on 192.168.1.0/24, and also on a public /24 a
|
||||
// provider handed it, beside the private network's own link and a container bridge.
|
||||
var homeServer = []AttachedNetwork{
|
||||
{Link: "eth0", Network: "192.168.1.10/24"},
|
||||
{Link: "eth1", Network: "203.0.113.7/24"},
|
||||
{Link: "eth0", Network: "fe80::1/64"},
|
||||
{Link: "eth0", Network: "fd12:3456:789a::5/64"},
|
||||
{Link: "wg-mesh", Network: "10.10.0.4/24"},
|
||||
{Link: "docker0", Network: "172.17.0.1/16"},
|
||||
}
|
||||
|
||||
func judged(t *testing.T) []LocalNetwork {
|
||||
t.Helper()
|
||||
return JudgeLocalNetworks(homeServer, []string{"eth0", "eth1"}, "wg-mesh")
|
||||
}
|
||||
|
||||
// **A public subnet never counts** (ADR 0340 §2), and only a private one on a link facing outside does
|
||||
// (§3): the tunnel's and a bridge's are this machine's own, whatever their addresses.
|
||||
func TestOnlyAPrivateNetworkOnALinkFacingOutsideCounts(t *testing.T) {
|
||||
got := CountedLocalNetworks(judged(t))
|
||||
want := []string{"192.168.1.0/24", "fd12:3456:789a::/64"}
|
||||
if strings.Join(got, " ") != strings.Join(want, " ") {
|
||||
t.Fatalf("counted %v, want %v", got, want)
|
||||
}
|
||||
for _, j := range judged(t) {
|
||||
if j.Why == "" {
|
||||
t.Errorf("%s on %s is judged without a why", j.Network, j.Link)
|
||||
}
|
||||
switch j.Network {
|
||||
case "203.0.113.0/24":
|
||||
if j.Counts || !strings.Contains(j.Why, "public") {
|
||||
t.Errorf("the public subnet is judged %v (%s), want never counted as public", j.Counts, j.Why)
|
||||
}
|
||||
case "fe80::/64":
|
||||
if j.Counts || !strings.Contains(j.Why, "link-local") {
|
||||
t.Errorf("a link-local network is judged %v (%s)", j.Counts, j.Why)
|
||||
}
|
||||
case "10.10.0.0/24", "172.17.0.0/16":
|
||||
if j.Counts {
|
||||
t.Errorf("%s on %s counts, and it is not the local network", j.Network, j.Link)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// A network overlapping a private range without lying wholly inside it does not count either, so a
|
||||
// wide prefix around a private range cannot carry the internet with it.
|
||||
func TestANetworkNotWhollyInAPrivateRangeDoesNotCount(t *testing.T) {
|
||||
for _, n := range []string{"10.0.0.0/7", "172.0.0.0/8", "100.64.0.0/10", "0.0.0.0/0", "::/0"} {
|
||||
got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: n}}, []string{"eth0"}, "")
|
||||
if len(got) != 1 || got[0].Counts {
|
||||
t.Errorf("%s counts as a local network: %+v", n, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// **The filter admits the local network on that port's rule alone** (§5), beside the private network,
|
||||
// in both chains, and never the public subnet.
|
||||
func TestALocalNetworkPortIsAdmittedFromItsNetworksAndTheMesh(t *testing.T) {
|
||||
rules := []Rule{
|
||||
{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}},
|
||||
{Port: 5432, Protocol: "tcp", From: FromMesh, Because: []string{"postgres"}},
|
||||
}
|
||||
local := CountedLocalNetworks(judged(t))
|
||||
out := AsNftablesWithLocal(rules, []string{"10.10.0.1", "10.10.0.4"}, false, nil,
|
||||
[]string{"eth0", "eth1"}, "wg-mesh", local)
|
||||
|
||||
for _, want := range []string{
|
||||
"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } tcp dport 1883 accept",
|
||||
"ip6 saddr { fd12:3456:789a::/64 } tcp dport 1883 accept",
|
||||
"ip saddr { 10.10.0.1, 10.10.0.4, 192.168.1.0/24 } ct original proto-dst 1883 accept",
|
||||
// The mesh-only port is not widened by the machine having a local network.
|
||||
"ip saddr { 10.10.0.1, 10.10.0.4 } tcp dport 5432 accept",
|
||||
} {
|
||||
if !strings.Contains(out, want) {
|
||||
t.Errorf("the rule set lacks %q:\n%s", want, out)
|
||||
}
|
||||
}
|
||||
if strings.Contains(out, "203.0.113") {
|
||||
t.Errorf("the public subnet reached the rule set:\n%s", out)
|
||||
}
|
||||
if strings.Contains(out, "tcp dport 1883 accept\n") && !strings.Contains(out, "saddr") {
|
||||
t.Errorf("1883 is open to anywhere:\n%s", out)
|
||||
}
|
||||
for _, line := range strings.Split(out, "\n") {
|
||||
if strings.TrimSpace(line) == "tcp dport 1883 accept" {
|
||||
t.Fatalf("1883 is open to anywhere:\n%s", out)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// **Nothing resolved is closed and said** (§6): a machine that reported no private network admits the
|
||||
// port from the private network only, and the rule set says it found none — never widened to anywhere.
|
||||
func TestNoLocalNetworkIsSaidAndNotWidened(t *testing.T) {
|
||||
rules := []Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork, Because: []string{"mosquitto"}}}
|
||||
out := AsNftablesWithLocal(rules, []string{"10.10.0.1"}, false, nil, []string{"eth0"}, "wg-mesh", nil)
|
||||
if !strings.Contains(out, "1883 wanted the local network, and this machine reported no private network") {
|
||||
t.Errorf("the rule set does not say the local network resolved to nothing:\n%s", out)
|
||||
}
|
||||
if !strings.Contains(out, "ip saddr { 10.10.0.1 } tcp dport 1883 accept") {
|
||||
t.Errorf("the port is not admitted from the private network:\n%s", out)
|
||||
}
|
||||
for _, line := range strings.Split(out, "\n") {
|
||||
if strings.TrimSpace(line) == "tcp dport 1883 accept" {
|
||||
t.Fatalf("an unresolved local network was widened to anywhere:\n%s", out)
|
||||
}
|
||||
}
|
||||
said := LocalNetworkPorts(rules, nil)[0].Said()
|
||||
if !strings.Contains(said, "none") {
|
||||
t.Errorf("plan says %q, want it to say no local network was found", said)
|
||||
}
|
||||
}
|
||||
|
||||
// `local-network` is a source a manifest may name (§1, changing ADR 0045 §3), and an unknown source is
|
||||
// still refused.
|
||||
func TestAManifestMayListenFromTheLocalNetwork(t *testing.T) {
|
||||
if _, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
|
||||
"listens":[{"port":1883,"from":"local-network"}]}`)); err != nil {
|
||||
t.Fatalf("a listen from the local network is refused: %v", err)
|
||||
}
|
||||
_, err := ParseManifest([]byte(`{"module":"mosquitto","version":"1",
|
||||
"listens":[{"port":1883,"from":"lan"}]}`))
|
||||
if err == nil || !strings.Contains(err.Error(), `from "lan"`) {
|
||||
t.Fatalf("a source the mesh cannot render is not refused: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// **A fourth reach** (§4, changing ADR 0138 §4): `internal` with the local networks added to what the
|
||||
// filter opens — the internal name, not the public one.
|
||||
func TestTheLocalNetworkReachIsInternalWithTheLocalNetworkAdded(t *testing.T) {
|
||||
public, internal := namesFor(t, aRoutedWeb(), reachSet(ReachLocalNetwork))
|
||||
if public != "" || internal != "app.anchor.internal" {
|
||||
t.Fatalf("names are %q and %q, want the internal name only", public, internal)
|
||||
}
|
||||
bare := aRoutedWeb()
|
||||
bare.Contributes = nil
|
||||
r := Resolution{Node: "anchor", Modules: []Manifest{bare}}
|
||||
rules, err := r.Rules(Rendering{Settings: reachSet(ReachLocalNetwork)})
|
||||
if err != nil {
|
||||
t.Fatalf("rules: %v", err)
|
||||
}
|
||||
if len(rules) != 1 || rules[0].From != FromLocalNetwork {
|
||||
t.Fatalf("reach local-network made the filter say %+v", rules)
|
||||
}
|
||||
}
|
||||
|
||||
// Two modules wanting one port, one from the mesh and one from the local network, render one rule from
|
||||
// the local network: it covers the mesh, and anywhere covers it.
|
||||
func TestTheLocalNetworkSitsBetweenTheMeshAndAnywhere(t *testing.T) {
|
||||
got := widest([]Rule{
|
||||
{Port: 53, Protocol: "udp", From: FromMesh, Because: []string{"a"}},
|
||||
{Port: 53, Protocol: "udp", From: FromLocalNetwork, Because: []string{"b"}},
|
||||
})
|
||||
if len(got) != 1 || got[0].From != FromLocalNetwork || len(got[0].Because) != 2 {
|
||||
t.Fatalf("got %+v", got)
|
||||
}
|
||||
got = widest(append(got, Rule{Port: 53, Protocol: "udp", From: FromEverywhere, Because: []string{"c"}}))
|
||||
if len(got) != 1 || got[0].From != FromEverywhere {
|
||||
t.Fatalf("got %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
// On an adopted node the opening is the private network's part only: the found firewall admits the
|
||||
// local network, and an opening that widened to everywhere would open the port to the internet.
|
||||
func TestAnAdoptedNodeOpensTheLocalNetworkPortToTheMeshOnly(t *testing.T) {
|
||||
out := Openings([]Rule{{Port: 1883, Protocol: "tcp", From: FromLocalNetwork}}, nil, nil)
|
||||
if len(out) != 1 || out[0]["from"] != OpeningFromMesh {
|
||||
t.Fatalf("openings %v", out)
|
||||
}
|
||||
}
|
||||
|
||||
// A global unicast IPv6 subnet on a link facing outside is public, and never counts: the IPv6 side of the
|
||||
// rule that `local-network` cannot open a port to the internet (ADR 0340 §2).
|
||||
func TestAGlobalIPv6SubnetIsPublicAndNeverCounts(t *testing.T) {
|
||||
got := JudgeLocalNetworks([]AttachedNetwork{{Link: "eth0", Network: "2001:db8:1234::7/48"}}, []string{"eth0"}, "wg-mesh")
|
||||
if len(got) != 1 {
|
||||
t.Fatalf("judged %+v", got)
|
||||
}
|
||||
if got[0].Counts {
|
||||
t.Fatalf("the global IPv6 subnet %s counts as a local network", got[0].Network)
|
||||
}
|
||||
if got[0].Network != "2001:db8:1234::/48" || !strings.Contains(got[0].Why, "public, never counted") {
|
||||
t.Fatalf("judged %s with why %q, want it named public and never counted", got[0].Network, got[0].Why)
|
||||
}
|
||||
if n := CountedLocalNetworks(got); len(n) != 0 {
|
||||
t.Fatalf("counted %v", n)
|
||||
}
|
||||
}
|
||||
@@ -269,8 +269,7 @@ func KeepsConsumerData(catalogue map[string]Manifest, provision string) bool {
|
||||
func (o Offer) MachineReach() bool { return o.Reach == ReachMachine }
|
||||
|
||||
// OfferCredential names which of the provider's own secrets a provision's consumers receive — or, with
|
||||
// IssuedBy "outside", that only a person can give the provision's credential (novox/hq ADR 0337, issue 164) — or,
|
||||
// with IssuedBy "software", that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
|
||||
// IssuedBy, that the provider's software issues the provision's one credential itself (novox/hq ADR 0305,
|
||||
// issue 526): a media server's sign-in token from its vendor, which the mesh can neither make nor rotate.
|
||||
// Tool is then the provider's own tool that answers that value, sealed to a key made for the controller's
|
||||
// one call, and to the controller alone.
|
||||
@@ -294,34 +293,6 @@ func (m Manifest) IssuedCredentialOf(provision string) (string, bool) {
|
||||
return "", false
|
||||
}
|
||||
|
||||
// IssuedOutsideOf is whether this module's offer of a provision says only a person outside the mesh can give its
|
||||
// credential (novox/hq ADR 0337): the mesh never makes a value for it, and a consumer holds one only once a person
|
||||
// gave it with `secret accept`.
|
||||
func (m Manifest) IssuedOutsideOf(provision string) bool {
|
||||
for _, o := range m.Provides {
|
||||
if o.Name == provision && o.Credential != nil && o.Credential.IssuedBy == IssuedOutside {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
|
||||
// OffersIssuedOutside is whether any module of a catalogue offers the provision with a credential issued outside
|
||||
// the mesh (novox/hq ADR 0337), and the first such module by name.
|
||||
func OffersIssuedOutside(shelf map[string]Manifest, provision string) (string, bool) {
|
||||
var names []string
|
||||
for name, m := range shelf {
|
||||
if m.IssuedOutsideOf(provision) {
|
||||
names = append(names, name)
|
||||
}
|
||||
}
|
||||
if len(names) == 0 {
|
||||
return "", false
|
||||
}
|
||||
sort.Strings(names)
|
||||
return names[0], true
|
||||
}
|
||||
|
||||
// SharedCredentialOf is the own secret an offer of this module names as the provision's credential,
|
||||
// and whether it names one.
|
||||
func (m Manifest) SharedCredentialOf(provision string) (string, bool) {
|
||||
@@ -1165,12 +1136,6 @@ const (
|
||||
FromEverywhere = "anywhere"
|
||||
// FromMachine is this machine only — a port bound for something else on the same host.
|
||||
FromMachine = "machine"
|
||||
// FromLocalNetwork is the private network and the networks this machine is directly attached to
|
||||
// through its uplink, as it reports them, and only those wholly in a private range (novox/hq ADR
|
||||
// 0340): a local service reached by devices that will never be nodes, said as exactly that rather
|
||||
// than as `anywhere`. A public subnet the machine sits on never counts, so it cannot open a port to
|
||||
// the internet.
|
||||
FromLocalNetwork = "local-network"
|
||||
)
|
||||
|
||||
// At is this port's protocol, with the default applied.
|
||||
@@ -1682,28 +1647,14 @@ func ParseManifest(raw []byte) (Manifest, error) {
|
||||
"makes is %d", m.Module, p, id.Max, shortest))
|
||||
}
|
||||
}
|
||||
if c := offer.Credential; c != nil && c.IssuedBy == IssuedOutside {
|
||||
// Only a person can give it (novox/hq ADR 0337 §1, issue 164): the software holds a value the mesh can
|
||||
// neither make nor fetch, so the offer names nothing that would answer it — no own secret, no tool.
|
||||
switch {
|
||||
case c.Own != "":
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s provides %q with a credential issued outside the mesh and names its own secret %q too; a "+
|
||||
"person gives the value with `secret accept`, so the offer names no own secret (ADR 0337)",
|
||||
m.Module, p, c.Own))
|
||||
case c.Tool != "":
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s provides %q with a credential issued outside the mesh and names the tool %q; only a "+
|
||||
"person gives it, so the offer names no tool (ADR 0337)", m.Module, p, c.Tool))
|
||||
}
|
||||
} else if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
|
||||
if c := offer.Credential; c != nil && (c.IssuedBy != "" || c.Tool != "") {
|
||||
// The software issues it (novox/hq ADR 0305): named by the tool that answers it, never by an own
|
||||
// secret, which would be a second copy for the mesh to keep in step with the software's.
|
||||
switch {
|
||||
case c.IssuedBy != IssuedBySoftware:
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s provides %q with a credential issued by %q; the issuers an offer may name are %q and %q "+
|
||||
"(ADR 0305, ADR 0337)", m.Module, p, c.IssuedBy, IssuedBySoftware, IssuedOutside))
|
||||
"%s provides %q with a credential issued by %q; the one issuer an offer may name is %q (ADR 0305)",
|
||||
m.Module, p, c.IssuedBy, IssuedBySoftware))
|
||||
case c.Own != "":
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s provides %q with a credential its software issues and names its own secret %q too; the "+
|
||||
@@ -1935,17 +1886,17 @@ func ParseManifest(raw []byte) (Manifest, error) {
|
||||
"%s listens on port %d, which is not a port", m.Module, l.Port))
|
||||
}
|
||||
switch l.From {
|
||||
case FromMesh, FromEverywhere, FromMachine, FromLocalNetwork:
|
||||
case FromMesh, FromEverywhere, FromMachine:
|
||||
case "":
|
||||
// The fault this field exists to prevent. A rule with no source is open, and a
|
||||
// manifest that omitted it would read as a restriction and be none.
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s listens on %d and does not say from where; it is %q, %q, %q or %q",
|
||||
m.Module, l.Port, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
|
||||
"%s listens on %d and does not say from where; it is %q, %q or %q",
|
||||
m.Module, l.Port, FromMesh, FromEverywhere, FromMachine))
|
||||
default:
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s listens on %d from %q; it is %q, %q, %q or %q",
|
||||
m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine, FromLocalNetwork))
|
||||
"%s listens on %d from %q; it is %q, %q or %q",
|
||||
m.Module, l.Port, l.From, FromMesh, FromEverywhere, FromMachine))
|
||||
}
|
||||
if p := l.At(); p != "tcp" && p != "udp" {
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
|
||||
@@ -111,9 +111,6 @@ type Provider struct {
|
||||
// (novox/hq to-be 23), and the pair is what tells the holder of a seat apart from another module
|
||||
// providing the same thing (ADR 0110).
|
||||
Module string
|
||||
// LeftOut says each served key left out of Serves because that node composes no name it asks
|
||||
// for (novox/hq ADR 0346 §3): said under each consumer's need.
|
||||
LeftOut []string
|
||||
}
|
||||
|
||||
// Held is a claim somebody already has, used for the scopes wider than one node.
|
||||
@@ -233,9 +230,6 @@ type Needed struct {
|
||||
// state, not a consumer missing its key. Set by the plan, which is the only layer that knows a
|
||||
// licence's manager; empty for every consumer.
|
||||
Manager bool
|
||||
// LeftOut says each served key the provider left out, because its machine composes no name the
|
||||
// value asks for (novox/hq ADR 0346 §3).
|
||||
LeftOut []string
|
||||
// Module is the providing module on From, empty for a need answered by a record or by nothing
|
||||
// that serves it. A provider is a (node, module) pair (novox/hq to-be 23), and a binding to data
|
||||
// is a binding to the pair (ADR 0232).
|
||||
@@ -588,7 +582,7 @@ func Resolve(catalogue map[string]Manifest, assigned []string, node Node, world
|
||||
bound = pm.IdentityBoundOf(want)
|
||||
}
|
||||
needs = append(needs, Needed{Name: want, From: p.Node, At: p.At, Module: p.Module,
|
||||
Serves: p.Serves, For: because[want], SharedOwn: shared, Identity: bound, LeftOut: p.LeftOut})
|
||||
Serves: p.Serves, For: because[want], SharedOwn: shared, Identity: bound})
|
||||
}
|
||||
switch {
|
||||
case world.Unchecked:
|
||||
|
||||
@@ -331,13 +331,12 @@ func UnassignRefusal(catalogue map[string]Manifest, node string, assigned, remov
|
||||
}
|
||||
|
||||
// CollisionRefusal is why assigning `adding` beside `assigned` is refused for what two modules
|
||||
// would both declare, or nothing (novox/hq ADR 0210 §1, 04-ISSUES/235): one path, unit or name, or a package one
|
||||
// declares present and another absent. A package several modules declare present is no collision (ADR 0303).
|
||||
// would both declare, or nothing (novox/hq ADR 0210 §1, 04-ISSUES/235).
|
||||
//
|
||||
// **Refused, not kept like an unresolved provision.** An assignment is otherwise kept when the
|
||||
// node does not resolve, because assignment is not an ordering: a consumer's provider can follow.
|
||||
// A collision is not an order anything can complete — no further assignment makes two owners of one
|
||||
// file one owner — and kept, it leaves the node unresolvable, so the next push of anything drops
|
||||
// package one owner — and kept, it leaves the node unresolvable, so the next push of anything drops
|
||||
// it from the mesh. Only collisions involving a module being added are refused; one already on the
|
||||
// node is `status`'s, and refusing an unrelated assignment for it would block its own remedy.
|
||||
func CollisionRefusal(catalogue map[string]Manifest, node string, assigned, adding []string) error {
|
||||
|
||||
@@ -322,6 +322,9 @@ var defaultSeats = append([]Seat{
|
||||
// node-mounts writes a mount and an automount unit per share on a machine that asks (shares.go).
|
||||
{Name: NFSServerSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: nfsServerVerbs()},
|
||||
{Name: MountsSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0263", Serves: mountsVerbs()},
|
||||
// A machine's SMB shares for the devices on its own network (novox/hq ADR 0341, smb.go): its holder
|
||||
// writes the SMB configuration, serves 445 alone and maps every client to the shared folder's owner.
|
||||
{Name: SMBServerSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0341", Serves: smbServerVerbs()},
|
||||
// A node's files and accounts, read (novox/hq ADR 0310, reads.go): by an account of the holder's own that holds
|
||||
// no secret, on every node, so the reads ADR 0268 §5 takes over from the login shell's execute have a tool.
|
||||
{Name: ReadsSeat, Scope: ScopeNode, Decision: "novox/hq ADR 0310", Serves: readsVerbs()},
|
||||
|
||||
@@ -48,7 +48,7 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
|
||||
delivered[s.Delivers] = s.Name
|
||||
}
|
||||
}
|
||||
// Forty-one with node-reads (novox/hq ADR 0310); forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
|
||||
// Forty-two with node-smb-server (novox/hq ADR 0341); forty-one with node-reads (novox/hq ADR 0310); forty with node-nfs-server and node-mounts (novox/hq ADR 0263); thirty-eight with node-resolver (novox/hq ADR 0247); thirty-seven with mesh-delivery (novox/hq ADR 0239); thirty-six since node-resolver-config retired
|
||||
// into node-uplink (novox/hq ADR 0223); thirty-seven
|
||||
// since the retired node-dns-resolver went (novox/hq ADR 0220); thirty-eight with
|
||||
// node-backup (novox/hq ADR 0214); thirty-seven with node-message-bus (novox/hq ADR 0215);
|
||||
@@ -59,8 +59,8 @@ func TestTheSeatsAreAClosedSetAndEachNamesItsDecision(t *testing.T) {
|
||||
// node-container-runtime (ADR 0207); nineteen with node-environment and node-login-shell (ADR 0203,
|
||||
// ADR 0204); seventeen with node-build-agent (ADR 0190). One fewer once the retired
|
||||
// mesh-build-machine row goes, when no registered manifest claims it.
|
||||
if len(Seats()) != 41 {
|
||||
t.Errorf("the mesh defines %d seats rather than 41; the set is closed, so a change here is "+
|
||||
if len(Seats()) != 42 {
|
||||
t.Errorf("the mesh defines %d seats rather than 42; the set is closed, so a change here is "+
|
||||
"a decision (novox/hq ADR 0110): %s", len(Seats()), seatNames())
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,202 +0,0 @@
|
||||
package catalogue
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"sort"
|
||||
"strings"
|
||||
)
|
||||
|
||||
// A provider may tell its consumers its own composed names (novox/hq ADR 0346, issue 624).
|
||||
//
|
||||
// **The name is already the mesh's.** A module contributes a label to a requirement — a route — and
|
||||
// the mesh joins it with the providing machine's domains; the module reads the result in its own files
|
||||
// as `${bound:<requirement>:name}` (novox/hq 04-ISSUES/122). Its consumers could not be told it: a
|
||||
// served value named only the consumer (ADR 0202) and settings. The forge's package registry writes
|
||||
// every tarball at its public name, and a consumer that must trust that name had no source for it but a
|
||||
// second copy kept by hand. So a served value may say `${bound:<requirement>:<name>}` for a requirement
|
||||
// the provider contributes to, and the mesh fills it from the same composition the provider's own files
|
||||
// and its proxy receive.
|
||||
//
|
||||
// **A name the providing machine does not compose leaves the key out** (ADR 0346 §3): a machine with
|
||||
// no public domain has no public name to give, and an empty value or a refusal would be worse than a
|
||||
// consumer told nothing — a refused provider machine takes every provision it offers down with it. The
|
||||
// plan says which key was left out, and why, on the provider's machine and under each consumer's need.
|
||||
|
||||
// ownNameFacts are what a served value may name of the provider's own composition: the names, as its
|
||||
// own files read them (withOwnNames).
|
||||
var ownNameFacts = []string{"name", "internal-name"}
|
||||
|
||||
// requirementsContributedTo is every requirement m contributes to, sorted.
|
||||
func requirementsContributedTo(m Manifest) []string {
|
||||
seen := map[string]bool{}
|
||||
for to := range m.Contributes {
|
||||
seen[to] = true
|
||||
}
|
||||
for to := range m.ContributesMany {
|
||||
seen[to] = true
|
||||
}
|
||||
out := make([]string, 0, len(seen))
|
||||
for to := range seen {
|
||||
out = append(out, to)
|
||||
}
|
||||
sort.Strings(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// ownNameKeys is every name a served value of m may say for one requirement it contributes to:
|
||||
// `name` and `internal-name`, and `name-<local>` and `internal-name-<local>` for each local name it
|
||||
// contributes under.
|
||||
func ownNameKeys(m Manifest, to string) []string {
|
||||
keys := append([]string{}, ownNameFacts...)
|
||||
for _, local := range sortedKeys(m.ContributesMany[to]) {
|
||||
for _, fact := range ownNameFacts {
|
||||
keys = append(keys, fact+"-"+local)
|
||||
}
|
||||
}
|
||||
return keys
|
||||
}
|
||||
|
||||
// ServedOwnNames fills the provider's own composed names into what it serves one provision's
|
||||
// consumers, from this resolution's composition of the provider's machine (ADR 0346).
|
||||
//
|
||||
// A value naming a name this machine does not compose is left out, with its key, and said. The map is
|
||||
// copied only when something changes, as ServedTo does: the caller's may be the manifest's.
|
||||
func (r Resolution) ServedOwnNames(m Manifest, provision string, serves map[string]any, layers []Layer) (
|
||||
map[string]any, []string, error) {
|
||||
var asking []string
|
||||
for _, key := range sortedAnyKeys(serves) {
|
||||
if text, ok := serves[key].(string); ok && bound.MatchString(text) {
|
||||
asking = append(asking, key)
|
||||
}
|
||||
}
|
||||
if len(asking) == 0 {
|
||||
return serves, nil, nil
|
||||
}
|
||||
own := map[string]map[string]string{}
|
||||
for _, to := range requirementsContributedTo(m) {
|
||||
names, err := r.ownNames(m, to, layers)
|
||||
if err != nil {
|
||||
return nil, nil, err
|
||||
}
|
||||
values := map[string]string{}
|
||||
withOwnNames(values, names)
|
||||
own[to] = values
|
||||
}
|
||||
out := make(map[string]any, len(serves))
|
||||
for k, v := range serves {
|
||||
out[k] = v
|
||||
}
|
||||
var said []string
|
||||
for _, key := range asking {
|
||||
text := serves[key].(string)
|
||||
var missing string
|
||||
filled := bound.ReplaceAllStringFunc(text, func(token string) string {
|
||||
parts := bound.FindStringSubmatch(token)
|
||||
if value := own[parts[1]][parts[2]]; value != "" && parts[3] == "" {
|
||||
return value
|
||||
}
|
||||
if missing == "" {
|
||||
missing = token
|
||||
}
|
||||
return token
|
||||
})
|
||||
if missing != "" {
|
||||
delete(out, key)
|
||||
said = append(said, fmt.Sprintf(
|
||||
"%s serves %s without %q: it names %s, and %s composes no such name for %s (it has no "+
|
||||
"public domain, or the endpoint is not reached publicly) (novox/hq ADR 0346)",
|
||||
m.Module, provision, key, missing, orHere(r.Node), m.Module))
|
||||
continue
|
||||
}
|
||||
out[key] = filled
|
||||
}
|
||||
return out, said, nil
|
||||
}
|
||||
|
||||
func orHere(node string) string {
|
||||
if node == "" {
|
||||
return "this machine"
|
||||
}
|
||||
return node
|
||||
}
|
||||
|
||||
// ServedLeftOut is what the providers in this node's own set leave out of what they serve, because
|
||||
// this machine composes no name a served value asks for (ADR 0346 §3): said on the provider's machine,
|
||||
// where the remedy is.
|
||||
func (r Resolution) ServedLeftOut(settings SettingsBy) []string {
|
||||
var said []string
|
||||
for _, m := range r.Modules {
|
||||
for _, provision := range sortedServes(m.Serves) {
|
||||
_, lines, err := r.ServedOwnNames(m, provision, m.Serves[provision], WithDefaults(m, settings[m.Module]))
|
||||
if err != nil {
|
||||
said = append(said, fmt.Sprintf("%s serves %s, and its own names could not be composed: %v",
|
||||
m.Module, provision, err))
|
||||
continue
|
||||
}
|
||||
said = append(said, lines...)
|
||||
}
|
||||
}
|
||||
return said
|
||||
}
|
||||
|
||||
// checkServedOwnNames refuses a served `${bound:…}` that names a requirement the module does not
|
||||
// contribute to, a fact other than its own names, or a local name it does not contribute under; and
|
||||
// one with a default, since a served value is left out rather than given one (ADR 0346 §3, §4).
|
||||
func checkServedOwnNames(m Manifest, provision, key, text string) []string {
|
||||
var problems []string
|
||||
contributes := requirementsContributedTo(m)
|
||||
for _, parts := range bound.FindAllStringSubmatch(text, -1) {
|
||||
to, fact, fallback := parts[1], parts[2], parts[3]
|
||||
says := fmt.Sprintf("%s serves %s, and the value it serves as %q says %s", m.Module, provision, key, parts[0])
|
||||
switch {
|
||||
case fallback != "":
|
||||
problems = append(problems, says+": a served name takes no default; one the machine does not "+
|
||||
"compose leaves the key out (novox/hq ADR 0346)")
|
||||
case !oneOf(contributes, to):
|
||||
problems = append(problems, fmt.Sprintf(
|
||||
"%s, and %s contributes to %s: a served value names only the provider's own names "+
|
||||
"(novox/hq ADR 0346)", says, m.Module, orNothing(quoted(contributes))))
|
||||
case !oneOf(ownNameKeys(m, to), fact):
|
||||
problems = append(problems, fmt.Sprintf("%s, and what %s is called through %s is %s (novox/hq ADR 0346)",
|
||||
says, m.Module, to, strings.Join(ownNameKeys(m, to), ", ")))
|
||||
}
|
||||
}
|
||||
return problems
|
||||
}
|
||||
|
||||
func quoted(values []string) []string {
|
||||
out := make([]string, len(values))
|
||||
for i, v := range values {
|
||||
out[i] = fmt.Sprintf("%q", v)
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// nestedOwnNames refuses a `${bound:…}` inside a served list or object: only a string value of its own is
|
||||
// filled (ServedOwnNames), so a nested one would reach the consumer as the placeholder (ADR 0346 §5).
|
||||
func nestedOwnNames(m Manifest, provision, key string, value any) []string {
|
||||
var found []string
|
||||
var walk func(v any)
|
||||
walk = func(v any) {
|
||||
switch x := v.(type) {
|
||||
case string:
|
||||
found = append(found, bound.FindAllString(x, -1)...)
|
||||
case []any:
|
||||
for _, e := range x {
|
||||
walk(e)
|
||||
}
|
||||
case map[string]any:
|
||||
for _, k := range sortedAnyKeys(x) {
|
||||
walk(x[k])
|
||||
}
|
||||
}
|
||||
}
|
||||
walk(value)
|
||||
if len(found) == 0 {
|
||||
return nil
|
||||
}
|
||||
return []string{fmt.Sprintf(
|
||||
"%s serves %s, and the value it serves as %q holds %s inside a list or an object: a provider's own "+
|
||||
"name is filled only in a string value of its own (novox/hq ADR 0346)",
|
||||
m.Module, provision, key, strings.Join(found, ", "))}
|
||||
}
|
||||
@@ -1,168 +0,0 @@
|
||||
package catalogue
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// novox/hq ADR 0346, issue 624: the forge's package registry writes every tarball at its public name,
|
||||
// and the lab, its consumer, must trust that name and no other. The name is the mesh's own composition
|
||||
// of the forge's route, which the forge's files read as ${bound:route:name-web}; a consumer can now be
|
||||
// served it.
|
||||
|
||||
const aRegistryForge = `{"module":"forge","version":"1","requires":["route"],
|
||||
"provides":[{"name":"npm-package-registry","scope":"mesh"}],
|
||||
"contributes":{"route":{"web":{"label":"git","port":3000}}},
|
||||
"serves":{"npm-package-registry":{"scheme":"http","port":3000,"npm-path":"/api/packages/novox/npm/",
|
||||
"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"}}}`
|
||||
|
||||
func aForgeManifest(t *testing.T) Manifest {
|
||||
t.Helper()
|
||||
m, err := ParseManifest([]byte(aRegistryForge))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
func TestAProviderServesItsOwnComposedName(t *testing.T) {
|
||||
m := aForgeManifest(t)
|
||||
r := Resolution{Node: "home", PublicDomain: "example.org"}
|
||||
got, said, err := r.ServedOwnNames(m, "npm-package-registry", m.Serves["npm-package-registry"], nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if got["public-root"] != "https://git.example.org/api/packages/novox/npm/" || len(said) != 0 {
|
||||
t.Fatalf("the public root is the route's composed name: %v, said %v", got, said)
|
||||
}
|
||||
if got["npm-path"] != "/api/packages/novox/npm/" || got["port"] != float64(3000) {
|
||||
t.Fatalf("the rest is served as it was: %v", got)
|
||||
}
|
||||
if m.Serves["npm-package-registry"]["public-root"] != "https://${bound:route:name-web}/api/packages/novox/npm/" {
|
||||
t.Fatal("the manifest's own map was rewritten")
|
||||
}
|
||||
}
|
||||
|
||||
func TestANameTheMachineDoesNotComposeLeavesTheKeyOutAndSaysSo(t *testing.T) {
|
||||
m := aForgeManifest(t)
|
||||
r := Resolution{Node: "home"} // no public domain
|
||||
got, said, err := r.ServedOwnNames(m, "npm-package-registry", m.Serves["npm-package-registry"], nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, there := got["public-root"]; there {
|
||||
t.Fatalf("a name not composed is left out, never written as the placeholder or empty: %v", got)
|
||||
}
|
||||
if got["npm-path"] == nil {
|
||||
t.Fatalf("only the key that names it is left out: %v", got)
|
||||
}
|
||||
if len(said) != 1 || !strings.Contains(said[0], `forge serves npm-package-registry without "public-root"`) ||
|
||||
!strings.Contains(said[0], "home composes no such name") {
|
||||
t.Fatalf("said: %v", said)
|
||||
}
|
||||
if lines := (Resolution{Node: "home", Modules: []Manifest{m}}).ServedLeftOut(nil); len(lines) != 1 {
|
||||
t.Fatalf("the plan on the provider's machine says it: %v", lines)
|
||||
}
|
||||
if lines := (Resolution{Node: "home", PublicDomain: "example.org", Modules: []Manifest{m}}).ServedLeftOut(nil); len(lines) != 0 {
|
||||
t.Fatalf("nothing to say when the name is composed: %v", lines)
|
||||
}
|
||||
}
|
||||
|
||||
// On the provider's own machine the consumer is served the same name (ADR 0346 §2).
|
||||
func TestAConsumerBesideTheProviderIsServedItsName(t *testing.T) {
|
||||
m := aForgeManifest(t)
|
||||
consumer := Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
|
||||
Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
|
||||
node := workstation()
|
||||
node.PublicDomain = "example.org"
|
||||
got, err := Resolve(shelf(minimalRouteProxy(), m, consumer), []string{"route-proxy", "forge", "lab"}, node, World{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
served, answered, err := got.servedOnThisMachine("npm-package-registry", Rendering{})
|
||||
if err != nil || !answered {
|
||||
t.Fatalf("answered %v: %v", answered, err)
|
||||
}
|
||||
if served["public-root"] != "https://git.example.org/api/packages/novox/npm/" {
|
||||
t.Fatalf("served beside the provider: %v", served)
|
||||
}
|
||||
out, err := got.Declaration(Rendering{})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
var binding string
|
||||
for _, r := range out {
|
||||
if r["path"] == "/var/lib/lab/package-registry.json" {
|
||||
binding, _ = r["content"].(string)
|
||||
}
|
||||
}
|
||||
if !strings.Contains(binding, `"public-root": "https://git.example.org/api/packages/novox/npm/"`) &&
|
||||
!strings.Contains(binding, `"public-root":"https://git.example.org/api/packages/novox/npm/"`) {
|
||||
t.Fatalf("the consumer's binding carries the name:\n%s", binding)
|
||||
}
|
||||
if strings.Contains(binding, "${bound:") {
|
||||
t.Fatalf("a placeholder reached the consumer:\n%s", binding)
|
||||
}
|
||||
}
|
||||
|
||||
// From another machine, the provider's served values carry what that machine composed, and a key it
|
||||
// left out is said on the consumer's need (ADR 0346 §2, §3).
|
||||
func TestAConsumerElsewhereIsToldWhatTheProviderLeftOut(t *testing.T) {
|
||||
consumer := Manifest{Module: "lab", Version: "1", Requires: []string{"npm-package-registry"},
|
||||
Binds: map[string]string{"npm-package-registry": "/var/lib/lab/package-registry.json"}}
|
||||
node := workstation()
|
||||
node.At = "workstation.internal"
|
||||
world := World{Offered: map[string][]Provider{"npm-package-registry": {{Node: "home", At: "home.internal",
|
||||
Module: "forge", Serves: map[string]any{"port": 3000},
|
||||
LeftOut: []string{`forge serves npm-package-registry without "public-root"`}}}}}
|
||||
got, err := Resolve(shelf(aForgeManifest(t), consumer), []string{"lab"}, node, world)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, n := range got.Needs {
|
||||
if n.Name == "npm-package-registry" {
|
||||
if len(n.LeftOut) != 1 {
|
||||
t.Fatalf("the need carries what was left out: %+v", n)
|
||||
}
|
||||
return
|
||||
}
|
||||
}
|
||||
t.Fatalf("no need: %+v", got.Needs)
|
||||
}
|
||||
|
||||
func TestAServedNameIsCheckedWhenTheDefinitionIsRead(t *testing.T) {
|
||||
for bad, want := range map[string]string{
|
||||
`"public-root":"https://${bound:route:name-api}/x"`: "what forge is called through route is name, internal-name, name-web, internal-name-web",
|
||||
`"public-root":"https://${bound:postgres-database:name}/x"`: `forge contributes to "route"`,
|
||||
`"public-root":"https://${bound:route:name-web|default:x}/x"`: "takes no default",
|
||||
`"public-root":"https://${bound:route:at}/x"`: "what forge is called through route",
|
||||
} {
|
||||
raw := strings.Replace(aRegistryForge, `"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"`, bad, 1)
|
||||
_, err := ParseManifest([]byte(raw))
|
||||
if err == nil || !strings.Contains(err.Error(), want) {
|
||||
t.Errorf("%s: want a refusal saying %q, got %v", bad, want, err)
|
||||
}
|
||||
}
|
||||
nested := strings.Replace(aRegistryForge, `"public-root":"https://${bound:route:name-web}/api/packages/novox/npm/"`,
|
||||
`"roots":["https://${bound:route:name-web}/x"]`, 1)
|
||||
if _, err := ParseManifest([]byte(nested)); err == nil || !strings.Contains(err.Error(), "inside a list or an object") {
|
||||
t.Errorf("a nested own name is refused, not served as the placeholder: %v", err)
|
||||
}
|
||||
if _, err := ParseManifest([]byte(aRegistryForge)); err != nil {
|
||||
t.Fatalf("its own name is accepted: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// The provider's contributions file carries no own name on a consumer's entry (ADR 0346 §4): only what
|
||||
// is derived for that consumer is there (ADR 0202 §5), and the provider reads its own names in its files.
|
||||
func TestAProvidersOwnNameIsNotOnItsConsumersEntry(t *testing.T) {
|
||||
m := aForgeManifest(t)
|
||||
r := Resolution{Node: "home", PublicDomain: "example.org", Modules: []Manifest{m}}
|
||||
derived, err := r.derivedFor("npm-package-registry", "lab_home", "lab", "", nil)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if derived != nil {
|
||||
t.Fatalf("a consumer's entry carries only what was derived for it: %v", derived)
|
||||
}
|
||||
}
|
||||
@@ -192,16 +192,6 @@ func settle(base map[string]any, layers []Layer, protected map[string]bool, what
|
||||
"%s sets %q on %v, and that module keeps %q for itself — it is not settable",
|
||||
layer.From, key, what, key)
|
||||
}
|
||||
// **No layer replaces a secret the vault fills, at any depth** (novox/hq issue 610): a
|
||||
// mergeable file's `${secret:<name>}` is the vault's value, and a layer that reached it —
|
||||
// `server.secret_key` under a `server` the file takes — would put a value the operator or an
|
||||
// agent chose where the vault's belongs. Judged against the file's own content, so it holds
|
||||
// whatever a module's `protected` list says.
|
||||
if at := secretReplacedBy(base[key], value, key); at != "" {
|
||||
return nil, fmt.Errorf(
|
||||
"%s sets %q on %v, which the vault fills (${secret:…}); a secret comes from the vault, "+
|
||||
"never from a setting (novox/hq issues 342, 610)", layer.From, at, what)
|
||||
}
|
||||
merged[key] = mergeValue(merged[key], value)
|
||||
}
|
||||
}
|
||||
@@ -586,54 +576,3 @@ func JudgeSettings(m Manifest, layers []Layer, adopted bool) error {
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// secretReplacedBy is the path in a mergeable file's own content that a layer's value would replace while the
|
||||
// vault fills it — a string holding `${secret:` — or "" when the value leaves every such string as it is
|
||||
// (novox/hq issue 610). Maps merge key by key (mergeValue), so only the keys the value names are judged; any
|
||||
// other value replaces the whole of what it lands on.
|
||||
func secretReplacedBy(base, value any, at string) string {
|
||||
if baseMap, isMap := base.(map[string]any); isMap {
|
||||
if valueMap, also := value.(map[string]any); also {
|
||||
keys := make([]string, 0, len(valueMap))
|
||||
for k := range valueMap {
|
||||
keys = append(keys, k)
|
||||
}
|
||||
sort.Strings(keys)
|
||||
for _, k := range keys {
|
||||
if found := secretReplacedBy(baseMap[k], valueMap[k], at+"."+k); found != "" {
|
||||
return found
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
}
|
||||
return secretIn(base, at)
|
||||
}
|
||||
|
||||
// secretIn is the first path under v holding a vault placeholder, or "".
|
||||
func secretIn(v any, at string) string {
|
||||
switch t := v.(type) {
|
||||
case string:
|
||||
if strings.Contains(t, "${secret:") {
|
||||
return at
|
||||
}
|
||||
case map[string]any:
|
||||
keys := make([]string, 0, len(t))
|
||||
for k := range t {
|
||||
keys = append(keys, k)
|
||||
}
|
||||
sort.Strings(keys)
|
||||
for _, k := range keys {
|
||||
if found := secretIn(t[k], at+"."+k); found != "" {
|
||||
return found
|
||||
}
|
||||
}
|
||||
case []any:
|
||||
for i, item := range t {
|
||||
if found := secretIn(item, fmt.Sprintf("%s[%d]", at, i)); found != "" {
|
||||
return found
|
||||
}
|
||||
}
|
||||
}
|
||||
return ""
|
||||
}
|
||||
|
||||
@@ -234,29 +234,3 @@ func TestAServedValueMayBeTheOperators(t *testing.T) {
|
||||
t.Errorf("a setting a served fact asks for is not stray: %v", unused)
|
||||
}
|
||||
}
|
||||
|
||||
// No layer replaces a value the vault fills, at any depth (novox/hq issue 610): searxng's server.secret_key
|
||||
// sits under `server`, a key its file takes, and a layer reaching it was let through by a top-level-only check.
|
||||
func TestNoLayerReplacesAVaultSecretAtAnyDepth(t *testing.T) {
|
||||
file := map[string]any{"id": "settings", "type": "file", "merge": MergeJSON,
|
||||
"content": `{"server": {"secret_key": "${secret:secret}", "port": 8080}, "ui": {"theme": "simple"}, "token": "${secret:token}"}`}
|
||||
layer := func(values map[string]any) []Layer { return []Layer{{From: "anchor", Values: values}} }
|
||||
|
||||
merged, err := ApplySettings(file, layer(map[string]any{"server": map[string]any{"port": float64(9000)}, "ui": map[string]any{"theme": "dark"}}))
|
||||
if err != nil {
|
||||
t.Fatalf("a key beside the secret was refused: %v", err)
|
||||
}
|
||||
if c := merged["content"].(string); !strings.Contains(c, `"secret_key": "${secret:secret}"`) || !strings.Contains(c, `"port": 9000`) {
|
||||
t.Fatalf("the secret or the setting did not land as meant:\n%s", c)
|
||||
}
|
||||
for name, values := range map[string]map[string]any{
|
||||
"the nested secret": {"server": map[string]any{"secret_key": "chosen"}},
|
||||
"the whole map holding it": {"server": "elsewhere"},
|
||||
"a top-level secret": {"token": "chosen"},
|
||||
"the secret, emptied": {"server": map[string]any{"secret_key": ""}},
|
||||
} {
|
||||
if _, err := ApplySettings(file, layer(values)); err == nil || !strings.Contains(err.Error(), "vault") {
|
||||
t.Errorf("%s: %v, want a refusal naming the vault", name, err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -31,9 +31,10 @@ func nfsServerVerbs() []Verb {
|
||||
{Name: "exports", Description: "Every share this machine exports: its name, its path, read-write or " +
|
||||
"read-only, the owner every client is mapped to (uid and gid), each node it is exported to with that " +
|
||||
"node's private address and access (only the nodes the server grants it to and that ask for it), " +
|
||||
"what is granted and not asked for or asked for and not granted, and whether the kernel holds it " +
|
||||
"now. Also the exports found that are not the mesh's: a dataset's sharenfs property, a line in " +
|
||||
"/etc/exports.",
|
||||
"the subnets of this machine's local network it is exported to when the server grants it " +
|
||||
"local-network (novox/hq ADR 0341), what is granted and not asked for or asked for and not " +
|
||||
"granted, and whether the kernel holds it now. Also the exports found that are not the mesh's: a " +
|
||||
"dataset's sharenfs property, a line in /etc/exports.",
|
||||
Input: schema(map[string]string{}, nil),
|
||||
Replaces: []string{"exportfs -v", "cat /etc/exports", "zfs get sharenfs"}},
|
||||
{Name: "clients", Description: "Which machines have mounted which share now, as the NFS server " +
|
||||
@@ -55,8 +56,10 @@ func nfsServerVerbs() []Verb {
|
||||
Input: schema(map[string]string{}, nil),
|
||||
Replaces: []string{"exportfs -ra"}},
|
||||
{Name: "adopt", Description: "Take over an export a person made by hand: clear a dataset's sharenfs " +
|
||||
"property for a path the mesh's own export now serves — only when that export is live. Without " +
|
||||
"confirm, says what it would do and changes nothing.",
|
||||
"property for a path the mesh's own export now serves — only when that export is live and covers " +
|
||||
"every client the property exported to: for a property exporting to the local network, the " +
|
||||
"mesh's local-network export of the path (novox/hq ADR 0341). Without confirm, says what it " +
|
||||
"would do and changes nothing.",
|
||||
Input: schema(map[string]string{
|
||||
"path": "the shared path whose hand-made export is taken over",
|
||||
"confirm": "\"true\": change it (needs why); anything else is a dry run",
|
||||
|
||||
@@ -0,0 +1,53 @@
|
||||
package catalogue
|
||||
|
||||
// A machine's SMB shares, served to the devices on its own network that are not nodes (novox/hq
|
||||
// ADR 0341).
|
||||
//
|
||||
// **One holder per machine.** Two modules writing one machine's Samba configuration is the conflict a
|
||||
// seat exists to refuse, so the role is a node seat. It delivers nothing: its clients are devices that
|
||||
// are not nodes, and a node that wants the same files mounts the NFS share (ADR 0263), so no provision
|
||||
// is answered through it.
|
||||
//
|
||||
// **The data is the operator's** (ADR 0051). The holder never creates, chowns or removes anything under
|
||||
// a shared path, and every client acts as the shared folder's owner. Its verbs read, and the one that
|
||||
// takes over the configuration a person wrote by hand does it only on a person's word, keeping a dated
|
||||
// copy of what it replaces.
|
||||
|
||||
// SMBServerSeat is the role of the machine that shares folders over SMB with its local network
|
||||
// (novox/hq ADR 0341).
|
||||
const SMBServerSeat = "node-smb-server"
|
||||
|
||||
// smbServerVerbs is the contract every holder of node-smb-server serves (novox/hq ADR 0341).
|
||||
func smbServerVerbs() []Verb {
|
||||
return []Verb{
|
||||
{Name: "shares", Description: "Every SMB share this machine serves: its name, its path, read-write " +
|
||||
"or read-only, the owner every client acts as (uid and gid), the logins allowed and whether each " +
|
||||
"login's password was given or is kept as found, and whether the service serves it now. Also " +
|
||||
"whether the configuration is the mesh's or still the hand-written one, and each hand-written " +
|
||||
"share with whether the settings name it. A password is never shown.",
|
||||
Input: schema(map[string]string{}, nil),
|
||||
Replaces: []string{"testparm -s", "cat /etc/samba/smb.conf", "pdbedit -L"}},
|
||||
{Name: "sessions", Description: "Which devices are connected to which share now, with the login and " +
|
||||
"the protocol version each uses, as the SMB service knows them.",
|
||||
Input: schema(map[string]string{}, nil),
|
||||
Replaces: []string{"smbstatus"}},
|
||||
{Name: "test", Description: "Whether this machine serves one share now and whether its SMB service " +
|
||||
"is up and listening on 445: what a device on the local network is answered.",
|
||||
Input: schema(map[string]string{"share": "the share, by its name"}, []string{"share"}),
|
||||
Replaces: []string{"smbclient -L"}},
|
||||
{Name: "reload", Description: "Have the SMB service read its configuration again now (smbcontrol " +
|
||||
"reload-config) and answer the shares as it then serves them. The module's own process writes the " +
|
||||
"configuration; this is for after a change made outside it. Changes no shared path.",
|
||||
Input: schema(map[string]string{}, nil),
|
||||
Replaces: []string{"smbcontrol smbd reload-config", "systemctl reload smb"}},
|
||||
{Name: "adopt", Description: "Take over the SMB configuration a person wrote by hand: keep a dated " +
|
||||
"copy of it beside it and write the mesh's own in its place — only when every hand-written share " +
|
||||
"has its counterpart in the settings, so no share disappears. Without confirm, says what it would " +
|
||||
"do and changes nothing: each hand-written share beside the mesh's rendering of it.",
|
||||
Input: schema(map[string]string{
|
||||
"confirm": "\"true\": change it (needs why); anything else is a dry run",
|
||||
"why": "why, for the record",
|
||||
}, nil, "confirm"),
|
||||
Replaces: []string{"edit /etc/samba/smb.conf"}},
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
package catalogue
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
// Defends novox/hq ADR 0341: a machine's SMB shares are one node seat, node-smb-server, with its verbs
|
||||
// required of every holder, delivering nothing — its clients are devices that are not nodes.
|
||||
|
||||
func TestTheSMBServerIsANodeSeatWithItsVerbs(t *testing.T) {
|
||||
s, ok := SeatNamed(SMBServerSeat)
|
||||
if !ok {
|
||||
t.Fatalf("%s is not in the mesh's set", SMBServerSeat)
|
||||
}
|
||||
if s.Scope != ScopeNode || s.Decision != "novox/hq ADR 0341" || s.Delivers != "" || s.Replicated {
|
||||
t.Errorf("%s is %+v; a node seat under ADR 0341 that delivers nothing", SMBServerSeat, s)
|
||||
}
|
||||
var got []string
|
||||
for _, v := range s.Serves {
|
||||
got = append(got, v.Name)
|
||||
if v.Optional {
|
||||
t.Errorf("%s.%s is optional; its first holder serves it", SMBServerSeat, v.Name)
|
||||
}
|
||||
if v.Description == "" || v.Input["type"] != "object" || len(v.Replaces) == 0 {
|
||||
t.Errorf("%s.%s has no description, no object schema or says it replaces nothing", SMBServerSeat, v.Name)
|
||||
}
|
||||
}
|
||||
if strings.Join(got, " ") != "shares sessions test reload adopt" {
|
||||
t.Errorf("%s serves %v", SMBServerSeat, got)
|
||||
}
|
||||
}
|
||||
|
||||
// Taking over the hand-written configuration is a person's act (ADR 0341 clause 7): a dry run unless the
|
||||
// string switch says "true", and it says it keeps a dated copy and refuses to drop a share.
|
||||
func TestTheSMBAdoptIsADryRunUnlessConfirmed(t *testing.T) {
|
||||
s, _ := SeatNamed(SMBServerSeat)
|
||||
for _, v := range s.Serves {
|
||||
if v.Name != "adopt" {
|
||||
continue
|
||||
}
|
||||
props, _ := v.Input["properties"].(map[string]any)
|
||||
confirm, _ := props["confirm"].(map[string]any)
|
||||
if confirm == nil || confirm["enum"] == nil || confirm["type"] != "string" {
|
||||
t.Errorf("adopt has no string confirm switch: %v", v.Input)
|
||||
}
|
||||
for _, says := range []string{"Without confirm, says what it would do and changes nothing", "dated copy", "no share disappears"} {
|
||||
if !strings.Contains(v.Description, says) {
|
||||
t.Errorf("adopt does not say %q: %s", says, v.Description)
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
t.Error("node-smb-server has no adopt")
|
||||
}
|
||||
|
||||
// A holder serving every verb holds the seat; a verb too many, one too few or the mesh's scope is refused,
|
||||
// as the catalogue's smb-server module claims it.
|
||||
func TestAHolderOfTheSMBSeatServesEveryVerbAndNothingElse(t *testing.T) {
|
||||
seat, _ := SeatNamed(SMBServerSeat)
|
||||
verbs := []string{"shares", "sessions", "test", "reload", "adopt"}
|
||||
holder := Manifest{Module: "smb-server", Version: "1",
|
||||
Claims: []Claim{{Name: SMBServerSeat, Scope: ScopeNode, Serves: verbs}}}
|
||||
if err := CanHold(holder, seat); err != nil {
|
||||
t.Errorf("smb-server serving every verb is refused: %v", err)
|
||||
}
|
||||
short := holder
|
||||
short.Claims = []Claim{{Name: SMBServerSeat, Scope: ScopeNode, Serves: verbs[:4]}}
|
||||
if err := CanHold(short, seat); err == nil || !strings.Contains(err.Error(), "adopt") {
|
||||
t.Errorf("leaving adopt out was accepted: %v", err)
|
||||
}
|
||||
mesh := holder
|
||||
mesh.Claims = []Claim{{Name: SMBServerSeat, Scope: ScopeMesh, Serves: verbs}}
|
||||
if err := CanHold(mesh, seat); err == nil {
|
||||
t.Error("claiming a node seat at the mesh's scope was accepted")
|
||||
}
|
||||
}
|
||||
|
||||
// node-nfs-server's adopt clears sharenfs only once the mesh's export covers every client the property
|
||||
// exported to, the local network included (ADR 0341 clause 10), and exports names the local-network grant.
|
||||
func TestTheNFSVerbsSayTheLocalNetworkGrant(t *testing.T) {
|
||||
s, _ := SeatNamed(NFSServerSeat)
|
||||
for _, v := range s.Serves {
|
||||
switch v.Name {
|
||||
case "adopt":
|
||||
if !strings.Contains(v.Description, "covers every client the property exported to") {
|
||||
t.Errorf("nfs adopt does not wait for the export to cover every client: %s", v.Description)
|
||||
}
|
||||
case "exports":
|
||||
if !strings.Contains(v.Description, "local-network") {
|
||||
t.Errorf("nfs exports does not say the local-network grant: %s", v.Description)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -217,16 +217,14 @@ var ControllerVerbs = []Verb{
|
||||
Input: schema(map[string]string{"node": "the machine's name", "provision": "the provision"}, []string{"node", "provision"})},
|
||||
{Name: "push", Description: "Send one machine everything it should be. With no machine named it is a push of the " +
|
||||
"WHOLE mesh — every machine that is behind — and the answer says so first; behind says that outright. " +
|
||||
"Answers at once that it is running, with a call id: `calls` with that id says what it sent and, for a " +
|
||||
"machine named, how that machine applied it — applied, refused with its reason, or each failed resource — " +
|
||||
"once it reports within wait (a push can reload the bus, which then refuses any answer still to come). A push by hand is a repair, " +
|
||||
"Answers at once that it is running, with a call id: `calls` with that id says what it sent " +
|
||||
"(a push can reload the bus, which then refuses any answer still to come). A push by hand is a repair, " +
|
||||
"and says why: recorded in the hand-act log (novox/hq to-be 45 §7). A machine whose push would give a " +
|
||||
"running module's data another directory is held and named, the others sent (novox/hq ADR 0217): read " +
|
||||
"`plan` with diff, and name the machine with move to send it.",
|
||||
Input: schema(map[string]string{
|
||||
"node": "the machine's name; without it, every machine that is behind",
|
||||
"move": "with node: the modules whose data may move with this push, comma-separated (optional)",
|
||||
"wait": "with node: how long the call waits for the machine to report how it applied what it was sent, as \"90s\" or \"2m\"; \"0\" waits for nothing; without it, the controller's setting push-wait (optional)",
|
||||
"behind": "\"true\": every machine that is behind, the whole mesh — the same as naming none, said outright; not with node",
|
||||
"why": "why this is pushed by hand: recorded in the hand-act log",
|
||||
"cause": "the cause in a word, or a condition's kind — the word a second push for the same reason uses (optional)",
|
||||
|
||||
@@ -58,42 +58,7 @@ func (i *Inventory) Dependencies(ctx context.Context) ([]Edge, error) {
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
held, err := i.Held(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return dependenciesWith(entries, against, held), nil
|
||||
}
|
||||
|
||||
// packagesHeld is, by package name, the module whose artifact the mesh holds as that package: a
|
||||
// `package` artifact's reference is `<name>@<version>` (the builder's publishPackage), never an
|
||||
// artifact-store reference, so a build that stood on it recorded the package's name and version.
|
||||
func packagesHeld(held map[string]string) map[string]string {
|
||||
out := map[string]string{}
|
||||
for key, reference := range held {
|
||||
module, _, ok := strings.Cut(key, "/")
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
if name := packageName(reference); name != "" {
|
||||
out[name] = module
|
||||
}
|
||||
}
|
||||
return out
|
||||
}
|
||||
|
||||
// packageName is the name of a `<name>@<version>` package reference, or "" for anything else: a
|
||||
// kept or pinned image (`…@sha256:…`), a URL, or a reference with no version.
|
||||
func packageName(reference string) string {
|
||||
if strings.HasPrefix(reference, catalogue.ArtifactStoreScheme) || strings.Contains(reference, "@sha256:") ||
|
||||
strings.Contains(reference, "://") {
|
||||
return ""
|
||||
}
|
||||
at := strings.LastIndex(reference, "@")
|
||||
if at <= 0 || at == len(reference)-1 {
|
||||
return ""
|
||||
}
|
||||
return reference[:at]
|
||||
return dependenciesOf(entries, against, nil), nil
|
||||
}
|
||||
|
||||
// dependenciesOf is Dependencies over what was read, so a test can hand it a catalogue.
|
||||
@@ -101,20 +66,6 @@ func packageName(reference string) string {
|
||||
// `read` draws no edge (novox/hq ADR 0267 rule 4): what a build read moves it through its build source, in
|
||||
// the planner, never through the relation.
|
||||
func dependenciesOf(entries []Entry, against map[string][]string, _ map[string][]ReadRepository) []Edge {
|
||||
return dependenciesWith(entries, against, nil)
|
||||
}
|
||||
|
||||
// dependenciesWith is the relation with the artifacts the mesh holds, "<module>/<artifact>" to its
|
||||
// reference (Held), so a package a build stood on is read as its module's.
|
||||
//
|
||||
// **A built manifest carries no `build`** (catalogue.Resolve drops it), so what a module declared it
|
||||
// is built on is read from what is kept of it once it is built (novox/hq issue 614): the bases its
|
||||
// newest build was handed (`against`) — an artifact-store reference, or a package's `<name>@<version>`
|
||||
// — and the language of every bundle it compiled (`Bundles`). Read only from records the mesh already
|
||||
// keeps, so it holds for every module built before it, and a controller rolled back to one without it
|
||||
// reads the same records as before.
|
||||
func dependenciesWith(entries []Entry, against map[string][]string, held map[string]string) []Edge {
|
||||
packages := packagesHeld(held)
|
||||
known := map[string]bool{}
|
||||
var builders []string
|
||||
for _, e := range entries {
|
||||
@@ -160,13 +111,6 @@ func dependenciesWith(entries []Entry, against map[string][]string, held map[str
|
||||
}
|
||||
}
|
||||
}
|
||||
// **And once it is built**, from the bundles its resolved manifest keeps (novox/hq issue 614): the
|
||||
// `build` it was declared with is gone by then, and a toolchain that moved rebuilt none of them.
|
||||
for _, b := range e.Manifest.Bundles {
|
||||
if chain, err := builder.ToolchainFor(b.Language); err == nil {
|
||||
add(name, chain.Base, EdgeStandsOn)
|
||||
}
|
||||
}
|
||||
for _, ref := range against[name] {
|
||||
if rest, ok := strings.CutPrefix(ref, catalogue.ArtifactStoreScheme); ok {
|
||||
// A copy of an upstream image is no module's artifact (novox/hq ADR 0257): its
|
||||
@@ -177,13 +121,6 @@ func dependenciesWith(entries []Entry, against map[string][]string, held map[str
|
||||
if base, _, found := strings.Cut(rest, "/"); found {
|
||||
add(name, base, EdgeStandsOn)
|
||||
}
|
||||
continue
|
||||
}
|
||||
// A package base (`build.on` naming a module's `package` artifact) is recorded as the
|
||||
// package's name and version (novox/hq issue 614): the module that publishes that package
|
||||
// is what it stood on, whichever version the mesh holds now.
|
||||
if base, ok := packages[packageName(ref)]; ok {
|
||||
add(name, base, EdgeStandsOn)
|
||||
}
|
||||
}
|
||||
if e.Source.Repository != "" {
|
||||
|
||||
@@ -1,7 +1,6 @@
|
||||
package inventory
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
@@ -175,74 +174,3 @@ func TestACopyOfAnUpstreamImageIsNoEdge(t *testing.T) {
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// **A built module keeps its build edges** (novox/hq issue 614). A manifest the mesh registers from a
|
||||
// build carries no `build` (catalogue.Resolve drops it), so mesh-tools' `build.on` naming mesh-sdk's
|
||||
// `lib` package and a provider's TypeScript bundle drew no edge once built, and a new SDK rebuilt
|
||||
// neither. The package base is read from what the build was handed (`@novox/mesh-sdk@0.1.13`, the
|
||||
// package's name whichever version the mesh holds now), the toolchain from the bundles it keeps.
|
||||
func TestABuiltModuleKeepsItsBuildEdges(t *testing.T) {
|
||||
built := func(name string, bundles ...catalogue.Bundle) Entry {
|
||||
return Entry{Manifest: catalogue.Manifest{Module: name, Bundles: bundles},
|
||||
Source: Source{Repository: "http://forge/novox/" + name + ".git"}}
|
||||
}
|
||||
entries := []Entry{
|
||||
built("mesh-sdk"),
|
||||
built("mesh-tools"),
|
||||
built("mesh-tools-go"),
|
||||
built("minio", catalogue.Bundle{Name: "code", Language: "typescript"}),
|
||||
built("umami", catalogue.Bundle{Name: "code", Language: "TypeScript"}),
|
||||
built("dnsmasq", catalogue.Bundle{Name: "tools", Language: "go"}),
|
||||
built("plain"),
|
||||
}
|
||||
against := map[string][]string{
|
||||
"mesh-tools": {"@novox/mesh-sdk@0.1.13",
|
||||
catalogue.ArtifactStoreScheme + "upstream/docker.io/library/node@sha256:" + strings.Repeat("0", 64)},
|
||||
// A package nobody in the mesh publishes is no edge.
|
||||
"plain": {"left-pad@1.3.0"},
|
||||
}
|
||||
held := map[string]string{
|
||||
"mesh-sdk/lib": "@novox/mesh-sdk@0.1.14",
|
||||
"mesh-tools/runtime": catalogue.ArtifactStoreScheme + "mesh-tools/runtime@sha256:" + strings.Repeat("1", 64),
|
||||
}
|
||||
got := dependenciesWith(entries, against, held)
|
||||
has := func(from, to string) bool {
|
||||
for _, e := range got {
|
||||
if e.From == from && e.To == to && e.Kind == EdgeStandsOn {
|
||||
return true
|
||||
}
|
||||
}
|
||||
return false
|
||||
}
|
||||
for _, want := range [][2]string{
|
||||
{"mesh-tools", "mesh-sdk"},
|
||||
{"minio", "mesh-tools"},
|
||||
{"umami", "mesh-tools"},
|
||||
{"dnsmasq", "mesh-tools-go"},
|
||||
} {
|
||||
if !has(want[0], want[1]) {
|
||||
t.Errorf("no %s stands-on %s: %+v", want[0], want[1], got)
|
||||
}
|
||||
}
|
||||
for _, e := range got {
|
||||
if e.From == "plain" && e.Kind != EdgeBuiltBy {
|
||||
t.Errorf("an unknown package drew an edge: %+v", e)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestAPackageNameIsReadOnlyFromAPackageReference(t *testing.T) {
|
||||
for ref, want := range map[string]string{
|
||||
"@novox/mesh-sdk@0.1.14": "@novox/mesh-sdk",
|
||||
"left-pad@1.3.0": "left-pad",
|
||||
"@novox/mesh-sdk": "",
|
||||
"novox.internal:5100/mesh-tools/build@sha256:" + strings.Repeat("0", 64): "",
|
||||
catalogue.ArtifactStoreScheme + "mesh-tools/build@sha256:0": "",
|
||||
"http://store/v2/x/blobs/sha256:0": "",
|
||||
"": "",
|
||||
} {
|
||||
if got := packageName(ref); got != want {
|
||||
t.Errorf("packageName(%q) = %q, want %q", ref, got, want)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -44,13 +44,7 @@ type Wait struct {
|
||||
Part string `json:"part"`
|
||||
Secret string `json:"secret,omitempty"`
|
||||
Setting string `json:"setting,omitempty"`
|
||||
// Provision is a provision the module requires whose credential only a person can give and nobody gave yet
|
||||
// (novox/hq ADR 0337 §5): a wait names exactly one of Secret, Setting or Provision.
|
||||
Provision string `json:"provision,omitempty"`
|
||||
What string `json:"what"`
|
||||
// Act is the line that gives a provision's credential, filled by the controller when it excuses the wait
|
||||
// (ADR 0337 §7); never said by a machine.
|
||||
Act string `json:"act,omitempty"`
|
||||
What string `json:"what"`
|
||||
}
|
||||
|
||||
// NodeHealth is a machine's newest statement, as kept.
|
||||
|
||||
@@ -36,16 +36,7 @@ type MadeOf struct {
|
||||
BootedAt *time.Time `json:"booted_at"`
|
||||
Timezone string `json:"timezone"`
|
||||
Filesystems []MountedFilesystem `json:"filesystems"`
|
||||
// Networks is every network the machine is directly attached to on a link facing outside it, as
|
||||
// link and network (novox/hq ADR 0340 §7): what a port reached from `local-network` resolves from.
|
||||
Networks []AttachedNetwork `json:"networks"`
|
||||
Unknown map[string]string `json:"unknown"`
|
||||
}
|
||||
|
||||
// AttachedNetwork is one network a machine said it is attached to, and the link it is on.
|
||||
type AttachedNetwork struct {
|
||||
Link string `json:"link"`
|
||||
Network string `json:"network"`
|
||||
Unknown map[string]string `json:"unknown"`
|
||||
}
|
||||
|
||||
// MountedFilesystem is one local filesystem a machine has mounted.
|
||||
|
||||
@@ -40,18 +40,3 @@ func TestAProfileWithoutTheFactsIsAnOlderNodeEngineNotNothing(t *testing.T) {
|
||||
t.Error("a node that never reported read as having reported")
|
||||
}
|
||||
}
|
||||
|
||||
// The networks a machine is attached to (novox/hq ADR 0340 §7), in the node-engine's words: what a port
|
||||
// reached from `local-network` resolves from.
|
||||
func TestAMachinesAttachedNetworksAreRead(t *testing.T) {
|
||||
a, had, err := machineFrom([]byte(`{"architecture":"amd64","kernel":"linux",
|
||||
"machine":{"observed_at":"2026-10-13T09:00:00Z",
|
||||
"networks":[{"link":"eth0","network":"192.168.1.0/24"},{"link":"eth1","network":"203.0.113.0/24"}]}}`))
|
||||
if err != nil || !had || a.Machine == nil {
|
||||
t.Fatalf("%+v had %v err %v", a, had, err)
|
||||
}
|
||||
n := a.Machine.Networks
|
||||
if len(n) != 2 || n[0].Link != "eth0" || n[0].Network != "192.168.1.0/24" || n[1].Network != "203.0.113.0/24" {
|
||||
t.Fatalf("networks read as %+v", n)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,252 +0,0 @@
|
||||
package inventory
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"sort"
|
||||
|
||||
"github.com/jackc/pgx/v5"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
"github.com/novox/mesh-controller/internal/secrets"
|
||||
)
|
||||
|
||||
// A provision whose credential only a person outside the mesh can give (novox/hq ADR 0337, issue 164): a Servarr
|
||||
// app's API key, an indexer's key, a downloader's password. The provider's software holds the value; the mesh can
|
||||
// neither make one that would work nor fetch it. So the mesh never makes one (§2), a person gives it once per
|
||||
// provider and it is sealed to every consumer of that provider (§3), and until then a consumer holds no credential
|
||||
// for it and is told so (§4), and the rest of it runs.
|
||||
|
||||
// NotGivenError is a pair credential only a person can give, which no person gave for this pair under the keys its
|
||||
// two ends have now: the consumer receives no credential for it, and waits (ADR 0337 §4, §8). It is not a fault of
|
||||
// the machine, so the plan does not refuse the machine for it.
|
||||
type NotGivenError struct {
|
||||
Provision, Consumer, ConsumerModule, Provider, ProviderModule, Local string
|
||||
// Own is set when the credential is the provider's own secret issued outside (ADR 0158, ADR 0228), and names it.
|
||||
Own string
|
||||
// Why is why no value is held, in words that never carry one.
|
||||
Why string
|
||||
}
|
||||
|
||||
func (e *NotGivenError) Error() string {
|
||||
if e.Own != "" {
|
||||
return fmt.Sprintf("%s on %s holds no %s from %s: %s; give it with `secret accept %s %s %s`",
|
||||
e.ConsumerModule, e.Consumer, e.Provision, e.Provider, e.Why, e.Provider, e.ProviderModule, e.Own)
|
||||
}
|
||||
return fmt.Sprintf("%s on %s holds no %s from %s: %s; it is issued outside the mesh and given with `%s`",
|
||||
e.ConsumerModule, e.Consumer, e.Provision, e.Provider, e.Why, acceptLine(e.Provider, e.ProviderModule, e.Provision))
|
||||
}
|
||||
|
||||
// IsNotGiven is whether an error is a credential only a person gives, not given yet.
|
||||
func IsNotGiven(err error) bool {
|
||||
var ng *NotGivenError
|
||||
return errors.As(err, &ng)
|
||||
}
|
||||
|
||||
// acceptLine is the one line that gives a provision's credential issued outside, for every consumer of a provider.
|
||||
func acceptLine(provider, providerModule, provision string) string {
|
||||
if providerModule == "" {
|
||||
providerModule = "<provider module>"
|
||||
}
|
||||
return fmt.Sprintf("secret accept %s %s %s", provider, providerModule, provision)
|
||||
}
|
||||
|
||||
// AcceptLine is acceptLine, for the controller's words.
|
||||
func AcceptLine(provider, providerModule, provision string) string {
|
||||
return acceptLine(provider, providerModule, provision)
|
||||
}
|
||||
|
||||
// issuedOutside is whether a module in the catalogue offers the provision with a credential issued outside the
|
||||
// mesh, and which.
|
||||
func (i *Inventory) issuedOutside(ctx context.Context, provision string) (string, bool, error) {
|
||||
shelf, err := i.Catalogue(ctx)
|
||||
if err != nil {
|
||||
return "", false, err
|
||||
}
|
||||
module, outside := catalogue.OffersIssuedOutside(shelf, provision)
|
||||
return module, outside, nil
|
||||
}
|
||||
|
||||
// ownIssuedOutside is whether a provider's own secret says only an outside party issues it (ADR 0228).
|
||||
func (i *Inventory) ownIssuedOutside(ctx context.Context, providerModule, own string) (string, bool, error) {
|
||||
if providerModule == "" {
|
||||
return own, false, nil
|
||||
}
|
||||
m, err := i.declared(ctx, providerModule)
|
||||
if err != nil {
|
||||
return own, false, err
|
||||
}
|
||||
return own, m.OwnSecrets[own].IssuedBy == catalogue.IssuedOutside, nil
|
||||
}
|
||||
|
||||
// GivenPairSecret is the credential of a pair whose provision is issued outside the mesh, as a person gave it, and
|
||||
// never one the mesh makes (ADR 0337 §2, §4). It writes nothing. A value is answered only when a person gave it
|
||||
// (`accepted`) and it is sealed to the keys both ends have now; otherwise a NotGivenError says why — never given, or
|
||||
// given under a key one end no longer has (§8), or a value the mesh made before the rule, which is not given and
|
||||
// never delivered again (§2).
|
||||
func (i *Inventory) GivenPairSecret(ctx context.Context, name, consumer, consumerModule, provider, providerModule,
|
||||
local string) (Secret, error) {
|
||||
consumerKey, err := i.SealingKeyOf(ctx, consumer)
|
||||
if err != nil {
|
||||
return Secret{}, err
|
||||
}
|
||||
providerKey, err := i.SealingKeyOf(ctx, provider)
|
||||
if err != nil {
|
||||
return Secret{}, err
|
||||
}
|
||||
consumerNode, err := i.NodeByName(ctx, consumer)
|
||||
if err != nil {
|
||||
return Secret{}, err
|
||||
}
|
||||
providerNode, err := i.NodeByName(ctx, provider)
|
||||
if err != nil {
|
||||
return Secret{}, err
|
||||
}
|
||||
notGiven := func(why string) (Secret, error) {
|
||||
return Secret{}, &NotGivenError{Provision: name, Consumer: consumer, ConsumerModule: consumerModule,
|
||||
Provider: provider, ProviderModule: providerModule, Local: local, Why: why}
|
||||
}
|
||||
var held Secret
|
||||
err = i.store.Pool().QueryRow(ctx,
|
||||
`select for_consumer, for_provider, consumer_key, provider_key, origin from secret
|
||||
where name = $1 and consumer = $2 and consumer_module = $3 and provider = $4 and local = $5`,
|
||||
name, consumerNode.ID, consumerModule, providerNode.ID, local).
|
||||
Scan(&held.ForConsumer, &held.ForProvider, &held.ConsumerKey, &held.ProviderKey, &held.Origin)
|
||||
switch {
|
||||
case errors.Is(err, pgx.ErrNoRows):
|
||||
return notGiven("nobody gave it")
|
||||
case err != nil:
|
||||
return Secret{}, err
|
||||
case held.Origin != OriginAccepted:
|
||||
return notGiven("the value held was made by the mesh, which " + providerModule + "'s software would refuse")
|
||||
case consumerKey == "" || providerKey == "" || held.ConsumerKey != consumerKey || held.ProviderKey != providerKey:
|
||||
return notGiven("it was given under a sealing key one end no longer has")
|
||||
}
|
||||
held.Name, held.Consumer, held.Provider = name, consumer, provider
|
||||
held.ConsumerModule, held.Local = consumerModule, local
|
||||
return held, nil
|
||||
}
|
||||
|
||||
// PairEnd is one consumer of a provision from one provider: the machine, the module there and its local name.
|
||||
type PairEnd struct {
|
||||
Consumer, ConsumerModule, Local string
|
||||
}
|
||||
|
||||
// ProvisionAccepted is what one accept for a provider sealed (ADR 0337 §3): the consumers it reached, those it could
|
||||
// not (no sealing key on their machine), and the machines to send.
|
||||
type ProvisionAccepted struct {
|
||||
Sealed, Unsealable []PairEnd
|
||||
Machines []string
|
||||
}
|
||||
|
||||
// AcceptSecretForProvision seals one value a person gave for a provision issued outside the mesh to the provider's
|
||||
// machine, to every consumer named, and to the operator, in one act under one generation, each row `accepted`
|
||||
// (ADR 0337 §3, issue 165); the plaintext is not kept. The consumers are every one that binds the provision from
|
||||
// this provider now, which the caller finds by resolving every machine. A consumer whose machine has no sealing key
|
||||
// is not sealed to, and said.
|
||||
func (i *Inventory) AcceptSecretForProvision(ctx context.Context, provision, provider, providerModule, value string,
|
||||
consumers []PairEnd) (ProvisionAccepted, error) {
|
||||
m, err := i.declared(ctx, providerModule)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
if !m.IssuedOutsideOf(provision) {
|
||||
return ProvisionAccepted{}, fmt.Errorf("%s does not offer %q with a credential issued outside the mesh "+
|
||||
"(\"credential\": {\"issued-by\": \"outside\"}, ADR 0337), so its consumers' credentials are not given "+
|
||||
"once for the provider", providerModule, provision)
|
||||
}
|
||||
if value == "" {
|
||||
return ProvisionAccepted{}, errors.New("there is nothing to seal")
|
||||
}
|
||||
providerNode, err := i.NodeByName(ctx, provider)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
providerKey, err := i.SealingKeyOf(ctx, provider)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
if providerKey == "" {
|
||||
return ProvisionAccepted{}, fmt.Errorf("%s has no sealing key, so nothing can be sealed to it; a node joins to get one", provider)
|
||||
}
|
||||
forOperator, operatorKey, err := i.operatorSeal(ctx, value)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
generation := secrets.Stamp()
|
||||
var out ProvisionAccepted
|
||||
machines := map[string]bool{provider: true}
|
||||
tx, err := i.store.Pool().Begin(ctx)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
defer func() { _ = tx.Rollback(ctx) }()
|
||||
for _, c := range consumers {
|
||||
consumerNode, err := i.NodeByName(ctx, c.Consumer)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
consumerKey, err := i.SealingKeyOf(ctx, c.Consumer)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
if consumerKey == "" {
|
||||
out.Unsealable = append(out.Unsealable, c)
|
||||
continue
|
||||
}
|
||||
sealed, err := secrets.Accept(value, consumerKey, providerKey)
|
||||
if err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
if _, err := tx.Exec(ctx,
|
||||
`insert into secret (name, consumer, consumer_module, provider, for_consumer, for_provider,
|
||||
consumer_key, provider_key, operator_sealed, operator_key, origin, local, generation)
|
||||
values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)
|
||||
on conflict (name, local, consumer, consumer_module, provider) do update set
|
||||
for_consumer = excluded.for_consumer, for_provider = excluded.for_provider,
|
||||
consumer_key = excluded.consumer_key, provider_key = excluded.provider_key,
|
||||
created_at = now(), origin = excluded.origin, generation = excluded.generation,
|
||||
operator_sealed = excluded.operator_sealed, operator_key = excluded.operator_key`,
|
||||
provision, consumerNode.ID, c.ConsumerModule, providerNode.ID,
|
||||
sealed.ForConsumer, sealed.ForProvider, sealed.ConsumerKey, sealed.ProviderKey,
|
||||
forOperator, operatorKey, OriginAccepted, c.Local, generation); err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
out.Sealed = append(out.Sealed, c)
|
||||
machines[c.Consumer] = true
|
||||
}
|
||||
if err := tx.Commit(ctx); err != nil {
|
||||
return ProvisionAccepted{}, err
|
||||
}
|
||||
for n := range machines {
|
||||
out.Machines = append(out.Machines, n)
|
||||
}
|
||||
sort.Strings(out.Machines)
|
||||
return out, nil
|
||||
}
|
||||
|
||||
// GivenPairsOf is every provision a module on a machine holds a value a person gave for, sealed to the keys both
|
||||
// ends have now: what a wait for a provision's credential is checked against (ADR 0337 §6).
|
||||
func (i *Inventory) GivenPairsOf(ctx context.Context, machine, module string) (map[string]bool, error) {
|
||||
rows, err := i.store.Pool().Query(ctx,
|
||||
`select s.name
|
||||
from secret s
|
||||
join node c on c.id = s.consumer
|
||||
join node p on p.id = s.provider
|
||||
where c.name = $1 and s.consumer_module = $2 and s.origin = 'accepted'
|
||||
and s.consumer_key = c.sealing_key and s.provider_key = p.sealing_key`, machine, module)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer rows.Close()
|
||||
out := map[string]bool{}
|
||||
for rows.Next() {
|
||||
var name string
|
||||
if err := rows.Scan(&name); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
out[name] = true
|
||||
}
|
||||
return out, rows.Err()
|
||||
}
|
||||
@@ -1,195 +0,0 @@
|
||||
package inventory
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"github.com/novox/mesh-controller/internal/catalogue"
|
||||
)
|
||||
|
||||
// outsideProvision registers a provider offering tv-api with a credential issued outside the mesh (novox/hq ADR
|
||||
// 0337 §1) and two consumers requiring it, on twoNodesWithKeys' machines.
|
||||
func outsideProvision(t *testing.T, inv *Inventory) {
|
||||
t.Helper()
|
||||
ctx := t.Context()
|
||||
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "tv", Version: "1",
|
||||
Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
|
||||
Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}}, Source{}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
for _, m := range []string{"requests", "indexer"} {
|
||||
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: m, Version: "1", Requires: []string{"tv-api"},
|
||||
Secrets: map[string]string{"tv-api": "/run/tv-api.secret"}}, Source{}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// pairRows is how many pair rows the store holds for tv-api.
|
||||
func pairRows(t *testing.T, inv *Inventory) int {
|
||||
t.Helper()
|
||||
var n int
|
||||
if err := inv.store.Pool().QueryRow(t.Context(), `select count(*) from secret where name = 'tv-api'`).Scan(&n); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return n
|
||||
}
|
||||
|
||||
// A credential only a person can give is never made (ADR 0337 §2, issue 164): not for a pair with no row, which is
|
||||
// what a newly bound consumer has, and not after a key change; a value the mesh made before the rule is not given.
|
||||
func TestACredentialIssuedOutsideIsNeverMade(t *testing.T) {
|
||||
inv, ctx := twoNodesWithKeys(t)
|
||||
outsideProvision(t, inv)
|
||||
|
||||
_, err := inv.SecretFor(ctx, "tv-api", "consumer", "requests", "provider", "")
|
||||
if !IsNotGiven(err) {
|
||||
t.Fatalf("SecretFor made or refused a credential only a person gives, rather than saying it was not given: %v", err)
|
||||
}
|
||||
if !strings.Contains(err.Error(), "secret accept provider tv tv-api") {
|
||||
t.Fatalf("not given does not name the one line that gives it: %v", err)
|
||||
}
|
||||
if n := pairRows(t, inv); n != 0 {
|
||||
t.Fatalf("the store holds %d rows for tv-api, which nobody gave", n)
|
||||
}
|
||||
if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); !IsNotGiven(err) {
|
||||
t.Fatalf("a pair nobody gave read as given: %v", err)
|
||||
}
|
||||
if n := pairRows(t, inv); n != 0 {
|
||||
t.Fatalf("reading the pair wrote %d rows", n)
|
||||
}
|
||||
|
||||
// A value the mesh made before the rule (the minted value of issue 164) is not given.
|
||||
if _, err := inv.store.Pool().Exec(ctx, `insert into secret (name, consumer, consumer_module, provider,
|
||||
for_consumer, for_provider, consumer_key, provider_key, local)
|
||||
select 'tv-api', c.id, 'indexer', p.id, 'x', 'y', c.sealing_key, p.sealing_key, ''
|
||||
from node c, node p where c.name = 'consumer' and p.name = 'provider'`); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "indexer", "provider", "tv", ""); !IsNotGiven(err) ||
|
||||
!strings.Contains(err.Error(), "made by the mesh") {
|
||||
t.Fatalf("a value the mesh made before the rule read as given: %v", err)
|
||||
}
|
||||
|
||||
// Given, then a key changes: not given, and nothing is made in its place (ADR 0337 §8).
|
||||
if _, err := inv.AcceptSecretForProvision(ctx, "tv-api", "provider", "tv", "the app's key",
|
||||
[]PairEnd{{Consumer: "consumer", ConsumerModule: "requests"}}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); err != nil {
|
||||
t.Fatalf("the value given does not read as given: %v", err)
|
||||
}
|
||||
cn, _ := inv.NodeByName(ctx, "consumer")
|
||||
key, _ := aSealingKey(t)
|
||||
if err := inv.RecordSealingKey(ctx, cn.ID, key); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := inv.GivenPairSecret(ctx, "tv-api", "consumer", "requests", "provider", "tv", ""); !IsNotGiven(err) ||
|
||||
!strings.Contains(err.Error(), "sealing key") {
|
||||
t.Fatalf("a value given under a key the consumer no longer has read as given: %v", err)
|
||||
}
|
||||
var origin string
|
||||
if err := inv.store.Pool().QueryRow(ctx, `select origin from secret where name = 'tv-api' and consumer_module = 'requests'`).
|
||||
Scan(&origin); err != nil || origin != OriginAccepted {
|
||||
t.Fatalf("the given row was replaced (origin %q, %v)", origin, err)
|
||||
}
|
||||
|
||||
// Rotate refuses it, naming the accept (ADR 0337 §9).
|
||||
err = inv.RotateSecret(ctx, "tv-api", "consumer", "requests", "provider", "")
|
||||
if err == nil || !strings.Contains(err.Error(), "secret accept provider tv tv-api") {
|
||||
t.Fatalf("rotate of a credential issued outside was not refused naming the accept: %v", err)
|
||||
}
|
||||
}
|
||||
|
||||
// One accept for a provider is sealed to every consumer named, to the provider and to the operator, under one
|
||||
// generation, each row accepted (ADR 0337 §3, issue 165); a consumer with no sealing key is said, not sealed to.
|
||||
func TestOneAcceptForAProviderIsSealedToEveryConsumer(t *testing.T) {
|
||||
inv, ctx := twoNodesWithKeys(t)
|
||||
outsideProvision(t, inv)
|
||||
operatorKey, operatorOpens := aSealingKey(t)
|
||||
if _, err := inv.SetOperatorKey(ctx, operatorKey); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
consumerKey, consumerOpens := aSealingKey(t)
|
||||
cn, _ := inv.NodeByName(ctx, "consumer")
|
||||
if err := inv.RecordSealingKey(ctx, cn.ID, consumerKey); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if _, err := inv.AddNode(ctx, "keyless"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
accepted, err := inv.AcceptSecretForProvision(ctx, "tv-api", "provider", "tv", "the app's key", []PairEnd{
|
||||
{Consumer: "consumer", ConsumerModule: "requests"}, {Consumer: "consumer", ConsumerModule: "indexer"},
|
||||
{Consumer: "keyless", ConsumerModule: "requests"}})
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if len(accepted.Sealed) != 2 || len(accepted.Unsealable) != 1 || accepted.Unsealable[0].Consumer != "keyless" {
|
||||
t.Fatalf("the accept did not seal to both consumers with keys and say the keyless one: %+v", accepted)
|
||||
}
|
||||
if strings.Join(accepted.Machines, ",") != "consumer,provider" {
|
||||
t.Fatalf("the machines to send are the provider's and every consumer's sealed to: %v", accepted.Machines)
|
||||
}
|
||||
rows, err := inv.store.Pool().Query(ctx, `select consumer_module, origin, coalesce(generation, ''), for_consumer,
|
||||
coalesce(operator_sealed, '') from secret where name = 'tv-api'`)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer rows.Close()
|
||||
generations := map[string]bool{}
|
||||
seen := 0
|
||||
for rows.Next() {
|
||||
var module, origin, generation, forConsumer, forOperator string
|
||||
if err := rows.Scan(&module, &origin, &generation, &forConsumer, &forOperator); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
seen++
|
||||
if origin != OriginAccepted || generation == "" {
|
||||
t.Fatalf("%s's row is not accepted under a generation (origin %q)", module, origin)
|
||||
}
|
||||
generations[generation] = true
|
||||
if opened, ok := consumerOpens(forConsumer); !ok || string(opened) != "the app's key" {
|
||||
t.Fatalf("%s's copy does not open to the value given", module)
|
||||
}
|
||||
if opened, ok := operatorOpens(forOperator); !ok || string(opened) != "the app's key" {
|
||||
t.Fatalf("%s's operator copy does not open to the value given", module)
|
||||
}
|
||||
}
|
||||
if seen != 2 || len(generations) != 1 {
|
||||
t.Fatalf("%d rows under %d generations; want 2 under one", seen, len(generations))
|
||||
}
|
||||
given, err := inv.GivenPairsOf(ctx, "consumer", "indexer")
|
||||
if err != nil || !given["tv-api"] {
|
||||
t.Fatalf("the provision given does not read as given for indexer (%v)", err)
|
||||
}
|
||||
|
||||
// Only an offer that says so is given this way.
|
||||
if _, err := inv.AcceptSecretForProvision(ctx, "secret", "provider", "gitea", "x", nil); err == nil {
|
||||
t.Fatal("a provision not issued outside was given once for its provider")
|
||||
}
|
||||
}
|
||||
|
||||
// The provider's own secret issued outside the mesh, named as a provision's shared credential (ADR 0158, ADR 0228),
|
||||
// is never made for a consumer that binds: the consumer is told it was not given (ADR 0337 §2, §4).
|
||||
func TestASharedOwnSecretIssuedOutsideIsNeverMade(t *testing.T) {
|
||||
inv, ctx := twoNodesWithKeys(t)
|
||||
if err := inv.RegisterModule(ctx, catalogue.Manifest{Module: "downloader", Version: "1",
|
||||
OwnSecrets: catalogue.OwnSecrets{"password": {Path: "/run/password", Taken: catalogue.TakenAtStart,
|
||||
IssuedBy: catalogue.IssuedOutside}},
|
||||
Provides: []catalogue.Offer{{Name: "downloader-api", Scope: catalogue.ScopeMesh,
|
||||
Credential: &catalogue.OfferCredential{Own: "password"}}}}, Source{}); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
_, err := inv.SharedSecretFor(ctx, "downloader-api", "consumer", "gitea", "provider", "downloader", "", "password")
|
||||
if !IsNotGiven(err) {
|
||||
t.Fatalf("a shared own secret issued outside was made or refused rather than not given: %v", err)
|
||||
}
|
||||
var n int
|
||||
if err := inv.store.Pool().QueryRow(ctx, `select count(*) from module_secret where module = 'downloader'`).Scan(&n); err != nil || n != 0 {
|
||||
t.Fatalf("the mesh made %d values of an own secret issued outside (%v)", n, err)
|
||||
}
|
||||
if err := inv.remakeShared(ctx, nil, "", "downloader", "password", "", nil, "", "", ""); err == nil ||
|
||||
!strings.Contains(err.Error(), "issued outside") {
|
||||
t.Fatalf("remakeShared made a value of an own secret issued outside: %v", err)
|
||||
}
|
||||
}
|
||||
@@ -433,20 +433,6 @@ type PlanRelease struct {
|
||||
Skipped []string `json:"skipped,omitempty"`
|
||||
// By is the person who released it, empty when the mesh did.
|
||||
By string `json:"by,omitempty"`
|
||||
// Settings is set on a settings walk (novox/hq ADR 0344): not the builds waiting for a gate, but a settings
|
||||
// layer the operator approved, sent to the machines it reaches one at a time, its module judged on each.
|
||||
Settings *PlanSettings `json:"settings,omitempty"`
|
||||
}
|
||||
|
||||
// PlanSettings is what a settings walk sends (novox/hq ADR 0344): the module whose layer the operator approved, the
|
||||
// layer's scope, the ask that approved it and what changed, in words.
|
||||
type PlanSettings struct {
|
||||
Module string `json:"module"`
|
||||
// Node is the machine the layer is for, empty for the whole mesh.
|
||||
Node string `json:"node,omitempty"`
|
||||
// Ask is the proposal the operator approved, and Change what its layer changed ("~ prefs").
|
||||
Ask string `json:"ask"`
|
||||
Change string `json:"change,omitempty"`
|
||||
}
|
||||
|
||||
// The states a plan passes through.
|
||||
|
||||
@@ -104,21 +104,6 @@ func (i *Inventory) SecretFor(ctx context.Context, name, consumer, consumerModul
|
||||
consumerModule, name, provider, consumer, consumerModule, name, provider, localFlag(local))
|
||||
}
|
||||
|
||||
// **Never made where only a person can give it** (novox/hq ADR 0337 §2, issue 164): a provision whose offer
|
||||
// says `issued-by: outside` gets no value of the mesh's, which its provider's software would refuse. Asked
|
||||
// here, on the one path that makes a value, so no caller can have one made by not knowing; the plan reads
|
||||
// such a pair with GivenPairSecret, which never makes one and delivers only a value a person gave.
|
||||
why := "nobody gave it"
|
||||
if err == nil {
|
||||
why = "the value held was sealed to a key one end no longer has"
|
||||
}
|
||||
if providerModule, outside, oerr := i.issuedOutside(ctx, name); oerr != nil {
|
||||
return Secret{}, oerr
|
||||
} else if outside {
|
||||
return Secret{}, &NotGivenError{Provision: name, Consumer: consumer, ConsumerModule: consumerModule,
|
||||
Provider: provider, ProviderModule: providerModule, Local: local, Why: why}
|
||||
}
|
||||
|
||||
// And to the operator, when the mesh has one (novox/hq ADR 0085, amended): the third copy that
|
||||
// makes a vault-provided secret recoverable, and nothing the mesh can open.
|
||||
operator, err := i.OperatorKey(ctx)
|
||||
@@ -254,16 +239,6 @@ func (i *Inventory) RotateSecret(ctx context.Context, name, consumer, consumerMo
|
||||
`select origin from secret where name = $1 and consumer = $2 and consumer_module = $3
|
||||
and provider = $4 and local = $5`,
|
||||
name, consumerNode.ID, consumerModule, providerNode.ID, local).Scan(&origin)
|
||||
if providerModule, outside, oerr := i.issuedOutside(ctx, name); oerr != nil {
|
||||
return oerr
|
||||
} else if outside {
|
||||
// Only a person can give it, so only a person can give its next value (novox/hq ADR 0337 §9, ADR 0092 §7):
|
||||
// deleting the row would leave the consumer waiting for nothing new.
|
||||
return fmt.Errorf(
|
||||
"%s is issued outside the mesh: %s's software holds it and the mesh cannot make its replacement. "+
|
||||
"Give the new value with `%s`, which seals it to every consumer of %s on %s",
|
||||
name, providerModule, acceptLine(provider, providerModule, name), providerModule, provider)
|
||||
}
|
||||
if err == nil && origin == OriginAccepted {
|
||||
return fmt.Errorf(
|
||||
"%s's %q credential from %s was accepted from a person, and the mesh cannot make "+
|
||||
@@ -911,15 +886,6 @@ func (i *Inventory) SharedSecretFor(ctx context.Context, provision, consumer, co
|
||||
held.ConsumerModule, held.Local = consumerModule, local
|
||||
return held, nil
|
||||
}
|
||||
if own, outside, err := i.ownIssuedOutside(ctx, providerModule, own); err != nil {
|
||||
return Secret{}, err
|
||||
} else if outside && (ownOrigin == nil || *ownOrigin != OriginAccepted) {
|
||||
// The provider's own secret only an outside party issues, which nobody gave (ADR 0228, issue 401): the
|
||||
// mesh makes no value for it here either, and the consumer is told it was not given (ADR 0337 §4).
|
||||
return Secret{}, &NotGivenError{Provision: provision, Consumer: consumer, ConsumerModule: consumerModule,
|
||||
Provider: provider, ProviderModule: providerModule, Local: local, Own: own,
|
||||
Why: "nobody gave " + providerModule + "'s own secret " + own + ", which is issued outside the mesh"}
|
||||
}
|
||||
if ownOrigin != nil && *ownOrigin == OriginAccepted {
|
||||
return Secret{}, fmt.Errorf(
|
||||
"%s on %s needs %s from %s, whose credential is %s's own secret %q — a value given to the "+
|
||||
@@ -946,11 +912,6 @@ func (i *Inventory) remakeShared(ctx context.Context, providerID any, providerKe
|
||||
if len(provisions) == 0 {
|
||||
return fmt.Errorf("%s names no provision whose credential is its own secret %q", providerModule, own)
|
||||
}
|
||||
if m.OwnSecrets[own].IssuedBy == catalogue.IssuedOutside {
|
||||
// Never made (novox/hq ADR 0228, ADR 0337 §2): only a person can give it, with `secret accept`.
|
||||
return fmt.Errorf("%s's own secret %q is issued outside the mesh, so the mesh makes no value for it; a "+
|
||||
"person gives it with `secret accept <machine> %s %s`", providerModule, own, providerModule, own)
|
||||
}
|
||||
operator, err := i.OperatorKey(ctx)
|
||||
if err != nil {
|
||||
return err
|
||||
|
||||
@@ -577,10 +577,7 @@ type Wait struct {
|
||||
Part string `json:"part"`
|
||||
Secret string `json:"secret,omitempty"`
|
||||
Setting string `json:"setting,omitempty"`
|
||||
// Provision is a provision the module requires whose credential only a person can give and nobody gave yet
|
||||
// (novox/hq ADR 0337 §5): a wait names exactly one of Secret, Setting or Provision.
|
||||
Provision string `json:"provision,omitempty"`
|
||||
What string `json:"what"`
|
||||
What string `json:"what"`
|
||||
}
|
||||
|
||||
// ResourceHealth is one long-running resource's state.
|
||||
|
||||
+11
-56
@@ -80,57 +80,6 @@ func Check(text string, machines ...string) (Refusal, bool) {
|
||||
return Refusal{"address", "a hardware address"}, false
|
||||
case reIPv6.MatchString(text):
|
||||
return Refusal{"address", "an IPv6 address"}, false
|
||||
}
|
||||
if refusal, ok := secretShape(text); !ok {
|
||||
return refusal, false
|
||||
}
|
||||
if reWinPath.MatchString(text) {
|
||||
return Refusal{"path", "a drive path"}, false
|
||||
}
|
||||
if refusal, ok := randomRun(text); !ok {
|
||||
return refusal, false
|
||||
}
|
||||
for _, word := range strings.FieldsFunc(text, isSeparator) {
|
||||
w := strings.TrimRight(word, ".:!?")
|
||||
if isPath(w) {
|
||||
return Refusal{"path", "a file path"}, false
|
||||
}
|
||||
if isHostName(w) {
|
||||
return Refusal{"address", "a host name"}, false
|
||||
}
|
||||
}
|
||||
return Refusal{}, true
|
||||
}
|
||||
|
||||
// Secret says whether a text carries a secret's shape, the one class that leaves the mesh nowhere — the
|
||||
// messenger's CheckSecret, one for one. It is what an ask's whole words (asks.Ask.Whole, novox/hq issue 383)
|
||||
// are held to: on a channel that proves who answers, a path or an address is what the operator approves and
|
||||
// is shown; a secret never is. A path is read as one: a run with a slash in it is judged piece by piece
|
||||
// between the slashes, so "/mnt/Photos_2024/Jochen" is a path and not a random string (the review of
|
||||
// 2026-10-10); the named shapes hold whatever the run holds.
|
||||
func Secret(text string, machines ...string) (Refusal, bool) {
|
||||
text = withoutMachines(text, machines)
|
||||
if refusal, ok := secretShape(text); !ok {
|
||||
return refusal, false
|
||||
}
|
||||
return randomRunOutsidePaths(text)
|
||||
}
|
||||
|
||||
// randomRunOutsidePaths is randomRun with each run that holds a slash judged by its pieces between the slashes.
|
||||
func randomRunOutsidePaths(text string) (Refusal, bool) {
|
||||
for _, run := range reRun.FindAllString(text, -1) {
|
||||
for _, piece := range strings.Split(run, "/") {
|
||||
if len(piece) >= 20 && looksRandom(piece) {
|
||||
return Refusal{"secret", "a long random-looking string"}, false
|
||||
}
|
||||
}
|
||||
}
|
||||
return Refusal{}, true
|
||||
}
|
||||
|
||||
// secretShape is the secret shapes a pattern names.
|
||||
func secretShape(text string) (Refusal, bool) {
|
||||
switch {
|
||||
case rePEM.MatchString(text):
|
||||
return Refusal{"secret", "a key block"}, false
|
||||
case reJWT.MatchString(text):
|
||||
@@ -143,17 +92,23 @@ func secretShape(text string) (Refusal, bool) {
|
||||
return Refusal{"secret", "a value given to a secret's name"}, false
|
||||
case reHex.MatchString(text):
|
||||
return Refusal{"secret", "a long hexadecimal string"}, false
|
||||
case reWinPath.MatchString(text):
|
||||
return Refusal{"path", "a drive path"}, false
|
||||
}
|
||||
return Refusal{}, true
|
||||
}
|
||||
|
||||
// randomRun is a long unbroken run of characters spread as a random string's are.
|
||||
func randomRun(text string) (Refusal, bool) {
|
||||
for _, run := range reRun.FindAllString(text, -1) {
|
||||
if looksRandom(run) {
|
||||
return Refusal{"secret", "a long random-looking string"}, false
|
||||
}
|
||||
}
|
||||
for _, word := range strings.FieldsFunc(text, isSeparator) {
|
||||
w := strings.TrimRight(word, ".:!?")
|
||||
if isPath(w) {
|
||||
return Refusal{"path", "a file path"}, false
|
||||
}
|
||||
if isHostName(w) {
|
||||
return Refusal{"address", "a host name"}, false
|
||||
}
|
||||
}
|
||||
return Refusal{}, true
|
||||
}
|
||||
|
||||
|
||||
@@ -86,40 +86,3 @@ func TestScrubAlwaysGivesWhatMayLeave(t *testing.T) {
|
||||
t.Errorf("a text that passes was changed: %q", got)
|
||||
}
|
||||
}
|
||||
|
||||
// Secret is the one class that leaves the mesh nowhere (novox/hq issue 383): it refuses every secret's shape
|
||||
// Check refuses, and nothing Check refuses as an address or a path — those an ask's whole words may carry.
|
||||
func TestSecretRefusesOnlyASecretsShape(t *testing.T) {
|
||||
for _, text := range []string{
|
||||
"-----BEGIN RSA PRIVATE KEY-----",
|
||||
"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.abc",
|
||||
"123456789:ABCdefGHIjklMNOpqrSTUvwxYZ0123456789ab",
|
||||
"ghp_abcdefghijklmnopqrstuvwxyz0123456789",
|
||||
"password=hunter2",
|
||||
"0123456789abcdef0123456789abcdef",
|
||||
"a key xK9mQ2vL8pR4tW7yB3nF6hJ1dG5sA0zC",
|
||||
} {
|
||||
r, ok := Secret(text)
|
||||
if ok || r.Class != "secret" {
|
||||
t.Errorf("not refused as a secret: %q (%s)", text, r)
|
||||
}
|
||||
}
|
||||
for _, text := range []string{
|
||||
"recalbox=smb://nas.lan/recalbox@/mnt/recalbox:ro",
|
||||
"library=/mnt/library",
|
||||
"photos=/mnt/Photos_2024/Jochen",
|
||||
"games=smb://nas.lan/Recalbox_Games2024",
|
||||
"/srv/media/Series_Archive/Season01",
|
||||
"10.77.0.9:53",
|
||||
"jochen@example.com",
|
||||
"C:\\Users\\jo",
|
||||
"anchor and the laptop",
|
||||
} {
|
||||
if r, ok := Secret(text, "anchor"); !ok {
|
||||
t.Errorf("refused as %s: %q", r, text)
|
||||
}
|
||||
if _, ok := Check(text, "anchor"); ok && text != "anchor and the laptop" {
|
||||
t.Errorf("Check lets %q leave, so Secret is not the narrower rule", text)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
+1
-16
@@ -35,11 +35,6 @@
|
||||
"kind": "preference",
|
||||
"default": "10m",
|
||||
"why": "a busy period never holds a batch longer than this after its first merge (novox/hq ADR 0276)"
|
||||
},
|
||||
"push-wait": {
|
||||
"kind": "preference",
|
||||
"default": "2m",
|
||||
"why": "how long a push to a named machine waits for that machine's answer, so its call says how it went; a call's own wait overrides it, and 0 waits for nothing (novox/hq issue 629)"
|
||||
}
|
||||
},
|
||||
"tools": [
|
||||
@@ -125,15 +120,6 @@
|
||||
"owner": "mesh-controller",
|
||||
"content": "{\n \"merge-window\": \"${setting:merge-window}\",\n \"merge-window-at-most\": \"${setting:merge-window-at-most}\"\n}\n"
|
||||
},
|
||||
{
|
||||
"id": "push",
|
||||
"trusted": false,
|
||||
"type": "file",
|
||||
"path": "${dir:mesh-state}/push.json",
|
||||
"mode": "0600",
|
||||
"owner": "mesh-controller",
|
||||
"content": "{\n \"push-wait\": \"${setting:push-wait}\"\n}\n"
|
||||
},
|
||||
{
|
||||
"id": "controller",
|
||||
"type": "process",
|
||||
@@ -158,8 +144,7 @@
|
||||
"MESH_BROKER_ADDRESS_PORT": "${seat:mesh-broker:5671}",
|
||||
"MESH_BUS_NATS_FILE": "${dir:mesh-state}/bus",
|
||||
"MESH_CONTROLLER_VERSION": "${version}",
|
||||
"MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json",
|
||||
"MESH_PUSH_FILE": "${dir:mesh-state}/push.json"
|
||||
"MESH_MERGE_WINDOW_FILE": "${dir:mesh-state}/merge-window.json"
|
||||
},
|
||||
"replaces": [
|
||||
"server"
|
||||
|
||||
Vendored
+1
-1
@@ -9,7 +9,7 @@ a second place to clean besides the catalogue itself.
|
||||
|
||||
mesh-catalog e0bc919d4945bb5f13f971f74643a0b714cf45da modules/*/module.json, modules/nats/Dockerfile
|
||||
mesh-host 7a41e120635b3f7b6cb94cca8b3fc4093e4e6110 examples/foundation-first-node.lock
|
||||
mesh-sdk 5933eb757d443293631be2bed27a96288c2348d8 conformance/events/module-event.json
|
||||
mesh-sdk 33917f91ac3cc213b879b32f3c70e2aa70395f98 conformance/events/module-event.json
|
||||
|
||||
To move them, from this repository's root, with the two repositories checked out beside it:
|
||||
|
||||
|
||||
Vendored
-15
@@ -45,18 +45,3 @@
|
||||
./cmd/mesh-controller TestReplay348AFaultFromBeforeTheSendFailsNoGate
|
||||
./cmd/mesh-controller TestReplay239AModuleNameIsNotTakenOverByAnotherRepository
|
||||
./cmd/mesh-controller TestAWalkThatMovedNothingSaysWhichModulesMatchedWhatRuns
|
||||
./cmd/mesh-controller TestReplay614ANewSDKPlansTheToolchainAndThenItsBundles
|
||||
./internal/inventory TestACredentialIssuedOutsideIsNeverMade
|
||||
./internal/inventory TestOneAcceptForAProviderIsSealedToEveryConsumer
|
||||
./internal/inventory TestASharedOwnSecretIssuedOutsideIsNeverMade
|
||||
./cmd/mesh-controller TestOneAcceptForAProviderIsPlacedForEveryConsumer
|
||||
./cmd/mesh-controller TestReplay164
|
||||
./cmd/mesh-controller TestAnApprovedLayerOpensTheWalkThatSendsIt
|
||||
./cmd/mesh-controller TestASettingsWalkSendsOneMachineAtATimeEachJudged
|
||||
./cmd/mesh-controller TestAFailedSettingsWalkStopsAndHoldsNothingBack
|
||||
./cmd/mesh-controller TestASettingsWalkSendsTheLayerAloneEveryBuildKept
|
||||
./cmd/mesh-controller TestASettingsWalkStopsBeforeADataMoveAndPassesOverAMachineAway
|
||||
./cmd/mesh-controller TestACrossingSendSupersedesASettingsGate
|
||||
./cmd/mesh-controller TestASettingsWalkFailsOnARefusalThatCannotClear
|
||||
./cmd/mesh-controller TestAProviderElsewhereServesItsOwnComposedName
|
||||
./cmd/mesh-controller TestANoMoveTierWaitsForNoNewReport
|
||||
|
||||
+5
-69
@@ -170,18 +170,10 @@ func (a Ask) Digest() string {
|
||||
canonical(&b, v)
|
||||
}
|
||||
}
|
||||
// Whole and Details are written whenever either or WholeDetails is given, and WholeDetails after them whenever
|
||||
// it is given (novox/hq ADR 0347): the fields after the options are then always one of three fixed shapes —
|
||||
// none, the two, or the three — and the count of values the sequence holds tells them apart, so no two asks
|
||||
// encode the same (the review of mesh-sdk #25). An ask with none of them digests as before they existed, and
|
||||
// one without WholeDetails as before it existed.
|
||||
if a.Whole != "" || a.Details != "" || a.WholeDetails != "" {
|
||||
if a.Whole != "" || a.Details != "" {
|
||||
canonical(&b, a.Whole)
|
||||
canonical(&b, a.Details)
|
||||
}
|
||||
if a.WholeDetails != "" {
|
||||
canonical(&b, a.WholeDetails)
|
||||
}
|
||||
sum := sha256.Sum256([]byte(b.String()))
|
||||
return "sha256:" + hex.EncodeToString(sum[:])
|
||||
}
|
||||
@@ -210,59 +202,9 @@ type Ask struct {
|
||||
// The asker withholds a value shaped like a secret in it, and the router refuses the ask when one is left;
|
||||
// Explanation stays under the whole content rule everywhere else. Empty, Explanation is shown everywhere.
|
||||
Whole string `json:"whole,omitempty"`
|
||||
// Details are the ask's secondary words, line by line under the content rule: who proposed it, a
|
||||
// fingerprint, how to read it whole. The router shows them in the note of the ask's own message
|
||||
// (Message.Note), after what the ask's options do and when it expires — never in its body (novox/hq
|
||||
// issue 639).
|
||||
// Details is what the Details answer on the ask's message shows, line by line under the content rule: a
|
||||
// fingerprint, how to read the proposal whole at the terminal. Empty, an ask's own message offers no Details.
|
||||
Details string `json:"details,omitempty"`
|
||||
// WholeDetails are the Details with their exact values whole, shown in place of Details where Whole is shown
|
||||
// in place of the explanation (a kind that proves who answers, given the ask's answers): every value an
|
||||
// approval sets, whole, so the person reads exactly what they approve (novox/hq issue 383). Held, like
|
||||
// Whole, to the secret rule alone; the router refuses the ask when a secret's shape is left in it. Empty,
|
||||
// Details are shown everywhere.
|
||||
WholeDetails string `json:"whole-details,omitempty"`
|
||||
}
|
||||
|
||||
// What an ask's explanation is held to, so it reads at a glance on a phone (novox/hq issue 639): a summary
|
||||
// of two or three short sentences on its first line — what changes, why, what it costs or risks — then at
|
||||
// most three points, a line each, only where they add something. Whole is held to the same. Who asked, when,
|
||||
// the fingerprint and how to read it whole are Details, never the explanation.
|
||||
const (
|
||||
SummaryLength = 300
|
||||
MostPoints = 3
|
||||
PointLength = 160
|
||||
)
|
||||
|
||||
// Glance says why an explanation does not read at a glance, or nil: its first line, the summary, longer than
|
||||
// SummaryLength; more than MostPoints lines after it; a point longer than PointLength. Blank lines are not
|
||||
// counted. An asker holds its asks to it in its own tests; the router says, without refusing, an ask that
|
||||
// does not hold to it.
|
||||
func Glance(explanation string) error {
|
||||
var lines []string
|
||||
for _, l := range strings.Split(explanation, "\n") {
|
||||
if strings.TrimSpace(l) != "" {
|
||||
lines = append(lines, strings.TrimSpace(l))
|
||||
}
|
||||
}
|
||||
var problems []string
|
||||
switch {
|
||||
case len(lines) == 0:
|
||||
problems = append(problems, "it has no summary")
|
||||
case len([]rune(lines[0])) > SummaryLength:
|
||||
problems = append(problems, fmt.Sprintf("its summary is %d characters, more than %d", len([]rune(lines[0])), SummaryLength))
|
||||
}
|
||||
if len(lines) > 1+MostPoints {
|
||||
problems = append(problems, fmt.Sprintf("it has %d points after its summary, more than %d", len(lines)-1, MostPoints))
|
||||
}
|
||||
for i, l := range lines {
|
||||
if i > 0 && len([]rune(l)) > PointLength {
|
||||
problems = append(problems, fmt.Sprintf("its point %d is %d characters, more than %d", i, len([]rune(l)), PointLength))
|
||||
}
|
||||
}
|
||||
if len(problems) > 0 {
|
||||
return errors.New("the explanation does not read at a glance: " + strings.Join(problems, "; "))
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// The bounds of an ask (novox/hq ADR 0234 §8, ADR 0259 §4).
|
||||
@@ -493,14 +435,8 @@ type Message struct {
|
||||
Title string `json:"title"`
|
||||
Body string `json:"body"`
|
||||
Buttons []Button `json:"buttons,omitempty"`
|
||||
// Note is the message's secondary words, after its body and its buttons: who asked and when, what each
|
||||
// answer does, when it expires, and the ask's Details. A channel shows it smaller, collapsed or set apart
|
||||
// where it can, and after the body where it cannot (novox/hq issue 639). A channel that bounds a message's
|
||||
// length cuts the body first and the note only when the title and the note alone do not fit, saying each
|
||||
// cut (novox/hq ADR 0347 §5).
|
||||
Note string `json:"note,omitempty"`
|
||||
Urgent bool `json:"urgent,omitempty"`
|
||||
Silent bool `json:"silent,omitempty"`
|
||||
Urgent bool `json:"urgent,omitempty"`
|
||||
Silent bool `json:"silent,omitempty"`
|
||||
// Reply is the Choice or LinkAsked this answers, by its ID: the channel shows it where that was made.
|
||||
Reply string `json:"reply,omitempty"`
|
||||
// To is the account linked as the operator on this kind, for a channel that verifies its sender: where
|
||||
|
||||
Vendored
+1
-1
@@ -1,4 +1,4 @@
|
||||
# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261013182924-5933eb757d44
|
||||
# git.novox.be/novox/mesh-sdk/go v0.1.14-0.20261010191001-33917f91ac3c
|
||||
## explicit; go 1.22
|
||||
git.novox.be/novox/mesh-sdk/go/asks
|
||||
# github.com/antithesishq/antithesis-sdk-go v0.7.0-default-no-op
|
||||
|
||||
Reference in New Issue
Block a user