318 lines
14 KiB
Go
318 lines
14 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
"github.com/novox/mesh-controller/internal/catalogue"
|
|
"github.com/novox/mesh-controller/internal/inventory"
|
|
"github.com/novox/mesh-controller/internal/secrets"
|
|
)
|
|
|
|
// The controller's secret verbs reach the vault only for a module filled the new way (design 57's V2, issue 675,
|
|
// the release lead's decision on it; novox/hq ADR 0349 clauses 8 to 10 and 17).
|
|
|
|
// standInVault answers the vault's two-step verbs as mesh-vault does: a key made for each call, the value opened
|
|
// with it here and nowhere else. It keeps what it took and every argument it was sent, as the bus carried them.
|
|
type standInVault struct {
|
|
t *testing.T
|
|
mu sync.Mutex
|
|
keys map[string]string // call → private key
|
|
taken map[string]string // secret → value
|
|
sent []string // every argument, as JSON
|
|
refuse error // refuses every first step when set
|
|
outcome []string
|
|
again bool // the value is held already
|
|
// perHolder answers `issued` with a value per holder named, the last one not answered (issue 749).
|
|
perHolder bool
|
|
// asked is how the vault's own ask at a desk ends, as mesh-vault answers `secret-ask` (issue 723): the vault
|
|
// asks the desk itself, so the controller sends one step and is told how it ended.
|
|
asked string
|
|
}
|
|
|
|
func newStandInVault(t *testing.T) *standInVault {
|
|
return &standInVault{t: t, keys: map[string]string{}, taken: map[string]string{}}
|
|
}
|
|
|
|
func (v *standInVault) ask(verb string, args map[string]any) (json.RawMessage, error) {
|
|
v.mu.Lock()
|
|
defer v.mu.Unlock()
|
|
raw, _ := json.Marshal(map[string]any{"verb": verb, "args": args})
|
|
v.sent = append(v.sent, string(raw))
|
|
if verb == "rotate" {
|
|
return json.Marshal(vaultChanged{Name: "own/g14/dunst/token", Generation: 2, By: fmt.Sprint(args["by"])})
|
|
}
|
|
// The vault asks the desk's prompt and the provider's tool itself, in its own name (issue 723): one step from
|
|
// the controller, which carries no key and no sealed value.
|
|
switch verb {
|
|
case "secret-ask":
|
|
if v.refuse != nil {
|
|
return nil, v.refuse
|
|
}
|
|
outcome := v.asked
|
|
if outcome == "" {
|
|
outcome = "given"
|
|
}
|
|
return json.Marshal(vaultAsked{Secret: fmt.Sprintf("own/%v/%v/%v", args["node"], args["module"], args["name"]),
|
|
Generation: 1, AskedBy: "as-the-vault-recorded", Outcome: outcome})
|
|
case "issued":
|
|
if v.refuse != nil {
|
|
return nil, v.refuse
|
|
}
|
|
// A tool answering a value per holder (issue 749): the vault keeps one for each holder named, and says which
|
|
// it was not given.
|
|
if holders, ok := args["holders"].([]issuedHolder); ok && v.perHolder {
|
|
out := vaultIssued{Secret: fmt.Sprintf("provision/%v/%v", args["provider"], args["provision"]), Unchanged: v.again}
|
|
for i, h := range holders {
|
|
if i == len(holders)-1 && len(holders) > 1 {
|
|
out.NotAnswered = append(out.NotAnswered, h)
|
|
continue
|
|
}
|
|
out.Holders = append(out.Holders, vaultIssuedHolder{Node: h.Node, Module: h.Module,
|
|
Secret: fmt.Sprintf("%s/%s/%s", out.Secret, h.Node, h.Module), Generation: 1, Unchanged: v.again})
|
|
}
|
|
return json.Marshal(out)
|
|
}
|
|
return json.Marshal(vaultIssued{Secret: fmt.Sprintf("provision/%v/%v", args["provider"], args["provision"]),
|
|
Generation: 1, Unchanged: v.again})
|
|
}
|
|
call, _ := args["call"].(string)
|
|
if call == "" {
|
|
if v.refuse != nil {
|
|
return nil, v.refuse
|
|
}
|
|
public, private, err := secrets.Keypair()
|
|
if err != nil {
|
|
v.t.Fatal(err)
|
|
}
|
|
call = fmt.Sprintf("call-%d", len(v.keys)+1)
|
|
v.keys[call] = private
|
|
secret := fmt.Sprintf("%s/%v", verb, args["name"])
|
|
return json.Marshal(vaultOpened{Call: call, SealTo: public, Secret: secret, AskedBy: "as-the-vault-recorded"})
|
|
}
|
|
private, ok := v.keys[call]
|
|
if !ok {
|
|
return nil, errors.New("no such call")
|
|
}
|
|
delete(v.keys, call)
|
|
if o, _ := args["outcome"].(string); o != "" {
|
|
v.outcome = append(v.outcome, o)
|
|
return json.Marshal(vaultChanged{Unchanged: true})
|
|
}
|
|
value, err := secrets.Open(private, fmt.Sprint(args["sealed"]))
|
|
if err != nil {
|
|
return nil, errors.New("not sealed to this call")
|
|
}
|
|
// As mesh-vault takes a typed value: its line ending off (intake.go AskEnd).
|
|
v.taken[verb] = strings.TrimRight(string(value), "\r\n")
|
|
return json.Marshal(vaultChanged{Name: verb, Generation: 1, Unchanged: v.again})
|
|
}
|
|
|
|
func (v *standInVault) said() string {
|
|
v.mu.Lock()
|
|
defer v.mu.Unlock()
|
|
return strings.Join(v.sent, "\n")
|
|
}
|
|
|
|
// A module's secrets are the vault's once the catalogue marks it moved (design 57 V4, issue 647): its machine's
|
|
// client asks the vault for them. Every module not marked, and one the catalogue does not hold, keeps today's path.
|
|
|
|
// A switch that cannot be read does nothing, and says why: never today's path by default.
|
|
func TestASwitchThatCannotBeReadDoesNothing(t *testing.T) {
|
|
var ran []string
|
|
err := bySwitch("dunst", func(string) (bool, error) { return false, errors.New("the store is gone") },
|
|
func() error { ran = append(ran, "today"); return nil },
|
|
func() error { ran = append(ran, "vault"); return nil })
|
|
if err == nil || len(ran) > 0 || !strings.Contains(err.Error(), "the store is gone") {
|
|
t.Errorf("an unreadable switch ran %v (%v)", ran, err)
|
|
}
|
|
}
|
|
|
|
// The switch: today's path for a module filled the old way, the vault's for one filled the new way, and never
|
|
// both.
|
|
func TestTheSwitchRunsOnePathByTheModulesForm(t *testing.T) {
|
|
moved := switchOf(func(m string) bool { return m == "dunst" })
|
|
for module, want := range map[string]string{"telegram": "today", "dunst": "vault"} {
|
|
var ran []string
|
|
err := bySwitch(module, moved,
|
|
func() error { ran = append(ran, "today"); return nil },
|
|
func() error { ran = append(ran, "vault"); return nil })
|
|
if err != nil || strings.Join(ran, ",") != want {
|
|
t.Errorf("%s ran %v (%v), not %s", module, ran, err, want)
|
|
}
|
|
}
|
|
var ran []string
|
|
_ = bySwitch("dunst", nil, func() error { ran = append(ran, "today"); return nil },
|
|
func() error { ran = append(ran, "vault"); return nil })
|
|
if strings.Join(ran, ",") != "today" {
|
|
t.Errorf("no switch ran %v", ran)
|
|
}
|
|
}
|
|
|
|
// `secret accept` for a module filled the new way: the value read at the terminal is sealed there to the key the
|
|
// vault made for this one call; no clear value crosses the bus or reaches the controller's log. Over a real bus,
|
|
// with a tap on every subject.
|
|
|
|
// The desk's path for a module filled the new way (issue 723): the controller asks the vault once; the vault
|
|
// records the ask, holds its bounds and asks the desk's prompt itself, so the controller never reaches the desk and
|
|
// carries no key and no sealed value; today's store is not touched. For a module filled the old way, the vault is
|
|
// never asked.
|
|
func TestAnAskForAModuleFilledTheNewWayIsTheVaults(t *testing.T) {
|
|
d, accepted, acts, asked := aDesk(t, sealedTo(t, typed))
|
|
d.askedBy = "g14/claude-code"
|
|
d.open = func(node, module, name, desk string) (int64, error) {
|
|
t.Fatal("today's record was asked")
|
|
return 0, nil
|
|
}
|
|
vault := newStandInVault(t)
|
|
d.vault = vault.ask
|
|
words, err := d.give("anchor", "telegram", "telegram-token", "laptop")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(*accepted) != 0 {
|
|
t.Fatal("the controller opened and kept what was typed")
|
|
}
|
|
if len(*asked) != 0 {
|
|
t.Fatalf("the controller asked the desk's prompt itself: %v", *asked)
|
|
}
|
|
said := vault.said()
|
|
if !strings.Contains(said, `"verb":"secret-ask"`) || !strings.Contains(said, `"asked_by":"g14/claude-code"`) ||
|
|
!strings.Contains(said, `"desk":"laptop"`) || strings.Count(said, "\n") != 0 {
|
|
t.Errorf("the vault was not asked once, naming who asked and the desk: %s", said)
|
|
}
|
|
if strings.Contains(said, "seal_to") || strings.Contains(said, "sealed") || strings.Contains(said, `"call"`) {
|
|
t.Errorf("the controller carried a key or a sealed value: %s", said)
|
|
}
|
|
if len(*acts) != 1 || (*acts)[0].Cause != "given-at-the-desk" || !strings.Contains((*acts)[0].Why, "kept in the vault") ||
|
|
!strings.Contains((*acts)[0].Why, "as-the-vault-recorded") {
|
|
t.Errorf("the act: %+v", *acts)
|
|
}
|
|
if !strings.Contains(words, "own/anchor/telegram/telegram-token") || strings.Contains(words, typed) {
|
|
t.Errorf("said %q", words)
|
|
}
|
|
|
|
// Dismissed and timed out: nothing given, said so.
|
|
for _, outcome := range []string{"dismissed", "timed-out", "empty"} {
|
|
d2, _, _, _ := aDesk(t, sealedTo(t, typed))
|
|
v2 := newStandInVault(t)
|
|
v2.asked = outcome
|
|
d2.vault = v2.ask
|
|
if _, err := d2.give("anchor", "telegram", "telegram-token", "laptop"); !errors.Is(err, errNothingGiven) {
|
|
t.Errorf("%s: %v", outcome, err)
|
|
}
|
|
}
|
|
// Failed at the desk: an error, not "nothing given".
|
|
d5, _, acts5, _ := aDesk(t, sealedTo(t, typed))
|
|
v5 := newStandInVault(t)
|
|
v5.asked = "failed"
|
|
d5.vault = v5.ask
|
|
if _, err := d5.give("anchor", "telegram", "telegram-token", "laptop"); err == nil || errors.Is(err, errNothingGiven) ||
|
|
len(*acts5) != 0 {
|
|
t.Errorf("a failed ask: %v, acts %d", err, len(*acts5))
|
|
}
|
|
// The vault's bounds refuse: said so, nobody is asked by the controller.
|
|
d3, _, _, asked3 := aDesk(t, sealedTo(t, typed))
|
|
v3 := newStandInVault(t)
|
|
v3.refuse = errors.New("an ask for telegram-token of telegram on anchor is still open")
|
|
d3.vault = v3.ask
|
|
if _, err := d3.give("anchor", "telegram", "telegram-token", "laptop"); err == nil ||
|
|
!strings.Contains(err.Error(), "still open") || len(*asked3) != 0 {
|
|
t.Errorf("a refused ask: %v, prompts %d", err, len(*asked3))
|
|
}
|
|
|
|
// Filled the old way: today's path, the vault never asked.
|
|
d4, accepted4, _, _ := aDesk(t, sealedTo(t, typed))
|
|
if _, err := d4.give("anchor", "telegram", "telegram-token", "laptop"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if len(*accepted4) != 1 || d4.vault != nil {
|
|
t.Error("a module filled the old way did not take today's path")
|
|
}
|
|
}
|
|
|
|
// `secret issued` for a provider filled the new way (issue 723): the controller asks the vault once, naming the
|
|
// provider's machine, module and tool; the vault asks the tool itself; the controller never reaches the tool and
|
|
// nothing is kept, sealed or sent here. A provider filled the old way keeps today's path and the vault is never
|
|
// asked.
|
|
|
|
// `secret issued` names to the vault the provision's holders from that provider (issue 749): a tool may answer a
|
|
// value for each, which the vault keeps as that holder's own; the controller says what was kept for whom and which
|
|
// holder the tool gave nothing for, never a value. A provider answering one value is told the holders all the same
|
|
// and keeps the provision's one credential.
|
|
|
|
// The holders named are the provision's holders from that provider, each consuming module on each machine once.
|
|
func TestTheHoldersNamedAreThoseOfThatProvider(t *testing.T) {
|
|
holders := []inventory.Holder{
|
|
{Provision: "gitea-read", Consumer: "anchor", ConsumerModule: "claude-code", Provider: "novox"},
|
|
{Provision: "gitea-read", Consumer: "anchor", ConsumerModule: "claude-code", Local: "second", Provider: "novox"},
|
|
{Provision: "gitea-read", Consumer: "laptop", ConsumerModule: "claude-code", Provider: "novox"},
|
|
{Provision: "gitea-read", Consumer: "ace", ConsumerModule: "claude-code", Provider: "shanks"},
|
|
}
|
|
got := issuedHoldersFrom(holders, "novox")
|
|
if fmt.Sprint(got) != "[claude-code on anchor claude-code on laptop]" {
|
|
t.Errorf("the holders named: %v", got)
|
|
}
|
|
if got := issuedHoldersFrom(holders, "g14"); len(got) != 0 {
|
|
t.Errorf("a provider holding nothing named %v", got)
|
|
}
|
|
shelf := map[string]catalogue.Manifest{"gitea": {Module: "gitea", Provides: []catalogue.Offer{{Name: "gitea-read",
|
|
Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedBySoftware, Tool: "gitea_agent_token"}}}}}
|
|
providers, err := issuedProvidersFrom(shelf, holders, func(string) ([]string, error) { return []string{"gitea"}, nil },
|
|
"gitea-read")
|
|
if err != nil || len(providers) != 2 || providers[0].Node != "novox" || fmt.Sprint(providers[0].Holders) !=
|
|
"[claude-code on anchor claude-code on laptop]" || fmt.Sprint(providers[1].Holders) != "[claude-code on ace]" {
|
|
t.Errorf("the providers asked: %+v %v", providers, err)
|
|
}
|
|
}
|
|
|
|
// `secret rotate` for a module filled the new way asks the vault, naming who asked; nothing is sent.
|
|
func TestARotationForAModuleFilledTheNewWayIsTheVaults(t *testing.T) {
|
|
vault := newStandInVault(t)
|
|
if _, err := rotateInVault(vault.ask, ownSecretArgs("g14", "dunst", "token"), "g14/claude-code", " "); err == nil ||
|
|
vault.said() != "" {
|
|
t.Fatalf("a rotation without a why reached the vault: %v", err)
|
|
}
|
|
words, err := rotateInVault(vault.ask, ownSecretArgs("g14", "dunst", "token"), "g14/claude-code", "leaked")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !strings.Contains(vault.said(), `"verb":"rotate"`) || !strings.Contains(vault.said(), `"by":"g14/claude-code"`) ||
|
|
!strings.Contains(vault.said(), `"module":"dunst"`) || !strings.Contains(vault.said(), `"why":"leaked"`) {
|
|
t.Errorf("the vault was told %s", vault.said())
|
|
}
|
|
if !strings.Contains(words, "generation 2") || !strings.Contains(words, "takes it from the vault") {
|
|
t.Errorf("%q", words)
|
|
}
|
|
}
|
|
|
|
// The module that decides `accept --provider` is the one on the provider's machine that offers the provision; none,
|
|
// or several, is none, and today's path then says what is wrong.
|
|
func TestTheProvidersModuleIsTheOneThatOffersTheProvision(t *testing.T) {
|
|
offer := func(module string, provisions ...string) catalogue.Manifest {
|
|
m := catalogue.Manifest{Module: module}
|
|
for _, p := range provisions {
|
|
m.Provides = append(m.Provides, catalogue.Offer{Name: p})
|
|
}
|
|
return m
|
|
}
|
|
shelf := map[string]catalogue.Manifest{"tv": offer("tv", "tv-api"), "plex": offer("plex", "plex-api"),
|
|
"other-tv": offer("other-tv", "tv-api"), "dunst": offer("dunst")}
|
|
for _, c := range []struct {
|
|
assigned []string
|
|
want string
|
|
}{
|
|
{[]string{"dunst", "tv", "plex"}, "tv"},
|
|
{[]string{"dunst", "plex"}, ""},
|
|
{[]string{"tv", "other-tv"}, ""},
|
|
} {
|
|
if got := offeredOn(shelf, c.assigned, "tv-api"); got != c.want {
|
|
t.Errorf("%v: %q, want %q", c.assigned, got, c.want)
|
|
}
|
|
}
|
|
}
|