mirror of
https://github.com/gadgethd/ukmesh.git
synced 2026-10-15 10:40:01 +00:00
test(ops): cover concurrent newuser grant updates
This commit is contained in:
gadgethd
Executable → Regular
+205
-62
@@ -2,86 +2,229 @@
|
||||
|
||||
set -Eeuo pipefail
|
||||
|
||||
readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
readonly SCRIPT_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
||||
readonly NODE_A='A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1A1'
|
||||
readonly NODE_B='B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2B2'
|
||||
readonly NODE_C='C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3C3'
|
||||
readonly NODE_C="$(printf 'C3%.0s' {1..32})"
|
||||
|
||||
test_root="$(mktemp -d)"
|
||||
trap 'rm -rf -- "$test_root"' EXIT
|
||||
mkdir -p "$test_root/bin" "$test_root/repo" "$test_root/infra"
|
||||
touch "$test_root/infra/docker-compose.yml"
|
||||
printf 'OWNER_MQTT_USERNAME_MAP=alice=%s,bob=%s\n' "$NODE_A" "$NODE_C" \
|
||||
>"$test_root/repo/.env"
|
||||
cleanup() {
|
||||
local status=$?
|
||||
if (( status == 0 )); then
|
||||
rm -rf -- "$test_root"
|
||||
else
|
||||
printf 'newuser test artifacts retained at %s\n' "$test_root" >&2
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT
|
||||
mkdir -p "$test_root/bin"
|
||||
|
||||
cat >"$test_root/bin/docker" <<'EOF'
|
||||
#!/usr/bin/env bash
|
||||
set -Eeuo pipefail
|
||||
|
||||
printf 'ARGS %s\n' "$*" >>"$FAKE_DOCKER_LOG"
|
||||
if [[ ${1:-} == inspect ]]; then
|
||||
if [[ $* == *State.Running* ]]; then
|
||||
printf 'true\n'
|
||||
elif [[ $* == *State.Status* ]]; then
|
||||
printf 'running\n'
|
||||
else
|
||||
printf 'healthy\n'
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
case ${1:-} in
|
||||
inspect)
|
||||
if [[ $* == *State.Running* ]]; then
|
||||
printf 'true\n'
|
||||
if [[ ${1:-} == compose ]]; then
|
||||
case "$*" in
|
||||
*'ps -q mosquitto') printf 'infra-mosquitto-id\n' ;;
|
||||
*'ps -q timescaledb') printf 'infra-timescaledb-id\n' ;;
|
||||
*' up -d --no-deps backend') printf 'COMPOSE_BACKEND\n' >>"$FAKE_DOCKER_LOG" ;;
|
||||
*) printf 'unexpected docker compose invocation: %s\n' "$*" >&2; exit 1 ;;
|
||||
esac
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ ${1:-} == logs ]]; then
|
||||
if [[ -n ${FAKE_DISCOVERY_WAIT_MARKER:-} ]]; then
|
||||
: >"$FAKE_DISCOVERY_WAIT_MARKER"
|
||||
fi
|
||||
if [[ -n ${FAKE_DISCOVERY_RELEASE:-} && -e $FAKE_DISCOVERY_RELEASE ]]; then
|
||||
printf "New client connected from 127.0.0.1:1234 as meshcore_%s_1 (p2, c1, k60, u'%s').\n" \
|
||||
"$FAKE_DISCOVERY_NODE" "$FAKE_DISCOVERY_USERNAME"
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
[[ ${1:-} == exec ]] || { printf 'unexpected docker invocation: %s\n' "$*" >&2; exit 1; }
|
||||
|
||||
# Never put the generated broker password into test logs.
|
||||
if [[ $* == *'NEWUSER_MQTT_PASSWORD='* ]]; then
|
||||
printf 'VERIFY_BROKER_LOGIN\n' >>"$FAKE_DOCKER_LOG"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ $* == *'mosquitto_passwd -b '* ]]; then
|
||||
username="${!#}"
|
||||
printf 'CREDENTIAL_CREATE %s\n' "$username" >>"$FAKE_DOCKER_LOG"
|
||||
: >"$FAKE_CREDENTIAL_FILE"
|
||||
[[ ${FAKE_FAIL_STAGE:-} != credential ]] || exit 1
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ $* == *'mosquitto_passwd -D '* ]]; then
|
||||
username="${!#}"
|
||||
printf 'CREDENTIAL_DELETE %s\n' "$username" >>"$FAKE_DOCKER_LOG"
|
||||
rm -f -- "$FAKE_CREDENTIAL_FILE"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ $* == *'while IFS=: read'* ]]; then
|
||||
username="${!#}"
|
||||
if [[ ",${FAKE_EXISTING_USERS:-}," == *",${username},"* ]]; then
|
||||
exit 0
|
||||
fi
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [[ $* == *'/mosquitto/config/acl'* ]]; then
|
||||
if [[ $* == *'node_id='* ]]; then
|
||||
printf 'ACL_READBACK\n' >>"$FAKE_DOCKER_LOG"
|
||||
[[ ${FAKE_FAIL_STAGE:-} != acl ]]
|
||||
exit $?
|
||||
fi
|
||||
printf 'ACL_PRECHECK\n' >>"$FAKE_DOCKER_LOG"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
sql=''
|
||||
if [[ " $* " == *' -i '* ]]; then
|
||||
sql="$(cat)"
|
||||
printf 'SQL %s\n' "$sql" >>"$FAKE_DOCKER_LOG"
|
||||
fi
|
||||
|
||||
mqtt_username=''
|
||||
for argument in "$@"; do
|
||||
case $argument in
|
||||
mqtt_username=*) mqtt_username=${argument#*=} ;;
|
||||
esac
|
||||
done
|
||||
|
||||
if [[ $* == *' psql '* ]]; then
|
||||
if [[ $sql == *'SELECT COALESCE('* ]]; then
|
||||
if [[ ",${FAKE_EXISTING_DB_USERS:-}," == *",${mqtt_username},"* ]]; then
|
||||
printf 'active\n'
|
||||
else
|
||||
printf 'healthy\n'
|
||||
printf 'missing\n'
|
||||
fi
|
||||
;;
|
||||
compose)
|
||||
case "$*" in
|
||||
*'ps -q mosquitto') printf 'infra-mosquitto-id\n' ;;
|
||||
*'ps -q timescaledb') printf 'infra-timescaledb-id\n' ;;
|
||||
*' up -d --no-deps backend') ;;
|
||||
*) printf 'unexpected docker compose invocation: %s\n' "$*" >&2; exit 1 ;;
|
||||
esac
|
||||
;;
|
||||
exec)
|
||||
sql=''
|
||||
if [[ " $* " == *' -i '* ]]; then
|
||||
sql="$(cat)"
|
||||
printf 'STDIN %s\n' "$sql" >>"$FAKE_DOCKER_LOG"
|
||||
fi
|
||||
if [[ $* == *' psql '* ]]; then
|
||||
if [[ $sql == *'SELECT COALESCE('* ]]; then
|
||||
printf 'active\n'
|
||||
elif [[ $sql == *'JOIN owner_accounts'* ]]; then
|
||||
printf '1\n'
|
||||
elif [[ $sql == *'node_identity_nodes'* ]]; then
|
||||
printf '1\n'
|
||||
fi
|
||||
fi
|
||||
;;
|
||||
*)
|
||||
printf 'unexpected docker invocation: %s\n' "$*" >&2
|
||||
exit 1
|
||||
;;
|
||||
esac
|
||||
elif [[ $sql == *'SELECT COUNT(*)'*'JOIN owner_accounts'* ]]; then
|
||||
if [[ ${FAKE_FAIL_STAGE:-} == database-readback ]]; then printf '0\n'; else printf '1\n'; fi
|
||||
elif [[ $sql == *'SELECT COUNT(*) FROM owner_account_nodes'* ]]; then
|
||||
printf '0\n'
|
||||
elif [[ $sql == *'INSERT INTO owner_account_nodes'* ]]; then
|
||||
printf 'DB_WRITE %s\n' "$mqtt_username" >>"$FAKE_DOCKER_LOG"
|
||||
[[ ${FAKE_FAIL_STAGE:-} != environment ]] || exit 1
|
||||
: >"$FAKE_DB_STATE_FILE"
|
||||
[[ ${FAKE_FAIL_STAGE:-} != db ]] || exit 1
|
||||
elif [[ $sql == *'node_identity_nodes'* ]]; then
|
||||
printf '0\n'
|
||||
elif [[ $sql == *'DELETE FROM owner_accounts'* || $sql == *'DELETE FROM owner_account_nodes'* ]]; then
|
||||
printf 'DB_ROLLBACK %s\n' "$mqtt_username" >>"$FAKE_DOCKER_LOG"
|
||||
rm -f -- "$FAKE_DB_STATE_FILE"
|
||||
fi
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# SIGHUP, health probes, and all other fake exec operations succeed.
|
||||
exit 0
|
||||
EOF
|
||||
chmod +x "$test_root/bin/docker"
|
||||
|
||||
export FAKE_DOCKER_LOG="$test_root/docker.log"
|
||||
output="$test_root/output.log"
|
||||
PATH="$test_root/bin:$PATH" \
|
||||
NEWUSER_REPO_DIR="$test_root/repo" \
|
||||
MESHCORE_INFRA_PROJECT_DIR="$test_root/infra" \
|
||||
TMPDIR="$test_root" \
|
||||
bash "$SCRIPT_DIR/newuser.sh" --link alice "$NODE_B" >"$output" 2>&1
|
||||
init_sandbox() {
|
||||
local name=$1
|
||||
local initial_map=$2
|
||||
SANDBOX="$test_root/$name"
|
||||
mkdir -p "$SANDBOX/repo" "$SANDBOX/infra"
|
||||
touch "$SANDBOX/infra/docker-compose.yml"
|
||||
printf 'OWNER_MQTT_USERNAME_MAP=%s\n' "$initial_map" >"$SANDBOX/repo/.env"
|
||||
: >"$SANDBOX/docker.log"
|
||||
export FAKE_DOCKER_LOG="$SANDBOX/docker.log"
|
||||
export FAKE_CREDENTIAL_FILE="$SANDBOX/credential-state"
|
||||
export FAKE_DB_STATE_FILE="$SANDBOX/db-state"
|
||||
}
|
||||
|
||||
run_newuser() {
|
||||
local sandbox=$1
|
||||
local output=$2
|
||||
local existing_users=$3
|
||||
local existing_db_users=$4
|
||||
local fail_stage=$5
|
||||
shift 5
|
||||
PATH="$test_root/bin:$PATH" \
|
||||
NEWUSER_REPO_DIR="$sandbox/repo" \
|
||||
MESHCORE_INFRA_PROJECT_DIR="$sandbox/infra" \
|
||||
TMPDIR="$sandbox" \
|
||||
NEWUSER_DISCOVERY_POLL_SECONDS=0.05 \
|
||||
FAKE_EXISTING_USERS="$existing_users" \
|
||||
FAKE_EXISTING_DB_USERS="$existing_db_users" \
|
||||
FAKE_FAIL_STAGE="$fail_stage" \
|
||||
FAKE_DISCOVERY_WAIT_MARKER="${sandbox}/discovery-waiting" \
|
||||
FAKE_DISCOVERY_RELEASE="${sandbox}/discovery-release" \
|
||||
FAKE_DISCOVERY_NODE="$NODE_B" \
|
||||
FAKE_DISCOVERY_USERNAME=charlie \
|
||||
bash "$SCRIPT_DIR/newuser.sh" "$@" >"$output" 2>&1
|
||||
}
|
||||
|
||||
assert_file_contains() {
|
||||
local file=$1
|
||||
local text=$2
|
||||
grep -Fq -- "$text" "$file" \
|
||||
|| { printf 'expected %s to contain: %s\n' "$file" "$text" >&2; exit 1; }
|
||||
}
|
||||
|
||||
# Linking a node preserves the current map and existing broker password.
|
||||
init_sandbox link "alice=${NODE_A},bob=${NODE_C}"
|
||||
run_newuser "$SANDBOX" "$SANDBOX/output.log" 'alice' 'alice' '' --link alice "$NODE_B"
|
||||
expected_map="OWNER_MQTT_USERNAME_MAP=alice=${NODE_A},bob=${NODE_C},alice=${NODE_B}"
|
||||
[[ $(<"$test_root/repo/.env") == "$expected_map" ]] \
|
||||
|| { printf 'unexpected owner map: %s\n' "$(<"$test_root/repo/.env")" >&2; exit 1; }
|
||||
grep -Fq 'Password: unchanged (existing credential)' "$output"
|
||||
grep -Fq 'INSERT INTO owner_account_nodes' "$FAKE_DOCKER_LOG"
|
||||
grep -Fq 'compose -f docker-compose.yml -f docker-compose.live.yml up -d --no-deps backend' \
|
||||
"$FAKE_DOCKER_LOG"
|
||||
grep -Fq "compose --project-directory $test_root/infra --project-name meshcore-infra -f $test_root/infra/docker-compose.yml ps -q mosquitto" \
|
||||
"$FAKE_DOCKER_LOG"
|
||||
grep -Fq "compose --project-directory $test_root/infra --project-name meshcore-infra -f $test_root/infra/docker-compose.yml ps -q timescaledb" \
|
||||
"$FAKE_DOCKER_LOG"
|
||||
if grep -Fq 'mosquitto_passwd -b' "$FAKE_DOCKER_LOG"; then
|
||||
[[ $(<"$SANDBOX/repo/.env") == "$expected_map" ]] \
|
||||
|| { printf 'unexpected owner map: %s\n' "$(<"$SANDBOX/repo/.env")" >&2; exit 1; }
|
||||
assert_file_contains "$SANDBOX/output.log" 'Password: unchanged (existing credential)'
|
||||
assert_file_contains "$SANDBOX/docker.log" 'INSERT INTO owner_account_nodes'
|
||||
assert_file_contains "$SANDBOX/docker.log" 'COMPOSE_BACKEND'
|
||||
if grep -Fq 'CREDENTIAL_CREATE alice' "$SANDBOX/docker.log"; then
|
||||
printf 'link flow unexpectedly changed the existing credential\n' >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
printf 'newuser multi-node link test passed\n'
|
||||
# A second process adds a grant while discovery has released the lock. The
|
||||
# discovery run must merge into the map it rereads after reacquiring the lock.
|
||||
init_sandbox concurrent "alice=${NODE_A}"
|
||||
PATH="$test_root/bin:$PATH" \
|
||||
NEWUSER_REPO_DIR="$SANDBOX/repo" \
|
||||
MESHCORE_INFRA_PROJECT_DIR="$SANDBOX/infra" \
|
||||
TMPDIR="$SANDBOX" \
|
||||
NEWUSER_DISCOVERY_POLL_SECONDS=0.05 \
|
||||
FAKE_DOCKER_LOG="$SANDBOX/docker.log" \
|
||||
FAKE_CREDENTIAL_FILE="$SANDBOX/credential-state" \
|
||||
FAKE_DB_STATE_FILE="$SANDBOX/db-state" \
|
||||
FAKE_EXISTING_USERS='alice,charlie' \
|
||||
FAKE_EXISTING_DB_USERS=alice \
|
||||
FAKE_DISCOVERY_WAIT_MARKER="$SANDBOX/discovery-waiting" \
|
||||
FAKE_DISCOVERY_RELEASE="$SANDBOX/discovery-release" \
|
||||
FAKE_DISCOVERY_NODE="$NODE_B" \
|
||||
FAKE_DISCOVERY_USERNAME=charlie \
|
||||
bash "$SCRIPT_DIR/newuser.sh" --watch --timeout 10 charlie >"$SANDBOX/watcher.log" 2>&1 &
|
||||
watcher_pid=$!
|
||||
for _ in {1..100}; do
|
||||
[[ -e $SANDBOX/discovery-waiting ]] && break
|
||||
sleep 0.02
|
||||
done
|
||||
[[ -e $SANDBOX/discovery-waiting ]] \
|
||||
|| { kill "$watcher_pid" 2>/dev/null || true; printf 'watcher did not enter discovery\n' >&2; exit 1; }
|
||||
run_newuser "$SANDBOX" "$SANDBOX/second-run.log" 'alice,charlie' 'alice' '' bob "$NODE_C"
|
||||
: >"$SANDBOX/discovery-release"
|
||||
wait "$watcher_pid"
|
||||
expected_map="OWNER_MQTT_USERNAME_MAP=alice=${NODE_A},bob=${NODE_C},charlie=${NODE_B}"
|
||||
[[ $(<"$SANDBOX/repo/.env") == "$expected_map" ]] \
|
||||
|| { printf 'concurrent owner map lost a grant: %s\n' "$(<"$SANDBOX/repo/.env")" >&2; exit 1; }
|
||||
|
||||
printf 'newuser concurrent-discovery regression test passed\n'
|
||||
|
||||
Reference in New Issue
Block a user