mesh-controller/cmd/mesh-controller/issued_test.go

package main

import (
	"encoding/json"
	"strings"
	"testing"

	"git.novox.be/novox/mesh-sdk/go/catalogue"
	"git.novox.be/novox/mesh-sdk/go/compose"
	"git.novox.be/novox/mesh-sdk/go/overlay"
	"github.com/novox/mesh-controller/internal/inventory"
	"github.com/novox/mesh-controller/internal/link"
	"github.com/novox/mesh-controller/internal/secrets"
)

// The `issued` verb runs `secret issued <provision>` and nothing else, and that line is the one `secret` line
// beside rotate and the desk's that a verb may run (novox/hq ADR 0305 §3, §10, issue 526).
func TestTheIssuedVerbRunsTheOneLineThatCarriesNoValue(t *testing.T) {
	argv, err := argvFor("issued", map[string]any{"provision": "plex-api"})
	if err != nil {
		t.Fatal(err)
	}
	if strings.Join(argv, " ") != "secret issued plex-api" {
		t.Fatalf("the verb composed %q", argv)
	}
	if _, err := argvFor("issued", map[string]any{}); err == nil {
		t.Fatal("the verb ran with no provision")
	}
	if _, err := argvFor("issued", map[string]any{"provision": "plex-api", "secret": "a value"}); err == nil {
		t.Fatal("the verb took a value beside the provision")
	}
	for _, line := range [][]string{
		{"secret", "issued", "plex-api", "--from", "/tmp/x"},
		{"secret", "issued", "--from"},
		{"secret", "issued"},
		{"secret", "accept", "ace", "kometa", "plex-api", "--provider", "ace"},
		{"secret", "recover", "ace", "kometa", "plex-api"},
	} {
		if err := terminalOnly(line); err == nil {
			t.Errorf("%q ran through a verb", line)
		}
	}
	if err := terminalOnly([]string{"secret", "issued", "plex-api"}); err != nil {
		t.Fatalf("the issued line was refused through its verb: %v", err)
	}
	found := false
	for _, v := range catalogue.ControllerVerbs {
		if v.Name == "issued" {
			found = true
		}
	}
	if !found {
		t.Fatal("the controller's seat does not declare the issued verb")
	}
}

// A provider's tool answering the value sealed to the call's key: what a provider does (ADR 0305 §2).
func issuedSealed(t *testing.T, value string) func(issuedProvider, map[string]any) (link.Answer, error) {
	return func(_ issuedProvider, args map[string]any) (link.Answer, error) {
		key, _ := args["seal_to"].(string)
		if key == "" {
			t.Fatal("the provider was asked without a key to seal to")
		}
		if _, carried := args["value"]; carried {
			t.Fatal("the ask carried a value")
		}
		sealed, err := secrets.Seal(key, []byte(value))
		if err != nil {
			t.Fatal(err)
		}
		raw, _ := json.Marshal(map[string]string{"sealed": sealed})
		return link.Answer{Result: raw}, nil
	}
}

type issuedRecorder struct {
	kept  []string
	acts  []link.HandAct
	sent  [][]string
	again bool // the value is held by every holder already
}

func (r *issuedRecorder) taker(t *testing.T, ask func(issuedProvider, map[string]any) (link.Answer, error)) issuedTaker {
	return issuedTaker{
		providers: func(provision string) ([]issuedProvider, bool, error) {
			return []issuedProvider{{Node: "ace", Module: "plex", Tool: "plex_issued_credential"}}, true, nil
		},
		ask: ask,
		keep: func(provision, provider, value string) (inventory.IssuedKept, error) {
			r.kept = append(r.kept, value)
			holders := []inventory.Holder{{Provision: provision, Consumer: "ace", ConsumerModule: "kometa", Provider: provider},
				{Provision: provision, Consumer: "ace", ConsumerModule: "tautulli", Provider: provider}}
			if r.again {
				return inventory.IssuedKept{Holders: holders}, nil
			}
			return inventory.IssuedKept{Changed: true, Holders: holders, Sealed: holders, Machines: []string{"ace"}}, nil
		},
		record: func(act link.HandAct) error { r.acts = append(r.acts, act); return nil },
		send:   func(machines []string) error { r.sent = append(r.sent, machines); return nil },
	}
}

// The value the provider's tool sealed to the call is kept, recorded and sent, and the answer never says it.

// The same value again writes nothing, records nothing and sends nobody (ADR 0305 §5).

// A value not sealed to the call's key is not taken, nor is a refusal, nor an empty answer (ADR 0305 §2).

// A provision no offer says its software issues is refused before anything is asked.

// Which assignments are asked: the modules on the providing machine whose offer says so, with their tool.
func TestTheProvidersAskedAreTheOffersThatSaySo(t *testing.T) {
	shelf := map[string]catalogue.Manifest{
		"plex": {Module: "plex", Provides: []catalogue.Offer{{Name: "plex-api", Credential: &catalogue.OfferCredential{
			IssuedBy: catalogue.IssuedBySoftware, Tool: "plex_issued_credential"}}}},
		"jellyfin": {Module: "jellyfin", Provides: []catalogue.Offer{{Name: "plex-api"}}},
	}
	got := issuedOn(shelf, "ace", []string{"jellyfin", "plex", "kometa"}, "plex-api")
	if len(got) != 1 || got[0].Node != "ace" || got[0].Module != "plex" || got[0].Tool != "plex_issued_credential" {
		t.Fatalf("the providers asked: %+v", got)
	}
	if err := issuedRefusesRotation(shelf, "plex-api"); err == nil || !strings.Contains(err.Error(), "secret issued plex-api") {
		t.Fatalf("rotate of an issued provision was not refused with the way to take it: %v", err)
	}
	if err := issuedRefusesRotation(shelf, "postgres-database"); err != nil {
		t.Fatalf("rotate of an ordinary provision was refused: %v", err)
	}
}

// A change of an issued value is the mesh working as decided, never a repair (ADR 0305 §8).
func TestAnIssuedValueIsADecisionInTheHandActLog(t *testing.T) {
	for _, v := range handActVerbs {
		if v.Verb == handActIssued {
			if v.Decision == "" {
				t.Fatal("secret issued counts as a repair")
			}
			return
		}
	}
	t.Fatal("secret issued is not in the hand-act table")
}

// needOf is the need a consumer has of a provision, as mesh-sdk's resolution gives it (the controller's issuedToHolder and
// providerMoved became the fields Needed.IssuedToHolder and ProviderMoved of compose.Resolve, issue 1389): the shelf, the
// provider on one machine and the consumer on another.
func needOf(t *testing.T, shelf map[string]catalogue.Manifest, provider, consumer, provision string) catalogue.Needed {
	t.Helper()
	all := map[string]catalogue.Manifest{}
	for name, m := range shelf {
		all[name] = m
	}
	all[consumer] = catalogue.Manifest{Module: consumer, Version: "1", Requires: []string{provision}}
	// The private network comes with the control plane, and both machines run it.
	var network []string
	for _, m := range provided {
		all[m.Module] = m
		if m.Module == overlay.Name {
			network = append(network, m.Module)
		}
	}
	in := compose.Input{Catalogue: all, OverlayCIDR: "10.77.0.0/16", InternalSuffix: "internal",
		Nodes: []compose.Node{
			{Name: "novox", Assigned: append([]string{provider}, network...), Place: compose.Place{Address: "10.77.0.1"}},
			{Name: "ace", Assigned: append([]string{consumer}, network...), Place: compose.Place{Address: "10.77.0.2"}}}}
	resolved, err := compose.Resolve(in, "ace")
	if err != nil {
		t.Fatalf("%s does not resolve beside %s: %v", consumer, provider, err)
	}
	for _, n := range resolved.Plan.Needs {
		if n.For == consumer && n.Name == provision {
			return n
		}
	}
	t.Fatalf("%s has no need of %s: %+v", consumer, provision, resolved.Plan.Needs)
	return catalogue.Needed{}
}

// **A need's credential is the vault's for its holder alone** (issue 757) exactly when its providing module is marked
// moved, so `secret issued` goes to the vault naming each holder, and its software issues the provision's credential.
func TestANeedIsIssuedToItsHolderOnlyWhereTheProviderIsMovedAndItsSoftwareIssuesIt(t *testing.T) {
	forge := func(moved bool, issued bool) catalogue.Manifest {
		offer := catalogue.Offer{Name: "gitea-read", Scope: catalogue.ScopeMesh}
		if issued {
			offer.Credential = &catalogue.OfferCredential{IssuedBy: catalogue.IssuedBySoftware, Tool: "gitea_agent_token"}
		}
		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: moved, Provides: []catalogue.Offer{offer}}
	}
	shared := func(moved bool) catalogue.Manifest {
		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: moved, OwnSecrets: catalogue.OwnSecrets{"key": {Path: "/k"}},
			Provides: []catalogue.Offer{{Name: "gitea-read", Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{Own: "key"}}}}
	}
	given := func() catalogue.Manifest {
		return catalogue.Manifest{Module: "gitea", Version: "1", Moved: true, Provides: []catalogue.Offer{{Name: "gitea-read",
			Scope: catalogue.ScopeMesh, Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}}}
	}
	for why, c := range map[string]struct {
		forge catalogue.Manifest
		want  bool
	}{
		"moved and issued by its software": {forge(true, true), true},
		"not moved":                        {forge(false, true), false},
		"a login for each consumer":        {forge(true, false), true},
		"a login for each, not moved":      {forge(false, false), false},
		"a credential every holder shares": {shared(true), false},
		"a credential a person gives":      {given(), false},
	} {
		got := needOf(t, map[string]catalogue.Manifest{"gitea": c.forge}, "gitea", "claude-code", "gitea-read")
		if got.IssuedToHolder != c.want {
			t.Errorf("%s: issued to its holder is %v, want %v", why, got.IssuedToHolder, c.want)
		}
	}
}

// **The vault is a moved provider for its consumers' credentials** (issue 793): its pair rows are the vault's since
// V3, so a need of `secret` is issued to its holder and answered by a moved provider, whether or not the module is
// marked moved; another module is not.
func TestTheModuleHoldingTheVaultSeatCountsAsMovedForItsConsumers(t *testing.T) {
	vault := catalogue.Manifest{Module: "mesh-vault", Version: "1", Claims: []catalogue.Claim{{Name: "mesh-vault", Scope: catalogue.ScopeMesh}},
		Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
	other := catalogue.Manifest{Module: "mesh-vault", Version: "1", Provides: []catalogue.Offer{{Name: "secret", Scope: catalogue.ScopeMesh}}}
	if got := needOf(t, map[string]catalogue.Manifest{"mesh-vault": vault}, "mesh-vault", "gitea", "secret"); !got.IssuedToHolder || !got.ProviderMoved {
		t.Errorf("the vault's consumer is not answered by a moved provider: %+v", got)
	}
	if got := needOf(t, map[string]catalogue.Manifest{"mesh-vault": other}, "mesh-vault", "gitea", "secret"); got.IssuedToHolder || got.ProviderMoved {
		t.Errorf("a module not holding the vault seat counts as moved: %+v", got)
	}
}

// **A provision answered by the helper makes its provider a moved one for that provision alone** (issue 792): the
// provides entry says `"answered-by": "helper"`, the module need not be marked moved, and no credential is the vault's
// for it. Another provision of the module, or a module without the entry, does not count.
func TestAnOfferAnsweredByTheHelperCountsAsMovedForThatProvisionOnly(t *testing.T) {
	proxy := catalogue.Manifest{Module: "route-proxy", Version: "1", Provides: []catalogue.Offer{
		{Name: "route", Scope: catalogue.ScopeMesh, AnsweredBy: catalogue.AnsweredByHelper}, {Name: "other", Scope: catalogue.ScopeMesh}}}
	plain := catalogue.Manifest{Module: "route-proxy", Version: "1", Provides: []catalogue.Offer{{Name: "route", Scope: catalogue.ScopeMesh}}}
	shelf := func(m catalogue.Manifest) map[string]catalogue.Manifest {
		return map[string]catalogue.Manifest{m.Module: m}
	}
	if got := needOf(t, shelf(proxy), "route-proxy", "gitea", "route"); !got.ProviderMoved {
		t.Error("a provision answered by the helper is not answered by a moved provider")
	} else if got.IssuedToHolder {
		t.Error("the flag made a credential the vault's")
	}
	if got := needOf(t, shelf(proxy), "route-proxy", "gitea", "other"); got.ProviderMoved {
		t.Error("a provision not answered by the helper counts as moved")
	}
	if got := needOf(t, shelf(plain), "route-proxy", "gitea", "route"); got.ProviderMoved {
		t.Error("a module without the entry counts as moved")
	}
}