wgtunnel: S3 Part 1 — pure-Go keygen + hub wire (WireWireguard, report stanza, RegisterWG)

key.go: create-once 0600/0700, corrupt-refusal (never overwrite — may be escrowed identity), clamp for CANONICAL STORED form (x/crypto X25519 clamps derivation internally — discovered during red-proof (c); the stored-clamped test is the real anchor). Fixed vectors generated with real wg pubkey (provenance in test). hub: WireDesiredState.Wireguard + WireguardStatus report stanza + RegisterWG client (typed errors, token-free). S2 golden copied BYTE-IDENTICAL + field-exact decode test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-04 07:00:19 +02:00
parent 4ba1b144d6
commit 0daae92c4f
7 changed files with 520 additions and 1 deletions
@@ -0,0 +1,56 @@
+package hub
+
+// S3 Group C — the wireguard desired-state block contract. testdata/desired-state-wireguard.
+// golden.json MUST stay byte-identical with felhom.eu/hub's copy (the established cross-repo
+// duplication rule); this test decodes it through the new WireWireguard struct field-exactly
+// and key-set-compares to catch drift.
+
+import (
+	"encoding/json"
+	"os"
+	"testing"
+)
+
+func TestDesiredStateWireguardGolden_DecodesFieldExact(t *testing.T) {
+	raw, err := os.ReadFile("testdata/desired-state-wireguard.golden.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var resp DesiredStateResponse
+	if err := json.Unmarshal(raw, &resp); err != nil {
+		t.Fatalf("wireguard golden does not decode into DesiredStateResponse: %v", err)
+	}
+	wg := resp.DesiredState.Wireguard
+	if wg == nil {
+		t.Fatal("wireguard block missing after decode")
+	}
+	if wg.Pubkey != "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE=" {
+		t.Errorf("pubkey = %q", wg.Pubkey)
+	}
+	if wg.AssignedIP != "10.77.0.2/32" {
+		t.Errorf("assigned_ip = %q", wg.AssignedIP)
+	}
+	ep := wg.Endpoint
+	if ep.DNSName != "ep0.felhom.eu" || ep.WGPort != 443 ||
+		ep.ServerPubkey != "CQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQk=" || ep.PBSTunnelIP != "10.77.0.1" {
+		t.Errorf("endpoint = %+v", ep)
+	}
+	// The base (non-wireguard) content of the golden is the S2 superset of the original
+	// desired-state golden — the pre-existing fields must still decode.
+	if len(resp.DesiredState.Guests) != 2 || resp.DesiredState.PBSNamespace != "felhom-cust-acme" {
+		t.Errorf("base fields lost: guests=%d ns=%q", len(resp.DesiredState.Guests), resp.DesiredState.PBSNamespace)
+	}
+
+	// Key-set drift guard for the wireguard object + its endpoint.
+	var golden map[string]any
+	json.Unmarshal(raw, &golden)
+	b, _ := json.Marshal(resp)
+	var got map[string]any
+	json.Unmarshal(b, &got)
+	assertSameKeys(t, "desired_state.wireguard",
+		golden["desired_state"].(map[string]any)["wireguard"],
+		got["desired_state"].(map[string]any)["wireguard"])
+	assertSameKeys(t, "desired_state.wireguard.endpoint",
+		golden["desired_state"].(map[string]any)["wireguard"].(map[string]any)["endpoint"],
+		got["desired_state"].(map[string]any)["wireguard"].(map[string]any)["endpoint"])
+}