feat(hub): operator OOB peer + oob_peer_ip desired-state merge (H1 Part 1)

store.SetOperatorOOBPeer/GetOperatorOOBPeer (empty-host_id wg_peers row, explicit /32, validated in-subnet/not-reserved/not-taken, last-write-wins rotation). PUT/GET /admin/wg/operator-peer (global key). mergeWireguard adds oob_peer_ip when an operator peer exists (absent = byte-identical). BumpAllHostGenerations forces fleet re-fetch. Non-hollow tests both sides. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-05 22:08:06 +02:00
parent a3ee93e97e
commit 0ec7555126
6 changed files with 342 additions and 1 deletions
@@ -0,0 +1,73 @@
+package store
+
+import "testing"
+
+const opPubkey = "cdmN4U+fjR18zBk+SKoceJQyz9HgA9+hN8/FiKF1u0o="
+
+func TestOperatorOOBPeer_RoundTripRotateAndUnbound(t *testing.T) {
+	s := newTestStore(t)
+	setTestEndpoint(t, s, "10.77.0.0/24", "10.77.0.1")
+
+	// none → (nil,nil)
+	if op, err := s.GetOperatorOOBPeer(); err != nil || op != nil {
+		t.Fatalf("no operator peer: got %+v / %v", op, err)
+	}
+
+	// register at an explicit /32
+	if err := s.SetOperatorOOBPeer(opPubkey, "10.77.0.250"); err != nil {
+		t.Fatalf("SetOperatorOOBPeer: %v", err)
+	}
+	op, err := s.GetOperatorOOBPeer()
+	if err != nil || op == nil {
+		t.Fatalf("GetOperatorOOBPeer: %+v / %v", op, err)
+	}
+	if op.AssignedIP != "10.77.0.250" || op.Pubkey != opPubkey {
+		t.Fatalf("operator peer = %+v", op)
+	}
+	if op.HostID != "" || op.Note != OperatorOOBNote {
+		t.Fatalf("operator peer must be UNBOUND (host_id '') + note operator-oob: %+v", op)
+	}
+	// it IS in the peer list (so peersync pushes it to the endpoint)
+	if peerCount(t, s) != 1 {
+		t.Fatalf("operator peer must appear in ListWGPeers")
+	}
+
+	// rotate: new key + new IP replaces the old (last-write-wins, still one operator row)
+	const opPubkey2 = "tQ6eJC9y8pSKtam44DaSrrtYBZYUvZG2z1stS6PsaD4="
+	if err := s.SetOperatorOOBPeer(opPubkey2, "10.77.0.249"); err != nil {
+		t.Fatalf("rotate: %v", err)
+	}
+	op, _ = s.GetOperatorOOBPeer()
+	if op.Pubkey != opPubkey2 || op.AssignedIP != "10.77.0.249" {
+		t.Fatalf("rotate did not replace: %+v", op)
+	}
+	if peerCount(t, s) != 1 {
+		t.Fatalf("rotate must keep exactly one operator peer, got %d", peerCount(t, s))
+	}
+}
+
+func TestOperatorOOBPeer_ValidationRejectsReservedAndTaken(t *testing.T) {
+	s := newTestStore(t)
+	setTestEndpoint(t, s, "10.77.0.0/24", "10.77.0.1")
+
+	for _, bad := range []struct{ ip, why string }{
+		{"10.77.0.1", "pbs_tunnel_ip"},
+		{"10.77.0.0", "network address"},
+		{"10.77.0.255", "broadcast"},
+		{"10.88.0.5", "outside subnet"},
+		{"not-an-ip", "not an ip"},
+	} {
+		if err := s.SetOperatorOOBPeer(opPubkey, bad.ip); err == nil {
+			t.Errorf("SetOperatorOOBPeer(%q) accepted but should reject (%s)", bad.ip, bad.why)
+		}
+	}
+
+	// a customer peer holds 10.77.0.2 → operator can't take it
+	if _, _, err := s.AddWGPeer("PCUST", "h1", ""); err != nil {
+		t.Fatalf("AddWGPeer: %v", err)
+	}
+	custIP, _ := s.GetWGPeerForHost("h1")
+	if err := s.SetOperatorOOBPeer(opPubkey, custIP.AssignedIP); err == nil {
+		t.Fatalf("operator peer must not take a customer's IP %s", custIP.AssignedIP)
+	}
+}