amadan
console: classify the routes door the rebase brought in
`GET /api/cli/apps/{account}/{app}/routes` (apiroutes.go, issue #64) landed on
main while this branch was being built. Rebasing onto it produced the one
conflict of the whole replay, and it produced it in exactly the right place:
the door arrived registered with mux.HandleFunc, and cliRoute is now the only
legal way to register an /api/cli/ door.
Its authority was not a judgement call — apiroutes.go's own package comment
already answers it. That door is gated on apiAccountApp and deliberately NOT on
the instance family's gate, because "an app token is a machine credential
minted for one instance to register itself; this answer describes every route
of the app, with upstream addresses, owning units and environment bindings,
which is an operator's view rather than a workload's". A service credential is
the same kind of caller an app token is, so the door that refuses one refuses
all of them: the zero Set, and a place in policyDoors — person-only by intent
rather than by bookkeeping.
closedDoors 12 -> 13, and the e2e pin's deliberate hardcoded count with it.
TestEveryCLIDoorNamesItsRoles is what caught this, with a set difference and a
message naming both directions of the failure.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_016UimU7fAfeAoBMm6HKCPwQ
1 file changed,
+3
−2
internal/console/svcroutes_test.go+3 −2
diff --git a/internal/console/svcroutes_test.go b/internal/console/svcroutes_test.go| index a3b6ad21b..9faa6eb20 100644 |
| --- a/internal/console/svcroutes_test.go |
| +++ b/internal/console/svcroutes_test.go |
| @@ -50,7 +50,7 @@ import ( |
| var ( |
| mintDoors = []string{"/instance-token", "/api/cli/services/"} |
| fleetDoors = []string{"/api/cli/fleets/"} |
| - policyDoors = []string{"/instances-manifest"} |
| + policyDoors = []string{"/instances-manifest", "/{app}/routes"} |
| ) |
| // closedDoors is the exact set of /api/cli/ patterns registered with the zero |
| @@ -73,6 +73,7 @@ var closedDoors = []string{ |
| // inside, and none ever has: handleAPIInstanceEnable gates on |
| // apiAccountApp, which could not see a non-person at all. Closing it at |
| // the registration says so where the role table can be read. |
| + "GET /api/cli/apps/{account}/{app}/routes", |
| "PUT /api/cli/apps/{account}/{app}/instances-manifest", |
| // Enrolling a BOX into a fleet, and rotating or detaching one, is a |
| // human act with a machine's credentials as its output. Same cut. |
| @@ -600,7 +601,7 @@ func TestEveryClosedDoorRefusesAServiceCredential(t *testing.T) { |
| } |
| seen++ |
| } |
| - if seen != len(closedDoors) || seen != 12 { |
| + if seen != len(closedDoors) || seen != 13 { |
| t.Errorf("walked %d closed doors, want all %d (and 12 today: instance-token, instances-manifest, six fleets, four services)", |
| seen, len(closedDoors)) |
| } |