jschoubben
e362c800a4
On node-logins' ready the engine fetches the new value through the vault's own hand-out (own/<node>/mesh-host/<login>, opened with its sealing key), dials a second connection as the new login on the pinned certificate, and switches only if that authenticates, then calls mesh-vault.node-account-confirm over the link as the new login (the vault is asked in the name of the login the open link authenticated as, and only once that link is open). It keeps the old value until the key says the rotation is done and drops it then, never before; an abandon, after the switch before or after the confirmation, switches back before the new value is dropped; repeated refusals of the new login's credentials before rotation-done bring it back to the old one, said as the finding node-account-fallback (in the journal: no route for an engine's finding to the watchman is decided), and the same rotation is not tried again. Tests: two added, paid by merging two identity sealing tests into one; more to be paid by deleting the identity token tests that move to mesh-sdk with the token (774/S64). (issue 774, 774/S62, 774/S63) Claude-Session: https://claude.ai/code/session_01NcbgfJ9Gum47zkFKWRaovL
36 lines
1.0 KiB
Go
36 lines
1.0 KiB
Go
package link
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"time"
|
|
|
|
"github.com/nats-io/nats.go"
|
|
)
|
|
|
|
// TestDial dials a second connection to the bus as login with password, on the pinned certificate and the node's one inbox,
|
|
// and answers whether it authenticated (novox/hq ADR 0583 §3): the connection is closed at once, nothing is subscribed or said.
|
|
func TestDial(ctx context.Context, m Membership, login, password string, timeout time.Duration) error {
|
|
config, err := PinnedConfig(m.Fingerprint)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
conn, err := nats.Connect(natsURL(m.Broker),
|
|
nats.Secure(config),
|
|
nats.UserInfo(login, password),
|
|
nats.CustomInboxPrefix("_INBOX.node."+m.Node),
|
|
nats.Name("mesh-host/"+m.Node+"/test-dial"),
|
|
nats.Timeout(timeout),
|
|
nats.NoReconnect())
|
|
if err != nil {
|
|
return fmt.Errorf("cannot dial as %s: %w", login, err)
|
|
}
|
|
defer conn.Close()
|
|
flush, cancel := context.WithTimeout(ctx, timeout)
|
|
defer cancel()
|
|
if err := conn.FlushWithContext(flush); err != nil {
|
|
return fmt.Errorf("the bus did not answer as %s: %w", login, err)
|
|
}
|
|
return nil
|
|
}
|