mesh-controller/cmd/mesh-controller/compose_fallbacks_test.go

package main

import (
	"encoding/base64"
	"errors"
	"strings"
	"testing"

	"git.novox.be/novox/mesh-sdk/go/catalogue"
	"git.novox.be/novox/mesh-sdk/go/compose"
	"github.com/novox/mesh-controller/internal/broker"
)

// aCoreInput is an Input of one machine that takes a core module whose credential the vault has not boxed: the composition
// stands in a vault box for it, and the machine holds the controller's own seal of it.
func aCoreInput(t *testing.T) (*meshInput, string) {
	t.Helper()
	raw := make([]byte, 32)
	raw[0] = 9
	key := base64.StdEncoding.EncodeToString(raw)
	client := catalogue.Manifest{Module: "mesh-provisioner-client", Version: "1",
		Claims:     []catalogue.Claim{{Name: broker.NodeProvisionerSeat, Scope: catalogue.ScopeNode}},
		OwnSecrets: catalogue.OwnSecrets{broker.ProvisionerSecret: {Path: "/var/lib/mesh-provisioner-client/broker"}}}
	return &meshInput{Input: compose.Input{
		Catalogue: map[string]catalogue.Manifest{client.Module: client},
		Nodes: []compose.Node{{Name: "laptop", Assigned: []string{client.Module}, SealingKey: key, Stated: true,
			Contract: compose.VaultBoxContract}},
		OwnSecrets: []compose.OwnSecretRow{{Node: "laptop", Module: client.Module, Name: broker.ProvisionerSecret,
			Origin: "made", SealedTo: key, Sealed: "SEALED-BY-THE-CONTROLLER"}},
	}}, client.Module
}

// 1385 (the lead's answer 1): where the vault is silent and no box is kept, the declaration carries the controller's own seal
// for the core credential, as ADR 0396 has it, and stands in for nothing. It failed first: the composition's declaration
// carried the stand-in box, and a send was refused.
func TestACoreCredentialTheVaultDidNotBoxIsSealedByTheController(t *testing.T) {
	in, module := aCoreInput(t)
	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
	if err != nil {
		t.Fatal(err)
	}
	if len(d.CoreBoxesWanted) != 1 || len(stillForeseen(d)) == 0 {
		t.Fatalf("the composition does not stand in for the vault's box: %v", d.CoreBoxesWanted)
	}
	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
	if err != nil {
		t.Fatal(err)
	}
	if left := stillForeseen(sealed); len(left) != 0 {
		t.Fatalf("the declaration still stands in for %v", left)
	}
	var file map[string]any
	for _, r := range sealed.Resources {
		if r["id"] == module+"."+catalogue.NeedID(broker.ProvisionerSecret) {
			file = r
		}
	}
	if file == nil || file["sealed"] != "SEALED-BY-THE-CONTROLLER" || file[catalogue.VaultSealedField] != nil {
		t.Fatalf("the core credential is carried as %v: the controller's own seal, not the vault's box", file)
	}
	// And a module the vault did answer for is left as it is.
	other, _, err := sealedByTheController(in, "laptop", d, []string{"another-module"})
	if err != nil {
		t.Fatal(err)
	}
	if len(stillForeseen(other)) == 0 {
		t.Fatal("a module the vault answered for was sealed by the controller")
	}
}

// 1383 (the lead's answer 4): the machine that runs the bus is refused where no user has a credential, with busUserList's
// words, and a machine that does not run the bus is not. It failed first: the Input stood a list in and the bus node composed.
func TestTheMachineThatRunsTheBusIsRefusedWhereNoUserHasACredential(t *testing.T) {
	bus := catalogue.Manifest{Module: "nats", Version: "1", BusUsers: "/etc/nats/users.conf",
		Claims: []catalogue.Claim{{Name: "mesh-broker", Scope: catalogue.ScopeMesh}}}
	other := catalogue.Manifest{Module: "files", Version: "1"}
	why := errors.New("this machine runs the bus and not one user has a credential, so the composed list would refuse every connection in the mesh")
	in := &meshInput{busRefused: why, Input: compose.Input{
		Catalogue: map[string]catalogue.Manifest{"nats": bus, "files": other},
		Nodes:     []compose.Node{{Name: "anchor", Assigned: []string{"nats"}}, {Name: "laptop", Assigned: []string{"files"}}},
	}}
	if err := refusedBus(in, "anchor"); err == nil || !strings.Contains(err.Error(), "not one user has a credential") {
		t.Fatalf("the machine that runs the bus is not refused: %v", err)
	}
	if err := refusedBus(in, "laptop"); err != nil {
		t.Fatalf("a machine that does not run the bus is refused: %v", err)
	}
	if err := refusedBus(&meshInput{Input: in.Input}, "anchor"); err != nil {
		t.Fatalf("a bus with users is refused: %v", err)
	}
}

// The controller's seal replaces the stand-in box whatever path the resource carries: the path is the manifest's with the
// machine's words filled in, not the manifest's own. It failed first, with the path compared (the live try: "composed twice and
// still names ... asked of the vault by the next send").
func TestTheControllersSealReplacesTheBoxWhateverPathTheFileCarries(t *testing.T) {
	in, module := aCoreInput(t)
	d, _, err := compose.ComposeIn(in.Input, "laptop", compose.Foreseeing)
	if err != nil {
		t.Fatal(err)
	}
	for _, r := range d.Resources {
		if _, box := r[catalogue.VaultSealedField]; box {
			r["path"] = "/home/someone/.var/lib/mesh-provisioner-client/broker"
		}
	}
	sealed, _, err := sealedByTheController(in, "laptop", d, []string{module})
	if err != nil {
		t.Fatal(err)
	}
	if left := stillForeseen(sealed); len(left) != 0 {
		t.Fatalf("the declaration still stands in for %v", left)
	}
}