crates/monetize-shop-pairing/src/holger_tests.rs
//! **A sold Holger estate speaks holger's contract** (2026-10-17): its own variants, its
//! boxes seeded and planned as holger, its own free switch, no Gunnar welcome — and Gunnar's
//! contract is the default, unchanged (the Gunnar tests in `tests` are not touched).
use super::*;
#[allow(unused_imports)]
use crate::test_fixtures::*;
fn order() -> LaidOrder {
serde_json::from_value(serde_json::json!({
"company": "acme", "apex": "holger.rs", "domain": "",
"names": ["acme.holger.rs"],
"estate": {"reference": "estate/acme", "company": "acme", "zone": "se-sto1", "machines": [
{"role": "front", "hostname": "f", "title": "f", "plan": "STARTER-4xCPU-8GB", "server": "s1", "public_ipv4": "198.51.100.1", "utility_ipv4": "10.6.0.1", "disks": [{"title": "sys", "id": "d1", "gib": 40, "tier": "standard", "address": "virtio:0"}]},
{"role": "main", "hostname": "m", "title": "m", "plan": "STARTER-4xCPU-16GB", "server": "s2", "public_ipv4": "198.51.100.2", "utility_ipv4": "10.6.0.2", "disks": [{"title": "sys", "id": "d2", "gib": 50, "tier": "standard", "address": "virtio:0"}]},
{"role": "twin", "hostname": "t", "title": "t", "plan": "STARTER-1xCPU-2GB", "server": "s3", "public_ipv4": "198.51.100.3", "utility_ipv4": "10.6.0.3", "disks": [{"title": "sys", "id": "d3", "gib": 20, "tier": "standard", "address": "virtio:0"}]}
]},
"first_login_ttl_secs": 604800
}))
.unwrap()
}
/// ★ **The contract is the product's facts'** (v2.0 P3, A28 H11): each field the pairing speaks
/// is read off them, and a fact the product does not declare is refused by name.
#[test]
fn the_contract_is_read_off_the_products_facts_and_refused_by_name_when_missing() {
use monetize_server::testing::lifecycles::{gunnar_facts, holger_facts};
let (g, h) = (gunnar(), holger());
assert_eq!((g.sold_variant.as_str(), g.site_variant.as_str(), g.free_feed.as_str(), g.box_kind, g.front_seed.as_str(), g.box_seed.as_str()), ("gunnar-twin-monetize", "gunnar-twin-one", "plugin.gunnar.free", Kind::Gunnar, "front", "gunnar"));
assert_eq!((h.sold_variant.as_str(), h.site_variant.as_str(), h.free_feed.as_str(), h.box_kind, h.front_seed.as_str(), h.box_seed.as_str()), ("holger-twin-monetize", "holger-twin-one", "plugin.holger.free", Kind::Holger, "holger-front", "holger"));
assert!(g.welcome.as_deref().is_some_and(|w| w.contains("{account}/{repo}")) && h.welcome.is_none());
assert_eq!((g.billing, h.billing, g.offsite, h.offsite, h.boxes_hold_console_token, h.passkey_rp_feed.as_deref()), (Billing::Console, Billing::SitePayPage, false, true, true, Some("passkey_rp_id")));
for (missing, word) in [
(monetize_server::facts::Facts { kind: String::new(), ..gunnar_facts() }, "[contract-no-kind]"),
(monetize_server::facts::Facts { sold_variant: None, ..gunnar_facts() }, "[contract-sold-variant]"),
(monetize_server::facts::Facts { box_kind: Some("not a kind!".into()), ..gunnar_facts() }, "[contract-box-kind]"),
(monetize_server::facts::Facts { welcome_readme: None, ..gunnar_facts() }, "[contract-welcome-readme]"),
(monetize_server::facts::Facts { proof: None, ..holger_facts() }, "[contract-proof]"),
(monetize_server::facts::Facts { billing: None, ..holger_facts() }, "[contract-billing]"),
(monetize_server::facts::Facts { console_token_feed: None, ..holger_facts() }, "[contract-console-token-feed]"),
] {
let why = ProductContract::of(&missing).unwrap_err();
assert!(why.contains(word), "{word}: {why}");
}
// A product's own box kind (nordisk-pairing `Kind::Box`) pairs as that kind.
let lake = ProductContract::of(&monetize_server::facts::Facts { box_kind: Some("fe".into()), ..holger_facts() }).unwrap();
assert_eq!(lake.box_kind.as_str(), "fe");
}
/// ★ **A new order's installer link carries one pre-shared key on both ends** (lane WG-PSK-3,
/// nordisk-pairing 0.5.29), for Holger and Gunnar alike: the front's and the boxes' seeds name
/// the same 32-byte PSK the link file holds, a second order mints another, and with
/// `installer_link_psk = false` (a release whose media predate 0.5.29) neither end has one.
#[test]
fn a_new_orders_installer_link_carries_one_preshared_key_on_both_ends() {
for (c, front, boxes) in [(holger(), "seed.holger-front.toml", "seed.holger.toml"), (gunnar(), "seed.front.toml", "seed.gunnar.toml")] {
let get = |files: &[(String, String)], n: &str| files.iter().find(|(f, _)| f == n).map(|(_, v)| v.clone()).unwrap_or_else(|| panic!("{n}"));
let files = mint_material_with(&c, "acme.example", true).unwrap();
let link = nordisk_pairing::installer::Material::link_of(&get(&files, nordisk_pairing::installer::LINK_KEYS)).unwrap();
let psk = link.psk.unwrap_or_else(|| panic!("{}: the link file holds no PSK", c.product));
for seed in [front, boxes] {
let s = Seed::parse(&get(&files, seed)).unwrap();
let p = s.installer_link.unwrap().psk.unwrap_or_else(|| panic!("{}: {seed} carries no PSK", c.product));
assert_eq!(wg_appliance_core::decode_key(&p).unwrap(), psk, "{}: {seed} and the link file hold one key", c.product);
}
let again = mint_material_with(&c, "acme.example", true).unwrap();
assert_ne!(nordisk_pairing::installer::Material::link_of(&get(&again, nordisk_pairing::installer::LINK_KEYS)).unwrap().psk, Some(psk), "a second order, another key");
let off = mint_material_with(&c, "acme.example", false).unwrap();
assert_eq!(nordisk_pairing::installer::Material::link_of(&get(&off, nordisk_pairing::installer::LINK_KEYS)).unwrap().psk, None);
assert_eq!(Seed::parse(&get(&off, boxes)).unwrap().installer_link.unwrap().psk, None, "off: as before 0.5.29");
}
assert!(!monetize_server::estate_order::EstateOrderConfig::default().installer_link_psk, "off until every sold release reads it");
}
#[test]
fn a_holger_estate_is_seeded_recorded_and_planned_as_holger() {
let files = mint_material_for(&holger(), "acme.holger.rs").unwrap();
let get = |n: &str| files.iter().find(|(f, _)| f == n).map(|(_, v)| v.clone()).unwrap_or_else(|| panic!("{n}"));
let boxes = Seed::parse(&get("seed.holger.toml")).unwrap();
assert_eq!(boxes.kind, Kind::Holger, "the lay hands the product boxes this seed; they are holger boxes");
assert!(!files.iter().any(|(f, _)| f == "seed.gunnar.toml"), "a holger estate carries no gunnar seed");
let front = Seed::parse(&get("seed.holger-front.toml")).unwrap();
assert_eq!(front.kind, Kind::Front, "the pairing kind of a front; its medium and seed file are Holger's own");
assert!(!files.iter().any(|(f, _)| f == "seed.front.toml"), "a holger estate carries no seed for Gunnar's front");
assert!(mint_material_for(&gunnar(), "acme.gunnar.rs").unwrap().iter().any(|(f, _)| f == "seed.front.toml"), "Gunnar's front seed keeps its name");
let o = order();
let f = shared_feed_for(&holger(), &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
assert_eq!(f[contract::FEED_VARIANT], "holger-twin-monetize");
assert!(!f.contains_key(contract::FEED_OPERATOR_WELCOME), "holger makes no Gunnar welcome repository");
assert!(!f.contains_key(contract::FEED_BILLING_URL));
assert_eq!(f[FEED_OPERATOR], "acme-owner");
// F12: a Holger box binds its passkey plane to the fed console host; without it the sale
// check's first-login door (`/-/auth/passkey/config`) answered 404.
assert_eq!(f.get("passkey_rp_id").map(String::as_str), Some("acme.holger.rs"));
let g = shared_feed_for(&gunnar(), &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
assert!(!g.contains_key("passkey_rp_id"), "Gunnar's boxes hold no passkeys");
let p = plan_of_for(&holger(), &o, f, BTreeMap::new(), &BTreeMap::new(), 1800).unwrap();
assert_eq!(p.vms.iter().map(|v| (v.name.as_str(), v.kind)).collect::<Vec<_>>(), [("front", Kind::Front), ("main", Kind::Holger), ("twin", Kind::Holger)]);
}
#[test]
fn a_holger_front_is_fed_holgers_free_switch_and_never_the_directive() {
let dir = tempfile::tempdir().unwrap();
for (n, v) in [("console-admin-token", "aa"), ("estate-client.key", "cc")] {
std::fs::write(dir.path().join(n), v).unwrap();
}
let front = front_feed_for(&holger(), &BTreeMap::new(), &order(), dir.path()).unwrap();
assert_eq!(front.get("plugin.holger.free").map(String::as_str), Some("true"));
assert!(!front.contains_key("plugin.gunnar.free"), "{:?}", front.keys().collect::<Vec<_>>());
let site = monetize_server::estate_order::SiteFeed { bearer: "b".repeat(64), product: "holger".into(), label: "holger-rs".into(), seed_key: String::new(), public_site: false, cli_hole_public: false, public_repositories: Vec::new() };
let s = site_front_feed(&holger(), front, &site).unwrap();
assert!(!s.contains_key("plugin.holger.free"), "an operator site is not told its product is free");
assert_eq!(s[contract::FEED_CONSOLE_PRODUCT], "holger");
}
/// ★ **A Holger lay plan carries the WireGuard estate for all three boxes, as Gunnar's does**
/// (lane E1, 2026-10-19): the plan is a WireGuard plan; the front owns the overlay's `.1` (its
/// relay), main and the twin `.2` and `.3`, each at its laid utility address (where the relay
/// and the firewall rules name it); every box gets its own pre-shared key and the front holds
/// each box's as `wg_psk.<box>`. The plan is Gunnar's plan of the same order, box for box, but
/// for the product's box kind.
#[test]
fn a_holger_lay_plan_carries_the_wg_peers_of_all_three_boxes_as_gunnars_does() {
let o = order();
let f = shared_feed_for(&holger(), &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
let p = plan_of_for(&holger(), &o, f.clone(), BTreeMap::new(), &BTreeMap::new(), 1800).unwrap();
assert_eq!(p.tunnel, TunnelKind::Wireguard, "a Holger estate is a WireGuard estate");
let peers = |p: &Plan| p.vms.iter().map(|v| (v.name.clone(), v.overlay, v.utility, v.public)).collect::<Vec<_>>();
let ip = |s: &str| s.parse::<std::net::Ipv4Addr>().unwrap();
assert_eq!(
peers(&p),
[
("front".to_string(), nordisk_pairing::OVERLAY_FRONT, ip("10.6.0.1"), ip("198.51.100.1")),
("main".to_string(), nordisk_pairing::OVERLAY_BOX_A, ip("10.6.0.2"), ip("198.51.100.2")),
("twin".to_string(), nordisk_pairing::OVERLAY_BOX_B, ip("10.6.0.3"), ip("198.51.100.3")),
]
);
for v in &p.vms {
assert!(nordisk_pairing::in_overlay(v.overlay), "{} is on the overlay", v.name);
}
let g = plan_of_for(&gunnar(), &o, f, BTreeMap::new(), &BTreeMap::new(), 1800).unwrap();
assert_eq!((peers(&g), g.tunnel), (peers(&p), p.tunnel), "the same WireGuard estate as Gunnar's, box for box");
let psks: BTreeMap<String, String> = [("main", 1u8), ("twin", 2u8)].into_iter().map(|(n, b)| (n.to_string(), wg_appliance_core::encode_key(&[b; 32]))).collect();
let p = p.with_wg_psks(&psks).unwrap();
let vm = |n: &str| p.vms.iter().find(|v| v.name == n).unwrap();
for b in ["main", "twin"] {
assert_eq!(vm(b).feed.get(nordisk_pairing::installer::FEED_WG_PSK), Some(&psks[b]), "{b} holds its own key");
assert_eq!(vm("front").feed.get(&nordisk_pairing::installer::feed_wg_psk_for(b)), Some(&psks[b]), "the front holds {b}'s");
}
assert!(!vm("front").feed.contains_key(nordisk_pairing::installer::FEED_WG_PSK), "the front's relay holds each box's key by name, none of its own");
}
/// ★ **A laid estate's every tunnel has a pre-shared key** (lane WG-PSK, 2026-10-30), for both
/// products: the lay mints one per box ([`with_fresh_wg_psks`]), each box holds its own and the
/// front each box's under its name, no two links share one, a second lay mints new ones, the
/// plan's two ends of every link hold one key (`Plan::check`), and the plan's Debug never
/// prints one.
#[test]
fn a_laid_estates_every_tunnel_has_its_own_preshared_key() {
use nordisk_pairing::installer::{feed_wg_psk_for, FEED_WG_PSK};
let o = order();
for c in [holger(), gunnar()] {
let f = shared_feed_for(&c, &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
let laid = |f: BTreeMap<String, String>| with_fresh_wg_psks(plan_of_for(&c, &o, f, BTreeMap::new(), &BTreeMap::new(), 1800).unwrap()).unwrap();
let (p, again) = (laid(f.clone()), laid(f));
p.check().unwrap();
let vm = |p: &Plan, n: &str| p.vms.iter().find(|v| v.name == n).unwrap().feed.clone();
let boxes: Vec<String> = p.vms.iter().filter(|v| v.kind != Kind::Front).map(|v| v.name.clone()).collect();
assert_eq!(boxes, ["main", "twin"], "{}", c.product);
let mut seen = std::collections::BTreeSet::new();
for b in &boxes {
let own = vm(&p, b).get(FEED_WG_PSK).cloned().unwrap_or_else(|| panic!("{}: {b} has no pre-shared key", c.product));
assert!(wg_appliance_core::decode_key(&own).is_ok(), "{b}'s is a 32-byte key");
assert_eq!(vm(&p, "front").get(&feed_wg_psk_for(b)), Some(&own), "{}: the front holds {b}'s", c.product);
assert!(seen.insert(own.clone()), "{}: two links share a key", c.product);
assert_ne!(vm(&again, b).get(FEED_WG_PSK), Some(&own), "{}: a second lay mints new ones", c.product);
assert!(!format!("{p:?}").contains(&own), "the plan's Debug prints a key");
}
}
}
/// Generated for one test run: never a real credential in a fixture.
fn generated() -> String {
wg_appliance_core::keys::generate_keypair_b64().0
}
/// The off-site feed the shop holds for `company` (`InstallRequest.offsite`): generated keys.
fn offsite_store(company: &str, recipient: Option<&str>) -> BTreeMap<String, String> {
use monetize_server::estate_order::*;
let mut f = BTreeMap::from([
(FEED_OFFSITE_ENDPOINT.to_string(), "https://objects.example.invalid".to_string()),
(FEED_OFFSITE_BUCKET.to_string(), "estates-offsite".to_string()),
(FEED_OFFSITE_PREFIX.to_string(), offsite_prefix("holger", company)),
(FEED_OFFSITE_ACCESS_KEY.to_string(), generated()),
(FEED_OFFSITE_SECRET_KEY.to_string(), generated()),
]);
if let Some(r) = recipient {
f.insert(FEED_OFFSITE_RECIPIENT.to_string(), r.to_string());
}
f
}
/// The six off-site keys Holger's main reads (server-lib `offsite::FEED_*`, lane M5).
const OFFSITE_KEYS: [&str; 6] = ["offsite_recipient", "offsite_r2_endpoint", "offsite_bucket", "offsite_prefix", "secret.offsite_r2_access_key", "secret.offsite_r2_secret_key"];
/// ★ **Lane O1: a Holger lay plan feeds the off-site keys to the main and the twin** (which may
/// become main), never the front and never the shared feed: the store the shop holds for the
/// estate, its own prefix `holger/<company>/`, and the recipient its material carries — the
/// PUBLIC half of an X25519 pair minted with the order's material, whose private half never
/// reaches a box (nor the bundle the estate keeps).
#[test]
fn a_holger_lay_plan_feeds_the_offsite_keys_to_main_and_twin() {
let files = mint_material_for(&holger(), "acme.holger.rs").unwrap();
let get = |n: &str| files.iter().find(|(f, _)| f == n).map(|(_, v)| v.clone()).unwrap_or_else(|| panic!("{n} is minted with the material"));
let (key, public) = (get(monetize_server::custody::OFFSITE_KEY_FILE), get(monetize_server::custody::OFFSITE_PUB_FILE));
assert_eq!(wg_appliance_core::keys::public_from_private(&key).unwrap(), public, "an X25519 pair");
assert_eq!(wg_appliance_core::keys::decode_key(&public).unwrap().len(), 32, "base64 of 32 bytes, as Holger's key32 reads it");
assert_ne!(mint_material_for(&holger(), "acme.holger.rs").unwrap().iter().find(|(f, _)| f == monetize_server::custody::OFFSITE_PUB_FILE).unwrap().1, public, "each estate its own pair");
let o = order();
let store = offsite_store("acme", None);
let shared = shared_feed_for(&holger(), &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
let relay = BTreeMap::from([("secret.smtp_url".to_string(), generated()), ("secret.smtp_from".to_string(), "estate@example.invalid".to_string())]);
let boxes = box_feed(&relay, offsite_feed_for(&holger(), &store, Some(&public)));
let p = plan_of_for(&holger(), &o, shared, BTreeMap::from([("front_only".to_string(), "x".to_string())]), &boxes, 1800).unwrap();
for vm in &p.vms {
let fed: Vec<&str> = OFFSITE_KEYS.iter().copied().filter(|k| vm.feed.contains_key(*k)).collect();
if vm.name == "front" {
assert!(fed.is_empty(), "the front ships no copy: {fed:?}");
continue;
}
assert_eq!(fed, OFFSITE_KEYS, "{}: every off-site key", vm.name);
assert_eq!(vm.feed["offsite_recipient"], public, "{}: the estate's own recipient", vm.name);
assert_eq!(vm.feed["offsite_prefix"], "holger/acme/", "{}: the estate's own prefix", vm.name);
assert_eq!((vm.feed["offsite_r2_endpoint"].as_str(), vm.feed["offsite_bucket"].as_str()), ("https://objects.example.invalid", "estates-offsite"));
assert_eq!(vm.feed["secret.offsite_r2_access_key"], store["secret.offsite_r2_access_key"]);
assert_eq!(vm.feed["secret.offsite_r2_secret_key"], store["secret.offsite_r2_secret_key"]);
assert_eq!(vm.feed["secret.smtp_url"], relay["secret.smtp_url"], "{}: the relay as before", vm.name);
}
assert!(OFFSITE_KEYS.iter().all(|k| !p.feed.contains_key(*k)), "never in the shared feed (the front reads it too)");
let all = serde_json::to_string(&p).unwrap();
assert!(!all.contains(&key), "the private half is in no feed");
// The feed's own recipient (the custody's, kept past the hand-off) wins over the material's.
let kept = generated();
assert_eq!(offsite_feed_for(&holger(), &offsite_store("acme", Some(&kept)), Some(&public))["offsite_recipient"], kept);
// No recipient known, or no store: the copy stays off (nothing fed).
assert!(offsite_feed_for(&holger(), &store, None).is_empty());
assert!(offsite_feed_for(&holger(), &BTreeMap::new(), Some(&public)).is_empty());
// The bundle the estate keeps carries the public half, never the private one.
let dir = tempfile::tempdir().unwrap();
let (material, sink) = (dir.path().join("material"), dir.path().join("sink"));
std::fs::create_dir_all(&material).unwrap();
std::fs::create_dir_all(&sink).unwrap();
for (n, v) in &files {
std::fs::write(material.join(n), v).unwrap();
}
std::fs::write(sink.join("ledger.toml"), "").unwrap();
let b: serde_json::Value = serde_json::from_slice(&bundle(&material, &sink, &p).unwrap()).unwrap();
assert!(b["files"].get(monetize_server::custody::OFFSITE_KEY_FILE).is_none(), "the estate never holds its own off-site private key");
assert_eq!(b["files"][monetize_server::custody::OFFSITE_PUB_FILE], public);
}
/// ★ **Lane O1: an order paid before its pair existed is minted one at its install** — handed
/// back into the custody (`return/`), so it is kept; a box laid again after the hand-off (no
/// material held) mints none it could not keep.
#[test]
fn an_order_without_a_pair_is_minted_one_at_its_install_and_hands_it_back() {
let dir = tempfile::tempdir().unwrap();
let (handoff, material) = (dir.path().join("handoff"), dir.path().join("handoff/material"));
std::fs::create_dir_all(&material).unwrap();
let store = offsite_store("acme", None);
let r = offsite_recipient_in(&holger(), &store, &material, &handoff).unwrap().expect("minted");
let back = handoff.join(monetize_server::custody::handoff::RETURN_DIR);
let key = std::fs::read_to_string(back.join(monetize_server::custody::OFFSITE_KEY_FILE)).unwrap();
assert_eq!(std::fs::read_to_string(back.join(monetize_server::custody::OFFSITE_PUB_FILE)).unwrap(), r);
assert_eq!(wg_appliance_core::keys::public_from_private(&key).unwrap(), r, "handed back whole, for the custody to keep");
std::fs::write(material.join(monetize_server::custody::OFFSITE_PUB_FILE), &r).unwrap();
assert_eq!(offsite_recipient_in(&holger(), &store, &material, &handoff).unwrap().as_deref(), Some(r.as_str()), "the material's own pair is read, none minted");
let after = dir.path().join("relay");
assert_eq!(offsite_recipient_in(&holger(), &store, &after.join("material"), &after).unwrap(), None, "no material held: none minted");
assert!(!after.exists());
assert_eq!(offsite_recipient_in(&holger(), &offsite_store("acme", Some("kept")), &material, &handoff).unwrap(), None, "the feed names it already");
}
/// ★ **Lane O1: a Gunnar plan is unchanged by the off-site store** — Gunnar's contract ships no
/// copy from its boxes (its off-site copy is the operator's pull of the front's
/// `/backup/stream`): no pair is minted with its material, nothing is fed, nothing is handed
/// back, and its plan with the store held is its plan without it, byte for byte.
#[test]
#[allow(clippy::assertions_on_constants)]
fn a_gunnar_plan_is_unchanged_by_the_offsite_store() {
assert!(!gunnar().offsite && holger().offsite);
let files = mint_material_for(&gunnar(), "acme.gunnar.rs").unwrap();
assert!(!files.iter().any(|(f, _)| f.starts_with("offsite")), "{:?}", files.iter().map(|(f, _)| f).collect::<Vec<_>>());
let store = offsite_store("acme", Some(&generated()));
assert!(offsite_feed_for(&gunnar(), &store, Some("r")).is_empty());
let dir = tempfile::tempdir().unwrap();
let material = dir.path().join("material");
std::fs::create_dir_all(&material).unwrap();
assert_eq!(offsite_recipient_in(&gunnar(), &offsite_store("acme", None), &material, dir.path()).unwrap(), None);
assert!(!dir.path().join(monetize_server::custody::handoff::RETURN_DIR).exists(), "nothing minted, nothing handed back");
let o = order();
let relay = BTreeMap::from([("secret.smtp_url".to_string(), generated())]);
let shared = shared_feed_for(&gunnar(), &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
let with = plan_of_for(&gunnar(), &o, shared.clone(), BTreeMap::new(), &box_feed(&relay, offsite_feed_for(&gunnar(), &store, Some("r"))), 1800).unwrap();
let without = plan_of_for(&gunnar(), &o, shared, BTreeMap::new(), &relay, 1800).unwrap();
assert_eq!(serde_json::to_value(&with).unwrap(), serde_json::to_value(&without).unwrap());
assert!(with.vms.iter().all(|v| OFFSITE_KEYS.iter().all(|k| !v.feed.contains_key(*k))));
}
/// ★ **Sold media must not break silently (test3-holger-rs 2026-10-22).** A7 row 14 (lane G12,
/// 9bd76cb) stopped feeding main and twin the shared `holger_console_token`: a box of the new
/// release derives its own login from the front's offered console key and does NOT take a fed
/// shared bearer (holger server-cli `paired::install_console_token`: "a fed shared bearer is not
/// taken"). A box of a release from BEFORE the per-box key (test3's 5a333db3, holger 7eaa1c2a)
/// waits for that bearer up to an hour and serves nothing: test3's main sat 40+ minutes. So the
/// shop keeps feeding it to main and twin, as lane D7 did, until every sold Holger runs a release
/// with the per-box key; Gunnar's boxes get nothing new, byte for byte.
#[test]
fn a_holger_lay_plan_keeps_feeding_main_and_twin_the_console_bearer_older_releases_wait_for_and_gunnars_plan_is_unchanged() {
let o = order();
let bearer = generated();
let relay = BTreeMap::from([("secret.smtp_url".to_string(), generated()), ("secret.smtp_from".to_string(), "estate@example.invalid".to_string())]);
let store = offsite_store("acme", Some("r"));
let front = BTreeMap::from([(holger().console_token_feed.to_string(), bearer.clone()), ("tls.acme.holger.rs.key".to_string(), "k".to_string())]);
let shared = shared_feed_for(&holger(), &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
let boxes = box_feed_for(&holger(), &relay, offsite_feed_for(&holger(), &store, None), &front);
let p = plan_of_for(&holger(), &o, shared, front.clone(), &boxes, 1800).unwrap();
for vm in &p.vms {
if vm.name != "front" {
assert_eq!(vm.feed.get("holger_console_token"), Some(&bearer), "{}: the bearer a box of an older release waits for", vm.name);
assert!(!vm.feed.keys().any(|k| k.starts_with("tls.")), "{}: never the front's TLS key", vm.name);
assert_eq!(vm.feed["secret.smtp_url"], relay["secret.smtp_url"], "{}: the relay as before", vm.name);
assert_eq!(vm.feed["offsite_recipient"], "r", "{}: the off-site copy as before", vm.name);
}
}
assert!(!p.feed.contains_key("holger_console_token"), "never in the shared feed");
// A box's feed is the plain box feed and the front's bearer; none when the front holds none.
let mut with_bearer = box_feed(&relay, BTreeMap::new());
with_bearer.insert("holger_console_token".to_string(), bearer.clone());
assert_eq!(box_feed_for(&holger(), &relay, BTreeMap::new(), &front), with_bearer);
assert_eq!(box_feed_for(&holger(), &relay, BTreeMap::new(), &BTreeMap::new()), box_feed(&relay, BTreeMap::new()));
// Gunnar: its boxes hold no console bearer (`console_admin_token` is the front's alone).
let gfront = BTreeMap::from([(gunnar().console_token_feed.to_string(), bearer.clone())]);
let gstore = offsite_store("acme", Some("r"));
assert_eq!(box_feed_for(&gunnar(), &relay, offsite_feed_for(&gunnar(), &gstore, Some("r")), &gfront), box_feed(&relay, offsite_feed_for(&gunnar(), &gstore, Some("r"))), "Gunnar's box feed byte for byte");
let gshared = shared_feed_for(&gunnar(), &o, "acme-owner", "ssh-ed25519 AAAA op", "inviteinviteinvite").unwrap();
plan_of_for(&gunnar(), &o, gshared, gfront.clone(), &box_feed_for(&gunnar(), &relay, BTreeMap::new(), &gfront), 1800).expect("Gunnar's plan still checks (no front-only key on a box)");
}
/// ★ RA5-17 (OX-MONHUNT 2026-10-28): **a site's box laid again is fed the site's box keys with
/// no site bearer** — its variant and its public repositories — and its standing front is left
/// as it was: the relay mints no bearer, and is never refused for the one it does not carry.
#[test]
fn a_site_feed_with_no_bearer_feeds_the_boxes_and_leaves_the_front_as_it_was() {
let site = monetize_server::estate_order::SiteFeed { bearer: String::new(), product: "holger".into(), label: "holger-rs".into(), public_repositories: vec!["crates".into(), "npm".into()], ..Default::default() };
let front = BTreeMap::from([("console_instance".to_string(), "kept".to_string())]);
let mut feed = BTreeMap::new();
let out = with_site(&holger(), &mut feed, front.clone(), Some(&site)).expect("a relay's site feed is not refused for its missing bearer");
assert_eq!(out, front, "the standing front is not re-fed as the site");
assert_eq!(feed[contract::FEED_VARIANT], holger().site_variant, "the box is the site's box");
assert_eq!(site_box_feed(BTreeMap::new(), Some(&site))[contract::FEED_PUBLIC_REPOSITORIES], "crates,npm");
// The site's own lay (a bearer) feeds its front as the site, as before.
let laid = monetize_server::estate_order::SiteFeed { bearer: "b".repeat(64), ..site };
let mut feed = BTreeMap::new();
assert_eq!(with_site(&holger(), &mut feed, front, Some(&laid)).unwrap()[contract::FEED_CONSOLE_PRODUCT], "holger");
}
/// ★ **A routed repository name is a served name** (lane OX-WGDS3, the KVM gate's downstream
/// leg: a laid Holger front was fed no `repo_hosts`, and a name it would route must be one of its
/// `web_hosts`, in its certificate, edda `estate-front::route`): a sale feed's `repo_hosts`
/// (`repo.{{HOST}}`) joins the front's `web_hosts` and the certificate the shop mints for it.
/// Without it nothing changes.
#[test]
fn a_routed_repository_name_is_a_served_name() {
let dir = tempfile::tempdir().unwrap();
for (n, v) in [("console-admin-token", "aa"), ("estate-client.key", "cc")] {
std::fs::write(dir.path().join(n), v).unwrap();
}
let sale = BTreeMap::from([("repo_hosts".to_string(), "repo.{{HOST}}".to_string()), (MINT_CERTIFICATE.to_string(), "true".to_string())]);
let front = front_feed_for(&holger(), &sale, &order(), dir.path()).unwrap();
assert_eq!(front.get("repo_hosts").map(String::as_str), Some("repo.acme.holger.rs"));
assert_eq!(front.get("web_hosts").map(String::as_str), Some("acme.holger.rs,repo.acme.holger.rs"));
assert_eq!(served_names(&order(), "acme.holger.rs", &front), ["acme.holger.rs", "repo.acme.holger.rs"]);
let plain = front_feed_for(&holger(), &BTreeMap::new(), &order(), dir.path()).unwrap();
assert_eq!(plain.get("web_hosts").map(String::as_str), Some("acme.holger.rs"));
assert!(!plain.contains_key("repo_hosts"));
}
/// ★ **HOL-REPO-NAME: every Holger lay routes and certifies `repo.<site>`** (measured 2026-10-31:
/// repo.test2.holger.rs and repo.holger.rs had no record of the lay's and no name on the front's
/// certificate; Holger's docs send every client to `https://repo.<site>/…`). The order serves
/// the guest's names (`repo.` among them, DNS written for it by the lay); the shop's pairing
/// routes the ones the guest's `repo_names` rider names (`repo_hosts`), with NO sale feed key,
/// and they are served names: in `web_hosts` and in the certificate the shop mints.
#[test]
fn every_holger_lay_routes_and_certifies_the_repository_name_its_guest_serves() {
let dir = tempfile::tempdir().unwrap();
for (n, v) in [("console-admin-token", "aa"), ("estate-client.key", "cc")] {
std::fs::write(dir.path().join(n), v).unwrap();
}
let mut o = order();
o.names = ["acme.holger.rs", "www.acme.holger.rs", "repo.acme.holger.rs"].map(String::from).to_vec();
let sale = BTreeMap::from([(MINT_CERTIFICATE.to_string(), "true".to_string())]);
let front = front_feed_for(&holger(), &sale, &o, dir.path()).unwrap();
assert_eq!(front.get("repo_hosts").map(String::as_str), Some("repo.acme.holger.rs"), "routed with no sale feed key: {:?}", front.keys().collect::<Vec<_>>());
assert_eq!(front.get("web_hosts").map(String::as_str), Some("acme.holger.rs,www.acme.holger.rs,repo.acme.holger.rs"));
assert!(!front.contains_key("web_callback_only"), "Holger redirects no served name");
assert_eq!(served_names(&o, "acme.holger.rs", &front), ["acme.holger.rs", "www.acme.holger.rs", "repo.acme.holger.rs"], "the certificate's names");
// A sale feed that names it too routes it once.
let both = BTreeMap::from([("repo_hosts".to_string(), "repo.{{HOST}}".to_string())]);
assert_eq!(front_feed_for(&holger(), &both, &o, dir.path()).unwrap().get("repo_hosts").map(String::as_str), Some("repo.acme.holger.rs"));
// A name the order does not serve (no record laid for it) is never routed nor certified.
let plain = front_feed_for(&holger(), &BTreeMap::new(), &order(), dir.path()).unwrap();
assert!(!plain.contains_key("repo_hosts"), "{plain:?}");
}