amadan

carlos / platform Public

console: pin the instance record creation sites (#155)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude bc8adfddb6600c13ff75acd5c203a8c3ba23e99d parent e26f8e2
1 file changed, +114 −0
  • internal/console/instancetoken_creation_test.go +114 −0
diff --git a/internal/console/instancetoken_creation_test.go b/internal/console/instancetoken_creation_test.go
new file mode 100644
index 000000000..b239f2f4f
--- /dev/null
+++ b/internal/console/instancetoken_creation_test.go
@@ -0,0 +1,114 @@
+package console
+
+import (
+ "go/ast"
+ "go/parser"
+ "go/token"
+ "io/fs"
+ "os"
+ "path/filepath"
+ "slices"
+ "strings"
+ "testing"
+)
+
+// reviewedCreationSites is every path that creates an instance record (spec
+// 2026-10-16-instance-bound-tokens §3.4), as "file:function". Each stamps
+// CreatedAt from the clock at creation (or, for hostops.PrepareInstance,
+// refuses a supplied one and stamps its own), which is what makes an
+// instance token's incarnation binding sound. The seed and import doors
+// create from the record the create door stamped a moment earlier.
+//
+// A new caller fails TestInstanceRecordCreationSitesAreReviewed: read it,
+// check it stamps the clock and never replays a saved record, then add it.
+var reviewedCreationSites = []string{
+ "internal/console/apiinstanceimport.go:beginImport",
+ "internal/console/apiinstances.go:handleAPIInstanceCreate",
+ "internal/console/apiinstanceseed.go:beginFrom",
+ "internal/console/claim_first_route.go:attachClaimFirstRoute",
+ "internal/console/domainattach.go:attachDomainAs",
+ "internal/provision/replica.go:CreateRecordReplica",
+}
+
+func TestInstanceRecordCreationSitesAreReviewed(t *testing.T) {
+ root, err := filepath.Abs("../..")
+ if err != nil {
+ t.Fatal(err)
+ }
+ if _, err := os.Stat(filepath.Join(root, "go.mod")); err != nil {
+ t.Fatalf("module root not at %s: %v", root, err)
+ }
+ fset := token.NewFileSet()
+ var got []string
+ err = filepath.WalkDir(root, func(path string, d fs.DirEntry, err error) error {
+ if err != nil {
+ return err
+ }
+ if d.IsDir() {
+ if name := d.Name(); path != root && (strings.HasPrefix(name, ".") || name == "testdata" || name == "vendor") {
+ return filepath.SkipDir
+ }
+ return nil
+ }
+ if !strings.HasSuffix(path, ".go") || strings.HasSuffix(path, "_test.go") {
+ return nil
+ }
+ f, err := parser.ParseFile(fset, path, nil, 0)
+ if err != nil {
+ return err
+ }
+ rel, _ := filepath.Rel(root, path)
+ pkg := f.Name.Name
+ for _, decl := range f.Decls {
+ fn, ok := decl.(*ast.FuncDecl)
+ if !ok || fn.Body == nil {
+ continue
+ }
+ ast.Inspect(fn.Body, func(n ast.Node) bool {
+ call, ok := n.(*ast.CallExpr)
+ if !ok {
+ return true
+ }
+ if isCreationCall(call.Fun, pkg) {
+ site := filepath.ToSlash(rel) + ":" + fn.Name.Name
+ if !slices.Contains(got, site) {
+ got = append(got, site)
+ }
+ }
+ return true
+ })
+ }
+ return nil
+ })
+ if err != nil {
+ t.Fatal(err)
+ }
+ slices.Sort(got)
+ want := slices.Clone(reviewedCreationSites)
+ slices.Sort(want)
+ for _, s := range got {
+ if !slices.Contains(want, s) {
+ t.Errorf("unreviewed instance record creation site %s: check it stamps CreatedAt from the clock, then add it to reviewedCreationSites", s)
+ }
+ }
+ for _, s := range want {
+ if !slices.Contains(got, s) {
+ t.Errorf("reviewed creation site %s no longer creates a record: remove it", s)
+ }
+ }
+}
+
+// isCreationCall reports a call of provision.CreateRecord or
+// hostops.PrepareInstance, qualified from outside their packages or bare
+// from inside them.
+func isCreationCall(fun ast.Expr, pkg string) bool {
+ switch f := fun.(type) {
+ case *ast.SelectorExpr:
+ x, ok := f.X.(*ast.Ident)
+ return ok && ((x.Name == "provision" && f.Sel.Name == "CreateRecord") ||
+ (x.Name == "hostops" && f.Sel.Name == "PrepareInstance"))
+ case *ast.Ident:
+ return (pkg == "provision" && f.Name == "CreateRecord") || (pkg == "hostops" && f.Name == "PrepareInstance")
+ }
+ return false
+}