Build a minted account's value as the controller does, byte for byte, so a runtime reads the vault's unchanged (issue 774, ADR 0561 §2)

2026-10-28 21:54:04 +01:00
parent da506bb3b8
commit 8d9b3f779d
3 changed files with 115 additions and 0 deletions
@@ -344,4 +344,57 @@ func TestTheCopiedComposerComposesAsTheControllers(t *testing.T) {
 			t.Errorf("account-issued says %s at %s", raw, AccountIssuedSubject)
 		}
 	})
+	// 774/AC3 (novox/hq ADR 0561 §2): the account the vault seals is, byte for byte, what the controller hands for each of
+	// its three kinds: testdata/controller-credentials.json was written by the controller's own code (its "how").
+	t.Run("a held account is the controller's shape byte for byte", func(t *testing.T) {
+		raw, err := os.ReadFile(filepath.Join("testdata", "controller-credentials.json"))
+		if err != nil {
+			t.Fatal(err)
+		}
+		var captured struct {
+			Rows []struct{ Name, Held string }
+		}
+		if err := json.Unmarshal(raw, &captured); err != nil {
+			t.Fatal(err)
+		}
+		vault := ClaimedSeat{Seat: "mesh-vault", Scope: "mesh", Serves: []string{"get", "accept", "secret-ask", "issued",
+			"rotate", "move-in", "node-key", "own", "move-asks"}}
+		controller := ClaimedSeat{Seat: "mesh-controller", Scope: "mesh", Serves: strings.Split("tools,calls,status,nodes,"+
+			"node,placement-export,modules,seats,builds,plans,delivery-plan,delivery-order,delivery-check,deliver,"+
+			"delivery-stop,delivery-backups-again,delivery-walks,plan,assign,unassign,pin,unpin,push,rotate,give,issued,"+
+			"secret-move,secret-ask,issue,token,settings,command,queue,cancel,clear,replay,try,kill,pause,resume,hand-act,"+
+			"drill,warranted,hand-acts,durations,conditions,healers,doctor,upgrade,bus,retire,cleanup,judge-directories,"+
+			"root-free,dead-letters,data,build,artifacts,held,collect,move-placement,move-config,mirrors,images", ",")}
+		at := "nats://10.0.0.1:4222"
+		wanted := map[string]struct {
+			w        WantedAccount
+			password string
+		}{
+			"module": {WantedAccount{User: "laptop.cap-bot", Kind: KindModule, Node: "laptop", Module: "cap-bot", URL: at,
+				Fingerprint: "ab:cd", Claims: []ClaimedSeat{vault, {Seat: "node-service-manager", Scope: "node",
+					Serves: []string{"status"}}, controller, {Seat: "no-such-seat", Scope: "node"}}}, "pw-module"},
+			"module-no-claims-no-fingerprint": {WantedAccount{User: "laptop.cap-plain", Kind: KindModule, Node: "laptop",
+				Module: "cap-plain", URL: at}, "pw-plain"},
+			"provisioner": {WantedAccount{User: "provisioner.laptop", Kind: KindProvisioner, Node: "laptop", Module: "nats",
+				URL: at, Fingerprint: "ab:cd"}, "pw-prov"},
+			"process": {WantedAccount{User: "laptop.mesh-mail.send", Kind: KindProcess, Node: "laptop", Module: "mesh-mail",
+				Process: "send", URL: at, Fingerprint: "ab:cd"}, "pw-proc"},
+		}
+		if len(captured.Rows) != len(wanted) {
+			t.Fatalf("%d rows captured, %d wanted", len(captured.Rows), len(wanted))
+		}
+		for _, row := range captured.Rows {
+			c, ok := wanted[row.Name]
+			if !ok {
+				t.Fatalf("no wanted account for the captured %s", row.Name)
+			}
+			got, err := HeldCredential(c.w, c.password)
+			if err != nil || string(got) != row.Held {
+				t.Errorf("%s:\n got %s (%v)\nwant %s", row.Name, got, err, row.Held)
+			}
+		}
+		if _, err := HeldCredential(wanted["module"].w, ""); err == nil {
+			t.Error("an account was held with no password")
+		}
+	})
 }