161 lines
6.9 KiB
Go
161 lines
6.9 KiB
Go
package health
|
|
|
|
import (
|
|
"encoding/json"
|
|
"os"
|
|
"reflect"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
// ADR 0564 clause 3 (issue 1952 S2): the bodies of condition-raised, condition-changed and condition-cleared read the
|
|
// events the live controller said unchanged. testdata/condition-events.json holds five transitions of the controller's
|
|
// condition history (mesh-controller_condition-history, whose entries are the events' bodies, events.go Event), captured
|
|
// on 2026-10-29 with `mesh-controller.conditions history=true days=1`: a raising, a reopening with gaps, a resolver and a
|
|
// severity change with tried and was, and a clearing with why. Never written by hand.
|
|
func TestTheControllersConditionEventsReadUnchanged(t *testing.T) {
|
|
raw, err := os.ReadFile("testdata/condition-events.json")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var captured []json.RawMessage
|
|
if err := json.Unmarshal(raw, &captured); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
changes := map[string]bool{}
|
|
for _, body := range captured {
|
|
var e Event
|
|
if err := json.Unmarshal(body, &e); err != nil {
|
|
t.Fatalf("%s: %v", body, err)
|
|
}
|
|
changes[e.Change] = true
|
|
again, err := json.Marshal(e)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var want, got map[string]any
|
|
_ = json.Unmarshal(body, &want)
|
|
_ = json.Unmarshal(again, &got)
|
|
if !reflect.DeepEqual(want, got) {
|
|
t.Errorf("the controller's %s of %s reads back as\n%s\nnot\n%s", e.Change, e.Key, again, body)
|
|
}
|
|
if EventFor(e.Change) != e.Event || e.Key != Key(e.Subject.Scope, e.Subject.ID, e.Key[strings.LastIndex(e.Key, ".")+1:]) {
|
|
t.Errorf("%s: said as %s for a %s, or its key is not its subject's", e.Key, e.Event, e.Change)
|
|
}
|
|
}
|
|
for _, c := range []string{ChangeRaised, ChangeReopened, ChangeResolver, ChangeSeverity, ChangeCleared} {
|
|
if !changes[c] {
|
|
t.Errorf("no captured %s", c)
|
|
}
|
|
}
|
|
// The keeper's own body (Limits 9, 10): epoch 0, said and not left out, silenced null, and its show and silence
|
|
// naming the new seat.
|
|
c := Condition{Key: "machine.g14.silent", Actions: []Action{SilenceAction("machine.g14.silent")}}
|
|
b, _ := json.Marshal(Event{Condition: c, Event: EventRaised, Change: ChangeRaised, Show: ShowKeeper(c.Key)})
|
|
for _, says := range []string{`"epoch":0`, `"silenced":null`, `"show":"mesh-conditions.conditions key=machine.g14.silent"`,
|
|
`"verb":"mesh-conditions.silence"`} {
|
|
if !strings.Contains(string(b), says) {
|
|
t.Errorf("the keeper's body %s does not say %s", b, says)
|
|
}
|
|
}
|
|
}
|
|
|
|
// ADR 0564 clauses 2, 7, 8, 9 (issue 1952 S3, S4): the layouts between the observers, the healers and the keeper, and the
|
|
// take-over key the readers follow.
|
|
func TestTheHealthLayoutsHoldTheKeepersRules(t *testing.T) {
|
|
at := time.Date(2026, 10, 29, 12, 0, 0, 0, time.UTC)
|
|
good := Finding{Key: "provider.keycloak.ace.mesh-mail.failing", Kind: "provider-failing", Ref: "failing",
|
|
Subject: Subject{Scope: ScopeProvider, ID: "keycloak.ace.mesh-mail", Machine: "ace"},
|
|
Severity: Warning, Summary: "keycloak on ace fails mesh-mail", Source: "S8", Observer: WatchmanModule, At: at}
|
|
for _, c := range []struct {
|
|
name string
|
|
edit func(*Finding)
|
|
fails string
|
|
}{
|
|
{name: "a finding keyed by the controller's key rule"},
|
|
// The key rule is the controller's (condition.go Key): a character the bus refuses becomes `_`, so the finding
|
|
// and the condition it raises share one key.
|
|
{name: "an unsafe id", edit: func(f *Finding) {
|
|
f.Subject.ID, f.Key = "keycloak.ace.mesh mail*", "provider.keycloak.ace.mesh_mail_.failing"
|
|
}},
|
|
{name: "a key not its parts'", edit: func(f *Finding) { f.Key = "provider.keycloak.failing" }, fails: "not"},
|
|
{name: "an unknown scope", edit: func(f *Finding) { f.Subject.Scope = "thing" }, fails: "scope"},
|
|
{name: "no severity", edit: func(f *Finding) { f.Severity = "" }, fails: "urgent or a warning"},
|
|
{name: "no observer", edit: func(f *Finding) { f.Observer = "" }, fails: "observer"},
|
|
{name: "eleven observations", edit: func(f *Finding) { f.Evidence = make([]Evidence, KeptEvidence+1) }, fails: "at most"},
|
|
} {
|
|
f := good
|
|
if c.edit != nil {
|
|
c.edit(&f)
|
|
}
|
|
b, err := EncodeFinding(f)
|
|
if c.fails != "" {
|
|
if err == nil || !strings.Contains(err.Error(), c.fails) {
|
|
t.Errorf("%s: encoded (%v), want refused saying %q", c.name, err, c.fails)
|
|
}
|
|
continue
|
|
}
|
|
back, err := DecodeFinding(b)
|
|
if err != nil || back.Key != f.Key || back.V != FindingVersion || back.Evidence == nil {
|
|
t.Errorf("%s: read back as %+v, %v", c.name, back, err)
|
|
}
|
|
// The tool runner refuses a state value with a field named like a credential (mesh-tools bus/state.go
|
|
// credentialEndings), so a finding names none, or no observer could write it (issue 1952).
|
|
if field := credentialNamed(t, b); field != "" {
|
|
t.Errorf("%s: the finding carries the field %q, which the runtime refuses in state: %s", c.name, field, b)
|
|
}
|
|
}
|
|
// A finding written under the old name `token` is still read, its key's last part kept.
|
|
if old, err := DecodeFinding([]byte(`{"v":1,"key":"provider.keycloak.ace.mesh-mail.failing","kind":"provider-failing",` +
|
|
`"token":"failing","subject":{"scope":"provider","id":"keycloak.ace.mesh-mail"},"severity":"warning","summary":"s",` +
|
|
`"source":"S8","observer":"mesh-delivery-watchman"}`)); err != nil || old.Ref != "failing" {
|
|
t.Errorf("a finding under the old name read as %+v, %v", old, err)
|
|
}
|
|
if FindingsBucket(SelfCheckModule) != "mesh-self-check_findings" || Bucket(HealersModule, AttemptsState) != "mesh-healers_attempts" ||
|
|
KeeperSeat != KeeperModule || SelfCheckSeat != SelfCheckModule {
|
|
t.Errorf("the buckets are named %s, %s", FindingsBucket(SelfCheckModule), Bucket(HealersModule, AttemptsState))
|
|
}
|
|
|
|
// An attempt reaches the condition's tried as the controller wrote it: by the healer, its outcome and what it said.
|
|
if tr := (Attempt{Healer: "H3", Act: "asserted the grants", Outcome: OutcomeEscalated, Said: "budget spent", Begun: at}).Tried(); tr !=
|
|
(Tried{At: at, What: "asserted the grants", Outcome: "escalated: budget spent", By: "healer H3"}) {
|
|
t.Errorf("an attempt is tried as %+v", tr)
|
|
}
|
|
}
|
|
|
|
// credentialNamed is the first field of a JSON value whose name ends as mesh-tools' credentialEndings do, or "".
|
|
func credentialNamed(t *testing.T, raw []byte) string {
|
|
t.Helper()
|
|
var v any
|
|
if err := json.Unmarshal(raw, &v); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
var walk func(any) string
|
|
walk = func(v any) string {
|
|
switch x := v.(type) {
|
|
case map[string]any:
|
|
for k, inner := range x {
|
|
norm := strings.NewReplacer("-", "", "_", "", " ", "").Replace(strings.ToLower(k))
|
|
for _, end := range []string{"password", "passwd", "secret", "token", "credential", "credentials",
|
|
"authorization", "apikey", "privatekey", "accesskey", "cookie"} {
|
|
if strings.HasSuffix(norm, end) {
|
|
return k
|
|
}
|
|
}
|
|
if found := walk(inner); found != "" {
|
|
return found
|
|
}
|
|
}
|
|
case []any:
|
|
for _, inner := range x {
|
|
if found := walk(inner); found != "" {
|
|
return found
|
|
}
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
return walk(v)
|
|
}
|