hub v0.161.0: passphrase keys only until the box uses its own (box-config route; R-1159, D19); ep0 namespaces without a prune job alarmed, tenantsync v1.3.0 creates the job (R-1165)

hub/internal/api/r1159_min_controller_test.go

@@ -0,0 +1,34 @@
+package api
+
+import (
+	"os"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+)
+
+// boxConfigMinController must be the controller release that pulls its config with its own key (GET /box-config). If
+// it named an earlier one, a box on that controller would be refused its passphrase config refresh while it still
+// needs it (its config changes would stop arriving). Read from the controller's CHANGELOG beside this repo (the
+// workspace layout; a CI clone has no sibling, and says so).
+func TestR1159_BoxConfigMinControllerIsTheReleaseThatPullsWithItsKey(t *testing.T) {
+	p := filepath.Join("..", "..", "..", "..", "felhom-controller", "CHANGELOG.md")
+	b, err := os.ReadFile(p)
+	if err != nil {
+		t.Skipf("NOT CHECKED: the controller clone is not beside this repo (%v) — the workspace run checks it", err)
+	}
+	m := regexp.MustCompile(`(?m)^## v` + regexp.QuoteMeta(boxConfigMinController) + ` .*$`).FindString(string(b))
+	if m == "" {
+		t.Fatalf("the controller CHANGELOG has no `## v%s` heading — boxConfigMinController names a release that does not exist", boxConfigMinController)
+	}
+	if !strings.Contains(m, "box-config") && !strings.Contains(m, "own key") {
+		t.Fatalf("controller v%s's heading does not say it pulls its config with its own key: %s", boxConfigMinController, m)
+	}
+	// And no EARLIER release may claim it (then the constant would be too high, and the lock would arm late).
+	for _, h := range regexp.MustCompile(`(?m)^## v(\d+\.\d+\.\d+) .*$`).FindAllStringSubmatch(string(b), -1) {
+		if h[1] != boxConfigMinController && strings.Contains(h[0], "box-config") {
+			t.Errorf("controller v%s also names box-config: %s", h[1], h[0])
+		}
+	}
+}