hub: S2 API — box-facing WG registration + merge-at-read + hub-owned-key guard

POST /hosts/{id}/wg (per-host self-scoped; global = operator/DR path): bind / re-key-in-place / adopt; generation bump + endpoint push ONLY on real change. mergeWireguard injects the hub-owned block into served desired-state at READ time (stored operator blob never touched; fail-safe unmerged on any error; no-peer = byte-identical pass-through — existing golden test untouched+green). handleAdminSetDesiredState rejects top-level wireguard (400). Admin DELETE of a BOUND peer bumps the owning host. NEW golden desired-state-wireguard.golden.json = the S3 cross-repo contract. Red-proofs a/b/c/d run + reverted. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
2026-07-04 00:44:40 +02:00
parent fcf84a0c5c
commit ba52005e61
4 changed files with 447 additions and 0 deletions
@@ -9,9 +9,13 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"net/http"
+	"os"
+	"strings"
+	"sync"
 	"testing"

 	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
+	"gitea.dooplex.hu/admin/felhom-hub/internal/wgsync"
 )

 // fakeWGSyncer counts SyncNow/Trigger calls; err scripts the SyncNow result.
@@ -190,6 +194,252 @@ func TestWGPeers_DeleteUnknown404NoSync(t *testing.T) {
 	}
 }

+// --- S2 Group B: registration endpoint + merge-at-read + admin-PUT rejection ---
+
+// capturingPusher satisfies the wgsync push seam and records payload bytes — wiring a REAL
+// wgsync.Reconciler over it lets API tests assert the actual pushed payload content.
+type capturingPusher struct {
+	mu       sync.Mutex
+	payloads [][]byte
+}
+
+func (c *capturingPusher) Push(ctx context.Context, payload []byte) error {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	c.payloads = append(c.payloads, append([]byte(nil), payload...))
+	return nil
+}
+
+func (c *capturingPusher) count() int {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	return len(c.payloads)
+}
+
+func (c *capturingPusher) last() string {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if len(c.payloads) == 0 {
+		return ""
+	}
+	return string(c.payloads[len(c.payloads)-1])
+}
+
+// putGoldenEndpoint sets the endpoint record with the EXACT values of the S2 wireguard golden.
+func putGoldenEndpoint(t *testing.T, h *Handler) {
+	t.Helper()
+	body := `{"dns_name":"ep0.felhom.eu","wg_port":443,"server_pubkey":"` + testPK(9) + `",` +
+		`"tunnel_subnet":"10.77.0.0/24","pbs_tunnel_ip":"10.77.0.1"}`
+	if rr := do(h, http.MethodPut, "/admin/wg/endpoint", globalKey, body); rr.Code != http.StatusOK {
+		t.Fatalf("PUT golden endpoint = %d: %s", rr.Code, rr.Body.String())
+	}
+}
+
+func TestRegisterHostWG_FullFlowWithPerHostKey(t *testing.T) {
+	h, st, _ := newTestHandler(t)
+	seedHost(t, st, "h1", "c1", "HKEY1")
+	putGoldenEndpoint(t, h)
+	pusher := &capturingPusher{}
+	h.SetWGSyncer(wgsync.NewReconciler(st, pusher, nil))
+
+	rr := do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"`+testPK(1)+`"}`)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("register = %d: %s", rr.Code, rr.Body.String())
+	}
+	var resp struct {
+		AssignedIP string `json:"assigned_ip"`
+		Existed    bool   `json:"existed"`
+		Generation int64  `json:"generation"`
+		Sync       string `json:"sync"`
+	}
+	json.Unmarshal(rr.Body.Bytes(), &resp)
+	if resp.AssignedIP != "10.77.0.2/32" || resp.Existed || resp.Generation != 1 || resp.Sync != "ok" {
+		t.Errorf("resp = %+v, want .2/32 existed=false gen=1 sync=ok", resp)
+	}
+	if pusher.count() != 1 || !strings.Contains(pusher.last(), testPK(1)) {
+		t.Errorf("pushed payloads = %d, last = %s — want 1 push containing the pubkey", pusher.count(), pusher.last())
+	}
+	// Idempotent re-register: generation UNCHANGED, NO new push (both negatives).
+	rr = do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"`+testPK(1)+`"}`)
+	json.Unmarshal(rr.Body.Bytes(), &resp)
+	if rr.Code != http.StatusOK || !resp.Existed || resp.Generation != 1 || resp.Sync != "unchanged" {
+		t.Errorf("idempotent = %d %+v, want existed=true gen-still-1 sync=unchanged", rr.Code, resp)
+	}
+	if pusher.count() != 1 {
+		t.Errorf("push count after idempotent re-register = %d, want still 1", pusher.count())
+	}
+	// Re-key: pubkey swapped in place, ip kept, generation bumped, payload has P2 and NOT P1.
+	rr = do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"`+testPK(2)+`"}`)
+	json.Unmarshal(rr.Body.Bytes(), &resp)
+	if rr.Code != http.StatusOK || resp.AssignedIP != "10.77.0.2/32" || resp.Existed || resp.Generation != 2 {
+		t.Errorf("re-key = %d %+v, want ip kept, gen=2", rr.Code, resp)
+	}
+	if pusher.count() != 2 || !strings.Contains(pusher.last(), testPK(2)) || strings.Contains(pusher.last(), testPK(1)) {
+		t.Errorf("re-key payload = %s — must contain P2, not P1", pusher.last())
+	}
+}
+
+func TestRegisterHostWG_SelfScopeAndConflicts(t *testing.T) {
+	h, st, _ := newTestHandler(t)
+	seedHost(t, st, "h1", "c1", "HKEY1")
+	seedHost(t, st, "h2", "c2", "HKEY2")
+	fake := &fakeWGSyncer{}
+	h.SetWGSyncer(fake)
+
+	// c4: no endpoint record yet → 409, no allocation.
+	if rr := do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"`+testPK(1)+`"}`); rr.Code != http.StatusConflict {
+		t.Errorf("register without endpoint = %d, want 409", rr.Code)
+	}
+	putGoldenEndpoint(t, h)
+
+	// c1: h2's key on h1's path → 403, no row, no sync.
+	if rr := do(h, http.MethodPost, "/hosts/h1/wg", "HKEY2", `{"pubkey":"`+testPK(1)+`"}`); rr.Code != http.StatusForbidden {
+		t.Errorf("cross-host register = %d, want 403", rr.Code)
+	}
+	if peers, _ := st.ListWGPeers(); len(peers) != 0 {
+		t.Errorf("rows after 403 = %d, want 0", len(peers))
+	}
+	if fake.syncCalls != 0 {
+		t.Errorf("sync ran on refused register: %d", fake.syncCalls)
+	}
+	// no auth → 401
+	if rr := do(h, http.MethodPost, "/hosts/h1/wg", "", `{"pubkey":"`+testPK(1)+`"}`); rr.Code != http.StatusUnauthorized {
+		t.Errorf("no-auth register = %d, want 401", rr.Code)
+	}
+	// c3: unknown host (global key so the self-scope gate passes) → 404.
+	if rr := do(h, http.MethodPost, "/hosts/ghost/wg", globalKey, `{"pubkey":"`+testPK(1)+`"}`); rr.Code != http.StatusNotFound {
+		t.Errorf("unknown host = %d, want 404", rr.Code)
+	}
+	// c2: pubkey bound to h2 → h1 registering it → 409.
+	if rr := do(h, http.MethodPost, "/hosts/h2/wg", "HKEY2", `{"pubkey":"`+testPK(1)+`"}`); rr.Code != http.StatusOK {
+		t.Fatalf("h2 register = %d", rr.Code)
+	}
+	if rr := do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"`+testPK(1)+`"}`); rr.Code != http.StatusConflict {
+		t.Errorf("stealing h2's pubkey = %d, want 409", rr.Code)
+	}
+	// bad pubkey → 400
+	if rr := do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"nope"}`); rr.Code != http.StatusBadRequest {
+		t.Errorf("bad pubkey = %d, want 400", rr.Code)
+	}
+}
+
+func TestDesiredState_WireguardMergeMatchesGolden(t *testing.T) {
+	h, st, _ := newTestHandler(t)
+	seedHost(t, st, "h1", "c1", "HKEY1")
+	putGoldenEndpoint(t, h)
+	h.SetWGSyncer(&fakeWGSyncer{})
+
+	// Operator sets the EXISTING golden's desired_state (the operator blob half).
+	raw, err := os.ReadFile("testdata/desired-state.golden.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var base struct {
+		DesiredState json.RawMessage `json:"desired_state"`
+	}
+	json.Unmarshal(raw, &base)
+	if rr := do(h, http.MethodPut, "/admin/hosts/h1/desired-state", globalKey, string(base.DesiredState)); rr.Code != http.StatusOK {
+		t.Fatalf("admin-set: %d", rr.Code)
+	}
+	// Box registers → the served state must equal the NEW golden (base + wireguard block).
+	if rr := do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"`+testPK(1)+`"}`); rr.Code != http.StatusOK {
+		t.Fatalf("register: %d", rr.Code)
+	}
+
+	// This file is the S3 CROSS-REPO CONTRACT — the agent's testdata copy must stay
+	// byte-identical (the desired-state.golden.json duplication rule).
+	wgGolden, err := os.ReadFile("testdata/desired-state-wireguard.golden.json")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var want struct {
+		DesiredState json.RawMessage `json:"desired_state"`
+	}
+	json.Unmarshal(wgGolden, &want)
+
+	rr := do(h, http.MethodGet, "/hosts/h1/desired-state", "HKEY1", "")
+	if rr.Code != 200 {
+		t.Fatalf("GET: %d", rr.Code)
+	}
+	var got struct {
+		Generation   int64           `json:"generation"`
+		DesiredState json.RawMessage `json:"desired_state"`
+	}
+	json.Unmarshal(rr.Body.Bytes(), &got)
+	if got.Generation != 2 { // admin-set (1) + registration bump (2)
+		t.Errorf("generation = %d, want 2", got.Generation)
+	}
+	var wantAny, gotAny any
+	json.Unmarshal(want.DesiredState, &wantAny)
+	json.Unmarshal(got.DesiredState, &gotAny)
+	wb, _ := json.Marshal(wantAny)
+	gb, _ := json.Marshal(gotAny)
+	if string(wb) != string(gb) {
+		t.Errorf("served desired_state != wireguard golden:\n want: %s\n got:  %s", wb, gb)
+	}
+
+	// Stored-blob purity: the raw stored desired_json is BYTE-identical to what the operator PUT.
+	host, _ := st.GetHost("h1")
+	if host.DesiredJSON != string(base.DesiredState) {
+		t.Errorf("stored desired_json was modified by the merge:\n stored: %s\n put:    %s", host.DesiredJSON, base.DesiredState)
+	}
+}
+
+func TestAdminSetDesiredState_RejectsWireguardKey(t *testing.T) {
+	h, st, _ := newTestHandler(t)
+	seedHost(t, st, "h1", "c1", "HKEY1")
+	putGoldenEndpoint(t, h)
+
+	fake := `{"guests":[],"wireguard":{"pubkey":"FAKE","assigned_ip":"10.77.0.99/32"}}`
+	rr := do(h, http.MethodPut, "/admin/hosts/h1/desired-state", globalKey, fake)
+	if rr.Code != http.StatusBadRequest {
+		t.Fatalf("PUT with wireguard key = %d, want 400", rr.Code)
+	}
+	if !strings.Contains(rr.Body.String(), "hub-owned") {
+		t.Errorf("rejection message = %q, want the hub-owned hint", rr.Body.String())
+	}
+	// Follow-up GET must NOT serve the fake block (nothing was stored; no peer registered).
+	rr = do(h, http.MethodGet, "/hosts/h1/desired-state", "HKEY1", "")
+	if strings.Contains(rr.Body.String(), "FAKE") || strings.Contains(rr.Body.String(), "wireguard") {
+		t.Errorf("GET serves a wireguard block that was never legitimately registered: %s", rr.Body.String())
+	}
+	// Generation untouched by the refused PUT.
+	host, _ := st.GetHost("h1")
+	if host.DesiredGeneration != 0 {
+		t.Errorf("generation moved on refused PUT: %d", host.DesiredGeneration)
+	}
+}
+
+func TestAdminDeleteWGPeer_BumpsOwnerOnlyForBoundPeers(t *testing.T) {
+	h, st, _ := newTestHandler(t)
+	seedHost(t, st, "h1", "c1", "HKEY1")
+	putGoldenEndpoint(t, h)
+	h.SetWGSyncer(&fakeWGSyncer{})
+
+	// Bound peer: register (gen 1) then admin-delete → gen 2, GET has no wireguard key.
+	do(h, http.MethodPost, "/hosts/h1/wg", "HKEY1", `{"pubkey":"`+testPK(1)+`"}`)
+	rr := do(h, http.MethodDelete, "/admin/wg/peers", globalKey, `{"pubkey":"`+testPK(1)+`"}`)
+	if rr.Code != http.StatusOK {
+		t.Fatalf("delete bound = %d", rr.Code)
+	}
+	host, _ := st.GetHost("h1")
+	if host.DesiredGeneration != 2 {
+		t.Errorf("generation after bound delete = %d, want 2 (register+delete)", host.DesiredGeneration)
+	}
+	rr = do(h, http.MethodGet, "/hosts/h1/desired-state", "HKEY1", "")
+	if strings.Contains(rr.Body.String(), "wireguard") {
+		t.Errorf("GET still serves wireguard after peer delete: %s", rr.Body.String())
+	}
+
+	// Unbound peer: admin add + delete → NO host generation movement (the negative).
+	do(h, http.MethodPost, "/admin/wg/peers", globalKey, `{"pubkey":"`+testPK(3)+`"}`)
+	do(h, http.MethodDelete, "/admin/wg/peers", globalKey, `{"pubkey":"`+testPK(3)+`"}`)
+	host, _ = st.GetHost("h1")
+	if host.DesiredGeneration != 2 {
+		t.Errorf("unbound add/delete moved h1's generation: %d, want still 2", host.DesiredGeneration)
+	}
+}
+
 func TestWGPeers_DeleteKnownRemovesAndSyncs(t *testing.T) {
 	h, st, _ := newTestHandler(t)
 	putTestEndpoint(t, h)