AGENTS.md: a refused tool call is not a reason to end the turn; v2 plan (props, ctx guard, wake, identity, wiring) as acceptance tests; v1.1 run note
v2 given tests compiled against a panic-only skeleton (go vet clean); no reference implementation. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Claude Fable 5.1
@@ -0,0 +1,90 @@
|
||||
package identity_test
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"git.wntrmute.dev/kyle/crossbar/internal/identity"
|
||||
)
|
||||
|
||||
func TestParseWhois(t *testing.T) {
|
||||
raw, err := os.ReadFile(filepath.Join("testdata", "whois.json"))
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
id, err := identity.ParseWhois(raw)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
if id.Node != "titan" || id.Login == "" {
|
||||
t.Errorf("parsed %+v, want Node titan and a login", id)
|
||||
}
|
||||
if _, err := identity.ParseWhois([]byte(`{"Node":{}}`)); err == nil {
|
||||
t.Error("a whois answer without a node name must be an error")
|
||||
}
|
||||
if _, err := identity.ParseWhois([]byte(`nope`)); err == nil {
|
||||
t.Error("non-JSON must be an error")
|
||||
}
|
||||
}
|
||||
|
||||
// fakeResolver answers from a map; "" means not a tailnet peer.
|
||||
type fakeResolver map[string]string
|
||||
|
||||
func (f fakeResolver) Identity(ctx context.Context, ip string) (identity.ID, error) {
|
||||
n, ok := f[ip]
|
||||
if !ok {
|
||||
return identity.ID{}, identity.ErrNotAPeer
|
||||
}
|
||||
return identity.ID{Node: n, Login: n + "@example"}, nil
|
||||
}
|
||||
|
||||
func TestChecker(t *testing.T) {
|
||||
c := identity.NewChecker(fakeResolver{"100.64.0.5": "talos", "100.64.0.9": "titan"})
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
peers []string
|
||||
addr string
|
||||
want error
|
||||
}{
|
||||
{"open route", nil, "203.0.113.7:1", nil},
|
||||
{"allowed peer", []string{"talos", "titan"}, "100.64.0.5:44444", nil},
|
||||
{"other peer", []string{"talos"}, "100.64.0.9:1", identity.ErrForbidden},
|
||||
{"not a peer", []string{"talos"}, "203.0.113.7:1", identity.ErrForbidden},
|
||||
{"loopback", []string{"talos"}, "127.0.0.1:1", identity.ErrForbidden},
|
||||
{"garbage addr", []string{"talos"}, "nonsense", identity.ErrForbidden},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
got := c.Allow(context.Background(), tc.peers, tc.addr)
|
||||
if !errors.Is(got, tc.want) && !(got == nil && tc.want == nil) {
|
||||
t.Errorf("Allow(%v, %q) = %v, want %v", tc.peers, tc.addr, got, tc.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestCheckerCachesPerAddress(t *testing.T) {
|
||||
calls := 0
|
||||
r := countingResolver{f: fakeResolver{"100.64.0.5": "talos"}, calls: &calls}
|
||||
c := identity.NewChecker(r)
|
||||
for i := 0; i < 5; i++ {
|
||||
if err := c.Allow(context.Background(), []string{"talos"}, "100.64.0.5:1"); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
}
|
||||
if calls != 1 {
|
||||
t.Errorf("resolver called %d times for one address, want 1 (cache)", calls)
|
||||
}
|
||||
}
|
||||
|
||||
type countingResolver struct {
|
||||
f fakeResolver
|
||||
calls *int
|
||||
}
|
||||
|
||||
func (c countingResolver) Identity(ctx context.Context, ip string) (identity.ID, error) {
|
||||
*c.calls++
|
||||
return c.f.Identity(ctx, ip)
|
||||
}
|
||||
@@ -0,0 +1,74 @@
|
||||
package identity_test
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"git.wntrmute.dev/kyle/crossbar/internal/identity"
|
||||
)
|
||||
|
||||
// The middleware sits in front of the proxy: it names the route the same way the proxy does
|
||||
// (X-Crossbar-Route header, else first path segment) and refuses callers a route does not list.
|
||||
func TestMiddleware(t *testing.T) {
|
||||
peers := map[string][]string{"locked": {"talos"}, "open": nil}
|
||||
inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(204) })
|
||||
h := identity.Middleware(identity.NewChecker(fakeResolver{"100.64.0.5": "talos", "100.64.0.9": "titan"}),
|
||||
func(route string) ([]string, bool) { p, ok := peers[route]; return p, ok }, inner)
|
||||
for _, tc := range []struct {
|
||||
name, path, hdr, addr string
|
||||
want int
|
||||
}{
|
||||
{"open route, anyone", "/open/v1/models", "", "203.0.113.1:5", 204},
|
||||
{"locked, right peer", "/locked/v1/models", "", "100.64.0.5:5", 204},
|
||||
{"locked, wrong peer", "/locked/v1/models", "", "100.64.0.9:5", 403},
|
||||
{"locked, not a peer", "/locked/v1/models", "", "203.0.113.1:5", 403},
|
||||
{"locked via header", "/v1/models", "locked", "100.64.0.9:5", 403},
|
||||
{"header wins over path", "/open/v1/models", "locked", "203.0.113.1:5", 403},
|
||||
{"unknown route passes through to the proxy's own 404", "/nope/v1/models", "", "203.0.113.1:5", 204},
|
||||
{"admin path is never gated here", "/_crossbar/hosts", "", "203.0.113.1:5", 204},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
req := httptest.NewRequest(http.MethodGet, tc.path, nil)
|
||||
req.RemoteAddr = tc.addr
|
||||
if tc.hdr != "" {
|
||||
req.Header.Set("X-Crossbar-Route", tc.hdr)
|
||||
}
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
if rec.Code != tc.want {
|
||||
t.Errorf("%s = %d, want %d (%s)", tc.path, rec.Code, tc.want, rec.Body.String())
|
||||
}
|
||||
if rec.Code == 403 && (!strings.HasPrefix(rec.Header().Get("Content-Type"), "application/json") || !strings.Contains(rec.Body.String(), `"forbidden route"`)) {
|
||||
t.Errorf("403 must be JSON {\"error\":\"forbidden route\"}: %q", rec.Body.String())
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// HeaderResolver is the test/smoke identity source: it trusts X-Crossbar-Peer. It exists so the
|
||||
// smoke run can exercise the gate without a tailnet; config must call it out as insecure.
|
||||
func TestHeaderResolver(t *testing.T) {
|
||||
inner := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(204) })
|
||||
h := identity.Middleware(identity.NewHeaderChecker(), func(route string) ([]string, bool) { return []string{"talos"}, true }, inner)
|
||||
req := httptest.NewRequest(http.MethodGet, "/r/v1/models", nil)
|
||||
req.Header.Set("X-Crossbar-Peer", "talos")
|
||||
rec := httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
if rec.Code != 204 {
|
||||
t.Errorf("header peer talos: %d", rec.Code)
|
||||
}
|
||||
req.Header.Set("X-Crossbar-Peer", "titan")
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
if rec.Code != 403 {
|
||||
t.Errorf("header peer titan: %d, want 403", rec.Code)
|
||||
}
|
||||
req.Header.Del("X-Crossbar-Peer")
|
||||
rec = httptest.NewRecorder()
|
||||
h.ServeHTTP(rec, req)
|
||||
if rec.Code != 403 {
|
||||
t.Errorf("no header: %d, want 403", rec.Code)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"Node": {
|
||||
"ID": 1,
|
||||
"StableID": "nEXAMPLE",
|
||||
"Name": "titan.example.ts.net.",
|
||||
"User": 2,
|
||||
"Addresses": [
|
||||
"100.64.0.9/32",
|
||||
"fd7a:115c:a1e0::9/128"
|
||||
],
|
||||
"HomeDERP": 2,
|
||||
"Created": "2026-01-01T00:00:00Z",
|
||||
"Cap": 138,
|
||||
"Online": true,
|
||||
"ComputedName": "titan",
|
||||
"ComputedNameWithHost": "titan"
|
||||
},
|
||||
"UserProfile": {
|
||||
"ID": 2,
|
||||
"LoginName": "user@example.com",
|
||||
"DisplayName": "Example User"
|
||||
},
|
||||
"CapMap": null
|
||||
}
|
||||
Reference in New Issue
Block a user