Take the catalogue's composition rules into the node-engine

ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk carries no composition rule. The catalogue functions only the node-engine's composition reaches (Resolve, Resolution's Compose, Declaration, DataItems, LeftOut, Rules and the rest, the settings, placeholder and template refusals, the rendering helpers) are copied with their tests into internal/compose/resolution; a method of a mesh-sdk shape becomes a function taking it first. The composition calls its own copies, and the captured catalogue its tests read lives here now, shared by mesh-compose's tests. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
2026-11-02 19:15:55 +01:00
parent be0226b624
commit d68e241724
686 changed files with 35703 additions and 80 deletions
@@ -0,0 +1,79 @@
+package resolution
+
+import (
+	"strings"
+	"testing"
+
+	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
+)
+
+func needy() mcat.Manifest {
+	return mcat.Manifest{
+		Module: "postgres", Version: "1",
+		OwnSecrets: mcat.OwnSecrets{"superuser": {Path: "/var/lib/mesh/postgres/superuser"}},
+		Resources: []map[string]any{
+			{"id": "store", "type": "container", "name": "mesh-postgres", "image": "postgres@sha256:x"},
+		},
+	}
+}
+
+func TestAModulesOwnSecretLandsSealed(t *testing.T) {
+	got, err := Resolve(shelf(needy()), []string{"postgres"}, reachable(), mcat.World{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, err := Declaration(got, mcat.Rendering{
+		Needed: map[string]map[string]string{"postgres": {"superuser": "c2VhbGVk"}},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, r := range out {
+		if r["path"] != "/var/lib/mesh/postgres/superuser" {
+			continue
+		}
+		if r["sealed"] != "c2VhbGVk" {
+			t.Fatalf("got %v", r)
+		}
+		if r["content"] != nil {
+			t.Fatal("a module's own secret was written in the clear")
+		}
+		return
+	}
+	t.Fatalf("no secret was written: %v", out)
+}
+
+func TestADeclaredNeedThatWasNotMadeIsRefused(t *testing.T) {
+	// Skipping it would start a database with no password it knows, which fails to authenticate
+	// three layers from the machine reporting it.
+	got, _ := Resolve(shelf(needy()), []string{"postgres"}, reachable(), mcat.World{})
+	_, err := Declaration(got, mcat.Rendering{})
+	if err == nil {
+		t.Fatal("a module needing a secret was declared without one")
+	}
+	if !strings.Contains(err.Error(), "superuser") {
+		t.Fatalf("the refusal does not name what is missing: %v", err)
+	}
+}
+
+func TestAModuleMayNeedSeveralThings(t *testing.T) {
+	// A password and a token, say. Telling them apart is the module's business, not the mesh's.
+	m := needy()
+	m.OwnSecrets["replication"] = mcat.OwnSecret{Path: "/var/lib/mesh/postgres/replication"}
+	got, _ := Resolve(shelf(m), []string{"postgres"}, reachable(), mcat.World{})
+	out, err := Declaration(got, mcat.Rendering{Needed: map[string]map[string]string{
+		"postgres": {"superuser": "b25l", "replication": "dHdv"},
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	seen := map[string]string{}
+	for _, r := range out {
+		if path, ok := r["path"].(string); ok && strings.Contains(path, "/var/lib/mesh/postgres/") {
+			seen[path], _ = r["sealed"].(string)
+		}
+	}
+	if len(seen) != 2 || seen["/var/lib/mesh/postgres/superuser"] == seen["/var/lib/mesh/postgres/replication"] {
+		t.Fatalf("two needs did not land as two secrets: %v", seen)
+	}
+}