crates/gunnar-server/tests/clans.rs
//! **Clans, on the real plane** (owner, 2026-10-03: "ordinary accounts can
//! group with other in a clan, where group created repos are administered by
//! the group admin"; 2026-10-05: "when built, each member contributes storage
//! to the clan").
//!
//! The `Clans`, `Repos` and `Accounts` services over the REAL control plane
//! and stores, the caller attached as the gate attaches it. What must hold,
//! each its own test, each refusal beside its allowed twin:
//!
//! * a member makes PRIVATE repositories in the clan; only the clan's admin
//! publishes, deletes or administers them — a member is refused, and nothing
//! moved;
//! * the clan's namespace and its events are private until its admin opens
//! them, and to an outsider the clan does not exist;
//! * the clan's room is the SUM of what its members give;
//! * a contribution goes down only as far as what the clan stores; leaving
//! gives it back and is refused while it is in use;
//! * the last admin can neither leave nor be made a plain member;
//! * an enterprise account's employee joins no clan and makes none;
//! * only the clan's admin invites, removes, promotes and dissolves — a server
//! admin is not the clan's admin;
//! * a clan's name is one claim with the namespaces and the accounts;
//! * metered: a contribution comes out of the member's OWN room, the clan's
//! room is what the door holds a push to, and a member's own cap shrinks by
//! what it gives.
use std::sync::Arc;
use gunnar_core::RepoRef;
use gunnar_grpc::{
Access, AccountsService, Caller, ClansService, ControlPlane, EventBus, Identity as _,
ReposService, ServerConfig, ServiceContext, SsoService,
};
use gunnar_proto::accounts_server::Accounts as _;
use gunnar_proto::clans_server::Clans as _;
use gunnar_proto::repos_server::Repos as _;
use gunnar_proto::sso_server::Sso as _;
use gunnar_proto::*;
use gunnar_server::control_plane::CoreControlPlane;
use gunnar_server::stores::ServerStores;
use gunnar_store::conformance::pack::PackBuilder;
use tonic::{Code, Request};
const CLAN: &str = "fellows";
const MIB: u64 = 1 << 20;
const GIB: u64 = 1 << 30;
fn person(id: &str) -> Caller {
Caller {
principal_id: id.to_owned(),
fingerprint: format!("SHA256:{id}"),
machine: false,
authenticated: true,
}
}
/// A call from `caller`'s session: each person's test session is a fresh,
/// user-verified login (A34-10), so it carries a stepped-up core session
/// (IDENTITY-HOST).
fn with<T>(caller: &Caller, body: T) -> Request<T> {
let mut request = Request::new(body);
request.extensions_mut().insert(caller.clone());
request
.extensions_mut()
.insert(gunnar_grpc::auth::PersonSession {
stepped_up: true,
stepped_up_at_unix_ms: None,
});
request
}
struct Rig {
_dir: tempfile::TempDir,
stores: Arc<ServerStores>,
plane: Arc<CoreControlPlane>,
clans: ClansService,
repos: ReposService,
accounts: AccountsService,
#[cfg(feature = "metered")]
usage: gunnar_grpc::UsageService,
sso: SsoService,
}
impl Rig {
/// Four ordinary accounts (alice, bob, carol, dave), an enterprise
/// account `acme` with its employee `eve`, and `root`, a server admin.
fn new() -> Rig {
let dir = tempfile::tempdir().expect("tempdir");
let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
let plane = Arc::new(CoreControlPlane::new(Arc::clone(&stores)));
Rig::with(dir, stores, plane)
}
fn with(
dir: tempfile::TempDir,
stores: Arc<ServerStores>,
plane: Arc<CoreControlPlane>,
) -> Rig {
let control: Arc<dyn ControlPlane> = plane.clone();
let ctx = ServiceContext::new(
control,
Arc::new(EventBus::new(16)),
ServerConfig::default(),
);
for id in ["alice", "bob", "carol", "dave", "acme", "root"] {
plane
.add_principal(id, id, PrincipalKind::User)
.expect("account");
}
plane
.grant("root", "", "", GrantLevel::Admin)
.expect("root is a server admin");
Rig {
_dir: dir,
stores,
clans: ClansService::new(ctx.clone()),
repos: ReposService::new(ctx.clone()),
#[cfg(feature = "metered")]
usage: gunnar_grpc::UsageService::new(ctx.clone()),
sso: SsoService::new(ctx.clone()),
accounts: AccountsService::new(ctx),
plane,
}
}
async fn enroll_eve(&self) {
self.accounts
.enroll_employee(with(
&person("acme"),
EnrollEmployeeRequest {
account: "acme".into(),
id: "eve".into(),
name: "eve".into(),
..Default::default()
},
))
.await
.expect("acme enrolls eve: an enterprise account");
}
async fn create(&self, who: &str, name: &str, give: u64) -> Result<Clan, tonic::Status> {
self.clans
.create(with(
&person(who),
CreateClanRequest {
name: name.into(),
contribution_bytes: give,
},
))
.await
.map(|r| r.into_inner().clan.expect("a clan comes back"))
}
async fn get(&self, who: &str) -> Result<Clan, tonic::Status> {
self.clans
.get(with(&person(who), GetClanRequest { clan: CLAN.into() }))
.await
.map(|r| r.into_inner().clan.expect("a clan comes back"))
}
async fn invite(&self, who: &str, whom: &str) -> Result<Clan, tonic::Status> {
self.clans
.invite(with(
&person(who),
InviteToClanRequest {
clan: CLAN.into(),
principal_id: whom.into(),
},
))
.await
.map(|r| r.into_inner().clan.expect("a clan comes back"))
}
async fn accept(&self, who: &str, give: u64) -> Result<Clan, tonic::Status> {
self.clans
.accept(with(
&person(who),
AcceptClanInviteRequest {
clan: CLAN.into(),
contribution_bytes: give,
},
))
.await
.map(|r| r.into_inner().clan.expect("a clan comes back"))
}
async fn give(&self, who: &str, bytes: u64) -> Result<Clan, tonic::Status> {
self.clans
.set_contribution(with(
&person(who),
SetClanContributionRequest {
clan: CLAN.into(),
contribution_bytes: bytes,
},
))
.await
.map(|r| r.into_inner().clan.expect("a clan comes back"))
}
async fn leave(&self, who: &str) -> Result<(), tonic::Status> {
self.clans
.leave(with(&person(who), LeaveClanRequest { clan: CLAN.into() }))
.await
.map(|_| ())
}
/// `fellows`, made by alice (its admin, giving `alice`), bob a member
/// giving `bob`.
async fn fellows(&self, alice: u64, bob: u64) {
self.create("alice", CLAN, alice)
.await
.expect("alice makes the clan");
self.invite("alice", "bob")
.await
.expect("alice invites bob");
self.accept("bob", bob).await.expect("bob joins");
}
async fn make_repo(
&self,
who: &str,
name: &str,
visibility: Visibility,
) -> Result<Repo, tonic::Status> {
self.repos
.create(with(
&person(who),
CreateRepoRequest {
path: Some(RepoPath::new(CLAN, name)),
hash_kind: HashKind::Sha256 as i32,
visibility: visibility as i32,
..Default::default()
},
))
.await
.map(|r| r.into_inner().repo.expect("a repo comes back"))
}
async fn set_visibility(
&self,
who: &str,
name: &str,
to: Visibility,
) -> Result<Repo, tonic::Status> {
self.repos
.set_visibility(with(
&person(who),
SetVisibilityRequest {
path: Some(RepoPath::new(CLAN, name)),
visibility: to as i32,
},
))
.await
.map(|r| r.into_inner().repo.expect("a repo comes back"))
}
fn visibility(&self, name: &str) -> i32 {
self.plane
.get_repo(&RepoPath::new(CLAN, name))
.expect("the repo")
.visibility
}
/// Put about `bytes` of pack into `fellows/<name>`, and answer what the
/// clan stores now (its namespace's measured `pack_bytes`).
fn seed(&self, name: &str, bytes: usize) -> u64 {
let path = RepoRef::new(CLAN, name).expect("legal");
let repo = self
.stores
.catalog()
.get(&path)
.expect("read")
.expect("the repo exists");
let handle = self.stores.repo_store(&repo).expect("open");
let mut pb = PackBuilder::new(gix_hash::Kind::Sha256);
pb.object(gix_object::Kind::Blob, vec![b'q'; bytes]);
handle
.serve()
.put_pack(&pb.build().expect("pack").bytes)
.expect("put_pack");
drop(handle);
self.stores.close_repo(&path);
self.used()
}
fn used(&self) -> u64 {
self.settled()
}
/// What the clan stores once the store has stopped writing beside a new
/// pack (its indexes land a moment after the pack, MEASURED on a loaded
/// oden 2026-10-05: 1.5 MiB read, then 3.5 MiB): three equal readings in
/// a row, 300 ms apart.
fn settled(&self) -> u64 {
let read = || self.plane.usage(Some(CLAN)).expect("usage")[0].pack_bytes;
let (mut last, mut same) = (read(), 0);
for _ in 0..100 {
std::thread::sleep(std::time::Duration::from_millis(300));
let now = read();
same = if now == last { same + 1 } else { 0 };
last = now;
if same >= 3 {
break;
}
}
last
}
}
fn member<'a>(clan: &'a Clan, who: &str) -> Option<&'a ClanMember> {
clan.members.iter().find(|m| m.principal_id == who)
}
// ── what a member may do, and what is the clan admin's ─────────────────────
/// ★ **A member makes PRIVATE repositories in the clan; publishing, deleting
/// and administering them is the clan admin's.** Every refusal leaves the
/// repository as it was.
#[tokio::test]
async fn a_member_makes_private_repositories_and_only_the_clan_admin_publishes_or_deletes_them() {
let rig = Rig::new();
rig.fellows(0, 0).await;
// bob, a member, makes a private repository in the clan…
rig.make_repo("bob", "app", Visibility::Private)
.await
.expect("a member makes a private repository");
// …but not a public one: that is a publish, the admin's.
let err = rig
.make_repo("bob", "open", Visibility::Public)
.await
.expect_err("born public is a publish");
assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
assert!(
rig.plane.get_repo(&RepoPath::new(CLAN, "open")).is_err(),
"the refused repository was made anyway"
);
// bob writes, and does not administer.
let app = Access::repo(&RepoPath::new(CLAN, "app"));
assert!(
rig.plane.may("bob", &app, GrantLevel::Write).unwrap(),
"a member writes the clan's repositories"
);
assert!(
!rig.plane.may("bob", &app, GrantLevel::Admin).unwrap(),
"a member does not administer them"
);
assert!(
rig.plane.may("alice", &app, GrantLevel::Admin).unwrap(),
"the clan admin administers what a member made"
);
assert!(
!rig.plane.may("carol", &app, GrantLevel::Read).unwrap(),
"an outsider reads nothing of the clan's"
);
// Visibility: refused for the member, nothing moved; the admin's works.
let err = rig
.set_visibility("bob", "app", Visibility::Public)
.await
.expect_err("a member may not publish");
assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
assert_eq!(
rig.visibility("app"),
Visibility::Private as i32,
"a refused publish published"
);
rig.set_visibility("alice", "app", Visibility::Public)
.await
.expect("the clan admin publishes");
assert_eq!(rig.visibility("app"), Visibility::Public as i32);
// Who else may reach it: the admin's to grant (Admin over the clan's
// namespace), not a member's.
assert!(
!rig.plane
.may("bob", &Access::namespace(CLAN), GrantLevel::Admin)
.unwrap(),
"a member administers the clan"
);
assert!(rig
.plane
.may("alice", &Access::namespace(CLAN), GrantLevel::Admin)
.unwrap());
// Deletion: the admin's.
let delete = |who: &str| {
rig.repos.delete(with(
&person(who),
DeleteRepoRequest {
path: Some(RepoPath::new(CLAN, "app")),
..Default::default()
},
))
};
let err = delete("bob").await.expect_err("a member may not delete");
assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
assert!(
rig.plane.get_repo(&RepoPath::new(CLAN, "app")).is_ok(),
"a refused delete deleted"
);
delete("alice").await.expect("the clan admin deletes");
// An outsider makes nothing in the clan.
let err = rig
.make_repo("carol", "mine", Visibility::Private)
.await
.expect_err("an outsider");
assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
}
/// ★ **Defaults as for accounts**: the clan's namespace and its events are
/// not public; an outsider is not shown it and is told it does not exist —
/// the same answer as a clan that does not.
#[tokio::test]
async fn a_clans_namespace_and_events_are_private_and_to_an_outsider_it_does_not_exist() {
let rig = Rig::new();
rig.fellows(0, 0).await;
let ns = rig
.plane
.namespace(CLAN)
.expect("ask")
.expect("the clan's namespace exists");
assert!(
!ns.public && !ns.events_public,
"not public by default: {ns:?}"
);
let listed = |who: &str| {
rig.repos
.list_namespaces(with(&person(who), ListNamespacesRequest::default()))
};
let carol: Vec<String> = listed("carol")
.await
.unwrap()
.into_inner()
.namespaces
.into_iter()
.map(|n| n.name)
.collect();
assert!(
!carol.iter().any(|n| n == CLAN),
"an outsider is shown the clan's namespace: {carol:?}"
);
let bob: Vec<String> = listed("bob")
.await
.unwrap()
.into_inner()
.namespaces
.into_iter()
.map(|n| n.name)
.collect();
assert!(
bob.iter().any(|n| n == CLAN),
"a member is not shown its clan: {bob:?}"
);
let outsider = rig.get("carol").await.expect_err("carol is not in it");
let nothing = rig
.clans
.get(with(
&person("carol"),
GetClanRequest {
clan: "nope".into(),
},
))
.await
.expect_err("there is no such clan");
assert_eq!(
(outsider.code(), nothing.code()),
(Code::NotFound, Code::NotFound)
);
// Opening them is the clan admin's.
let open = |who: &str| {
rig.repos.set_namespace_settings(with(
&person(who),
SetNamespaceSettingsRequest {
name: CLAN.into(),
public: Some(true),
events_public: None,
},
))
};
assert_eq!(
open("bob").await.expect_err("a member").code(),
Code::PermissionDenied
);
assert!(
open("alice")
.await
.expect("the admin")
.into_inner()
.namespace
.unwrap()
.public
);
}
// ── the clan's room ─────────────────────────────────────────────────────────
/// ★ **The clan's room is the sum of what its members give.**
#[tokio::test]
async fn the_clans_room_is_the_sum_of_its_members_contributions() {
let rig = Rig::new();
rig.fellows(3 * GIB, 2 * GIB).await;
let clan = rig.get("bob").await.expect("bob sees his clan");
assert_eq!(clan.room_bytes, 5 * GIB, "3 GiB + 2 GiB");
assert_eq!(member(&clan, "alice").unwrap().contribution_bytes, 3 * GIB);
assert_eq!(clan.your_contribution_bytes, 2 * GIB, "bob's own");
assert_eq!(clan.your_role, ClanRole::Member as i32);
let clan = rig.give("bob", 4 * GIB).await.expect("bob gives more");
assert_eq!(clan.room_bytes, 7 * GIB, "3 GiB + 4 GiB");
// A member's view carries no invitations; the admin's does.
rig.invite("alice", "carol")
.await
.expect("alice invites carol");
assert!(
rig.get("bob").await.unwrap().invites.is_empty(),
"a member is shown the admin's invitations"
);
assert_eq!(rig.get("alice").await.unwrap().invites.len(), 1);
}
/// ★ **A contribution goes down only as far as what the clan stores.**
#[tokio::test]
async fn a_contribution_goes_down_only_to_what_the_clan_stores() {
let rig = Rig::new();
rig.fellows(0, 64 * MIB).await;
rig.make_repo("bob", "app", Visibility::Private)
.await
.expect("repo");
let used = rig.seed("app", 200_000);
assert!(used > 0, "the fixture is on disk");
let clan = rig.get("bob").await.unwrap();
assert_eq!(
clan.used_bytes,
Some(used),
"gunnar measured what the clan stores"
);
assert_eq!(
clan.your_floor_bytes,
Some(used),
"alice gives nothing: bob's floor is all of it"
);
// Below the floor: refused, naming it, nothing changed.
let err = rig
.give("bob", used - 1)
.await
.expect_err("below what the clan stores");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
assert!(
err.message().contains("may go down to"),
"{}",
err.message()
);
assert_eq!(
rig.get("bob").await.unwrap().your_contribution_bytes,
64 * MIB,
"a refused lowering lowered"
);
// Down to the floor exactly: fine.
rig.give("bob", used)
.await
.expect("down to what the clan stores");
// When another member gives, the floor moves: bob may give nothing.
rig.give("alice", used).await.expect("alice gives");
let clan = rig.give("bob", 0).await.expect("the others cover it");
assert_eq!(clan.room_bytes, used);
}
/// ★ **Leaving gives the contribution back — refused while it is in use.**
#[tokio::test]
async fn leaving_gives_the_contribution_back_and_is_refused_while_it_is_in_use() {
let rig = Rig::new();
rig.fellows(0, 64 * MIB).await;
rig.make_repo("bob", "app", Visibility::Private)
.await
.expect("repo");
let used = rig.seed("app", 200_000);
let err = rig.leave("bob").await.expect_err("bob's room is in use");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
assert!(
member(&rig.get("alice").await.unwrap(), "bob").is_some(),
"a refused leave left"
);
rig.give("alice", used)
.await
.expect("alice covers what the clan stores");
rig.leave("bob").await.expect("now bob may leave");
let clan = rig.get("alice").await.unwrap();
assert!(member(&clan, "bob").is_none());
assert_eq!(clan.room_bytes, used, "bob's contribution went with him");
assert_eq!(
rig.get("bob").await.expect_err("bob is out").code(),
Code::NotFound
);
assert!(
!rig.plane
.may(
"bob",
&Access::repo(&RepoPath::new(CLAN, "app")),
GrantLevel::Read
)
.unwrap(),
"a member who left still reads the clan's repositories"
);
}
/// ★ **The last admin can neither leave nor be made a plain member.**
#[tokio::test]
async fn the_last_admin_can_neither_leave_nor_be_unmade() {
let rig = Rig::new();
rig.fellows(0, 0).await;
let err = rig.leave("alice").await.expect_err("the last admin");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
assert!(err.message().contains("last admin"), "{}", err.message());
let unmake = |who: &str, whom: &str, admin: bool| {
rig.clans.set_admin(with(
&person(who),
SetClanAdminRequest {
clan: CLAN.into(),
principal_id: whom.into(),
admin,
},
))
};
assert_eq!(
unmake("alice", "alice", false)
.await
.expect_err("last admin")
.code(),
Code::FailedPrecondition
);
// ★ Owner 2026-10-14 (the console drew "Remove" on a clan's one admin): the
// admin cannot remove itself either, so a clan keeps at least one admin.
let err = rig
.clans
.remove_member(with(
&person("alice"),
RemoveClanMemberRequest {
clan: CLAN.into(),
principal_id: "alice".into(),
},
))
.await
.expect_err("the last admin removes itself");
assert!(
err.message().contains("cannot remove itself"),
"{}",
err.message()
);
assert_eq!(
member(&rig.get("alice").await.unwrap(), "alice").map(|m| m.admin),
Some(true),
"still its admin"
);
// With a second admin, the first may go.
unmake("alice", "bob", true)
.await
.expect("alice makes bob admin");
rig.leave("alice").await.expect("now alice may leave");
let clan = rig.get("bob").await.unwrap();
assert_eq!(clan.your_role, ClanRole::Admin as i32);
assert_eq!(clan.members.len(), 1);
}
// ── who may be in a clan, and who decides ───────────────────────────────────
/// ★ **An enterprise account's employee joins no clan and makes none** — its
/// account admin's rules win. The enterprise account itself is an ordinary
/// account and may.
#[tokio::test]
async fn an_enterprise_employee_joins_no_clan_and_makes_none() {
let rig = Rig::new();
rig.enroll_eve().await;
rig.create("alice", CLAN, 0).await.expect("clan");
let err = rig
.invite("alice", "eve")
.await
.expect_err("eve is acme's employee");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
assert!(
err.message().contains("employee of acme"),
"{}",
err.message()
);
let err = rig
.create("eve", "evesclan", 0)
.await
.expect_err("an employee makes no clan");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
assert!(
rig.plane.namespace("evesclan").unwrap().is_none(),
"a refused clan left its namespace behind"
);
let eve = rig
.clans
.list(with(&person("eve"), ListClansRequest {}))
.await
.unwrap()
.into_inner();
assert!(eve.clans.is_empty());
// The enterprise account's own admin is an ordinary account.
rig.invite("alice", "acme")
.await
.expect("acme itself may be invited");
rig.clans
.accept(with(
&person("acme"),
AcceptClanInviteRequest {
clan: CLAN.into(),
contribution_bytes: 0,
},
))
.await
.expect("acme joins");
}
/// ★ **Only the clan's admin invites, removes, promotes and dissolves** — and
/// a server admin is not the clan's admin.
#[tokio::test]
async fn only_the_clan_admin_invites_removes_promotes_and_dissolves() {
let rig = Rig::new();
rig.fellows(0, 0).await;
let err = rig
.invite("bob", "carol")
.await
.expect_err("a member invites nobody");
assert_eq!(err.code(), Code::PermissionDenied, "{err:?}");
let err = rig
.invite("root", "carol")
.await
.expect_err("a server admin is not the clan's admin");
assert_eq!(
err.code(),
Code::NotFound,
"to an outsider the clan does not exist: {err:?}"
);
let remove = |who: &str, whom: &str| {
rig.clans.remove_member(with(
&person(who),
RemoveClanMemberRequest {
clan: CLAN.into(),
principal_id: whom.into(),
},
))
};
assert_eq!(
remove("bob", "alice")
.await
.expect_err("a member removes nobody")
.code(),
Code::PermissionDenied
);
let dissolve = |who: &str| {
rig.clans.dissolve(with(
&person(who),
DissolveClanRequest { clan: CLAN.into() },
))
};
assert_eq!(
dissolve("bob")
.await
.expect_err("a member dissolves nothing")
.code(),
Code::PermissionDenied
);
// carol, invited, answers for herself; dave answers nothing of hers.
rig.invite("alice", "carol")
.await
.expect("the admin invites");
let err = rig
.accept("dave", 0)
.await
.expect_err("dave was not invited");
assert_eq!(err.code(), Code::NotFound, "{err:?}");
rig.clans
.decline(with(
&person("carol"),
DeclineClanInviteRequest {
clan: CLAN.into(),
principal_id: String::new(),
},
))
.await
.expect("carol declines");
assert!(rig.get("alice").await.unwrap().invites.is_empty());
remove("alice", "bob")
.await
.expect("the admin removes a member");
// A clan holding a repository is not dissolved; an empty one is, and its
// namespace goes with it.
rig.make_repo("alice", "keep", Visibility::Private)
.await
.expect("repo");
let err = dissolve("alice").await.expect_err("it holds a repository");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
rig.repos
.delete(with(
&person("alice"),
DeleteRepoRequest {
path: Some(RepoPath::new(CLAN, "keep")),
purge: true,
..Default::default()
},
))
.await
.expect("purged");
dissolve("alice").await.expect("an empty clan is dissolved");
assert!(
rig.plane.namespace(CLAN).unwrap().is_none(),
"the namespace went with the clan"
);
assert_eq!(
rig.get("alice").await.expect_err("gone").code(),
Code::NotFound
);
}
/// ★ **A clan's name is one claim with the namespaces and the accounts**: an
/// account's name is no clan's, a clan's is nobody's account, and a clan's
/// namespace goes only with the clan.
#[tokio::test]
async fn a_clans_name_is_one_claim_with_the_namespaces_and_the_accounts() {
let rig = Rig::new();
let err = rig
.create("alice", "bob", 0)
.await
.expect_err("bob is an account");
assert_eq!(err.code(), Code::AlreadyExists, "{err:?}");
rig.create("alice", CLAN, 0).await.expect("clan");
let err = rig.create("carol", CLAN, 0).await.expect_err("taken");
assert_eq!(err.code(), Code::AlreadyExists, "{err:?}");
assert!(
rig.plane
.add_principal(CLAN, CLAN, PrincipalKind::User)
.is_err(),
"an account was made under a clan's name"
);
let err = rig
.accounts
.enroll_employee(with(
&person("alice"),
EnrollEmployeeRequest {
account: CLAN.into(),
id: "zed".into(),
name: "zed".into(),
..Default::default()
},
))
.await
.expect_err("a clan is no account: it enrolls no employees");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
let err = rig
.repos
.delete_namespace(with(
&person("alice"),
DeleteNamespaceRequest {
name: CLAN.into(),
delete_repos: true,
},
))
.await
.expect_err("the clan's namespace goes with the clan");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
}
/// ★ **A clan is no account to company SSO either** (follow-up of the
/// clans + SSO merge, 2026-10-05): the clan's admin holds Admin over the
/// clan's namespace, which is the account-admin door's rule — so without a
/// refusal of its own a clan admin could give the clan an identity provider,
/// a SCIM bearer or a CSV import, and the people those let in would be
/// EMPLOYEES of the clan. Refused as `EnrollEmployee` refuses it
/// (FAILED_PRECONDITION, "is a clan, not an account"), and nothing written;
/// the same admin's own account is still served.
#[tokio::test]
async fn a_clan_is_no_account_to_company_sso() {
let rig = Rig::new();
rig.create("alice", CLAN, 0).await.expect("clan");
let refused_as_clan = |err: tonic::Status, verb: &str| {
assert_eq!(err.code(), Code::FailedPrecondition, "{verb}: {err:?}");
assert!(
err.message().contains("is a clan, not an account"),
"{verb}: {}",
err.message()
);
};
let err = rig
.sso
.set_provider(with(
&person("alice"),
SetProviderRequest {
provider: Some(SsoProvider {
account: CLAN.into(),
protocol: SsoProtocol::Oidc as i32,
display_name: "fellows corp".into(),
domains: vec!["fellows.example".into()],
oidc: Some(OidcSettings {
issuer: "https://idp.fellows.example".into(),
client_id: "gunnar-fellows".into(),
..Default::default()
}),
console_origin: "https://gunnar.example".into(),
..Default::default()
}),
client_secret: "never-stored".into(),
clear_client_secret: false,
clear_idp_ca: false,
},
))
.await
.expect_err("a clan has no identity provider");
refused_as_clan(err, "Sso.SetProvider");
let err = rig
.sso
.create_scim_token(with(
&person("alice"),
CreateScimTokenRequest {
account: CLAN.into(),
label: "directory".into(),
..Default::default()
},
))
.await
.expect_err("a clan has no SCIM bearer");
refused_as_clan(err, "Sso.CreateScimToken");
let err = rig
.sso
.import_users(with(
&person("alice"),
ImportUsersRequest {
account: CLAN.into(),
csv: "user_name,display_name,email,active\nzed@fellows.example,Zed,,true\n".into(),
dry_run: false,
},
))
.await
.expect_err("a clan imports no employees");
refused_as_clan(err, "Sso.ImportUsers");
let err = rig
.sso
.list_directory(with(
&person("alice"),
ListDirectoryRequest {
account: CLAN.into(),
},
))
.await
.expect_err("a clan has no directory");
refused_as_clan(err, "Sso.ListDirectory");
let auth = rig.stores.auth();
assert!(
auth.sso_provider(CLAN).unwrap().is_none(),
"a provider was written for the clan"
);
assert!(
auth.scim_tokens_of(CLAN).unwrap().is_empty(),
"a SCIM bearer was written for the clan"
);
assert!(
auth.sso_users_of(CLAN).unwrap().is_empty(),
"a directory user was written for the clan"
);
// The allowed twin: alice's OWN account is an account, and its admin is served.
rig.sso
.create_scim_token(with(
&person("alice"),
CreateScimTokenRequest {
account: "alice".into(),
label: "directory".into(),
..Default::default()
},
))
.await
.expect("alice's own account takes a SCIM bearer");
}
/// ★ **A member account that is removed leaves its clans**, and a clan whose
/// last admin it was goes to its longest-standing member — never adminless.
#[tokio::test]
async fn a_removed_account_leaves_its_clans_and_one_it_ran_goes_to_its_longest_member() {
let rig = Rig::new();
rig.fellows(0, 2 * GIB).await;
rig.invite("alice", "carol").await.unwrap();
rig.accept("carol", GIB).await.unwrap();
rig.plane
.remove_principal("alice")
.expect("alice's account is removed");
let clan = rig.get("bob").await.expect("bob is still in it");
assert!(member(&clan, "alice").is_none());
assert_eq!(
clan.your_role,
ClanRole::Admin as i32,
"bob joined first and runs it now"
);
assert_eq!(clan.room_bytes, 3 * GIB);
}
// ── metered: room is the member's own, and the door holds the clan to it ───
#[cfg(feature = "metered")]
mod metered {
use super::*;
use ed25519_dalek::{Signer as _, SigningKey};
use gunnar_common::monetize_key::MonetizePubkey;
use gunnar_proto::usage_server::Usage as _;
use gunnar_server::entitlement::{
EntitlementSlot, MeteredConfig, PACK_CEILING_SLACK_DIVISOR, PACK_CEILING_SLACK_FLOOR_BYTES,
};
use gunnar_ssh::command::GitService;
use gunnar_ssh::server::{Dispatch, DispatchError};
use gunnar_ssh::PlanGate as _;
use monetize_embed::{State, TenantId};
struct Metered {
rig: Rig,
slot: Arc<EntitlementSlot>,
key: SigningKey,
minted: std::sync::atomic::AtomicU64,
}
impl Metered {
fn new() -> Metered {
let dir = tempfile::tempdir().expect("tempdir");
let stores = Arc::new(ServerStores::open(dir.path()).expect("stores"));
let key = SigningKey::from_bytes(&[7u8; 32]);
let pubkey = dir.path().join("monetize.pub");
std::fs::write(&pubkey, key.verifying_key().to_bytes()).expect("write key");
let config = MeteredConfig::load(
&MonetizePubkey::Path(pubkey),
Some("https://gunnar.rs/billing/{tenant}"),
)
.expect("config");
let slot = EntitlementSlot::open(Arc::clone(&stores), &config).expect("slot");
let plane = Arc::new(
CoreControlPlane::new(Arc::clone(&stores)).with_entitlement(Arc::clone(&slot)),
);
Metered {
rig: Rig::with(dir, stores, plane),
slot,
key,
minted: std::sync::atomic::AtomicU64::new(0),
}
}
/// `ns` holds `cap` bytes of room: a fact signed as monetize signs.
fn room(&self, ns: &str, cap: u64) {
let issued = 1_789_000_000_000
+ self
.minted
.fetch_add(1, std::sync::atomic::Ordering::Relaxed);
let mut fact = monetize_embed::EntitlementFact {
tenant: TenantId(ns.to_owned()),
plan: "room".into(),
state: State::Paid,
// A period that has not ended: since round 2 a member whose
// paid period HAS ended gives the clan nothing the door counts.
paid_until_unix_ms: Some(
std::time::SystemTime::now()
.duration_since(std::time::UNIX_EPOCH)
.unwrap()
.as_millis() as u64
+ 30 * 86_400_000,
),
caps: [("pack_bytes".to_owned(), cap)].into_iter().collect(),
source: "payment:test".into(),
signature: vec![],
issued_unix_ms: Some(issued),
issued_signature: vec![],
};
fact.signature = self
.key
.sign(&monetize_embed::signing::fact_message(&fact))
.to_bytes()
.to_vec();
fact.issued_signature = self
.key
.sign(&monetize_embed::signing::fact_message_issued(&fact))
.to_bytes()
.to_vec();
self.rig
.plane
.entitlement_set(EntitlementFact {
namespace: ns.to_owned(),
plan: fact.plan,
state: EntitlementState::Paid as i32,
paid_until_unix_ms: fact.paid_until_unix_ms,
caps: fact.caps,
source: fact.source,
signature: fact.signature,
issued_unix_ms: fact.issued_unix_ms,
issued_signature: fact.issued_signature,
})
.expect("the fact is accepted");
}
fn dispatch(&self) -> Dispatch {
Dispatch::new(
self.rig
.stores
.ssh_control()
.with_plan_gate(Arc::clone(&self.slot) as Arc<dyn gunnar_ssh::PlanGate>),
)
}
fn principal(&self, id: &str) -> gunnar_core::Principal {
self.rig
.stores
.auth()
.principal(id)
.expect("read")
.expect("the account")
}
}
/// ★ **A contribution comes out of the member's OWN room** — what its
/// account holds and has not stored, promised or given its other clans —
/// and an employee may not hold a byte given to a clan.
#[tokio::test]
async fn a_contribution_comes_out_of_the_members_own_room() {
let m = Metered::new();
m.room("alice", 10 * GIB);
let err = m
.rig
.create("alice", CLAN, 11 * GIB)
.await
.expect_err("more than alice has");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
assert!(err.message().contains("short"), "{}", err.message());
assert!(
m.rig.plane.namespace(CLAN).unwrap().is_none(),
"a refused clan left its namespace"
);
let clan = m
.rig
.create("alice", CLAN, 6 * GIB)
.await
.expect("6 of alice's 10 GiB");
assert_eq!(
clan.your_room_left_bytes,
Some(4 * GIB),
"what alice could still give"
);
// Raising past her room is refused; within it, fine.
assert_eq!(
m.rig
.give("alice", 11 * GIB)
.await
.expect_err("past her room")
.code(),
Code::FailedPrecondition
);
m.rig.give("alice", 10 * GIB).await.expect("all of it");
m.rig
.give("alice", 6 * GIB)
.await
.expect("back to 6 (the clan stores nothing)");
// An employee's room is not the room alice gave the clan.
let err = m
.rig
.accounts
.enroll_employee(with(
&person("alice"),
EnrollEmployeeRequest {
account: "alice".into(),
id: "kim".into(),
name: "kim".into(),
// The server's default, 10 GiB: it would fit alice's
// 10 GiB exactly, were 6 of them not the clan's.
room_bytes: 0,
..Default::default()
},
))
.await
.expect_err("6 GiB given + 10 GiB asked > 10 GiB");
assert_eq!(err.code(), Code::FailedPrecondition, "{err:?}");
}
/// ★ **The door holds a clan to the sum, and a member to what it kept.**
/// A clan nobody gave room to takes no push; given room, its member's
/// push is let through; the member's own namespace's ceiling is its cap
/// less what it gives.
#[tokio::test]
async fn the_door_holds_a_clan_to_its_members_contributions_and_a_member_to_what_it_kept() {
let m = Metered::new();
m.room("alice", 10 * GIB);
m.rig.fellows(0, 0).await;
m.rig
.make_repo("bob", "app", Visibility::Private)
.await
.expect("repo");
let dispatch = m.dispatch();
let bob = m.principal("bob");
let app = RepoRef::new(CLAN, "app").unwrap();
let err = dispatch
.authorise_service(&bob, None, GitService::ReceivePack, app.clone())
.expect_err("a clan with no room takes no push");
let DispatchError::Plan { line, .. } = &err else {
panic!("{err:?}")
};
assert!(
line.contains("pack quota") && line.contains("clan fellows"),
"{line}"
);
m.rig
.give("alice", 3 * GIB)
.await
.expect("alice gives 3 GiB");
dispatch
.authorise_service(&bob, None, GitService::ReceivePack, app.clone())
.expect("a member pushes into the clan's room");
let ceiling = m
.slot
.pack_ceiling(CLAN)
.expect("a clan's push carries a ceiling");
let slack = (3 * GIB / PACK_CEILING_SLACK_DIVISOR).max(PACK_CEILING_SLACK_FLOOR_BYTES);
assert_eq!(
ceiling.bytes,
3 * GIB - m.rig.used() + slack,
"the clan's room, less what it holds, plus the slack"
);
// alice's own namespace: 10 GiB less the 3 she gave.
let own = m.slot.pack_ceiling("alice").expect("alice is capped");
let kept = 7 * GIB;
let slack = (kept / PACK_CEILING_SLACK_DIVISOR).max(PACK_CEILING_SLACK_FLOOR_BYTES);
assert_eq!(own.bytes, kept + slack, "alice's own room is what she kept");
// …and Usage.Read says the same numbers the door holds them to.
let usage = &m.rig.usage;
let allowed = |who: &'static str, ns: &'static str| async move {
usage
.read(with(
&person(who),
ReadUsageRequest {
namespace: ns.into(),
},
))
.await
.expect("Usage.Read")
.into_inner()
.allowance
.expect("an allowance")
.pack_bytes
};
assert_eq!(
allowed("bob", CLAN).await,
Some(3 * GIB),
"a clan's allowance is its members' sum"
);
assert_eq!(
allowed("alice", "alice").await,
Some(kept),
"alice's own allowance is what she kept"
);
}
}