jschoubben
d68e241724
ADR 0593 §7: the composer with its refusals leaves mesh-sdk, so mesh-sdk carries no composition rule. The catalogue functions only the node-engine's composition reaches (Resolve, Resolution's Compose, Declaration, DataItems, LeftOut, Rules and the rest, the settings, placeholder and template refusals, the rendering helpers) are copied with their tests into internal/compose/resolution; a method of a mesh-sdk shape becomes a function taking it first. The composition calls its own copies, and the captured catalogue its tests read lives here now, shared by mesh-compose's tests. Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
71 lines
2.6 KiB
Go
71 lines
2.6 KiB
Go
package resolution
|
|
|
|
import (
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
|
|
mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
|
|
"github.com/novox/mesh-host/internal/beside"
|
|
)
|
|
|
|
// **A machine trusts the mesh's authority because a module put its root there** (novox/hq ADR
|
|
// 0147, issue 129). The module carries a shell script and a unit, and both are worthless unless
|
|
// the mesh fills in where the authority is — which is the one thing about it the manifest cannot
|
|
// state, because the authority's address is a fact about the mesh and not about the module.
|
|
//
|
|
// So what is checked here is the rendering, not the parsing: the script the machine will run
|
|
// names the authority it was bound to, and the unit runs that script both ways. The verification
|
|
// itself — a plain client trusting an internal name on a machine holding this, and failing on one
|
|
// that does not — is the lab's, and cannot be had here.
|
|
func TestCaTrustRendersTheAuthorityItWasBoundTo(t *testing.T) {
|
|
m, err := mcat.ReadTreeManifest(beside.Dir(t, "mesh-catalog"), filepath.Join(beside.Catalogue(t), "ca-trust"))
|
|
if err != nil {
|
|
t.Fatalf("the trust module does not parse:\n%v", err)
|
|
}
|
|
|
|
r := mcat.Resolution{
|
|
Node: "workstation",
|
|
Modules: []mcat.Manifest{m},
|
|
Needs: []mcat.Needed{{
|
|
Name: "internal-acme-ca", From: "anchor", At: "anchor.internal", For: "ca-trust",
|
|
Serves: map[string]any{
|
|
"port": float64(9000), "path": "/acme/acme/directory", "roots": "/roots.pem",
|
|
},
|
|
}},
|
|
}
|
|
out, err := Declaration(r, mcat.Rendering{})
|
|
if err != nil {
|
|
t.Fatalf("the trust module could not be composed for a machine: %v", err)
|
|
}
|
|
|
|
script := fileNamed(out, "ca-trust.anchor")
|
|
if script == nil {
|
|
t.Fatalf("nothing writes the script the unit runs: %v", out)
|
|
}
|
|
body, _ := script["content"].(string)
|
|
if !strings.Contains(body, "https://anchor.internal:9000/roots.pem") {
|
|
t.Errorf("the script does not fetch from the authority it was bound to:\n%s", body)
|
|
}
|
|
if script["mode"] != "0755" {
|
|
t.Errorf("the script is written %v, which systemd cannot execute", script["mode"])
|
|
}
|
|
|
|
unit := fileNamed(out, "ca-trust.unit")
|
|
if unit == nil {
|
|
t.Fatalf("no unit: %v", out)
|
|
}
|
|
text, _ := unit["content"].(string)
|
|
// Both halves. A unit that only installs the anchor leaves a machine trusting an authority
|
|
// nobody assigned it to any more, which is the half issue 129 asked for by name.
|
|
for _, want := range []string{
|
|
"ExecStart=" + script["path"].(string) + " install",
|
|
"ExecStop=" + script["path"].(string) + " remove",
|
|
"RemainAfterExit=yes",
|
|
} {
|
|
if !strings.Contains(text, want) {
|
|
t.Errorf("the unit does not say %q:\n%s", want, text)
|
|
}
|
|
}
|
|
}
|