| 1 | package host |
| 2 | |
| 3 | import ( |
| 4 | "errors" |
| 5 | "github.com/carlosframework/platform/internal/hostbox" |
| 6 | "github.com/carlosframework/platform/internal/hostclaim" |
| 7 | "github.com/carlosframework/platform/internal/park" |
| 8 | "testing" |
| 9 | ) |
| 10 | |
| 11 | func TestPlan13ClaimRegionBinding(t *testing.T) { |
| 12 | for _, tc := range []struct { |
| 13 | roster, code, engine, home string |
| 14 | bad bool |
| 15 | }{ |
| 16 | {"ie", "", "ie", "ie", false}, {"uk", "uk", "uk", "", false}, |
| 17 | {"ca", "", "", "", true}, {"uk", "ie", "", "", true}, {"", "", "", "", true}, {"@home", "", "", "", true}, {"ie", "@home", "", "", true}, |
| 18 | } { |
| 19 | e, h, err := claimRegionBinding(tc.roster, tc.code, "ie") |
| 20 | if e != tc.engine || h != tc.home || (err != nil) != tc.bad { |
| 21 | t.Fatalf("%+v: %q %q %v", tc, e, h, err) |
| 22 | } |
| 23 | } |
| 24 | } |
| 25 | func TestPlan13VerifyRegionalHomeNames(t *testing.T) { |
| 26 | t.Parallel() |
| 27 | for _, home := range []string{"region", ""} { |
| 28 | identity := handoverRecoveryIdentity(t, hostbox.Actor{Box: "box", Enrollment: "enrolled", Region: "region", FleetHomeRegion: "region", ControlBucket: "control", Revision: 1, Binding: "1"}) |
| 29 | identity.HomeRegion = home |
| 30 | actor, err := identity.Verify(t.Context()) |
| 31 | if err != nil { |
| 32 | t.Fatal(err) |
| 33 | } |
| 34 | e := claimRegionalEnrollment{identity: identity, actor: actor} |
| 35 | for _, region := range []string{"region", park.HomeRegion, "other", ""} { |
| 36 | err = e.VerifyRegional(t.Context(), region, actor.Bucket, hostbox.RequestLimit) |
| 37 | want := region == "region" || (home != "" && region == park.HomeRegion) |
| 38 | if (err == nil) != want { |
| 39 | t.Fatalf("home %q region %q: %v", home, region, err) |
| 40 | } |
| 41 | } |
| 42 | if err = e.VerifyRegional(t.Context(), actor.Region, "other", hostbox.RequestLimit); !errors.Is(err, hostbox.ErrChanged) { |
| 43 | t.Fatal(err) |
| 44 | } |
| 45 | } |
| 46 | } |
| 47 | |
| 48 | func TestPlan13UnverifiedAliasRefused(t *testing.T) { |
| 49 | t.Parallel() |
| 50 | for _, fleet := range []string{"", "ie"} { |
| 51 | identity := handoverRecoveryIdentity(t, hostbox.Actor{Box: "box", Enrollment: "enrolled", Region: "ca", FleetHomeRegion: fleet, Revision: 1, Binding: "1"}) |
| 52 | identity.HomeRegion = "ca" |
| 53 | if _, err := identity.Verify(t.Context()); err == nil { |
| 54 | t.Fatal("unverified home alias accepted", fleet) |
| 55 | } |
| 56 | } |
| 57 | } |
| 58 | |
| 59 | func TestPlan13NamedBoxCannotAcknowledgeHomeDelete(t *testing.T) { |
| 60 | t.Parallel() |
| 61 | if _, _, err := claimRegionBinding("ca", "", "ie"); err == nil { |
| 62 | t.Fatal("missing CARLOS_REGION granted alias") |
| 63 | } |
| 64 | identity := handoverRecoveryIdentity(t, hostbox.Actor{Box: "ca-box", Enrollment: "enrolled", Region: "ca", FleetHomeRegion: "ie", Revision: 1, Binding: "1"}) |
| 65 | p := productionClaimRegional{Identity: identity, Local: &productionClaimLocal{legacyParticipation: true, Identity: identity, Resources: ClaimRuntimeResources{Mode: "agent", DataDir: t.TempDir()}, assembly: &ClaimAssembly{}, lifetime: t.Context()}} |
| 66 | for _, kind := range []string{hostclaim.KindDeleting, hostclaim.KindParking, hostclaim.KindPurging} { |
| 67 | ob := hostclaim.Obligation{ID: "chore", Op: "delete", Kind: "park-replica", Owner: "region:ca", Region: "ca", Retirement: "retirement"} |
| 68 | o := hostclaim.Observed{Host: "test.example", Claim: &hostclaim.Claim{Holder: &hostclaim.Holder{}, Op: hostclaim.Op{ID: "delete", Kind: kind}, Obligations: []hostclaim.Obligation{ob}}} |
| 69 | if err := p.Authorize(t.Context(), o, ob); err != nil { |
| 70 | t.Fatal("named control", err) |
| 71 | } |
| 72 | ob.Region, ob.Owner = park.HomeRegion, "region:@home" |
| 73 | o.Claim.Obligations[0] = ob |
| 74 | if err := p.Authorize(t.Context(), o, ob); err == nil { |
| 75 | t.Fatal("acknowledged home delete", kind) |
| 76 | } |
| 77 | if (park.Engine{Region: "ca"}).OwnsRegion(park.HomeRegion) { |
| 78 | t.Fatal("named engine owns home") |
| 79 | } |
| 80 | } |
| 81 | } |
| 82 | |
| 83 | func TestPlan13MissingDesignationRunsNamedOnly(t *testing.T) { |
| 84 | t.Parallel() |
| 85 | for _, name := range []string{"ie", "ca"} { |
| 86 | for _, code := range []string{"", name} { |
| 87 | engine, home, err := claimRegionBinding(name, code, "") |
| 88 | if err != nil || engine != name || home != "" { |
| 89 | t.Fatalf("%q/%q: %q %q %v", name, code, engine, home, err) |
| 90 | } |
| 91 | p := park.Engine{Region: engine, HomeRegion: home} |
| 92 | if !p.OwnsRegion(name) || p.OwnsRegion(park.HomeRegion) { |
| 93 | t.Fatal("degraded ownership", p) |
| 94 | } |
| 95 | identity := handoverRecoveryIdentity(t, hostbox.Actor{Box: "box", Enrollment: "enrolled", Region: name, Revision: 1, Binding: "1"}) |
| 96 | identity.HomeRegion = home |
| 97 | if _, err := identity.Verify(t.Context()); err != nil { |
| 98 | t.Fatal("named runtime identity", err) |
| 99 | } |
| 100 | } |
| 101 | } |
| 102 | } |
| 103 | |
amadan