| 1 | package callstest |
| 2 | |
| 3 | import ( |
| 4 | "encoding/json" |
| 5 | "strings" |
| 6 | "testing" |
| 7 | "time" |
| 8 | ) |
| 9 | |
| 10 | // Guest isolation over HTTP — §13's slice-2 gates, end to end. |
| 11 | // |
| 12 | // The hub half lives in internal/calls/hub/isolation_test.go. These are |
| 13 | // the two §13 names it in so many words: |
| 14 | // |
| 15 | // "roster carrying the waiting queue to members and not to guests" |
| 16 | // "a waiting guest receiving nothing but hello and its own outcome" |
| 17 | // |
| 18 | // plus the knock audience, which is the same rule and the one slice 4's |
| 19 | // chat fan-out will extend. Whole-branch review W-1 found all three |
| 20 | // ungated: the filters could be deleted and every test stayed green. |
| 21 | // |
| 22 | // What makes these discriminating is a second guest left waiting. With |
| 23 | // only one guest in the room the waiting queue is empty and no |
| 24 | // admission happens while anyone is waiting, so nothing can leak and |
| 25 | // nothing is proved. |
| 26 | |
| 27 | // guestRoom signs a member in, opens a stream for it, and leaves two |
| 28 | // guests knocking on the same link: `waiting` stays waiting for the |
| 29 | // whole test, and `newcomer` is whoever the test is about to admit. |
| 30 | // Returns the harness, the room, the member's browser and its peer, |
| 31 | // and the two guests' readers and peers. |
| 32 | type isolationRoom struct { |
| 33 | x *harness |
| 34 | sqid string |
| 35 | token string |
| 36 | member *client |
| 37 | memberSSE *sseReader |
| 38 | memberID string |
| 39 | waiting *sseReader |
| 40 | waitingID string |
| 41 | guest *sseReader |
| 42 | guestID string |
| 43 | } |
| 44 | |
| 45 | func openIsolationRoom(t *testing.T) *isolationRoom { |
| 46 | t.Helper() |
| 47 | x, sqid, tok := memberWithMeeting(t) |
| 48 | enableWaitingRoom(t, x, sqid) |
| 49 | |
| 50 | m := x.browser(t) |
| 51 | m.signIn("paul@example.com") |
| 52 | sm := m.stream("/m/" + sqid + "/stream") |
| 53 | t.Cleanup(sm.close) |
| 54 | pm, _ := sm.hello() |
| 55 | m.signal(sqid, pm, `{"type":"join"}`) |
| 56 | if ev, _, ok := sm.nextOf("roster", 2*time.Second); !ok { |
| 57 | t.Fatalf("the member never joined the mesh (got %q)", ev) |
| 58 | } |
| 59 | |
| 60 | // The guest that stays waiting for the whole test. It knocks first, |
| 61 | // so it is in the queue before anything below happens. |
| 62 | w := x.browser(t) |
| 63 | w.get("/j/" + tok) |
| 64 | w.signIn("waiter@example.com") |
| 65 | sw := w.stream("/m/" + sqid + "/stream") |
| 66 | t.Cleanup(sw.close) |
| 67 | pw, _ := sw.hello() |
| 68 | w.signal(sqid, pw, `{"type":"join"}`) |
| 69 | if ev, _, ok := sm.nextOf("knock", 2*time.Second); !ok { |
| 70 | t.Fatalf("the first guest never reached the queue (got %q)", ev) |
| 71 | } |
| 72 | |
| 73 | g := x.browser(t) |
| 74 | g.get("/j/" + tok) |
| 75 | g.signIn("guest@example.com") |
| 76 | sg := g.stream("/m/" + sqid + "/stream") |
| 77 | t.Cleanup(sg.close) |
| 78 | pg, _ := sg.hello() |
| 79 | g.signal(sqid, pg, `{"type":"join"}`) |
| 80 | if ev, _, ok := sm.nextOf("knock", 2*time.Second); !ok { |
| 81 | t.Fatalf("the second guest never reached the queue (got %q)", ev) |
| 82 | } |
| 83 | |
| 84 | return &isolationRoom{x: x, sqid: sqid, token: tok, member: m, memberSSE: sm, memberID: pm, |
| 85 | waiting: sw, waitingID: pw, guest: sg, guestID: pg} |
| 86 | } |
| 87 | |
| 88 | // silence asserts a reader carries no event at all for a short window. |
| 89 | // The heartbeat is an SSE comment and never reaches this channel, so an |
| 90 | // idle stream really is silent here. |
| 91 | func silence(t *testing.T, s *sseReader, who string) { |
| 92 | t.Helper() |
| 93 | if ev, data, ok := s.next(400 * time.Millisecond); ok { |
| 94 | t.Fatalf("%s received %q: %s", who, ev, data) |
| 95 | } |
| 96 | } |
| 97 | |
| 98 | // rosterBody is the roster event as it goes over the wire: the roster |
| 99 | // rides inside the message envelope, so a test that unmarshals the |
| 100 | // event data straight into a peers/waiting struct gets two empty slices |
| 101 | // and proves nothing. |
| 102 | type rosterBody struct { |
| 103 | Peers []struct{ Peer, Name, Kind string } `json:"peers"` |
| 104 | Waiting []struct{ Peer, Name, Kind string } `json:"waiting"` |
| 105 | } |
| 106 | |
| 107 | func parseRoster(t *testing.T, data []byte) rosterBody { |
| 108 | t.Helper() |
| 109 | var msg struct { |
| 110 | Type string `json:"type"` |
| 111 | Roster rosterBody `json:"roster"` |
| 112 | } |
| 113 | if err := json.Unmarshal(data, &msg); err != nil { |
| 114 | t.Fatalf("roster %s: %v", data, err) |
| 115 | } |
| 116 | if msg.Type != "roster" { |
| 117 | t.Fatalf("event is %q, want roster: %s", msg.Type, data) |
| 118 | } |
| 119 | if len(msg.Roster.Peers) == 0 { |
| 120 | t.Fatalf("roster carries no peers at all, which no admitted peer ever sees: %s", data) |
| 121 | } |
| 122 | return msg.Roster |
| 123 | } |
| 124 | |
| 125 | // §13: "roster carrying the waiting queue to members and not to |
| 126 | // guests" (W-1 row 1, and rows 2 and 4 as they appear on the wire). |
| 127 | // The guest is admitted while another guest is still knocking, so the |
| 128 | // waiting queue has a name in it to leak. |
| 129 | func TestTheWaitingQueueReachesMembersAndNeverAGuest(t *testing.T) { |
| 130 | r := openIsolationRoom(t) |
| 131 | r.member.signal(r.sqid, r.memberID, `{"type":"admit","payload":{"peer":"`+r.guestID+`"}}`) |
| 132 | |
| 133 | ev, data, ok := r.guest.nextOf("roster", 2*time.Second) |
| 134 | if !ok { |
| 135 | t.Fatalf("the guest was never admitted (got %q)", ev) |
| 136 | } |
| 137 | roster := parseRoster(t, data) |
| 138 | if len(roster.Waiting) != 0 { |
| 139 | t.Fatalf("an admitted guest was handed the waiting queue: %s", data) |
| 140 | } |
| 141 | // The queue is not merely absent from the parsed struct: the name of |
| 142 | // the person knocking is nowhere in the bytes. |
| 143 | if strings.Contains(string(data), r.waitingID) || strings.Contains(string(data), "waiter") { |
| 144 | t.Fatalf("the waiting guest appears in an admitted guest's roster: %s", data) |
| 145 | } |
| 146 | // And roster.peers is the mesh, not everyone joined: the guest still |
| 147 | // knocking is not in it either (W-1 row 2 over the wire). |
| 148 | for _, p := range roster.Peers { |
| 149 | if p.Peer == r.waitingID { |
| 150 | t.Fatalf("roster.peers listed a peer that has only knocked: %s", data) |
| 151 | } |
| 152 | } |
| 153 | if len(roster.Peers) != 2 { |
| 154 | t.Fatalf("roster.peers has %d entries, want the member and the guest: %s", len(roster.Peers), data) |
| 155 | } |
| 156 | |
| 157 | // The member half of the same sentence, so the test says what the |
| 158 | // rule is for and cannot pass by the queue being empty: a second |
| 159 | // member joining is sent the queue the guest was not. |
| 160 | m2 := newMemberBrowser(t, r.x, "paul@rslw.com") |
| 161 | s2 := m2.stream("/m/" + r.sqid + "/stream") |
| 162 | defer s2.close() |
| 163 | p2, _ := s2.hello() |
| 164 | m2.signal(r.sqid, p2, `{"type":"join"}`) |
| 165 | ev, data, ok = s2.nextOf("roster", 2*time.Second) |
| 166 | if !ok { |
| 167 | t.Fatalf("the second member never joined (got %q)", ev) |
| 168 | } |
| 169 | roster = parseRoster(t, data) |
| 170 | if len(roster.Waiting) != 1 || roster.Waiting[0].Peer != r.waitingID { |
| 171 | t.Fatalf("a member's roster must carry the queue, got %s", data) |
| 172 | } |
| 173 | } |
| 174 | |
| 175 | // §13: "a waiting guest receiving nothing but hello and its own |
| 176 | // outcome" (W-1 row 3 over the wire). Its own knock is delivered to the |
| 177 | // members; everything that happens next in the room — another guest |
| 178 | // admitted, a member arriving — is addressed to the mesh, and the |
| 179 | // waiting subscriber is not in it. |
| 180 | func TestAWaitingGuestIsSentNothingButHelloAndItsOwnOutcome(t *testing.T) { |
| 181 | r := openIsolationRoom(t) |
| 182 | silence(t, r.waiting, "a guest that has only knocked") |
| 183 | |
| 184 | // Another guest is let in. |
| 185 | r.member.signal(r.sqid, r.memberID, `{"type":"admit","payload":{"peer":"`+r.guestID+`"}}`) |
| 186 | if ev, _, ok := r.guest.nextOf("roster", 2*time.Second); !ok { |
| 187 | t.Fatalf("the other guest was never admitted (got %q)", ev) |
| 188 | } |
| 189 | silence(t, r.waiting, "a waiting guest, after someone else was admitted") |
| 190 | |
| 191 | // A second member arrives, which is an admission too. |
| 192 | m2 := newMemberBrowser(t, r.x, "paul@rslw.com") |
| 193 | s2 := m2.stream("/m/" + r.sqid + "/stream") |
| 194 | defer s2.close() |
| 195 | p2, _ := s2.hello() |
| 196 | m2.signal(r.sqid, p2, `{"type":"join"}`) |
| 197 | if ev, _, ok := s2.nextOf("roster", 2*time.Second); !ok { |
| 198 | t.Fatalf("the second member never joined (got %q)", ev) |
| 199 | } |
| 200 | // The mesh was told, so the silence above is an audience and not a |
| 201 | // server that stopped sending. |
| 202 | if ev, _, ok := r.guest.nextOf("peer", 2*time.Second); !ok { |
| 203 | t.Fatalf("the admitted guest was not told the member arrived (got %q)", ev) |
| 204 | } |
| 205 | silence(t, r.waiting, "a waiting guest, after a member joined") |
| 206 | |
| 207 | // Its own outcome still reaches it, which is the other half of the |
| 208 | // §13 sentence. |
| 209 | r.member.signal(r.sqid, r.memberID, `{"type":"admit","payload":{"peer":"`+r.waitingID+`"}}`) |
| 210 | if ev, _, ok := r.waiting.nextOf("roster", 2*time.Second); !ok { |
| 211 | t.Fatalf("the waiting guest was never told its own outcome (got %q)", ev) |
| 212 | } |
| 213 | } |
| 214 | |
| 215 | // W-1 row 5 over the wire: a knock carries the display name of the |
| 216 | // person asking to come in, so it goes to admitted members and to |
| 217 | // nobody else. Slice 4's chat fan-out is the same audience question. |
| 218 | func TestAKnockReachesAdmittedMembersAndNoGuest(t *testing.T) { |
| 219 | r := openIsolationRoom(t) |
| 220 | r.member.signal(r.sqid, r.memberID, `{"type":"admit","payload":{"peer":"`+r.guestID+`"}}`) |
| 221 | if ev, _, ok := r.guest.nextOf("roster", 2*time.Second); !ok { |
| 222 | t.Fatalf("the guest was never admitted (got %q)", ev) |
| 223 | } |
| 224 | |
| 225 | // A third outsider knocks while an admitted guest is in the mesh. |
| 226 | third := r.x.browser(t) |
| 227 | third.get("/j/" + r.token) |
| 228 | third.signIn("newcomer@example.com") |
| 229 | s3 := third.stream("/m/" + r.sqid + "/stream") |
| 230 | defer s3.close() |
| 231 | p3, _ := s3.hello() |
| 232 | third.signal(r.sqid, p3, `{"type":"join"}`) |
| 233 | |
| 234 | ev, data, ok := r.memberSSE.nextOf("knock", 2*time.Second) |
| 235 | if !ok { |
| 236 | t.Fatalf("the member did not get the knock (got %q)", ev) |
| 237 | } |
| 238 | if !strings.Contains(string(data), p3) { |
| 239 | t.Fatalf("the knock names someone else: %s", data) |
| 240 | } |
| 241 | silence(t, r.guest, "an admitted guest, while someone knocks") |
| 242 | silence(t, r.waiting, "a waiting guest, while someone else knocks") |
| 243 | } |
| 244 | |
amadan