nordisk/holger

server/lib/tests/a_downstreams_declaration_loads.rs

//! ★ Lane OX-WGDS3: **a downstream's declaration is one this server reads** — the recipe's
//! `downstream_ron` (what `cargo xtask downstream-media` stages as a downstream medium's
//! `holger_ron`), for `via: Front` and `via: Wireguard`, loads strictly (every key known), and
//! says what the box will do: mirror `bundles` from its one upstream, by TLS through the front
//! or in the clear to main's sync door from its invite, sign as its sync name, open reads, ONE
//! operator bearer.

use std::io::Write;

use holger_recipe::downstream_ron::{render, DownstreamRon, Via, WIREGUARD_DOOR};
use holger_server_lib::mirror_cycle::MirrorCredential;
use holger_server_lib::read_ron_config;

const KEY: &str = "ab12ab12ab12ab12ab12ab12ab12ab12ab12ab12ab12ab12ab12ab12ab12ab12";
const BEARER: &str = "gate-bearer-of-sufficient-length-0123456789";

fn load(text: &str) -> holger_server_lib::Holger {
    let mut f = tempfile::NamedTempFile::new().unwrap();
    f.write_all(text.as_bytes()).unwrap();
    read_ron_config(f.path())
        .unwrap_or_else(|e| panic!("the downstream's declaration loads: {e:#}\n{text}"))
}

#[test]
fn a_front_downstreams_declaration_loads_and_mirrors_the_front_over_tls() {
    let r = DownstreamRon::on_a_box(
        "lab-1",
        "test3.holger.rs",
        KEY,
        Via::Front {
            server_name: None,
            authority: None,
        },
        "https://10.0.2.2:40443",
        BEARER,
    )
    .unwrap();
    let h = load(&render(&r));
    // Lane HOL-CDS: it mirrors, so it is `boundary: Fetch`, which a fetch build holds to.
    assert_eq!(
        h.check_boundary()
            .expect("a mirroring downstream keeps to boundary: Fetch"),
        holger_server_lib::boundary::Boundary::Fetch
    );
    let sync = h.sync.as_ref().expect("a sync block");
    assert_eq!(sync.name, "lab-1");
    assert_eq!(
        (
            sync.upstreams[0].name.as_str(),
            sync.upstreams[0].key.as_str(),
            sync.upstreams[0].invite.as_deref()
        ),
        ("test3.holger.rs", KEY, None)
    );
    let m = h.mirror.as_ref().expect("a mirror block");
    let src = &m.ron_sources[0];
    assert_eq!(
        (src.ron_name.as_str(), src.ron_endpoint.as_str()),
        ("test3.holger.rs", "https://10.0.2.2:40443")
    );
    assert!(
        matches!(src.ron_credential, MirrorCredential::Tls { .. }),
        "{:?}",
        src.ron_credential
    );
    assert_eq!(
        (
            src.ron_repositories[0].ron_from.as_str(),
            src.ron_repositories[0].ron_to.as_str()
        ),
        ("bundles", "bundles")
    );
    // Dialled by address, verified under the certificate's name.
    let named = DownstreamRon::on_a_box(
        "lab-1",
        "test3.holger.rs",
        KEY,
        Via::Front {
            server_name: Some("repo.test3.holger.rs".into()),
            authority: None,
        },
        "https://10.0.2.2:40443",
        BEARER,
    )
    .unwrap();
    let h = load(&render(&named));
    match &h.mirror.as_ref().expect("a mirror block").ron_sources[0].ron_credential {
        MirrorCredential::Tls {
            ron_server_name, ..
        } => assert_eq!(ron_server_name.as_deref(), Some("repo.test3.holger.rs")),
        other => panic!("{other:?}"),
    }
    // The certificate's name and the route's `:authority` apart (lane OX-WGDS3: the bench front's
    // certificate is the site's, its repository route `repo.<site>`).
    let apart = DownstreamRon::on_a_box(
        "lab-1",
        "test3.holger.rs",
        KEY,
        Via::Front {
            server_name: Some("test3.holger.rs".into()),
            authority: Some("repo.test3.holger.rs".into()),
        },
        "https://10.0.2.2:40443",
        BEARER,
    )
    .unwrap();
    let src = load(&render(&apart))
        .mirror
        .expect("a mirror block")
        .ron_sources[0]
        .clone();
    match &src.ron_credential {
        MirrorCredential::Tls {
            ron_server_name,
            ron_authority,
            ..
        } => assert_eq!(
            (ron_server_name.as_deref(), ron_authority.as_deref()),
            (Some("test3.holger.rs"), Some("repo.test3.holger.rs"))
        ),
        other => panic!("{other:?}"),
    }
}

#[test]
fn a_wireguard_downstreams_declaration_loads_and_mirrors_mains_sync_door_from_its_invite() {
    let r = DownstreamRon::on_a_box(
        "lab-2",
        "test3.holger.rs",
        KEY,
        Via::Wireguard,
        WIREGUARD_DOOR,
        BEARER,
    )
    .unwrap();
    let h = load(&render(&r));
    let up = &h.sync.as_ref().expect("a sync block").upstreams[0];
    assert_eq!(
        (up.url.as_deref(), up.invite.as_deref()),
        (Some(WIREGUARD_DOOR), Some(r.invite_path().as_str()))
    );
    let src = &h.mirror.as_ref().expect("a mirror block").ron_sources[0];
    assert_eq!(src.ron_endpoint, WIREGUARD_DOOR);
    assert!(matches!(src.ron_credential, MirrorCredential::Anonymous));
    let auth = h.auth.as_ref().expect("the operator's bearer");
    assert!(auth.rbac_enabled(), "the bearer's box enforces roles");
}

/// ★ Lane cds4 (hol312 gate 2026-11-03): **the one-way appliance's declaration loads too**,
/// with its jobs under Heimdall (`engine: heimdall`, crun its fallback, the released guests).
/// The gate's lab boxes refused to start when a `sandbox:` line closed one parenthesis pair
/// short and the intake block swallowed the next keys.
#[test]
fn the_one_way_declaration_loads_with_its_jobs_under_heimdall() {
    use holger_recipe::downstream_ron::{render_one_way, OneWayRon};
    let text = render_one_way(&OneWayRon::on_a_box("lab-3", "LAB", BEARER).unwrap());
    let h = load(&text);
    assert!(text.contains("sandbox: Some((engine: heimdall,"), "{text}");
    assert!(h.promotion.is_some(), "the intake chain is declared");
}