mesh-sdk/go/catalogue/foundation_manifests_test.go

package catalogue

import (
	"fmt"
	"path/filepath"
	"reflect"
	"strings"
	"testing"

	"git.novox.be/novox/mesh-sdk/go/internal/beside"
)

// The catalogue's foundation modules as they are — in a merge check the catalogue cloned beside it,
// elsewhere the copy captured in testdata/beside (internal/beside, novox/hq issue 432) — parsed by the
// real parser (novox/hq ADR 0100):
// the store and the broker say which of their ports the mesh guards on an adopted node, and the
// filter module loads its table through a unit of its own whose stop deletes only that table.
// moduleTree is where a module is read from: the catalogue beside, with the catalogue as the root. In
// mesh-controller it first looked in the repository's own modules/<module>, where build-agent and
// route-proxy live whole (novox/hq ADR 0420 §1, issue 1019); mesh-sdk has no such directory, and the
// tests that read those two modules stay in mesh-controller (issue 1379).
func moduleTree(t *testing.T, module string) (root, dir string) {
	t.Helper()
	return beside.Dir(t, "mesh-catalog"), filepath.Join(beside.Catalogue(t), module)
}

func catalogueManifest(t *testing.T, module string) Manifest {
	t.Helper()
	root, dir := moduleTree(t, module)
	m, err := ReadTreeManifest(root, dir)
	if err != nil {
		t.Fatalf("%s does not parse:\n%v", module, err)
	}
	return m
}

func TestTheStoreAndTheBrokerSayWhatTheMeshGuards(t *testing.T) {
	if got := catalogueManifest(t, "postgres").Guards; !reflect.DeepEqual(got, []int{5432}) {
		t.Errorf("postgres guards %v; the store's port must be refused from outside", got)
	}
	// The bus's monitoring port, not its client port: a node reaches the bus, nobody outside
	// reads its state (novox/hq ADR 0131 — the broker that guarded 15672 has left the catalogue).
	if got := catalogueManifest(t, "nats").Guards; !reflect.DeepEqual(got, []int{8222}) {
		t.Errorf("nats guards %v; the monitoring port must be refused from outside", got)
	}
}

func TestTheFilterModuleNeverFlushesTheRuleset(t *testing.T) {
	m := catalogueManifest(t, "nftables")
	var unit, stock, load map[string]any
	for _, r := range m.Resources {
		switch r["id"] {
		case "unit":
			unit = r
		case "stock-unit-stop":
			stock = r
		case "load":
			load = r
		}
	}
	if load == nil || load["unit"] != "mesh-filter.service" {
		t.Fatalf("the filter is not loaded by its own unit: %v", load)
	}
	content, _ := unit["content"].(string)
	if unit == nil || unit["path"] != "/etc/systemd/system/mesh-filter.service" {
		t.Fatalf("the filter's unit is not written: %v", unit)
	}
	if strings.Contains(content, "flush") {
		t.Fatalf("stopping the filter flushes the whole ruleset — the runtime's and the found "+
			"firewall's with it:\n%s", content)
	}
	if !strings.Contains(content, "ExecStop=nft delete table inet mesh\n") ||
		!strings.Contains(content, "ExecStart=nft -f "+m.Filtering.Into+"\n") {
		t.Fatalf("the unit does not load the computed rule set and delete only its own table:\n%s",
			content)
	}
	// A node converged before the filter had its own unit still has the stock nftables.service
	// enabled, whose stop flushes the whole ruleset: a drop-in makes it delete only the mesh's
	// table, and the load is restarted on it so the host reloads units and the drop-in is read.
	if stock == nil || stock["path"] != "/etc/systemd/system/nftables.service.d/mesh.conf" ||
		!strings.HasSuffix(fmt.Sprint(stock["content"]),
			"[Service]\nExecStop=\nExecStop=nft delete table inet mesh\n") {
		t.Fatalf("the stock unit's stop is not replaced with deleting the mesh's table: %v", stock)
	}
	// A changed rule set is RELOADED — ExecReload replaces the table in one `nft -f`, so the node
	// is never unfiltered — and only the units themselves restart it, which is the one change a
	// reload cannot carry.
	if !reflect.DeepEqual(load["reload-on"], []any{"filtering"}) {
		t.Fatalf("the filter is restarted rather than reloaded when its rules change, leaving the "+
			"node unfiltered in between: %v", load)
	}
	if !reflect.DeepEqual(load["restart-on"], []any{"unit", "stock-unit-stop"}) {
		t.Fatalf("the filter is not restarted when its unit or the stock unit's drop-in changes: %v",
			load["restart-on"])
	}
}

// The package registry's port is the node's, like every other foundation port (novox/hq
// 04-ISSUES/085, ADR 0100). The forge is reached through what it says it serves, and consumers —
// the builder among them — are told that, rather than carrying a number of their own.