amadan

carlos / platform Public

Clone 
git clone https://amadan.net/carlos/platform

Plain git — no account needed to clone.

Download

Download this file

1package console
2
3import (
4 "context"
5 "encoding/json"
6 "errors"
7 "fmt"
8 "io"
9 "net/http"
10 "strings"
11 "sync"
12 "testing"
13 "time"
14
15 "github.com/carlosframework/platform/internal/provision"
16 "github.com/carlosframework/platform/internal/release"
17 "github.com/carlosframework/platform/internal/status"
18 "github.com/carlosframework/platform/internal/svcrole"
19 "github.com/carlosframework/platform/internal/updatewords"
20)
21
22const updURL = "/api/cli/apps/bab/km/instances/a.example.com/updates"
23
24// updatesFx is newConsoleFixture with app km in the ops account bab: v1 and
25// v2 shipped, v1 promoted to stable (so v1 has a promotion record and v2 has
26// none), and one instance record, a.example.com on stable with no settings.
27type updatesFx struct {
28 *consoleFixture
29 t *testing.T
30 store release.Store
31 member string // a CLI bearer for alice, a plain (non-owner) member of bab
32 owner string // a CLI bearer for paul, an owner of the ops account bab: the account in updURL
33 instanceToken string // an app-wide svcrole.Instance credential for km
34}
35
36func updatesFixture(t *testing.T) *updatesFx {
37 t.Helper()
38 fx := newConsoleFixture(t)
39 now := time.Now()
40 if _, err := fx.st.CreateAppIn(OpsAccountID, "km", "paul@keymail.dev", now); err != nil {
41 t.Fatal(err)
42 }
43 if err := fx.st.AddMember(OpsAccountID, "alice@keymail.dev", RoleMember, now); err != nil {
44 t.Fatal(err)
45 }
46 shipVersion(t, fx, "km", "v1")
47 shipVersion(t, fx, "km", "v2")
48 seedChannel(t, fx, "km", "stable", "v1")
49 ux := &updatesFx{
50 consoleFixture: fx,
51 t: t,
52 store: fx.rel,
53 member: cliToken(t, fx, "alice@keymail.dev", "code-updates-member"),
54 owner: cliToken(t, fx, "paul@keymail.dev", "code-updates-owner"),
55 instanceToken: serviceToken(t, fx.st, OpsAccountID, "router", "km", svcrole.Instance),
56 }
57 ux.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable"})
58 ux.putRecord(provision.Record{Schema: 1, Host: "a.example.com", Slug: "a", App: "km",
59 Account: release.OpsAccount, Channel: "stable", CreatedAt: now.UTC()})
60 return ux
61}
62
63// putRecord replaces (or creates) the record at rec's key with rec.
64func (fx *updatesFx) putRecord(rec provision.Record) {
65 fx.t.Helper()
66 ctx := context.Background()
67 if err := fx.store.Delete(ctx, provision.RecordKey(rec.Account, rec.App, rec.Host)); err != nil {
68 fx.t.Fatal(err)
69 }
70 if err := provision.CreateRecord(ctx, fx.store, rec); err != nil {
71 fx.t.Fatal(err)
72 }
73}
74
75func (fx *updatesFx) record(host string) provision.Record {
76 fx.t.Helper()
77 rec, err := provision.GetRecord(context.Background(), fx.store, release.OpsAccount, "km", host)
78 if err != nil {
79 fx.t.Fatal(err)
80 }
81 return *rec
82}
83
84// setManifest writes km's instances manifest (and so its update policy).
85func (fx *updatesFx) setManifest(m provision.Manifest) {
86 fx.t.Helper()
87 enableInstances(fx.t, fx.consoleFixture, "km", m)
88}
89
90// manifest reads km's instances manifest back.
91func (fx *updatesFx) manifest() provision.Manifest {
92 fx.t.Helper()
93 m, err := provision.GetManifest(context.Background(), fx.store, release.OpsAccount, "km")
94 if err != nil {
95 fx.t.Fatal(err)
96 }
97 return *m
98}
99
100// createInstance creates host through the console's create door as the
101// member, naming no channel, so the record takes the manifest's.
102func (fx *updatesFx) createInstance(t *testing.T, host string) {
103 t.Helper()
104 st, _, out := rawReq(t, http.MethodPost, instancesURL(fx.consoleFixture, "bab", "km"), fx.member, `{"host":"`+host+`"}`)
105 if st != http.StatusCreated {
106 t.Fatalf("create %s: %d %s", host, st, out)
107 }
108}
109
110// boxesEnforce makes the deployment one box, ie-1: an edges record and a
111// fresh heartbeat whose binary does (on) or does not apply update settings.
112func (fx *updatesFx) boxesEnforce(on bool) {
113 fx.t.Helper()
114 if _, _, err := fx.store.Get(context.Background(), "control/edges/ie-1.json"); err != nil {
115 seedEdgesRecord(fx.t, fx.consoleFixture, "ie-1")
116 }
117 m := &status.BoxMetrics{}
118 if on {
119 m.UpdateSettings = status.UpdateSettingsProtocol
120 }
121 seedSettingsBox(fx.t, fx.consoleFixture, "ie-1", time.Now(), m)
122}
123
124// sendJSON is rawReq with body marshalled to JSON.
125func sendJSON(t *testing.T, method, u string, body any, bearer string) (int, string) {
126 t.Helper()
127 raw, err := json.Marshal(body)
128 if err != nil {
129 t.Fatal(err)
130 }
131 st, _, out := rawReq(t, method, u, bearer, string(raw))
132 return st, out
133}
134
135func TestUpdatesGetShowsDefaults(t *testing.T) {
136 fx := updatesFixture(t)
137 st, out := getRaw(t, fx.ts.URL+updURL, fx.member)
138 if st != http.StatusOK || !strings.Contains(out, `"updates":"auto"`) || !strings.Contains(out, `"enforced":false`) {
139 t.Fatalf("GET: %d %s", st, out)
140 }
141}
142
143func TestUpdatesPutIsRefusedUntilEveryBoxEnforces(t *testing.T) {
144 fx := updatesFixture(t)
145 fx.boxesEnforce(false)
146 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
147 if st != http.StatusConflict || !strings.Contains(out, "every box") {
148 t.Fatalf("manual before the fleet enforces: %d %s", st, out)
149 }
150 // R3: a member is told how many boxes, never which.
151 if strings.Contains(out, "ie-1") || !strings.Contains(out, "1 boxes") {
152 t.Fatalf("the refusal must give a count and name no box: %s", out)
153 }
154 if fx.record("a.example.com").Updates != "" {
155 t.Fatal("a refused enable wrote the record")
156 }
157 fx.boxesEnforce(true)
158 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
159 if st != http.StatusOK || fx.record("a.example.com").Updates != release.UpdatesManual {
160 t.Fatalf("manual once enforced: %d %s", st, out)
161 }
162}
163
164// R3: when the gate cannot read the boxes at all, enabling is refused with
165// its own words, and the store's error text never reaches the member.
166func TestUpdatesPutIsRefusedWhenEnforcementIsUnknown(t *testing.T) {
167 fx := updatesFixture(t)
168 fx.boxesEnforce(true)
169 fx.srv.cfg.Releases = unlistableStore{fx.rel}
170 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
171 if st != http.StatusBadGateway || !strings.Contains(out, updatewords.Text("settings.console.enforcement-unknown")) {
172 t.Fatalf("enable with an unreadable inventory: %d %s", st, out)
173 }
174 if strings.Contains(out, brokenStoreErr) {
175 t.Fatalf("the refusal leaks the store's error: %s", out)
176 }
177 // Clearing is still allowed.
178 if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "auto"}, fx.member); st != http.StatusOK {
179 t.Fatalf("disabling with an unreadable inventory: %d %s", st, out)
180 }
181}
182
183// Review Focus 5.
184func TestClearingIsNeverRefused(t *testing.T) {
185 fx := updatesFixture(t)
186 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Pin: "v1"})
187 fx.boxesEnforce(false)
188 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": ""}, fx.member)
189 if st != http.StatusOK || fx.record("a.example.com").Pin != "" {
190 t.Fatalf("clearing a pin: %d %s", st, out)
191 }
192}
193
194// Fix round 1: a value re-sent unchanged beside a clear is not an enable, so
195// a client that sends its full state can still clear while the fleet does not
196// enforce. A changed value still waits.
197func TestClearingBesideAnUnchangedEnableIsNeverRefused(t *testing.T) {
198 fx := updatesFixture(t)
199 fx.boxesEnforce(false)
200 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
201 Updates: release.UpdatesManual, Pin: "v1"})
202 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual", "pin": ""}, fx.member)
203 if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Pin != "" || rec.Updates != release.UpdatesManual {
204 t.Fatalf("manual re-sent, pin cleared: %d %s, record %+v", st, out, rec)
205 }
206 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
207 Updates: release.UpdatesManual, Pin: "v1"})
208 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v1", "updates": "auto"}, fx.member)
209 if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Pin != "v1" || rec.Updates != release.UpdatesAuto {
210 t.Fatalf("pin re-sent, manual turned off: %d %s, record %+v", st, out, rec)
211 }
212 two := 2
213 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
214 Updates: release.UpdatesManual, Major: &two})
215 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2, "updates": "auto"}, fx.member)
216 if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Major == nil || *rec.Major != 2 || rec.Updates != release.UpdatesAuto {
217 t.Fatalf("major re-sent, manual turned off: %d %s, record %+v", st, out, rec)
218 }
219 // A changed value is still an enable, and still waits.
220 for _, body := range []map[string]any{{"major": 3}, {"pin": "v1", "updates": "auto"}, {"updates": "manual"}} {
221 before := fx.record("a.example.com")
222 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, body, fx.member)
223 if st != http.StatusConflict || !strings.Contains(out, "every box") {
224 t.Errorf("%v before the fleet enforces: %d %s", body, st, out)
225 }
226 if after := fx.record("a.example.com"); after.Updates != before.Updates || after.Pin != before.Pin || !sameMajor(after.Major, before.Major) {
227 t.Errorf("%v: a refused enable wrote the record: %+v -> %+v", body, before, after)
228 }
229 }
230}
231
232func TestPinMustHaveAPromotionRecord(t *testing.T) {
233 fx := updatesFixture(t) // ships km v1 and v2 and promotes v1 to stable
234 fx.boxesEnforce(true)
235 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v2"}, fx.member)
236 if st != http.StatusConflict || !strings.Contains(out, "promotion record") {
237 t.Fatalf("pin of an unpromoted build: %d %s", st, out)
238 }
239 st, _ = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v1"}, fx.member)
240 if st != http.StatusOK || fx.record("a.example.com").Pin != "v1" {
241 t.Fatalf("pin of a promoted build: %d", st)
242 }
243}
244
245// R7: a record that is there but cannot be verified is not "no record": it
246// is a 502 that asks for a retry, and the pin is not written.
247func TestPinCheckFailureIsNotNoRecord(t *testing.T) {
248 fx := updatesFixture(t)
249 fx.boxesEnforce(true)
250 if _, err := fx.store.Put(context.Background(), release.PromotionRecordKey("bab", "km", "v2"), []byte(`{"payload":"x","sig":"AAAA"}`), ""); err != nil {
251 t.Fatal(err)
252 }
253 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v2"}, fx.member)
254 want := fmt.Sprintf(updatewords.Text("settings.console.pin-check-failed"), "v2")
255 if st != http.StatusBadGateway || jsonErrorText(t, out) != want {
256 t.Fatalf("pin with an unverifiable record: %d %s", st, out)
257 }
258 if fx.record("a.example.com").Pin != "" {
259 t.Fatal("the pin was written")
260 }
261}
262
263// Strict input: a value of the wrong type is refused, never read as a clear.
264func TestUpdatesPutRefusesWrongTypes(t *testing.T) {
265 fx := updatesFixture(t)
266 fx.boxesEnforce(true)
267 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
268 Updates: release.UpdatesManual, Pin: "v1"})
269 for _, c := range []struct {
270 body string
271 want string
272 }{
273 {`{"updates":5}`, updatewords.Text("settings.console.bad-updates")},
274 {`{"updates":true}`, updatewords.Text("settings.console.bad-updates")},
275 {`{"updates":"sometimes"}`, updatewords.Text("settings.console.bad-updates")},
276 {`{"pin":true}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "true")},
277 {`{"pin":5}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "5")},
278 {`{"pin":"dev"}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "dev")},
279 {`{"pin":"../v1"}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "../v1")},
280 {`{"major":-1}`, updatewords.Text("settings.console.bad-major")},
281 {`{"major":1.5}`, updatewords.Text("settings.console.bad-major")},
282 {`{"major":"2"}`, updatewords.Text("settings.console.bad-major")},
283 {`{"major":1e300}`, updatewords.Text("settings.console.bad-major")},
284 } {
285 st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+updURL, fx.member, c.body)
286 if st != http.StatusBadRequest || jsonErrorText(t, out) != c.want {
287 t.Errorf("%s: %d %s, want 400 %q", c.body, st, out, c.want)
288 }
289 }
290 if rec := fx.record("a.example.com"); rec.Updates != release.UpdatesManual || rec.Pin != "v1" || rec.Major != nil {
291 t.Fatalf("a refused request changed the record: %+v", rec)
292 }
293 // null and "" clear.
294 if st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+updURL, fx.member, `{"updates":null,"pin":""}`); st != http.StatusOK {
295 t.Fatalf("clearing with null and empty: %d %s", st, out)
296 }
297 if rec := fx.record("a.example.com"); rec.Updates != "" || rec.Pin != "" {
298 t.Fatalf("null and empty did not clear: %+v", rec)
299 }
300}
301
302func TestMajorOnlyOnStable(t *testing.T) {
303 fx := updatesFixture(t)
304 fx.boxesEnforce(true)
305 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "beta"})
306 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2}, fx.member)
307 if st != http.StatusBadRequest || !strings.Contains(out, "stable") {
308 t.Fatalf("major off stable: %d %s", st, out)
309 }
310}
311
312// R4: a major left behind by a channel move is ignored by reconcile and shown
313// as major_ignored; it neither blocks an unrelated change nor is cleared by it.
314func TestStaleMajorOffStableIsLeftAlone(t *testing.T) {
315 fx := updatesFixture(t)
316 two := 2
317 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "beta", Major: &two})
318 st, out := getRaw(t, fx.ts.URL+updURL, fx.member)
319 if st != http.StatusOK || !strings.Contains(out, `"major_ignored":true`) {
320 t.Fatalf("GET of a stale major: %d %s", st, out)
321 }
322 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "auto"}, fx.member)
323 if st != http.StatusOK {
324 t.Fatalf("an unrelated change on a record with a stale major: %d %s", st, out)
325 }
326 if rec := fx.record("a.example.com"); rec.Updates != release.UpdatesAuto || rec.Major == nil || *rec.Major != 2 {
327 t.Fatalf("record after the change: %+v", rec)
328 }
329 // Clearing the stale major is allowed too.
330 if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": nil}, fx.member); st != http.StatusOK || fx.record("a.example.com").Major != nil {
331 t.Fatalf("clearing a stale major: %d %s", st, out)
332 }
333}
334
335// Astra r1 #2: a client that sends its full state resends the stale major
336// beside a clear. The unchanged major is not a new major off stable: the
337// clear goes through, the major is kept (R4), and that holds while the fleet
338// gate is closed too. A changed major off stable is still refused.
339func TestFullStateClearBesideAStaleMajor(t *testing.T) {
340 for _, enforced := range []bool{true, false} {
341 t.Run(fmt.Sprintf("enforced=%v", enforced), func(t *testing.T) {
342 fx := updatesFixture(t)
343 fx.boxesEnforce(enforced)
344 two := 2
345 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "beta",
346 Updates: release.UpdatesManual, Major: &two, Pin: "v1"})
347 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2, "pin": ""}, fx.member)
348 if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Pin != "" || rec.Major == nil || *rec.Major != 2 {
349 t.Fatalf("pin cleared beside the unchanged stale major: %d %s, record %+v", st, out, rec)
350 }
351 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2, "pin": "", "updates": "auto"}, fx.member)
352 if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Updates != release.UpdatesAuto || rec.Major == nil || *rec.Major != 2 {
353 t.Fatalf("manual turned off beside the unchanged stale major: %d %s, record %+v", st, out, rec)
354 }
355 // A changed major off stable is still refused, before the gate.
356 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 3, "pin": ""}, fx.member)
357 if st != http.StatusBadRequest || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.major-off-stable"), "a.example.com", "beta") {
358 t.Fatalf("a changed major off stable: %d %s", st, out)
359 }
360 if rec := fx.record("a.example.com"); rec.Major == nil || *rec.Major != 2 {
361 t.Fatalf("a refused major was written: %+v", rec)
362 }
363 })
364 }
365}
366
367func TestMajorOnStableIsSetAndCleared(t *testing.T) {
368 fx := updatesFixture(t)
369 fx.boxesEnforce(true)
370 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 3}, fx.member)
371 if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Major == nil || *rec.Major != 3 {
372 t.Fatalf("major on stable: %d %s", st, out)
373 }
374 if !strings.Contains(out, `"major":3`) || !strings.Contains(out, `"major_ignored":false`) {
375 t.Fatalf("the view after the change: %s", out)
376 }
377 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": ""}, fx.member)
378 if st != http.StatusOK || fx.record("a.example.com").Major != nil {
379 t.Fatalf("clearing major with empty: %d %s", st, out)
380 }
381}
382
383// A change bumps the serial once and leaves an activity line; a request that
384// changes nothing does neither.
385func TestUpdatesPutAnnouncesOnlyChanges(t *testing.T) {
386 fx := updatesFixture(t)
387 fx.boxesEnforce(true)
388 before := serial(t, fx.consoleFixture)
389 if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{}, fx.member); st != http.StatusOK {
390 t.Fatalf("empty PUT: %d %s", st, out)
391 }
392 if got := serial(t, fx.consoleFixture); got != before {
393 t.Fatalf("an empty PUT bumped the serial: %d -> %d", before, got)
394 }
395 if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member); st != http.StatusOK {
396 t.Fatalf("manual: %d %s", st, out)
397 }
398 if got := serial(t, fx.consoleFixture); got != before+1 {
399 t.Fatalf("serial = %d, want one bump from %d", got, before)
400 }
401 acts, err := fx.st.Events(OpsAccountID, "km", 50)
402 if err != nil {
403 t.Fatal(err)
404 }
405 want := fmt.Sprintf(updatewords.Text("settings.console.audit-set"), "a.example.com", "updates manual")
406 found := false
407 for _, a := range acts {
408 if a.Action == "instance-updates" && a.Detail == want && a.Address == "alice@keymail.dev" {
409 found = true
410 }
411 }
412 if !found {
413 t.Fatalf("no activity line %q by alice in %+v", want, acts)
414 }
415}
416
417func TestUpdatesDoorsRefuseNamedUnitsAndOtherKinds(t *testing.T) {
418 fx := updatesFixture(t)
419 fx.boxesEnforce(true)
420 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Unit: "console.service", Addr: "127.0.0.1:8080"})
421 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
422 if st != http.StatusConflict || !strings.Contains(out, "systemd unit") {
423 t.Fatalf("named unit: %d %s", st, out)
424 }
425 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Kind: "service", Addr: "127.0.0.1:8080"})
426 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
427 if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.not-instance"), "a.example.com", "service") {
428 t.Fatalf("service route: %d %s", st, out)
429 }
430 // Clearing is refused on these too: the door does not apply to them at all.
431 if rec := fx.record("a.example.com"); rec.Updates != "" {
432 t.Fatalf("a refused request wrote the record: %+v", rec)
433 }
434}
435
436func TestUpdatesDoorsRefuseChannel(t *testing.T) {
437 fx := updatesFixture(t)
438 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"channel": "beta"}, fx.member)
439 if st != http.StatusBadRequest || !strings.Contains(out, updatewords.Text("settings.console.channel-elsewhere")) {
440 t.Fatalf("channel through /updates: %d %s", st, out)
441 }
442}
443
444// An unknown host is the family's 404, for both doors.
445func TestUpdatesDoorsUnknownHostIs404(t *testing.T) {
446 fx := updatesFixture(t)
447 u := fx.ts.URL + "/api/cli/apps/bab/km/instances/nope.example.com/updates"
448 if st, out := getRaw(t, u, fx.member); st != http.StatusNotFound {
449 t.Fatalf("GET of an unknown host: %d %s", st, out)
450 }
451 if st, out := sendJSON(t, http.MethodPut, u, map[string]string{"updates": "auto"}, fx.member); st != http.StatusNotFound {
452 t.Fatalf("PUT of an unknown host: %d %s", st, out)
453 }
454}
455
456// The instance-bound credential is #155 step 6: until then no service
457// credential reaches any of the four doors.
458func TestUpdatesDoorsRefuseAppWideCredentials(t *testing.T) {
459 fx := updatesFixture(t)
460 for _, c := range []struct{ method, url string }{
461 {http.MethodGet, updURL}, {http.MethodPut, updURL},
462 {http.MethodPost, updURL + "/install"}, {http.MethodPut, "/api/cli/apps/bab/km/updates"},
463 } {
464 st, _ := sendJSON(t, c.method, fx.ts.URL+c.url, map[string]string{}, fx.instanceToken)
465 if st != http.StatusNotFound && st != http.StatusForbidden {
466 t.Errorf("%s %s with an app-wide instance credential: %d", c.method, c.url, st)
467 }
468 }
469}
470
471func TestTheConsoleNeverChoosesABuild(t *testing.T) {
472 fx := updatesFixture(t)
473 fx.boxesEnforce(true)
474 before := fx.record("a.example.com")
475 if st, _ := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member); st != http.StatusOK {
476 t.Fatal(st)
477 }
478 after := fx.record("a.example.com")
479 if after.Pin != before.Pin || after.Channel != before.Channel {
480 t.Fatalf("a preference change moved a build: %+v -> %+v", before, after)
481 }
482 _ = context.Background()
483}
484
485func TestInstallBumpsTheRequestAndChoosesNoBuild(t *testing.T) {
486 fx := updatesFixture(t)
487 before := fx.record("a.example.com")
488 serialBefore := serial(t, fx.consoleFixture)
489 st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
490 if st != http.StatusOK || !strings.Contains(out, `"request":1`) {
491 t.Fatalf("install: %d %s", st, out)
492 }
493 rec := fx.record("a.example.com")
494 if rec.InstallRequest == nil || rec.InstallRequest.ID != 1 || rec.InstallRequest.FastTrack ||
495 rec.InstallRequest.By != "alice@keymail.dev" || rec.InstallRequest.At.IsZero() {
496 t.Fatalf("record = %+v", rec)
497 }
498 // The console never names a build: the pin, channel and settings are as
499 // they were, and only the request moved.
500 if rec.Pin != before.Pin || rec.Channel != before.Channel || rec.Updates != before.Updates || !sameMajor(rec.Major, before.Major) {
501 t.Fatalf("Update now moved a build or a setting: %+v -> %+v", before, rec)
502 }
503 if got := serial(t, fx.consoleFixture); got != serialBefore+1 {
504 t.Fatalf("serial = %d, want one bump from %d", got, serialBefore)
505 }
506 acts, err := fx.st.Events(OpsAccountID, "km", 50)
507 if err != nil {
508 t.Fatal(err)
509 }
510 want := fmt.Sprintf(updatewords.Text("settings.console.audit-install"), "a.example.com", 1)
511 found := false
512 for _, a := range acts {
513 if a.Action == "instance-update-now" && a.Detail == want && a.Address == "alice@keymail.dev" {
514 found = true
515 }
516 }
517 if !found {
518 t.Fatalf("no activity line %q by alice in %+v", want, acts)
519 }
520 st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
521 if st != http.StatusOK || !strings.Contains(out, `"request":2`) || fx.record("a.example.com").InstallRequest.ID != 2 {
522 t.Fatalf("the second request did not increase the id: %d %s", st, out)
523 }
524}
525
526// Update now is not one of the settings §4.4 holds until every box applies
527// them: it is answered while the fleet does not enforce.
528func TestInstallIsNotHeldForTheFleet(t *testing.T) {
529 fx := updatesFixture(t)
530 fx.boxesEnforce(false)
531 if st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member); st != http.StatusOK {
532 t.Fatalf("install before the fleet enforces: %d %s", st, out)
533 }
534}
535
536// installRaceStore holds the first two reads of the instance record until
537// both have arrived, so the two requests decide from the same etag and one
538// of them must lose the write and retry.
539type installRaceStore struct {
540 release.Store
541 key string
542 mu sync.Mutex
543 arrived int
544 etags []string
545 both chan struct{}
546}
547
548func (s *installRaceStore) Get(ctx context.Context, key string) ([]byte, string, error) {
549 body, etag, err := s.Store.Get(ctx, key)
550 if key != s.key {
551 return body, etag, err
552 }
553 s.mu.Lock()
554 if s.arrived >= 2 {
555 s.mu.Unlock()
556 return body, etag, err
557 }
558 s.arrived++
559 s.etags = append(s.etags, etag)
560 if s.arrived == 2 {
561 close(s.both)
562 }
563 s.mu.Unlock()
564 select {
565 case <-s.both:
566 case <-time.After(10 * time.Second):
567 }
568 return body, etag, err
569}
570
571// installNoFatal is one install request that reports rather than fails, for
572// use off the test goroutine.
573func installNoFatal(u, bearer string) (int, string, error) {
574 req, err := http.NewRequest(http.MethodPost, u, strings.NewReader(`{}`))
575 if err != nil {
576 return 0, "", err
577 }
578 req.Header.Set("Content-Type", "application/json")
579 req.Header.Set("Authorization", "Bearer "+bearer)
580 res, err := http.DefaultClient.Do(req)
581 if err != nil {
582 return 0, "", err
583 }
584 defer res.Body.Close()
585 out, err := io.ReadAll(res.Body)
586 return res.StatusCode, string(out), err
587}
588
589// Review Focus 3: two requests that read the same etag both succeed, and the
590// ids they leave are 1 then 2. Neither is lost and no id repeats.
591func TestInstallRequestsRaceToIncreasingIDs(t *testing.T) {
592 fx := updatesFixture(t)
593 rs := &installRaceStore{Store: fx.rel, key: provision.RecordKey(release.OpsAccount, "km", "a.example.com"), both: make(chan struct{})}
594 fx.srv.cfg.Releases = rs
595 type result struct {
596 st int
597 out string
598 err error
599 }
600 done := make(chan result, 2)
601 for i := 0; i < 2; i++ {
602 go func() {
603 st, out, err := installNoFatal(fx.ts.URL+updURL+"/install", fx.member)
604 done <- result{st, out, err}
605 }()
606 }
607 var outs []string
608 for i := 0; i < 2; i++ {
609 r := <-done
610 if r.err != nil || r.st != http.StatusOK {
611 t.Fatalf("a racing request failed: %d %s %v", r.st, r.out, r.err)
612 }
613 outs = append(outs, r.out)
614 }
615 rs.mu.Lock()
616 etags := append([]string(nil), rs.etags...)
617 rs.mu.Unlock()
618 if len(etags) != 2 || etags[0] != etags[1] {
619 t.Fatalf("the two requests did not race from one read: etags %q", etags)
620 }
621 if id := fx.record("a.example.com").InstallRequest.ID; id != 2 {
622 t.Fatalf("after two racing requests the id is %d, want 2", id)
623 }
624 joined := strings.Join(outs, " ")
625 if !strings.Contains(joined, `"request":1`) || !strings.Contains(joined, `"request":2`) {
626 t.Fatalf("the two answers must be requests 1 and 2: %s", joined)
627 }
628}
629
630// installCASStore loses every record write's race, as a store would whose
631// record another writer keeps moving.
632type installCASStore struct {
633 release.Store
634 key string
635}
636
637func (s installCASStore) Get(ctx context.Context, key string) ([]byte, string, error) {
638 body, etag, err := s.Store.Get(ctx, key)
639 if key == s.key && err == nil {
640 // Each read answers a fresh etag, so the write's own read never
641 // matches the one the request decided from.
642 etag = fmt.Sprintf("%s-%d", etag, time.Now().UnixNano())
643 }
644 return body, etag, err
645}
646
647// R7: only a lost race retries, and five lost races are 409 changed; any
648// other write failure is a 502 that does not leak the store's words.
649func TestInstallGivesUpAfterFiveLostRaces(t *testing.T) {
650 fx := updatesFixture(t)
651 fx.srv.cfg.Releases = installCASStore{fx.rel, provision.RecordKey(release.OpsAccount, "km", "a.example.com")}
652 st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
653 if st != http.StatusConflict || jsonErrorText(t, out) != updatewords.Text("settings.console.changed") {
654 t.Fatalf("install that always loses: %d %s", st, out)
655 }
656 if fx.record("a.example.com").InstallRequest != nil {
657 t.Fatal("a lost request wrote the record")
658 }
659}
660
661func TestInstallStoreFailureIsA502(t *testing.T) {
662 fx := updatesFixture(t)
663 fx.srv.cfg.Releases = unputtableStore{fx.rel}
664 st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
665 if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.store-failed") {
666 t.Fatalf("install with an unwritable store: %d %s", st, out)
667 }
668 if strings.Contains(out, brokenStoreErr) {
669 t.Fatalf("the refusal leaks the store's error: %s", out)
670 }
671}
672
673type unputtableStore struct{ release.Store }
674
675func (u unputtableStore) Put(context.Context, string, []byte, string) (string, error) {
676 return "", errors.New(brokenStoreErr)
677}
678
679func TestInstallIsRefusedOnAPinnedInstance(t *testing.T) {
680 fx := updatesFixture(t)
681 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Pin: "v1"})
682 st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
683 if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.pinned"), "a.example.com", "v1") {
684 t.Fatalf("install on a pinned instance: %d %s", st, out)
685 }
686 if fx.record("a.example.com").InstallRequest != nil {
687 t.Fatal("a refused request wrote the record")
688 }
689}
690
691func TestInstallRefusesNamedUnitsOtherKindsAndUnknownHosts(t *testing.T) {
692 fx := updatesFixture(t)
693 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Unit: "console.service", Addr: "127.0.0.1:8080"})
694 st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
695 if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.named-unit"), "a.example.com") {
696 t.Fatalf("named unit: %d %s", st, out)
697 }
698 fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Kind: "service", Addr: "127.0.0.1:8080"})
699 st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
700 if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.not-instance"), "a.example.com", "service") {
701 t.Fatalf("service route: %d %s", st, out)
702 }
703 if fx.record("a.example.com").InstallRequest != nil {
704 t.Fatal("a refused request wrote the record")
705 }
706 u := fx.ts.URL + "/api/cli/apps/bab/km/instances/nope.example.com/updates/install"
707 if st, out := sendJSON(t, http.MethodPost, u, map[string]any{}, fx.member); st != http.StatusNotFound {
708 t.Fatalf("install on an unknown host: %d %s", st, out)
709 }
710}
711
712// R8: fast_track is an account owner's; the check is the role, made before
713// the store is read.
714func TestFastTrackInstallNeedsAnOwner(t *testing.T) {
715 fx := updatesFixture(t) // fx.member is a plain member of bab; fx.owner an owner of bab
716 st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{"fast_track": true}, fx.member)
717 if st != http.StatusForbidden || jsonErrorText(t, out) != updatewords.Text("settings.console.fast-track-owner") {
718 t.Fatalf("a member skipped bake: %d %s", st, out)
719 }
720 if fx.record("a.example.com").InstallRequest != nil {
721 t.Fatal("a refused fast track wrote the record")
722 }
723 st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{"fast_track": true}, fx.owner)
724 rec := fx.record("a.example.com")
725 if st != http.StatusOK || rec.InstallRequest == nil || !rec.InstallRequest.FastTrack || rec.InstallRequest.By != "paul@keymail.dev" {
726 t.Fatalf("an owner's fast-track request: %d %s, record %+v", st, out, rec)
727 }
728 // A plain member's ordinary request is still theirs to make, and clears
729 // the fast track the next request does not ask for.
730 st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{"fast_track": false}, fx.member)
731 if rec := fx.record("a.example.com"); st != http.StatusOK || rec.InstallRequest.ID != 2 || rec.InstallRequest.FastTrack {
732 t.Fatalf("a member's ordinary request after a fast track: %d %s, record %+v", st, out, rec)
733 }
734}
735
736const policyURL = "/api/cli/apps/bab/km/updates"
737
738func TestPolicyDoorSetsDefaults(t *testing.T) {
739 fx := updatesFixture(t)
740 fx.boxesEnforce(true)
741 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL,
742 map[string]any{"instance_control": []string{"updates"}, "default_updates": "manual"}, fx.member)
743 if st != http.StatusOK || !strings.Contains(out, `"default_updates":"manual"`) {
744 t.Fatalf("policy: %d %s", st, out)
745 }
746 if m := fx.manifest(); m.Updates == nil || m.Updates.DefaultUpdates != "manual" || m.Channel != "stable" {
747 t.Fatalf("manifest = %+v", m)
748 }
749}
750
751func TestPolicyDefaultsAreGatedLikeSettings(t *testing.T) {
752 fx := updatesFixture(t)
753 fx.boxesEnforce(false)
754 st, _ := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_major": 2}, fx.member)
755 if st != http.StatusConflict {
756 t.Fatalf("a default major before every box enforces: %d", st)
757 }
758 st, _ = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"instance_control": []string{"pin"}}, fx.member)
759 if st != http.StatusOK {
760 t.Fatalf("instance_control enables nothing by itself: %d", st)
761 }
762 st, _ = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"instance_control": []string{"bake"}}, fx.member)
763 if st != http.StatusBadRequest {
764 t.Fatalf("an unknown control name: %d", st)
765 }
766}
767
768// Spec rev 11 §3.2: there is no default pin.
769func TestPolicyDoorHasNoDefaultPin(t *testing.T) {
770 fx := updatesFixture(t)
771 fx.boxesEnforce(true)
772 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_pin": "v1"}, fx.member)
773 if st != http.StatusBadRequest || !strings.Contains(out, "default_pin") {
774 t.Fatalf("a default pin: %d %s", st, out)
775 }
776 if m := fx.manifest(); m.Updates != nil {
777 t.Fatalf("the refused request wrote a policy: %+v", m.Updates)
778 }
779}
780
781// Spec rev 11 §3.2: the channel default applies only when an instance is
782// created; every record carries its channel from creation.
783func TestDefaultChannelReachesOnlyNewInstances(t *testing.T) {
784 fx := updatesFixture(t) // a.example.com exists on stable
785 st, _ := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "beta"}, fx.member)
786 if st != http.StatusOK {
787 t.Fatal(st)
788 }
789 if ch := fx.record("a.example.com").Channel; ch != "stable" {
790 t.Fatalf("an existing instance moved to %s", ch)
791 }
792 rec := fx.record("a.example.com")
793 if u := provision.EffectiveUpdates(rec, fx.manifest().Updates); u.Channel != "stable" {
794 t.Fatalf("effective channel %s", u.Channel)
795 }
796 fx.createInstance(t, "b.example.com") // through the console's create door, no channel given
797 if ch := fx.record("b.example.com").Channel; ch != "beta" {
798 t.Fatalf("a new instance got %s, want the default beta", ch)
799 }
800}
801
802// Decision 7: the key check comes before any store read, so an unknown key
803// is the 400 even for an app with no instances manifest.
804func TestPolicyUnknownKeyIsRefusedBeforeTheStore(t *testing.T) {
805 fx := updatesFixture(t)
806 if err := fx.store.Delete(context.Background(), provision.ManifestKey(release.OpsAccount, "km")); err != nil {
807 t.Fatal(err)
808 }
809 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_pin": "v1", "default_updates": "auto"}, fx.member)
810 if st != http.StatusBadRequest || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.unknown-policy-key"), "default_pin") {
811 t.Fatalf("an unknown key on an app with no manifest: %d %s", st, out)
812 }
813}
814
815// Decision 1: only a change that turns a default ON waits for the fleet. A
816// value re-sent unchanged beside a clear is not an enable, and clearing is
817// never refused.
818func TestPolicyClearingBesideAnUnchangedEnableIsNeverRefused(t *testing.T) {
819 fx := updatesFixture(t)
820 fx.boxesEnforce(false)
821 two := 2
822 policy := &provision.UpdatePolicy{InstanceControl: []string{"pin"}, DefaultUpdates: release.UpdatesManual, DefaultMajor: &two}
823 fx.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable", Updates: policy})
824 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL,
825 map[string]any{"default_updates": "manual", "default_major": 2, "instance_control": nil}, fx.member)
826 if p := fx.manifest().Updates; st != http.StatusOK || p == nil || p.InstanceControl != nil ||
827 p.DefaultUpdates != release.UpdatesManual || p.DefaultMajor == nil || *p.DefaultMajor != 2 {
828 t.Fatalf("manual and major re-sent, control cleared: %d %s, policy %+v", st, out, p)
829 }
830 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_major": 2, "default_updates": "auto"}, fx.member)
831 if p := fx.manifest().Updates; st != http.StatusOK || p == nil || p.DefaultUpdates != release.UpdatesAuto || p.DefaultMajor == nil || *p.DefaultMajor != 2 {
832 t.Fatalf("major re-sent, manual turned off: %d %s, policy %+v", st, out, p)
833 }
834 // instance_control and default_channel never enable.
835 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"instance_control": []string{"updates", "major"}, "default_channel": "beta"}, fx.member)
836 if st != http.StatusOK {
837 t.Fatalf("control and channel before the fleet enforces: %d %s", st, out)
838 }
839 // A changed value is still an enable, and still waits.
840 for _, body := range []map[string]any{{"default_major": 3}, {"default_updates": "manual"}, {"default_major": 3, "default_updates": "auto"}} {
841 before := fx.manifest()
842 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, body, fx.member)
843 if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.not-enforced"), 1) {
844 t.Errorf("%v before the fleet enforces: %d %s", body, st, out)
845 }
846 if strings.Contains(out, "ie-1") {
847 t.Errorf("%v: the refusal names a box: %s", body, out)
848 }
849 after := fx.manifest()
850 if after.Updates.DefaultUpdates != before.Updates.DefaultUpdates || !sameMajor(after.Updates.DefaultMajor, before.Updates.DefaultMajor) {
851 t.Errorf("%v: a refused enable wrote the manifest: %+v -> %+v", body, before.Updates, after.Updates)
852 }
853 }
854 // Clearing them is never refused.
855 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_major": nil, "default_updates": nil, "instance_control": []string{}}, fx.member)
856 if m := fx.manifest(); st != http.StatusOK || m.Updates != nil || m.Channel != "beta" {
857 t.Fatalf("clearing every default: %d %s, manifest %+v", st, out, m)
858 }
859}
860
861// R3 at the policy door: an unreadable inventory refuses an enable with its
862// own words, and a clear still goes through.
863func TestPolicyEnableIsRefusedWhenEnforcementIsUnknown(t *testing.T) {
864 fx := updatesFixture(t)
865 fx.boxesEnforce(true)
866 fx.srv.cfg.Releases = unlistableStore{fx.rel}
867 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "manual"}, fx.member)
868 if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.enforcement-unknown") {
869 t.Fatalf("enable with an unreadable inventory: %d %s", st, out)
870 }
871 if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "auto"}, fx.member); st != http.StatusOK {
872 t.Fatalf("a non-enabling change with an unreadable inventory: %d %s", st, out)
873 }
874}
875
876// Decision 2: strict input. A value of the wrong type is refused, never read
877// as a clear, and a refused request writes nothing.
878func TestPolicyDoorRefusesWrongTypes(t *testing.T) {
879 fx := updatesFixture(t)
880 fx.boxesEnforce(true)
881 one := 1
882 policy := &provision.UpdatePolicy{InstanceControl: []string{"pin"}, DefaultUpdates: release.UpdatesManual, DefaultMajor: &one}
883 fx.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable", Updates: policy})
884 badControl := updatewords.Text("settings.console.bad-control")
885 badUpdates := updatewords.Text("settings.console.bad-updates")
886 badMajor := updatewords.Text("settings.console.bad-major")
887 for _, c := range []struct{ body, want string }{
888 {`{"instance_control":"updates"}`, badControl},
889 {`{"instance_control":""}`, badControl},
890 {`{"instance_control":5}`, badControl},
891 {`{"instance_control":{"updates":true}}`, badControl},
892 {`{"instance_control":[1]}`, badControl},
893 {`{"instance_control":["updates",null]}`, badControl},
894 {`{"instance_control":["updates","updates"]}`, badControl},
895 {`{"instance_control":["bake"]}`, badControl},
896 {`{"default_updates":5}`, badUpdates},
897 {`{"default_updates":true}`, badUpdates},
898 {`{"default_updates":"sometimes"}`, badUpdates},
899 {`{"default_major":-1}`, badMajor},
900 {`{"default_major":1.5}`, badMajor},
901 {`{"default_major":"2"}`, badMajor},
902 {`{"default_major":1e300}`, badMajor},
903 {`{"default_major":true}`, badMajor},
904 {`{"default_major":[2]}`, badMajor},
905 } {
906 st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, c.body)
907 if st != http.StatusBadRequest || jsonErrorText(t, out) != c.want {
908 t.Errorf("%s: %d %s, want 400 %q", c.body, st, out, c.want)
909 }
910 }
911 if p := fx.manifest().Updates; p == nil || len(p.InstanceControl) != 1 || p.DefaultUpdates != release.UpdatesManual || p.DefaultMajor == nil || *p.DefaultMajor != 1 {
912 t.Fatalf("a refused request changed the policy: %+v", p)
913 }
914 // null and "" clear, for every key that clears.
915 if st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, `{"instance_control":null,"default_updates":"","default_major":""}`); st != http.StatusOK {
916 t.Fatalf("clearing with null and empty: %d %s", st, out)
917 }
918 if m := fx.manifest(); m.Updates != nil || m.Channel != "stable" {
919 t.Fatalf("null and empty did not clear: %+v", m)
920 }
921 fx.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable", Updates: policy})
922 if st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, `{"default_updates":null,"default_major":null}`); st != http.StatusOK {
923 t.Fatalf("clearing with null: %d %s", st, out)
924 }
925 if p := fx.manifest().Updates; p == nil || p.DefaultUpdates != "" || p.DefaultMajor != nil || len(p.InstanceControl) != 1 {
926 t.Fatalf("null did not clear only what it named: %+v", p)
927 }
928}
929
930// Decision 3: default_channel is checked as the instances-manifest door
931// checks its channel, and the manifest's channel cannot be cleared here.
932func TestDefaultChannelIsValidatedAndNeverCleared(t *testing.T) {
933 fx := updatesFixture(t)
934 for _, body := range []string{
935 `{"default_channel":""}`, `{"default_channel":null}`, `{"default_channel":5}`,
936 `{"default_channel":"../x"}`, `{"default_channel":"a/b/c"}`, `{"default_channel":"Beta Two"}`,
937 } {
938 st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, body)
939 if st != http.StatusBadRequest || jsonErrorText(t, out) != "invalid channel name" {
940 t.Errorf("%s: %d %s, want 400 invalid channel name", body, st, out)
941 }
942 }
943 if ch := fx.manifest().Channel; ch != "stable" {
944 t.Fatalf("a refused channel changed the manifest: %s", ch)
945 }
946 if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "canary/x"}, fx.member); st != http.StatusOK || fx.manifest().Channel != "canary/x" {
947 t.Fatalf("a two-part channel: %d %s", st, out)
948 }
949}
950
951// policyFailingStore fails every read of one key with brokenStoreErr.
952type policyFailingStore struct {
953 release.Store
954 key string
955}
956
957func (s policyFailingStore) Get(ctx context.Context, key string) ([]byte, string, error) {
958 if key == s.key {
959 return nil, "", errors.New(brokenStoreErr)
960 }
961 return s.Store.Get(ctx, key)
962}
963
964// Decision 4: no manifest is 409 no-manifest; a manifest that cannot be read
965// is a 502 that does not leak the store's words.
966func TestPolicyDoorManifestReadFailures(t *testing.T) {
967 fx := updatesFixture(t)
968 key := provision.ManifestKey(release.OpsAccount, "km")
969 fx.srv.cfg.Releases = policyFailingStore{fx.rel, key}
970 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "auto"}, fx.member)
971 if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.policy-read-failed") {
972 t.Fatalf("an unreadable manifest: %d %s", st, out)
973 }
974 if strings.Contains(out, brokenStoreErr) {
975 t.Fatalf("the refusal leaks the store's error: %s", out)
976 }
977 fx.srv.cfg.Releases = fx.rel
978 if err := fx.store.Delete(context.Background(), key); err != nil {
979 t.Fatal(err)
980 }
981 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "auto"}, fx.member)
982 if st != http.StatusConflict || jsonErrorText(t, out) != updatewords.Text("settings.console.no-manifest") {
983 t.Fatalf("no manifest: %d %s", st, out)
984 }
985 if _, _, err := fx.store.Get(context.Background(), key); err == nil {
986 t.Fatal("the refused request wrote a manifest")
987 }
988}
989
990// Decision 5: a lost race is 409 changed; any other write failure is a 502
991// that does not leak the store's words.
992func TestPolicyDoorWriteFailures(t *testing.T) {
993 fx := updatesFixture(t)
994 key := provision.ManifestKey(release.OpsAccount, "km")
995 fx.srv.cfg.Releases = installCASStore{fx.rel, key}
996 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "beta"}, fx.member)
997 if st != http.StatusConflict || jsonErrorText(t, out) != updatewords.Text("settings.console.changed") {
998 t.Fatalf("a lost race: %d %s", st, out)
999 }
1000 fx.srv.cfg.Releases = unputtableStore{fx.rel}
1001 st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "beta"}, fx.member)
1002 if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.store-failed") {
1003 t.Fatalf("an unwritable store: %d %s", st, out)
1004 }
1005 if strings.Contains(out, brokenStoreErr) {
1006 t.Fatalf("the refusal leaks the store's error: %s", out)
1007 }
1008 fx.srv.cfg.Releases = fx.rel
1009 if ch := fx.manifest().Channel; ch != "stable" {
1010 t.Fatalf("a failed write changed the manifest: %s", ch)
1011 }
1012}
1013
1014// Decisions 6 and 8: a change bumps the serial once and leaves one activity
1015// line; a request that changes nothing writes, bumps and audits nothing, and
1016// answers the current policy. instance_control is [] when empty, never null.
1017func TestPolicyDoorAnnouncesOnlyChanges(t *testing.T) {
1018 fx := updatesFixture(t)
1019 fx.boxesEnforce(true)
1020 key := provision.ManifestKey(release.OpsAccount, "km")
1021 _, etag, err := fx.store.Get(context.Background(), key)
1022 if err != nil {
1023 t.Fatal(err)
1024 }
1025 before := serial(t, fx.consoleFixture)
1026 for _, body := range []map[string]any{{}, {"default_channel": "stable"}, {"default_updates": nil, "default_major": "", "instance_control": []string{}}} {
1027 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, body, fx.member)
1028 want := `{"default_channel":"stable","default_major":null,"default_updates":"","instance_control":[]}`
1029 if st != http.StatusOK || strings.TrimSpace(out) != want {
1030 t.Fatalf("%v: %d %s, want 200 %s", body, st, out, want)
1031 }
1032 }
1033 if _, now, _ := fx.store.Get(context.Background(), key); now != etag {
1034 t.Fatal("a request that changed nothing wrote the manifest")
1035 }
1036 if got := serial(t, fx.consoleFixture); got != before {
1037 t.Fatalf("a request that changed nothing bumped the serial: %d -> %d", before, got)
1038 }
1039 st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL,
1040 map[string]any{"instance_control": []string{"updates", "pin"}, "default_major": 2, "default_channel": "beta"}, fx.member)
1041 want := `{"default_channel":"beta","default_major":2,"default_updates":"","instance_control":["updates","pin"]}`
1042 if st != http.StatusOK || strings.TrimSpace(out) != want {
1043 t.Fatalf("a change: %d %s, want %s", st, out, want)
1044 }
1045 if got := serial(t, fx.consoleFixture); got != before+1 {
1046 t.Fatalf("serial = %d, want one bump from %d", got, before)
1047 }
1048 acts, err := fx.st.Events(OpsAccountID, "km", 50)
1049 if err != nil {
1050 t.Fatal(err)
1051 }
1052 wantLine := fmt.Sprintf(updatewords.Text("settings.console.audit-policy"), "km", "instance_control updates,pin, default major 2, default channel beta")
1053 n := 0
1054 for _, a := range acts {
1055 if a.Action == "app-update-policy" {
1056 n++
1057 if a.Detail != wantLine || a.Address != "alice@keymail.dev" {
1058 t.Errorf("activity line %+v, want %q by alice", a, wantLine)
1059 }
1060 }
1061 }
1062 if n != 1 {
1063 t.Fatalf("%d policy activity lines, want 1: %+v", n, acts)
1064 }
1065}
1066