crates/gunnar-cli/tests/installer_seed_push_create.rs
#![cfg(feature = "server")]
//! **The installer's seed, through the first-push door, under the
//! `ai-trailers` gate** — the forge exactly as a fresh estate meets it: an
//! EMPTY catalog (no namespace, no repository), the operator enrolled as the
//! bootstrap admin (a USER), and the installer's `installer-seed` MACHINE
//! principal holding the server-wide gunnar-admin grant (what the installer's
//! console grant, or a fed `principal.installer-seed = "machine admin <key>"`,
//! gives it).
//!
//! `ai_trailers_refused.rs` proves the exemption into a repository the
//! harness already made. This file proves it through PUSH-TO-CREATE, which is
//! how the seed really lands (the namespace is conjured by the same push), so
//! the gate must judge a repository that did not exist when the session
//! opened:
//!
//! 1. the operator (a user, server admin) pushes history carrying a trailer
//! to a missing repository: refused, naming the commit;
//! 2. `installer-seed` pushes the same history to the same, still ref-less
//! repository: accepted — and the bytes clone back;
//! 3. `installer-seed` pushes it to a SECOND missing repository in a missing
//! namespace: accepted (the seed of several repositories);
//! 4. `installer-seed` adds a NEW trailer commit to the now-seeded repository:
//! refused — the exemption ends with the first reference, seed or not.
mod common;
use std::path::{Path, PathBuf};
use common::{tools_present, Harness};
use gunnar_core::{Grant, Level, Principal, PrincipalKind};
/// The trailer, assembled so this file is not one `cargo xtask trailer-guard`
/// must exempt by name (its list is exact paths).
fn trailer() -> String {
format!("Co-Authored-By: {} <noreply@{}.com>", "Claude", "anthropic")
}
fn head(harness: &Harness, work: &Path) -> String {
harness
.git(work, &["rev-parse", "HEAD"])
.expect_ok("rev-parse")
.stdout
.trim()
.to_owned()
}
fn commit(harness: &Harness, work: &Path, file: &str, message: &str) -> String {
std::fs::write(work.join(file), message).expect("write");
harness.git(work, &["add", "."]).expect_ok("add");
harness
.git(work, &["commit", "--quiet", "-m", message])
.expect_ok("commit");
head(harness, work)
}
/// `installer-seed`, a MACHINE principal with the server-wide Admin grant and
/// a key of its own (never the operator's), as `ssh -i` would use it.
fn installer_seed(harness: &Harness) -> String {
let private = gunnar_core::mint_ed25519().expect("mint the seed key");
let parsed = gunnar_core::ssh_key::PrivateKey::from_openssh(&private).expect("parses");
let public = parsed.public_key().to_openssh().expect("render");
let path: PathBuf = harness.dir.path().join("installer_seed_key");
std::fs::write(&path, &private).expect("write the seed key");
#[cfg(unix)]
{
use std::os::unix::fs::PermissionsExt as _;
std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).expect("chmod");
}
let auth = harness.stores.auth();
auth.add_principal(
Principal::new("installer-seed", "installer-seed", PrincipalKind::Machine).expect("valid"),
)
.expect("add the seed principal");
auth.register_key("installer-seed", &public, None)
.expect("register the seed key");
auth.grant(Grant::server("installer-seed", Level::Admin))
.expect("server-wide admin");
harness.ssh_command().replace(
&harness.key_path.display().to_string(),
&path.display().to_string(),
)
}
#[test]
fn the_machine_seed_creates_repositories_with_trailer_history_and_the_operator_cannot() {
assert!(tools_present(), "this test requires git and ssh");
let mut harness = Harness::start_appliance_bootstrap();
assert!(
harness
.stores
.catalog()
.namespaces()
.expect("list")
.is_empty(),
"a fresh forge: no namespace at all"
);
let work = harness.dir.path().join("work");
harness
.git(
harness.dir.path(),
&[
"init",
"--quiet",
"-b",
"master",
work.to_str().expect("utf-8"),
],
)
.expect_ok("git init");
commit(&harness, &work, "a.txt", "root");
let historical = commit(
&harness,
&work,
"b.txt",
&format!("historical work\n\n{}", trailer()),
);
commit(&harness, &work, "c.txt", "later, clean");
// 1. The operator — a USER, server admin — into a repository that does not exist.
let url = harness.url("nordisk", "gunnar");
let refused = harness.git(&work, &["push", &url, "master"]);
assert!(
!refused.ok,
"the operator seeded trailer history:\n{}",
refused.stderr
);
assert!(
refused.stderr.contains(&historical),
"the refusal names the commit: {}",
refused.stderr
);
// 2. installer-seed, the same history, the same (still ref-less) repository.
let seed = installer_seed(&harness);
harness
.git_with_ssh(&work, &seed, &["push", "--quiet", &url, "master"])
.expect_ok("the installer seed through the first-push door");
let out = harness.dir.path().join("out");
harness
.git(harness.dir.path(), &["clone", "--quiet", &url, "out"])
.expect_ok("clone the seeded repository back");
let log = harness
.git(&out, &["log", "--format=%H", "master"])
.expect_ok("log")
.stdout
.clone();
assert!(
log.contains(&historical),
"the trailer commit is on the forge: {log}"
);
// 3. A second repository, in a namespace nobody made yet.
harness
.git_with_ssh(
&work,
&seed,
&["push", "--quiet", &harness.url("korp", "korp"), "master"],
)
.expect_ok("the seed conjures a second namespace and repository");
// 4. From the first reference on, the seed is judged like anyone.
let bad = commit(
&harness,
&work,
"d.txt",
&format!("new work\n\n{}", trailer()),
);
let refused = harness.git_with_ssh(&work, &seed, &["push", &url, "master"]);
assert!(
!refused.ok,
"installer-seed added a NEW trailer commit to a seeded repository"
);
assert!(refused.stderr.contains(&bad), "{}", refused.stderr);
harness.stop();
}