mesh-controller/internal/ownmanifest/public_issuer_test.go

package ownmanifest

import (
	"testing"

	. "git.novox.be/novox/mesh-sdk/go/catalogue"
)

// The public issuer is the proxy's own fact (novox/hq ADR 0226), and the folding of it must not
// move the proxy's account.
//
// route-proxy keeps each ACME authority's account and certificates in a directory named after a
// digest of the directory URL and of the root bundle its `trust` container copies in
// (modules/route-proxy/cmd/route-proxy, forThisAuthority). Until ADR 0226 the URL was rendered from a binding to
// `public-acme`'s `acme-ca`, spelled with the port. A URL spelled any other way — even the same
// authority without `:443` — or a root bundle from another image is a new authority to the proxy:
// a new account, and every routed name ordered again, on two machines at once, against Let's
// Encrypt's rate limits. So what the module now states is held to exactly what the binding rendered.

// renderedBeforeTheFold is route-proxy's acme.env as the binding to public-acme rendered it on every
// machine running the proxy, read from the controller's plan on 2026-10-06.
const renderedBeforeTheFold = "ACME_DIRECTORY=https://acme-v02.api.letsencrypt.org:443/directory\n" +
	"ACME_ROOTS=https://acme-v02.api.letsencrypt.org:443\n" +
	"ACME_ROOTS_PATH=\n"

// trustImage is the image whose system bundle becomes the public root the account directory is
// named after. Moving it renames that directory.
const trustImage = "alpine@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b"

func TestRouteProxyKeepsItsPublicAccountDirectory(t *testing.T) {
	m := catalogueManifest(t, "route-proxy")
	for _, r := range m.Requires {
		if r == "acme-ca" {
			t.Fatal("route-proxy still asks for acme-ca; the public issuer is its own fact (ADR 0226)")
		}
	}

	// As a build would leave it: each artifact a container names resolved to an image. Which image
	// does not matter to the file checked here. An archive resource carries no image: it unpacks a bundle.
	for _, res := range m.Resources {
		if res["type"] == "archive" {
			continue
		}
		if artifact, ok := res["artifact"].(string); ok {
			delete(res, "artifact")
			res["image"] = "registry.invalid/route-proxy/" + artifact +
				"@sha256:1111111111111111111111111111111111111111111111111111111111111111"
		}
	}
	r := Resolution{
		Node:    "anchor",
		Modules: []Manifest{m},
		Needs: []Needed{{
			Name: "internal-acme-ca", From: "home", At: "home.internal", For: "route-proxy",
			Serves: map[string]any{
				"port": float64(9000), "path": "/acme/acme/directory", "roots": "/roots.pem",
			},
		}},
	}
	// Its own broker credential, sealed as the mesh would; what it is does not matter here.
	out, err := r.Declaration(Rendering{Needed: map[string]map[string]string{
		"route-proxy": {"broker": "sealed"}}})
	if err != nil {
		t.Fatalf("route-proxy could not be composed for a machine: %v", err)
	}
	env := fileNamed(out, "route-proxy.acme-env")
	if env == nil {
		t.Fatalf("nothing writes the public issuer's environment: %v", out)
	}
	if got, _ := env["content"].(string); got != renderedBeforeTheFold {
		t.Fatalf("acme.env changed, which moves the proxy's account and reorders every certificate:\n"+
			"got  %q\nwant %q", got, renderedBeforeTheFold)
	}
	if fileNamed(out, "route-proxy.bound-acme-ca") != nil {
		t.Error("a binding to acme-ca is still written")
	}

	var trust string
	if m.Build != nil {
		for _, a := range m.Build.Artifacts {
			if a.Name == "trust" {
				trust = a.From
			}
		}
	}
	if trust != trustImage {
		t.Errorf("the trust image is %q, not %q: its system bundle is the public root the account "+
			"directory is named after, so moving it reorders every certificate. Move it only with a "+
			"plan for the account (ADR 0226)", trust, trustImage)
	}
}

// The proxy's program is mounted into the pinned trust image, not baked into an image (novox/hq ADR 0480 clauses 1,
// 2 and 4): a Go bundle of the module's own Go module stamped for alpine, unpacked by an archive resource, mounted
// read-only at /opt/mesh, called through args, and named under restart-on so a new program never leaves the old
// one running. The container's name, network and logging are what the jail and the routes rely on.
func TestRouteProxyRunsItsMountedProgramOnTheTrustImage(t *testing.T) {
	m := catalogueManifest(t, "route-proxy")
	var bundle *Artifact
	for i, a := range m.Build.Artifacts {
		if a.Name == "server" {
			bundle = &m.Build.Artifacts[i]
		}
		if a.Kind == "image" {
			t.Errorf("artifact %s is an image built from a Dockerfile (ADR 0452 §1)", a.Name)
		}
	}
	if bundle == nil || bundle.Kind != "bundle" || bundle.Language != "go" || bundle.System != "alpine" ||
		bundle.From != "cmd/route-proxy" || bundle.Binary != "route-proxy" {
		t.Fatalf("the server artifact is not a Go bundle of cmd/route-proxy stamped for alpine: %+v", bundle)
	}
	var archive, server map[string]any
	for _, r := range m.Resources {
		switch {
		case r["type"] == "archive" && r["artifact"] == "server":
			archive = r
		case r["id"] == "server":
			server = r
		}
	}
	if archive == nil || server == nil {
		t.Fatalf("archive %v or server container %v is missing", archive, server)
	}
	if server["artifact"] != "trust" || server["name"] != "route-proxy" || server["network"] != "host" || server["logging"] != "journald" {
		t.Errorf("the server container moved: %v", server)
	}
	mount := archive["path"].(string) + ":/opt/mesh:ro"
	mounted := false
	for _, v := range server["volumes"].([]any) {
		mounted = mounted || v == mount
	}
	if !mounted {
		t.Errorf("the archive is not mounted read-only at /opt/mesh (%s): %v", mount, server["volumes"])
	}
	if args, _ := server["args"].([]any); len(args) != 1 || args[0] != "/opt/mesh/route-proxy" {
		t.Errorf("args are %v, want the mounted program", server["args"])
	}
	restarts := false
	for _, v := range server["restart-on"].([]any) {
		restarts = restarts || v == archive["id"]
	}
	if !restarts {
		t.Errorf("restart-on %v does not name the archive %v", server["restart-on"], archive["id"])
	}
}