mesh-controller/internal/catalogue/resolved_path_test.go

package catalogue

// Every path the controller resolves for a module's directories and files is judged where the plan is
// composed (novox/hq issue 496). mesh-catalog #205 gave docker's `state` directory `"place": "."`, which
// resolves to <root>/docker — /var/lib/docker, every container's filesystem. The merge gate composed every
// machine and passed it; only the node-engine refused it, at apply, and failed the walk. The gate composes
// through Declaration, so a refusal here is a refusal at the gate, for every module.

import (
	"strings"
	"testing"
)

func composedOn(m Manifest, with Rendering) ([]map[string]any, error) {
	return Resolution{Node: "anchor", Modules: []Manifest{m}}.Declaration(with)
}

func pathOf(t *testing.T, resources []map[string]any, id string) string {
	t.Helper()
	for _, r := range resources {
		if r["id"] == id {
			return r["path"].(string)
		}
	}
	t.Fatalf("no resource %s in %v", id, resources)
	return ""
}

func TestADirectoryPlacedInDockersDataIsRefusedAtComposition(t *testing.T) {
	// The #205 shape, as it was merged.
	m := Manifest{Module: "docker", Version: "1", Resources: []map[string]any{
		{"id": "state", "type": "directory", "place": "."},
	}}
	_, err := composedOn(m, Rendering{})
	if err == nil {
		t.Fatal("a directory resolving to /var/lib/docker composed; the node-engine refuses it at apply")
	}
	for _, said := range []string{"docker", `"state"`, "/var/lib/docker", "issue 496"} {
		if !strings.Contains(err.Error(), said) {
			t.Errorf("the refusal names the module, the resource, the path and why; %q is missing from %q", said, err)
		}
	}
}

func TestTheMeshsPlaceForDockerComposes(t *testing.T) {
	// The fix #205 needed: the mesh's own directory for the module, <root>/mesh/docker.
	m := Manifest{Module: "docker", Version: "1", Resources: []map[string]any{
		{"id": "state", "type": "directory", "place": "mesh"},
		{"id": "marker", "type": "file", "path": "${dir:state}/applied", "content": "x"},
	}}
	resources, err := composedOn(m, Rendering{})
	if err != nil {
		t.Fatalf("place %q is the mesh's tree, which the mesh writes for every module: %v", "mesh", err)
	}
	if got := pathOf(t, resources, "docker.state"); got != "/var/lib/mesh/docker" {
		t.Fatalf("got %q", got)
	}
}

func TestEveryResolvedPathIsJudged(t *testing.T) {
	refused := map[string]Manifest{
		"a default directory under a data root inside containerd's data": {Module: "images", Version: "1",
			Resources: []map[string]any{{"id": "cache", "type": "directory"}}},
		"a stated directory in docker's data": {Module: "sidecar", Version: "1",
			Resources: []map[string]any{{"id": "volumes", "type": "directory", "path": "/var/lib/docker/volumes/x"}}},
		"a file beneath a placed directory that climbs out of it": {Module: "docker", Version: "1",
			Resources: []map[string]any{{"id": "state", "type": "directory", "place": "mesh"},
				{"id": "f", "type": "file", "path": "${dir:state}/../../containers/x", "content": "x"}}},
		"a file in /boot": {Module: "grub", Version: "1",
			Resources: []map[string]any{{"id": "cfg", "type": "file", "path": "/boot/grub/custom.cfg", "content": "x"}}},
		"a directory that is the data root itself": {Module: "lib", Version: "1",
			Resources: []map[string]any{{"id": "all", "type": "directory", "place": "."}}},
		"a directory in the node-engine's own tree, by another module": {Module: "intruder", Version: "1",
			Resources: []map[string]any{{"id": "d", "type": "directory", "path": "/var/lib/mesh-host/x"}}},
	}
	roots := map[string]Rendering{
		"a default directory under a data root inside containerd's data": {DataRoot: "/var/lib/containerd"},
		"a directory that is the data root itself":                       {DataRoot: "/var"},
	}
	for name, m := range refused {
		if _, err := composedOn(m, roots[name]); err == nil || !strings.Contains(err.Error(), "issue 496") {
			t.Errorf("%s: composed or refused for another reason: %v", name, err)
		}
	}

	// What the mesh's own modules place today, on every machine (read from each machine's live plan): the
	// machine's configuration, the mesh's tree, the node-engine's own, run directories and an account's keys.
	passes := map[string]Manifest{
		"a unit in /etc": {Module: "power", Version: "1",
			Resources: []map[string]any{{"id": "d", "type": "directory", "path": "/etc/systemd/system/x.service.d"},
				{"id": "u", "type": "file", "path": "/etc/systemd/system/x.service.d/a.conf", "content": "x"}}},
		"a run directory": {Module: "fail2ban", Version: "1",
			Resources: []map[string]any{{"id": "run-dir", "type": "directory", "path": "/var/run/fail2ban"}}},
		"a program in /usr/local": {Module: "claude-code", Version: "1",
			Resources: []map[string]any{{"id": "start", "type": "file", "path": "/usr/local/bin/claude-agent", "content": "x"}}},
		"the node-engine's launcher, by the node-engine": {Module: "mesh-host", Version: "1",
			Resources: []map[string]any{{"id": "launcher", "type": "file", "path": "/usr/lib/nox-mesh-host/launch", "content": "x"}}},
		"an account's .ssh": {Module: "ssh-client", Version: "1",
			Resources: []map[string]any{{"id": "ssh-dir", "type": "directory", "path": "/home/someone/.ssh"},
				{"id": "config", "type": "file", "path": "/home/someone/.ssh/config", "content": "x"}}},
		"a module's own root": {Module: "mailu", Version: "1",
			Resources: []map[string]any{{"id": "state", "type": "directory", "place": "."}}},
	}
	for name, m := range passes {
		if _, err := composedOn(m, Rendering{}); err != nil {
			t.Errorf("%s: refused: %v", name, err)
		}
	}
}