egutierrez
e9ad719424
0003 built the JetStream KV store (jetstreamStore) but the binary never selected it: membership.Open (SQLite) was hardcoded and OpenJetStream was only reached by migrate-to-kv. This completes the wiring so a node actually serves its control plane from the replicated KV. - New flag --store kv|sqlite (default sqlite). kv opens the JetStream KV control plane over the privileged internal connection; sqlite is the unchanged baseline (branch-by-abstraction: the full suite's SQLite paths are untouched). - Bootstrap cycle resolved with storeHolder: the authenticator consults the holder (fail-closed until set), so it can be built before the KV store exists. The KV store opens after NATS is up and is published into the holder. The only client that can connect in that window is the internal identity, which bypasses the store by key. In SQLite mode the store is set before StartServer, so the window does not exist. - needJS now covers --store kv as well as --cluster-name; the JetStream client is shared by the KV store and the replicated nonce bucket. - feature_flags.json: decentralized wiring documented as complete, realized via --store kv (opt-in per deploy; default stays sqlite). Fail-closed preserved: jetstreamStore.IsAuthorized already denies on any backend error; the holder denies while unset. Tests: - TestStoreHolderFailClosed: empty holder denies; serves after set. - TestKVStoreBootstrapUnderEnforce: end-to-end decentralized boot — KV-seeded user authenticates over nkey under enforce; outsider denied. - TestKVStoreDecentralizedConsistency: a room/user created on one node's KV store is visible to another's (ends the per-node SQLite divergence, audit 0008 N5). CGO_ENABLED=0 go build/vet/test green; govulncheck 0 reachable. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
52 lines
1.3 KiB
Go
52 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/hex"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
cs "fn-registry/functions/cybersecurity"
|
|
|
|
"github.com/enmanuel/unibus/pkg/membership"
|
|
)
|
|
|
|
// TestStoreHolderFailClosed: an empty holder denies everything (the bootstrap
|
|
// window before the store is set), and starts serving once a store is published.
|
|
func TestStoreHolderFailClosed(t *testing.T) {
|
|
h := &storeHolder{}
|
|
|
|
// Empty: deny + error (fail closed).
|
|
if h.IsAuthorized("anything") {
|
|
t.Fatalf("empty holder must deny IsAuthorized")
|
|
}
|
|
if _, err := h.subjectACL("anything"); err == nil {
|
|
t.Fatalf("empty holder must error from subjectACL (fail closed)")
|
|
}
|
|
|
|
// After set: serves from the real store.
|
|
store, err := membership.Open(filepath.Join(t.TempDir(), "unibus.db"))
|
|
if err != nil {
|
|
t.Fatalf("store: %v", err)
|
|
}
|
|
t.Cleanup(func() { store.Close() })
|
|
id, err := cs.GenerateIdentity()
|
|
if err != nil {
|
|
t.Fatalf("identity: %v", err)
|
|
}
|
|
pub := hex.EncodeToString(id.SignPub)
|
|
if err := store.AddUser(pub, "alice", membership.RoleMember); err != nil {
|
|
t.Fatalf("add user: %v", err)
|
|
}
|
|
h.set(store)
|
|
|
|
if !h.IsAuthorized(pub) {
|
|
t.Fatalf("after set, an active user must be authorized")
|
|
}
|
|
if _, err := h.subjectACL(pub); err != nil {
|
|
t.Fatalf("after set, subjectACL must succeed: %v", err)
|
|
}
|
|
if h.IsAuthorized("deadbeef") {
|
|
t.Fatalf("a non-user must not be authorized")
|
|
}
|
|
}
|