crates/installer/nordisk-pairing/src/door.rs
//! **The join door on the front — the installer** — shared by gunnar and holger.
//!
//! It holds the [`Ledger`] of the boxes the estate laid (one slot per utility
//! address), speaks mutual TLS with a certificate from the installer CA, admits
//! each box ONCE on the bootstrap certificate the medium carries, signs the
//! box's own certificate from its request, elects the weakest gunnar box the
//! twin when both have joined — decided once, kept — and answers every box
//! with its name, overlay address, role, the peers and the estate values it
//! FEEDS (so the medium carries none of them). See [`crate::mtls`].
//!
//! The wire is minimal HTTP/1.1 inside TLS 1.3 over `std` sockets:
//! `POST /pair/join` with the [`JoinRequest`] as TOML, `GET /pair/signal` for
//! the door's own view. WHO is speaking is the certificate the handshake
//! verified; WHICH SLOT is the TCP peer address — the join goes over the
//! utility network because that address is what terraform knew before the
//! box existed.
use crate::elect::{weakest, Verdict};
use crate::join::{Admission, Assigned, JoinError, JoinReply, JoinRequest, Ledger, Peer, Presented};
use crate::mtls::{self, InstallerCa, Issued};
use crate::seed::Kind;
use crate::Role;
use serde::{Deserialize, Serialize};
use std::collections::BTreeMap;
use std::io::{Read, Write};
use std::net::{Ipv4Addr, SocketAddr, SocketAddrV4, TcpStream};
use std::path::Path;
use std::sync::Arc;
use std::time::Duration;
pub const JOIN_PATH: &str = "/pair/join";
pub const SIGNAL_PATH: &str = "/pair/signal";
pub const MAX_REQUEST_BYTES: usize = 64 * 1024;
/// How long a box's own installer certificate is valid **by default**: 24 h.
///
/// It was a fixed 6 h (audit 2026-09-24): a box re-joining after a late
/// reboot — or a slot re-joined after [`Door::forget`] — found its own
/// certificate dead. The caller sets it per estate with
/// [`Door::with_box_cert_valid`]. NOTE: a chain is only as valid as its
/// shortest link — the installer CA (minted per MEDIUM by the caller, e.g.
/// private-gunnar-ops `installer.rs`, and long-lived since 2026-09-24
/// evening) must outlive the box certificates it signs.
pub const BOX_CERT_VALID: Duration = Duration::from_secs(24 * 3600);
/// **The feed key a re-admitted PRIMARY is given** (0.5.8, [`Door::readmit`]):
/// its twin's control plane, `<utility>:<port>` — where a fresh main is filled
/// from. The same word holger's box configuration uses (`recharge_from`).
pub const RECHARGE_FROM_FEED: &str = "recharge_from";
/// What [`Door::readmit`] did.
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Readmitted {
pub name: String,
/// `(public, utility)` of the dead box, and of the new one.
pub was: (Ipv4Addr, Ipv4Addr),
pub now: (Ipv4Addr, Ipv4Addr),
/// The dead box had joined (and its admission was cleared).
pub forgotten: bool,
/// The twin's control plane a re-admitted primary is fed.
pub recharge_from: Option<String>,
}
/// **The door's whole state**, one TOML file: the ledger, the verdict and the
/// estate values it feeds. The installer CA's key is NOT in it — it is its own
/// file on the front, handed to [`Door::with_ca`].
#[derive(Clone, Default, Serialize, Deserialize)]
pub struct Door {
pub ledger: Ledger,
#[serde(default)]
pub verdict: Option<Verdict>,
/// The estate values every admitted box is fed (`monetize_pubkey`, …).
#[serde(default)]
pub feed: BTreeMap<String, String>,
/// **The values ONE box is fed, by its name** (0.5.0, owner 2026-09-25):
/// what only that box may hold — the front's TLS key, the console's admin
/// token, plugin modules. The reply to `name` carries [`Door::feed`] and
/// then these (its own value wins on a clash); no other box's reply ever
/// carries them. **Never serialized**: the ledger file ([`Door::save`],
/// the run folder's `ledger.toml`) holds no per-box value — like the CA,
/// it is a process parameter the installer's plan hands the door.
#[serde(skip)]
pub own_feed: BTreeMap<String, BTreeMap<String, String>>,
/// **The front's tunnel, fed to every box** as the `front` peer of the
/// reply ([`JoinReply::front`]) — the relay key and endpoint of THIS lay,
/// which a constant medium cannot carry. `None` for a door with no relay
/// (`tunnel = none`).
#[serde(default, skip_serializing_if = "Option::is_none")]
pub front: Option<crate::join::FrontTunnel>,
#[serde(skip)]
ca: Option<InstallerCa>,
/// How long the box certificates this door signs are valid; `None` =
/// [`BOX_CERT_VALID`]. A process parameter, not ledger state.
#[serde(skip)]
box_cert_valid: Option<Duration>,
/// **The boxes an IN-PLACE re-admission is re-admitting now** ([`Door::readmit_kept`],
/// 0.5.26): each may show the certificate of ITS OWN slot while its admission is forgotten
/// ([`Door::rejoin_in_place`]). A process parameter of one run, never in the ledger file.
#[serde(skip)]
pub in_place: std::collections::BTreeSet<String>,
}
/// `Debug` names each box's own feed by its KEYS only (0.5.0): those values
/// are the ones only one box may hold (a TLS private key, a bearer).
impl std::fmt::Debug for Door {
fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
let own: BTreeMap<&String, Vec<&String>> = self.own_feed.iter().map(|(n, m)| (n, m.keys().collect())).collect();
f.debug_struct("Door").field("ledger", &self.ledger).field("verdict", &self.verdict).field("feed", &self.feed).field("front", &self.front).field("own_feed (keys)", &own).finish_non_exhaustive()
}
}
impl PartialEq for Door {
fn eq(&self, o: &Door) -> bool {
self.ledger == o.ledger && self.verdict == o.verdict && self.feed == o.feed && self.front == o.front
}
}
impl Door {
pub fn new(ledger: Ledger) -> Door {
Door { ledger, ..Default::default() }
}
/// The CA that signs the boxes' own certificates.
pub fn with_ca(mut self, ca: InstallerCa) -> Door {
self.ca = Some(ca);
self
}
/// How long the box certificates this door signs are valid (default
/// [`BOX_CERT_VALID`], 24 h).
pub fn with_box_cert_valid(mut self, valid_for: Duration) -> Door {
self.box_cert_valid = Some(valid_for);
self
}
pub fn box_cert_valid(&self) -> Duration {
self.box_cert_valid.unwrap_or(BOX_CERT_VALID)
}
/// **Clear a slot's admission** — for a box that was RE-INSTALLED (a new
/// disk, a new key, the old one gone). The slot stays laid; the box that
/// comes back joins it again on the bootstrap certificate, gets a new
/// certificate of its own and records its new tunnel key.
///
/// * A name the estate never laid is refused by name ([`JoinError::NotLaid`]).
/// * A slot that had not joined is `Ok(None)` — nothing to forget.
/// * The VERDICT is kept: roles are decided once, and a re-installed box
/// takes its slot's role back when it rejoins.
/// * Until the box rejoins, its OLD certificate is refused for the slot
/// (`join-forged`: a certificate for a slot that has not joined), and
/// the ledger is no longer complete, so the bootstrap certificate is
/// accepted again — for this slot only, and only while it is itself
/// still valid (the installer CA's lifetime is the caller's).
pub fn forget(&mut self, name: &str) -> Result<Option<crate::join::Admitted>, JoinError> {
if self.ledger.slot_of(name).is_none() {
return Err(JoinError::NotLaid(name.to_string()));
}
Ok(self.ledger.admitted.remove(name))
}
/// **Re-admit ONE box of a closed estate** (0.5.8) — a box that DIED and
/// was laid again from the same medium, at the address the provider gave
/// the new machine. The dead main of gunnar and of holger is the reason:
/// its twin holds everything, and a fresh main must join the estate it
/// left, as the primary it was, told where its twin is.
///
/// * The slot keeps its name, kind and overlay address; it moves to
/// `public` (the address the installer dials) with `utility` beside it.
/// Another box already laid at `public` is refused by name.
/// * The old admission is forgotten ([`Door::forget`]): the ledger is not
/// complete, so the bootstrap certificate is accepted again — for this
/// slot only — and the new box gets a certificate of its own.
/// * The VERDICT is kept: the new box takes the old one's role back.
/// * What the dead box OFFERED is dropped from the feed (`offer.<name>.*`):
/// the new box mints its own and offers them anew.
/// * A re-admitted PRIMARY with a twin is fed [`RECHARGE_FROM_FEED`] = the
/// twin's control plane (`<utility>:`[`crate::CONTROL_PORT`]) in its OWN
/// feed — where it is filled from; the product decides what that means.
pub fn readmit(&mut self, name: &str, public: Ipv4Addr, utility: Ipv4Addr) -> Result<Readmitted, String> {
let bad = |why: String| Err(format!("REFUSED [door-readmit] {why}"));
let Some((&old_public, slot)) = self.ledger.slot_of(name) else {
return bad(format!("`{name}` is not a box this estate laid"));
};
let mut slot = slot.clone();
let old_utility = slot.utility_or(old_public);
if slot.kind.is_product() && self.verdict.is_none() {
return bad(format!("the estate has no verdict yet: `{name}` is re-admitted into a CLOSED estate, and this one never elected (run the install)"));
}
if public != old_public {
if let Some(other) = self.ledger.slots.get(&public) {
return bad(format!("{public} is where `{}` is laid; two boxes are never laid at one address", other.name));
}
}
self.ledger.slots.remove(&old_public);
slot.utility = Some(utility);
self.ledger.slots.insert(public, slot);
let forgotten = self.ledger.admitted.remove(name).is_some();
let prefix = crate::bootstrap::fed_offer_key(name, "");
self.feed.retain(|k, _| !k.starts_with(&prefix));
let primary = self.verdict.as_ref().is_some_and(|v| v.primary == name);
let recharge_from = if primary {
self.verdict.as_ref().and_then(|v| self.ledger.slot_of(&v.twin)).map(|(k, s)| format!("{}:{}", s.utility_or(*k), crate::CONTROL_PORT))
} else {
None
};
if let Some(at) = &recharge_from {
self.own_feed.entry(name.to_string()).or_default().insert(RECHARGE_FROM_FEED.to_string(), at.clone());
}
Ok(Readmitted { name: name.to_string(), was: (old_public, old_utility), now: (public, utility), forgotten, recharge_from })
}
/// **Re-admit ONE box that was UPGRADED IN PLACE** (0.5.9, `estate
/// upgrade`): the same server, the same addresses, its data kept — its
/// slot and role as [`Door::readmit`] keeps them, its admission forgotten
/// (the upgrade's first boot is a new installation, which clears its
/// pairing state), its old offers dropped; but a primary is NOT fed
/// [`RECHARGE_FROM_FEED`] (and one left by an earlier recharge is taken
/// back): it holds everything it held.
pub fn readmit_kept(&mut self, name: &str) -> Result<Readmitted, String> {
let Some((&public, slot)) = self.ledger.slot_of(name) else {
return Err(format!("REFUSED [door-readmit] `{name}` is not a box this estate laid"));
};
let utility = slot.utility_or(public);
let mut r = self.readmit(name, public, utility)?;
if let Some(own) = self.own_feed.get_mut(name) {
own.remove(RECHARGE_FROM_FEED);
}
r.recharge_from = None;
self.in_place.insert(name.to_string());
Ok(r)
}
/// **A box of an in-place re-admission that shows ITS OWN certificate** (0.5.26, gunnar.rs
/// twin 2026-10-25): it was fed by an earlier run of this re-admission that ended before its
/// close (that run's door, and the admission it made, lived in that run only), so it asks
/// AS ITSELF, with no signing request. The installer dialled the slot's address over the
/// installer link, the handshake proved the certificate is this CA's, for the slot's name,
/// and the box is one [`Door::readmit_kept`] named: admitted again, with the tunnel key it
/// shows NOW. Anything else stays refused as before (`join-forged`): a box not in this
/// re-admission, another slot's certificate, a slot already admitted.
pub fn rejoin_in_place(&mut self, req: &JoinRequest, cn: &str, from: Ipv4Addr) -> Result<JoinReply, JoinError> {
if req.estate != self.ledger.estate {
return Err(JoinError::WrongEstate { want: self.ledger.estate.clone(), got: req.estate.clone() });
}
let slot = self.ledger.slots.get(&from).ok_or(JoinError::Unknown(from))?.clone();
if slot.name != cn || !self.in_place.contains(cn) || self.ledger.admitted.contains_key(cn) {
return Err(JoinError::Forged(format!("{from} is `{}`'s address, and it presents the certificate of `{cn}`", slot.name)));
}
if req.kind != slot.kind && slot.kind != Kind::Front {
return Err(JoinError::Forged(format!("{from} presents kind {:?}; the slot `{}` laid there is {:?}", req.kind, slot.name, slot.kind)));
}
self.ledger.admitted.insert(slot.name.clone(), crate::join::Admitted { from, tunnel_pubkey: req.tunnel_pubkey.clone(), capacity: req.capacity });
self.elect_if_ready();
Ok(self.reply_for(&slot.name))
}
pub fn load(path: &Path) -> Result<Door, String> {
let text = std::fs::read_to_string(path).map_err(|e| format!("{}: {e}", path.display()))?;
toml::from_str(&text).map_err(|e| format!("{}: not a door ledger: {e}", path.display()))
}
/// Whole and durably (0.5.17, G4: edda appliance-pid1 `durable::write_atomic` — staged
/// under its own name, fsync, rename, fsync of the directory): a reader never sees half a
/// ledger, a power cut leaves the old one or the new one, and two writers never share a
/// staging file.
pub fn save(&self, path: &Path) -> Result<(), String> {
let text = toml::to_string(self).map_err(|e| e.to_string())?;
appliance_pid1::durable::write_atomic(path, text.as_bytes(), None).map_err(|e| format!("{}: {e}", path.display()))
}
/// **A join from `from`, by `who`.** Admits under the ledger's rule, signs
/// the box's own certificate on its first join, elects when both gunnar
/// boxes have presented themselves, answers.
pub fn join(&mut self, req: &JoinRequest, who: &Presented, from: Ipv4Addr) -> Result<JoinReply, JoinError> {
// Sign BEFORE the slot is spent, so a request the CA cannot sign
// leaves the slot open for the box's next try.
let signed = if *who == Presented::Bootstrap && !self.ledger.admitted.values().any(|a| a.from == from) {
let name = self.ledger.slots.get(&from).map(|s| s.name.clone()).ok_or(JoinError::Unknown(from))?;
let ca = self.ca.as_ref().ok_or_else(|| JoinError::Sign("the door holds no installer CA".into()))?;
Some(ca.sign_box(&req.csr_pem, &name, self.box_cert_valid()).map_err(|e| JoinError::Sign(e.to_string()))?)
} else {
None
};
let admission = self.ledger.admit(req, who, from)?;
self.elect_if_ready();
let mut reply = self.reply_for(admission.name());
if let Admission::First(_) = admission {
reply.cert_pem = signed;
}
Ok(reply)
}
fn elect_if_ready(&mut self) {
if self.verdict.is_some() {
return;
}
// The product boxes, with their kind: an election is between exactly two
// boxes of ONE product (a gunnar and a holger never pair).
let products: Vec<(String, Ipv4Addr, crate::elect::Capacity, Kind)> = self
.ledger
.admitted
.iter()
.filter_map(|(name, a)| {
let (_, slot) = self.ledger.slot_of(name)?;
slot.kind.is_product().then_some((name.clone(), slot.overlay, a.capacity?, slot.kind))
})
.collect();
if let [a, b] = &products[..] {
if a.3 != b.3 {
return;
}
self.verdict = Some(weakest((&a.0, a.1, &a.2), (&b.0, b.1, &b.2)));
}
}
pub fn role_of(&self, name: &str) -> Option<Role> {
let (_, slot) = self.ledger.slot_of(name)?;
if !self.ledger.admitted.contains_key(name) {
return None;
}
match (slot.kind, &self.verdict) {
(Kind::Front, _) => Some(Role::Front),
// P3a: a product's own box kind is not elected; it stands alone as its own primary.
(Kind::Box(_), _) => Some(Role::Primary),
(k, Some(v)) if k.is_product() && v.twin == name => Some(Role::Twin),
(k, Some(v)) if k.is_product() && v.primary == name => Some(Role::Primary),
_ => None,
}
}
/// **The front's tunnel, as every box is fed it** (0.4.0): the one the
/// door was given ([`Door::front`]) or else DERIVED from the admitted
/// front VM — vm1 boots the same medium, presents its own tunnel key like
/// every box, and that key is the relay's; it is dialled at the address
/// the boxes reach it on (its slot's `endpoint`, or its UTILITY address),
/// port [`crate::RELAY_PORT`]. `None` until the front has presented a key.
pub fn front_tunnel(&self) -> Option<crate::join::FrontTunnel> {
if let Some(f) = &self.front {
return Some(f.clone());
}
self.ledger.slots.iter().filter(|(_, s)| s.kind == Kind::Front).find_map(|(addr, s)| {
let a = self.ledger.admitted.get(&s.name)?;
if a.tunnel_pubkey.trim().is_empty() {
return None;
}
// 0.4.2: on the UTILITY address — the path that never leaves the
// provider, and the one a mock guest can route (the public one is
// what the installer dials, not what the boxes reach).
let endpoint = s.endpoint.clone().unwrap_or_else(|| format!("{}:{}", s.utility_or(*addr), crate::RELAY_PORT));
Some(crate::join::FrontTunnel { tunnel_pubkey: a.tunnel_pubkey.clone(), endpoint })
})
}
/// The front (its tunnel, first), then every admitted gunnar box with a
/// known role, as peers. The front VM itself is listed once, as the
/// front peer.
pub fn peers(&self) -> Vec<Peer> {
let front = self.front_tunnel().map(|f| f.as_peer());
front
.into_iter()
.chain(self.ledger.admitted.iter().filter_map(|(name, a)| {
let (key, slot) = self.ledger.slot_of(name)?;
let role = self.role_of(name)?;
(role != Role::Front).then(|| Peer { name: name.clone(), role, tunnel_pubkey: a.tunnel_pubkey.clone(), overlay: slot.overlay, endpoint: slot.endpoint.clone(), utility: Some(slot.utility_or(*key)) })
}))
.collect()
}
pub fn reply_for(&self, name: &str) -> JoinReply {
let (_, slot) = self.ledger.slot_of(name).expect("reply_for is called for a laid name");
let primary_slot = self.verdict.as_ref().and_then(|v| self.ledger.slot_of(&v.primary));
let primary_overlay = primary_slot.map(|(_, s)| s.overlay);
let primary_utility = primary_slot.map(|(u, s)| s.utility_or(*u));
JoinReply {
estate: self.ledger.estate.clone(),
me: Assigned { name: name.to_string(), overlay: slot.overlay },
cert_pem: None,
role: self.role_of(name),
primary_overlay,
primary_utility,
peers: self.peers(),
feed: self.feed_for(name),
}
}
/// **What `name` is fed**: the shared [`Door::feed`], then its own
/// ([`Door::own_feed`]) over it. Nothing another box was given alone.
pub fn feed_for(&self, name: &str) -> BTreeMap<String, String> {
let mut f = self.feed.clone();
if let Some(own) = self.own_feed.get(name) {
f.extend(own.iter().map(|(k, v)| (k.clone(), v.clone())));
}
f
}
/// The door's own signal: who joined, the verdict.
pub fn signal(&self) -> String {
let q = |it: Vec<&String>| it.iter().map(|s| format!("\"{s}\"")).collect::<Vec<_>>().join(", ");
let mut out = format!(
"estate = \"{}\"\njoined = [{}]\nexpected = [{}]\n",
self.ledger.estate,
q(self.ledger.admitted.keys().collect()),
q(self.ledger.slots.values().map(|s| &s.name).collect())
);
match &self.verdict {
Some(v) => out.push_str(&format!("twin = \"{}\"\nprimary = \"{}\"\nwhy = \"{}\"\n", v.twin, v.primary, v.why.replace('"', "'"))),
None => out.push_str("verdict = \"pending\"\n"),
}
out.push_str(&format!("complete = {}\nbootstrap = \"{}\"\n", self.ledger.complete(), if self.ledger.complete() { "withdrawn" } else { "open" }));
out
}
}
// ── the wire ───────────────────────────────────────────────────────────────
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Request {
pub method: String,
pub path: String,
pub body: Vec<u8>,
}
/// One request from the bytes read so far. `None` = incomplete (read more);
/// `Some(Err)` = malformed.
pub fn parse_request(bytes: &[u8]) -> Option<Result<Request, String>> {
let head_end = bytes.windows(4).position(|w| w == b"\r\n\r\n")?;
let head = String::from_utf8_lossy(&bytes[..head_end]).to_string();
let mut lines = head.split("\r\n");
let start = lines.next().unwrap_or_default();
let mut parts = start.split_whitespace();
let (Some(method), Some(path)) = (parts.next(), parts.next()) else {
return Some(Err(format!("not an HTTP request line: `{start}`")));
};
let len: usize = lines
.filter_map(|l| l.split_once(':'))
.find(|(k, _)| k.trim().eq_ignore_ascii_case("content-length"))
.and_then(|(_, v)| v.trim().parse().ok())
.unwrap_or(0);
let body_start = head_end + 4;
if bytes.len() < body_start + len {
return None;
}
Some(Ok(Request { method: method.to_string(), path: path.to_string(), body: bytes[body_start..body_start + len].to_vec() }))
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct Response {
pub status: u16,
pub body: String,
}
impl Response {
pub fn bytes(&self) -> Vec<u8> {
let reason = match self.status {
200 => "OK",
400 => "Bad Request",
403 => "Forbidden",
404 => "Not Found",
405 => "Method Not Allowed",
_ => "Error",
};
format!(
"HTTP/1.1 {} {reason}\r\ncontent-type: application/toml\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{}",
self.status,
self.body.len(),
self.body
)
.into_bytes()
}
pub fn parse(raw: &[u8]) -> Result<Response, String> {
let text = String::from_utf8_lossy(raw);
let (head, body) = text.split_once("\r\n\r\n").ok_or("no end of headers in the reply")?;
let status = head.split_whitespace().nth(1).and_then(|s| s.parse().ok()).ok_or("no status in the reply")?;
Ok(Response { status, body: body.to_string() })
}
}
/// **One request, answered.** Pure over the door, the speaker and the address.
pub fn respond(door: &mut Door, req: &Request, who: &Presented, from: Ipv4Addr) -> Response {
match (req.method.as_str(), req.path.as_str()) {
("POST", JOIN_PATH) => {
let jr = match JoinRequest::parse(&String::from_utf8_lossy(&req.body)) {
Ok(j) => j,
Err(e) => return Response { status: 400, body: format!("{e}\n") },
};
match door.join(&jr, who, from).and_then(|r| r.render()) {
Ok(text) => Response { status: 200, body: text },
Err(e) => Response { status: 403, body: format!("{e}\n") },
}
}
("GET", SIGNAL_PATH) => Response { status: 200, body: door.signal() },
(_, JOIN_PATH) | (_, SIGNAL_PATH) => Response { status: 405, body: "REFUSED [door-method] POST /pair/join or GET /pair/signal\n".into() },
_ => Response { status: 404, body: "REFUSED [door-path] this door has /pair/join and /pair/signal\n".into() },
}
}
/// **Serve one connection** (the door's side): the TLS handshake with a
/// client certificate REQUIRED, one request, one answer. Returns whether the
/// door changed, so the caller saves it. A handshake that fails — a stranger's
/// certificate, none at all — is refused by rustls before a byte is read.
pub fn serve_one(door: &mut Door, cfg: Arc<rustls::ServerConfig>, stream: TcpStream) -> Result<bool, String> {
let from = match stream.peer_addr() {
Ok(SocketAddr::V4(a)) => *a.ip(),
other => return Err(format!("not an IPv4 peer: {other:?}")),
};
let _ = stream.set_read_timeout(Some(Duration::from_secs(10)));
let _ = stream.set_write_timeout(Some(Duration::from_secs(10)));
let conn = rustls::ServerConnection::new(cfg).map_err(|e| e.to_string())?;
let mut tls = rustls::StreamOwned::new(conn, stream);
let mut bytes = Vec::new();
let mut chunk = [0u8; 4096];
let req = loop {
let n = tls.read(&mut chunk).map_err(|e| format!("{from}: {e}"))?;
if n == 0 {
return Err(format!("{from}: closed before a request"));
}
bytes.extend_from_slice(&chunk[..n]);
if bytes.len() > MAX_REQUEST_BYTES {
return Err(format!("{from}: request too large"));
}
if let Some(r) = parse_request(&bytes) {
break r?;
}
};
let who = mtls::peer_cn(&tls.conn).map(|cn| Presented::from_cn(&cn)).ok_or_else(|| format!("{from}: no client certificate"))?;
let before = door.clone();
let r = respond(door, &req, &who, from);
tls.write_all(&r.bytes()).map_err(|e| e.to_string())?;
tls.conn.send_close_notify();
let _ = tls.flush();
Ok(*door != before)
}
/// **The box's side**: POST the join over mutual TLS — the installer CA pinned,
/// `identity` the certificate the box speaks with.
pub fn post_join(door: SocketAddrV4, ca_pem: &str, identity: &Issued, req: &JoinRequest, timeout: Duration) -> Result<JoinReply, String> {
let cfg = mtls::client_config(ca_pem, identity).map_err(|e| e.to_string())?;
let body = req.render().map_err(|e| e.to_string())?;
let s = TcpStream::connect_timeout(&SocketAddr::V4(door), timeout).map_err(|e| format!("could not be reached: {door}: {e}"))?;
let _ = s.set_read_timeout(Some(timeout));
let _ = s.set_write_timeout(Some(timeout));
let conn = rustls::ClientConnection::new(cfg, mtls::door_name(*door.ip())).map_err(|e| e.to_string())?;
let mut tls = rustls::StreamOwned::new(conn, s);
let raw = format!("POST {JOIN_PATH} HTTP/1.1\r\nhost: {door}\r\ncontent-type: application/toml\r\ncontent-length: {}\r\nconnection: close\r\n\r\n{body}", body.len());
tls.write_all(raw.as_bytes()).map_err(|e| format!("could not be reached: TLS to {door}: {e}"))?;
let mut buf = Vec::new();
// A peer that closes without close_notify still said everything it had.
match tls.read_to_end(&mut buf) {
Ok(_) => {}
Err(e) if e.kind() == std::io::ErrorKind::UnexpectedEof && !buf.is_empty() => {}
Err(e) => return Err(format!("could not be reached: reading from {door}: {e}")),
}
let r = Response::parse(&buf)?;
if r.status != 200 {
return Err(r.body.trim().to_string());
}
JoinReply::parse(&r.body).map_err(|e| e.to_string())
}
#[cfg(test)]
mod tests {
use super::*;
use crate::elect::Capacity;
use crate::join::Slot;
const H: Duration = Duration::from_secs(3600);
const FRONT: Ipv4Addr = Ipv4Addr::new(10, 13, 8, 179);
const MAIN: Ipv4Addr = Ipv4Addr::new(10, 13, 9, 90);
const TWIN: Ipv4Addr = Ipv4Addr::new(10, 13, 9, 87);
fn door(ca: &InstallerCa) -> Door {
let mut l = Ledger::new("gunnar.rs");
l.lay(FRONT, Slot { name: "front".into(), kind: Kind::Front, overlay: crate::OVERLAY_FRONT, endpoint: Some("95.111.211.189:51820".into()), utility: None });
l.lay(MAIN, Slot { name: "main".into(), kind: Kind::Gunnar, overlay: crate::OVERLAY_BOX_A, endpoint: None, utility: None });
l.lay(TWIN, Slot { name: "twin".into(), kind: Kind::Gunnar, overlay: crate::OVERLAY_BOX_B, endpoint: None, utility: None });
let mut d = Door::new(l).with_ca(ca.clone());
d.feed.insert("monetize_pubkey".into(), "eb16f371b856".into());
d.front = Some(crate::join::FrontTunnel { tunnel_pubkey: "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=".into(), endpoint: "95.111.211.189:51820".into() });
d
}
fn req(kind: Kind, key: &str, cores: u32) -> JoinRequest {
let (csr, _) = mtls::box_request().unwrap();
JoinRequest { estate: "gunnar.rs".into(), kind, tunnel_pubkey: key.into(), capacity: Some(Capacity { cores, ram_bytes: 4 << 30, data_bytes: 10 << 30, disk_mib_s: 500 }), csr_pem: csr }
}
fn post(d: &mut Door, r: &JoinRequest, who: &Presented, from: Ipv4Addr) -> Response {
let body = r.render().unwrap();
let raw = format!("POST {JOIN_PATH} HTTP/1.1\r\ncontent-length: {}\r\n\r\n{body}", body.len());
respond(d, &parse_request(raw.as_bytes()).unwrap().unwrap(), who, from)
}
/// 0.5.4: a HOLGER estate is gunnar's shape — two holger boxes are elected
/// the same way (the weakest is the twin), and a gunnar box and a holger box
/// never pair.
#[test]
fn two_holger_boxes_are_elected_and_a_gunnar_never_pairs_with_a_holger() {
let ca = InstallerCa::mint("holger.rs", H).unwrap();
let mut d = door(&ca);
for s in [MAIN, TWIN] {
d.ledger.slots.get_mut(&s).unwrap().kind = Kind::Holger;
}
d.join(&req(Kind::Gunnar, "KF", 2), &Presented::Bootstrap, FRONT).unwrap();
d.join(&req(Kind::Holger, "KM", 4), &Presented::Bootstrap, MAIN).unwrap();
let twin = d.join(&req(Kind::Holger, "KT", 1), &Presented::Bootstrap, TWIN).unwrap();
assert_eq!(twin.role, Some(Role::Twin), "the weakest holger box is the twin");
assert_eq!(d.role_of("main"), Some(Role::Primary));
let mut fresh = door(&ca);
fresh.ledger.slots.get_mut(&MAIN).unwrap().kind = Kind::Holger;
assert!(matches!(fresh.join(&req(Kind::Gunnar, "X", 4), &Presented::Bootstrap, MAIN), Err(JoinError::Forged(_))), "a holger slot demands a holger box");
let mut mixed = door(&ca);
mixed.ledger.slots.get_mut(&TWIN).unwrap().kind = Kind::Holger;
mixed.join(&req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN).unwrap();
mixed.join(&req(Kind::Holger, "KT", 1), &Presented::Bootstrap, TWIN).unwrap();
assert_eq!((mixed.role_of("main"), mixed.role_of("twin")), (None, None), "no election across products");
}
/// ★ P3a (A28 H13): a box of a product-named kind (`Kind::Box`) is admitted, never joins
/// an election, and stands alone as its own primary; two boxes of one box kind are not a
/// primary and a twin; a gunnar box in a box slot is forged; and a gunnar election beside
/// it is unchanged.
#[test]
fn a_box_kind_stands_alone_as_its_own_primary_and_never_joins_an_election() {
let ca = InstallerCa::mint("lake.rs", H).unwrap();
let be = Kind::named("be").unwrap();
let mut d = door(&ca);
for s in [MAIN, TWIN] {
d.ledger.slots.get_mut(&s).unwrap().kind = be;
}
d.join(&req(Kind::Gunnar, "KF", 2), &Presented::Bootstrap, FRONT).unwrap();
let main = d.join(&req(be, "KM", 4), &Presented::Bootstrap, MAIN).unwrap();
assert_eq!(main.role, Some(Role::Primary), "a box kind is fed its role at once: it waits for no twin");
let twin = d.join(&req(be, "KT", 1), &Presented::Bootstrap, TWIN).unwrap();
assert_eq!(twin.role, Some(Role::Primary), "two boxes of one box kind are two primaries, not an election");
assert_eq!(d.verdict, None, "no election among box kinds");
let mut fresh = door(&ca);
fresh.ledger.slots.get_mut(&MAIN).unwrap().kind = be;
assert!(matches!(fresh.join(&req(Kind::Gunnar, "X", 4), &Presented::Bootstrap, MAIN), Err(JoinError::Forged(_))), "a box slot demands its own kind");
let mut other = door(&ca);
other.ledger.slots.get_mut(&MAIN).unwrap().kind = be;
assert!(matches!(other.join(&req(Kind::named("fe").unwrap(), "X", 4), &Presented::Bootstrap, MAIN), Err(JoinError::Forged(_))), "another box kind is forged too");
assert!(d.readmit("main", Ipv4Addr::new(10, 13, 8, 99), Ipv4Addr::new(10, 13, 9, 99)).is_ok(), "a box kind is re-admitted with no verdict");
}
/// 0.4.0, the one-medium ruling: vm1 boots the SAME gunnar medium, the
/// front slot makes it the front, and its own tunnel key is the relay's —
/// fed to the boxes as the `front` peer, dialled on its laid address.
#[test]
fn vm1_on_the_gunnar_medium_becomes_the_front_and_its_key_is_the_relay_fed_to_the_boxes() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let mut d = door(&ca);
d.front = None;
d.ledger.slots.get_mut(&FRONT).unwrap().endpoint = None;
assert_eq!(d.front_tunnel(), None, "no front key before vm1 presented one");
let r = d.join(&req(Kind::Gunnar, "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=", 2), &Presented::Bootstrap, FRONT).unwrap();
assert_eq!(r.role, Some(Role::Front), "the slot, not the medium, makes the front");
d.join(&req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN).unwrap();
let twin = d.join(&req(Kind::Gunnar, "KT", 1), &Presented::Bootstrap, TWIN).unwrap();
let front = twin.front().expect("the front is fed");
assert_eq!(front.tunnel_pubkey, "xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=");
assert_eq!(front.endpoint.as_deref(), Some("10.13.8.179:51820"));
assert_eq!(twin.peers.iter().filter(|p| p.role == Role::Front).count(), 1, "vm1 listed once, as the front: {:?}", twin.peers);
assert_eq!(twin.peers.len(), 3);
// 0.4.1: the front certifies the twin on the utility network, so its
// reply names every box's utility address (here the ledger key).
let fr = d.reply_for("front");
let at = |role: Role| fr.peers.iter().find(|p| p.role == role).and_then(|p| p.utility);
assert_eq!((at(Role::Twin), at(Role::Primary), at(Role::Front)), (Some(TWIN), Some(MAIN), None), "{:?}", fr.peers);
// A box slot still demands its own kind.
let mut e = door(&ca);
assert!(matches!(e.join(&req(Kind::Front, "K", 1), &Presented::Bootstrap, MAIN), Err(JoinError::Forged(_))));
}
#[test]
fn joins_by_address_elect_the_weakest_sign_each_box_feed_the_estate_and_withdraw_bootstrap_at_completion() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let mut d = door(&ca);
let r = post(&mut d, &req(Kind::Front, "KF", 2), &Presented::Bootstrap, FRONT);
assert_eq!(JoinReply::parse(&r.body).unwrap().role, Some(Role::Front), "{}", r.body);
let r = post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN);
let reply = JoinReply::parse(&r.body).unwrap();
assert_eq!((reply.me.name.as_str(), reply.role), ("main", None), "admitted, election pending");
assert!(reply.cert_pem.as_deref().unwrap_or("").contains("BEGIN CERTIFICATE"), "the box's own certificate on its first join");
assert_eq!(reply.feed.get("monetize_pubkey").map(String::as_str), Some("eb16f371b856"), "the estate value is fed, not baked");
let front = reply.front().expect("the front's tunnel is fed on every reply, before any election");
assert_eq!((front.tunnel_pubkey.as_str(), front.endpoint.as_deref()), ("xTIBA5rboUvnH4htodjb6e697QjLERt1NAB4mZqp8Dg=", Some("95.111.211.189:51820")), "the lay's relay, fed — not on the medium");
// main asks again, with ITS OWN certificate: a read, no new certificate
let again = JoinReply::parse(&post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Box("main".into()), MAIN).body).unwrap();
assert!(again.cert_pem.is_none());
let r = post(&mut d, &req(Kind::Gunnar, "KT", 1), &Presented::Bootstrap, TWIN);
let reply = JoinReply::parse(&r.body).unwrap();
assert_eq!((reply.me.name.as_str(), reply.role, reply.primary_overlay), ("twin", Some(Role::Twin), Some(crate::OVERLAY_BOX_A)));
assert!(d.ledger.complete());
assert!(d.signal().contains("bootstrap = \"withdrawn\""));
let r = post(&mut d, &req(Kind::Gunnar, "X", 4), &Presented::Bootstrap, MAIN);
assert!(r.status == 403 && r.body.contains("REFUSED [join-withdrawn]"), "{}", r.body);
let p = std::env::temp_dir().join(format!("door-{}.toml", std::process::id()));
d.save(&p).unwrap();
let back = Door::load(&p).unwrap();
assert_eq!(back, d, "the ledger round-trips; the CA key is not in it");
assert!(!std::fs::read_to_string(&p).unwrap().contains("PRIVATE KEY"), "the CA key never lands in the ledger file");
let _ = std::fs::remove_file(&p);
}
/// The whole wire over loopback: TLS 1.3, the bootstrap certificate, the
/// box's own certificate on the second ask, a stranger refused.
#[test]
fn a_box_joins_over_real_mutual_tls_then_asks_again_as_itself() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let door_cert = ca.issue_door(Ipv4Addr::LOCALHOST, H).unwrap();
let boot = ca.issue_bootstrap(H).unwrap();
let mut l = Ledger::new("gunnar.rs");
l.lay(Ipv4Addr::LOCALHOST, Slot { name: "main".into(), kind: Kind::Gunnar, overlay: crate::OVERLAY_BOX_A, endpoint: None, utility: None });
let d = std::sync::Arc::new(std::sync::Mutex::new(Door::new(l).with_ca(ca.clone())));
let scfg = mtls::server_config(&ca.cert_pem, &door_cert).unwrap();
let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
let SocketAddr::V4(addr) = listener.local_addr().unwrap() else { panic!() };
let dd = d.clone();
let server = std::thread::spawn(move || {
for _ in 0..3 {
let (s, _) = listener.accept().unwrap();
let _ = serve_one(&mut dd.lock().unwrap(), scfg.clone(), s);
}
});
let (csr, box_key) = mtls::box_request().unwrap();
let r = JoinRequest { estate: "gunnar.rs".into(), kind: Kind::Gunnar, tunnel_pubkey: "KM".into(), capacity: None, csr_pem: csr };
let first = post_join(addr, &ca.cert_pem, &boot, &r, Duration::from_secs(5)).unwrap();
let mine = Issued { cert_pem: first.cert_pem.clone().expect("a certificate on the first join"), key_pem: box_key };
let second = post_join(addr, &ca.cert_pem, &mine, &JoinRequest { csr_pem: String::new(), ..r.clone() }, Duration::from_secs(5)).unwrap();
assert_eq!((second.me.name.as_str(), second.cert_pem.is_none()), ("main", true));
let stranger = InstallerCa::mint("stranger", H).unwrap().issue_bootstrap(H).unwrap();
assert!(post_join(addr, &ca.cert_pem, &stranger, &r, Duration::from_secs(5)).is_err(), "another CA's certificate never reaches the door's logic");
server.join().unwrap();
assert_eq!(d.lock().unwrap().ledger.admitted.len(), 1);
}
fn not_after(pem: &str) -> i64 {
let der = x509_parser::pem::parse_x509_pem(pem.as_bytes()).unwrap().1;
der.parse_x509().unwrap().validity().not_after.timestamp()
}
#[test]
fn the_box_certificate_lifetime_is_the_callers_with_a_24h_default() {
let ca = InstallerCa::mint("gunnar.rs", 48 * H).unwrap();
let now = time::OffsetDateTime::now_utc().unix_timestamp();
let mut d = door(&ca);
assert_eq!(d.box_cert_valid(), Duration::from_secs(24 * 3600));
let r = JoinReply::parse(&post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN).body).unwrap();
let left = not_after(&r.cert_pem.unwrap()) - now;
assert!((24 * 3600 - 60..=24 * 3600 + 60).contains(&left), "default 24 h, got {left} s");
let mut d = door(&ca).with_box_cert_valid(36 * H);
let r = JoinReply::parse(&post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN).body).unwrap();
let left = not_after(&r.cert_pem.unwrap()) - now;
assert!((36 * 3600 - 60..=36 * 3600 + 60).contains(&left), "the caller's 36 h, got {left} s");
let p = std::env::temp_dir().join(format!("door-valid-{}.toml", std::process::id()));
d.save(&p).unwrap();
assert!(!std::fs::read_to_string(&p).unwrap().contains("box_cert_valid"), "a process parameter, not ledger state");
let _ = std::fs::remove_file(&p);
}
/// 0.5.8: the DEAD MAIN of a closed estate, laid again at new addresses,
/// joins its old slot on the bootstrap certificate — the primary it was,
/// fed where its twin is — and every other box's next answer names it at
/// its new utility address. A re-admitted twin is fed no `recharge_from`.
#[test]
fn a_dead_main_is_readmitted_at_its_new_address_as_the_primary_and_told_where_its_twin_is() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let mut d = door(&ca);
post(&mut d, &req(Kind::Front, "KF", 2), &Presented::Bootstrap, FRONT);
post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN);
post(&mut d, &req(Kind::Gunnar, "KT", 1), &Presented::Bootstrap, TWIN);
d.feed.insert("offer.main.ticket_pubkey".into(), "dead-mains-key".into());
d.feed.insert("offer.front.plugin_door".into(), "10.13.8.179:8475".into());
let verdict = d.verdict.clone().expect("elected");
assert!(d.readmit("stranger", MAIN, MAIN).unwrap_err().contains("[door-readmit]"));
assert!(d.readmit("main", TWIN, TWIN).unwrap_err().contains("where `twin` is laid"), "two boxes at one address");
let mut unelected = door(&ca);
assert!(unelected.readmit("main", MAIN, MAIN).unwrap_err().contains("never elected"));
let (new_public, new_util) = (Ipv4Addr::new(127, 80, 99, 40), Ipv4Addr::new(10, 13, 9, 140));
let r = d.readmit("main", new_public, new_util).unwrap();
assert_eq!(r, Readmitted { name: "main".into(), was: (MAIN, MAIN), now: (new_public, new_util), forgotten: true, recharge_from: Some(format!("{TWIN}:{}", crate::CONTROL_PORT)) });
assert!(!d.ledger.slots.contains_key(&MAIN) && d.ledger.slots[&new_public].name == "main", "the slot moved");
assert_eq!(d.verdict, Some(verdict.clone()), "the verdict is kept");
assert!(!d.feed.contains_key("offer.main.ticket_pubkey"), "the dead box's offers are gone");
assert!(d.feed.contains_key("offer.front.plugin_door"), "the others' are kept");
assert!(!d.ledger.complete(), "the bootstrap certificate is open for that slot");
assert!(post(&mut d, &req(Kind::Gunnar, "X", 1), &Presented::Bootstrap, TWIN).body.contains("join-spent"), "…and only that slot");
let reply = d.join(&req(Kind::Gunnar, "KM2", 2), &Presented::Bootstrap, new_public).unwrap();
assert!(reply.cert_pem.as_deref().unwrap_or("").contains("BEGIN CERTIFICATE"), "a certificate of its own");
assert_eq!(reply.role, Some(Role::Primary), "the primary it was, even weaker than before");
assert_eq!(reply.feed.get(RECHARGE_FROM_FEED).map(String::as_str), Some(format!("{TWIN}:{}", crate::CONTROL_PORT).as_str()));
assert_eq!(reply.primary_utility, Some(new_util));
assert!(d.ledger.complete());
let twin = d.reply_for("twin");
assert_eq!(twin.primary_utility, Some(new_util), "the twin's next answer names the new main");
assert!(!twin.feed.contains_key(RECHARGE_FROM_FEED), "only the re-admitted primary is told");
let p = twin.peers.iter().find(|p| p.name == "main").unwrap();
assert_eq!((p.utility, p.tunnel_pubkey.as_str()), (Some(new_util), "KM2"), "the relay learns the new key");
let t = d.readmit("twin", TWIN, TWIN).unwrap();
assert_eq!(t.recharge_from, None, "a twin is not filled from anybody");
assert!(!d.feed_for("twin").contains_key(RECHARGE_FROM_FEED));
}
/// **An UPGRADED box is re-admitted where it stands, its data kept**
/// (`estate upgrade`, korp.reinstall=keep): the same slot at the same
/// address, its role back, the bootstrap certificate open for it — and a
/// primary is NOT told to be filled from its twin: it kept everything, and
/// a holger box told `recharge_from` serves nothing until a lane refills a
/// box that is not fresh (which the lane refuses). A `recharge_from` left
/// from an earlier recharge is taken back.
#[test]
fn an_upgraded_box_is_readmitted_in_place_and_a_primary_is_never_told_to_recharge() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let mut d = door(&ca);
post(&mut d, &req(Kind::Front, "KF", 2), &Presented::Bootstrap, FRONT);
post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN);
post(&mut d, &req(Kind::Gunnar, "KT", 1), &Presented::Bootstrap, TWIN);
d.feed.insert("offer.main.ticket_pubkey".into(), "the-old-build".into());
// An earlier recharge left its word in the main's own feed.
d.own_feed.entry("main".into()).or_default().insert(RECHARGE_FROM_FEED.into(), "stale".into());
let r = d.readmit_kept("main").unwrap();
assert_eq!(r, Readmitted { name: "main".into(), was: (MAIN, MAIN), now: (MAIN, MAIN), forgotten: true, recharge_from: None });
assert!(!d.feed_for("main").contains_key(RECHARGE_FROM_FEED), "a kept primary is filled from nobody");
assert!(!d.feed.contains_key("offer.main.ticket_pubkey"), "the upgraded box offers anew");
assert!(!d.ledger.complete(), "the bootstrap certificate is open for that slot");
let reply = d.join(&req(Kind::Gunnar, "KM2", 4), &Presented::Bootstrap, MAIN).unwrap();
assert_eq!(reply.role, Some(Role::Primary));
assert!(!reply.feed.contains_key(RECHARGE_FROM_FEED));
assert!(d.readmit_kept("stranger").unwrap_err().contains("[door-readmit]"));
}
/// ★ 0.5.26 (gunnar.rs twin, 2026-10-25): a box of an IN-PLACE re-admission that shows ITS
/// OWN certificate — fed by an earlier run of that re-admission that ended before its close —
/// is admitted again as itself, with the tunnel key it shows now. A box no re-admission
/// names, another slot's certificate and a slot already admitted stay `join-forged`, and the
/// door's own join still refuses the forgotten certificate.
#[test]
fn a_box_of_an_in_place_readmission_that_shows_its_own_certificate_is_admitted_as_itself() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let mut d = door(&ca);
post(&mut d, &req(Kind::Front, "KF", 2), &Presented::Bootstrap, FRONT);
post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN);
post(&mut d, &req(Kind::Gunnar, "KT", 1), &Presented::Bootstrap, TWIN);
let own = |key: &str| JoinRequest { csr_pem: String::new(), ..req(Kind::Gunnar, key, 1) };
// Nobody named: forged, as before.
d.forget("twin").unwrap();
assert!(matches!(d.rejoin_in_place(&own("KT2"), "twin", TWIN), Err(JoinError::Forged(_))), "no re-admission names the twin");
d.readmit_kept("twin").unwrap();
assert!(matches!(d.rejoin_in_place(&own("KT2"), "main", TWIN), Err(JoinError::Forged(_))), "the main's certificate at the twin's address");
assert!(matches!(d.join(&own("KT2"), &Presented::Box("twin".into()), TWIN), Err(JoinError::Forged(_))), "the door's own join still refuses it");
let reply = d.rejoin_in_place(&own("KT2"), "twin", TWIN).unwrap();
assert_eq!((reply.me.name.as_str(), reply.role), ("twin", Some(Role::Twin)), "its role back");
assert!(reply.cert_pem.is_none(), "it keeps the certificate it has");
assert_eq!(d.ledger.admitted["twin"].tunnel_pubkey, "KT2", "the tunnel key it shows now");
assert!(d.ledger.complete());
assert!(matches!(d.rejoin_in_place(&own("KT3"), "twin", TWIN), Err(JoinError::Forged(_))), "admitted already: nothing to re-key");
assert_eq!(d.ledger.admitted["twin"].tunnel_pubkey, "KT2");
}
#[test]
fn forget_clears_a_reinstalled_boxs_admission_keeps_the_verdict_and_lets_it_rejoin_once() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let mut d = door(&ca);
post(&mut d, &req(Kind::Front, "KF", 2), &Presented::Bootstrap, FRONT);
post(&mut d, &req(Kind::Gunnar, "KM", 4), &Presented::Bootstrap, MAIN);
post(&mut d, &req(Kind::Gunnar, "KT", 1), &Presented::Bootstrap, TWIN);
assert!(d.ledger.complete());
let verdict = d.verdict.clone().expect("elected");
// a name never laid: refused by name
let e = d.forget("stranger").unwrap_err();
assert_eq!(e, JoinError::NotLaid("stranger".into()));
assert!(e.to_string().starts_with("REFUSED [door-forget-unknown]"), "{e}");
// the twin is re-installed
let old = d.forget("twin").unwrap().expect("twin had joined");
assert_eq!(old.tunnel_pubkey, "KT");
assert_eq!(d.forget("twin"), Ok(None), "forgetting twice is nothing");
assert!(!d.ledger.complete() && d.signal().contains("bootstrap = \"open\""));
assert_eq!(d.role_of("twin"), None, "not admitted, no role");
// its OLD certificate is refused until it rejoins
let r = post(&mut d, &req(Kind::Gunnar, "KT", 1), &Presented::Box("twin".into()), TWIN);
assert!(r.status == 403 && r.body.contains("join-forged"), "{}", r.body);
// bootstrap is open for THAT slot only
let r = post(&mut d, &req(Kind::Gunnar, "X", 4), &Presented::Bootstrap, MAIN);
assert!(r.status == 403 && r.body.contains("join-spent"), "{}", r.body);
let r = post(&mut d, &req(Kind::Gunnar, "KT2", 8), &Presented::Bootstrap, TWIN);
let reply = JoinReply::parse(&r.body).unwrap();
assert!(reply.cert_pem.as_deref().unwrap_or("").contains("BEGIN CERTIFICATE"), "a new certificate for the new box");
assert_eq!(reply.role, Some(Role::Twin), "the verdict is kept even though the new box is stronger");
assert_eq!(d.verdict, Some(verdict));
assert_eq!(d.ledger.admitted["twin"].tunnel_pubkey, "KT2", "the new key is recorded");
assert!(d.ledger.complete() && d.signal().contains("bootstrap = \"withdrawn\""));
}
/// ★ 0.5.17 (G4): the ledger is written durably, each writer staging its own file — two
/// writers of one ledger (the installer's sink and a re-admission) never collide on one
/// staging name, and the ledger is always whole.
#[test]
fn two_writers_of_one_ledger_never_collide_and_the_ledger_stays_whole() {
let ca = InstallerCa::mint("gunnar.rs", H).unwrap();
let d = std::sync::Arc::new(door(&ca));
let dir = std::env::temp_dir().join(format!("door-durable-{}", std::process::id()));
let _ = std::fs::remove_dir_all(&dir);
std::fs::create_dir_all(&dir).unwrap();
let path = dir.join("ledger.toml");
let failed: Vec<String> = std::thread::scope(|s| {
let hs: Vec<_> = (0..8).map(|_| s.spawn(|| (0..40).filter_map(|_| d.save(&path).err()).collect::<Vec<_>>())).collect();
hs.into_iter().flat_map(|h| h.join().unwrap()).collect()
});
assert!(failed.is_empty(), "{} saves failed, e.g. {:?}", failed.len(), failed.first());
assert!(Door::load(&path).is_ok(), "the ledger is whole");
let left: Vec<_> = std::fs::read_dir(&dir).unwrap().map(|e| e.unwrap().file_name()).collect();
assert_eq!(left.len(), 1, "no staging file is left: {left:?}");
let _ = std::fs::remove_dir_all(&dir);
}
}