gunnar-proto 2.0.0

//! The generated surface, asserted rather than assumed.
//!
//! A `.proto` crate's tests can only be blind in one interesting way: they can
//! assert that *something* was generated without asserting *what*. So every
//! test here names the exact string, field or variant it expects, and the
//! negative cases assert a specific rejection rather than "an error happened".

use gunnar_proto::*;
use prost::Message;

#[test]
fn every_service_exists_with_its_wire_name() {
    // These strings are what a gRPC client puts on the wire and what a reverse
    // proxy routes on. A rename here breaks every UI (gRPC is the ONLY
    // control plane), so it is pinned by value, not by existence.
    assert_eq!(repos_server::SERVICE_NAME, "gunnar.v1.Repos");
    assert_eq!(refs_server::SERVICE_NAME, "gunnar.v1.Refs");
    assert_eq!(access_server::SERVICE_NAME, "gunnar.v1.Access");
    assert_eq!(policy_server::SERVICE_NAME, "gunnar.v1.Policy");
    assert_eq!(events_server::SERVICE_NAME, "gunnar.v1.Events");
    assert_eq!(admin_server::SERVICE_NAME, "gunnar.v1.Admin");
    assert_eq!(mirror_server::SERVICE_NAME, "gunnar.v1.Mirror");
    // The two halves of a change proposal, merged 2026-08-30: the record and
    // the review. Both pinned here for the same reason as the seven above —
    // these strings are what a client dials and what a proxy routes on.
    assert_eq!(pull_requests_server::SERVICE_NAME, "gunnar.v1.PullRequests");
    assert_eq!(forge_server::SERVICE_NAME, "gunnar.v1.Forge");
    assert_eq!(
        bootstrap_server::SERVICE_NAME,
        "gunnar.v1.Bootstrap",
        "the one service mounted outside the auth gate, and therefore the one whose name a \
         reverse proxy most needs to be sure of"
    );
}

#[test]
fn every_spec_event_kind_is_on_the_wire() {
    // The event stream lists seven; attestation adds one more; the bus adds the gap marker.
    for (kind, name) in [
        (EventKind::RefUpdated, "EVENT_KIND_REF_UPDATED"),
        (EventKind::RefDeleted, "EVENT_KIND_REF_DELETED"),
        (EventKind::PushRejected, "EVENT_KIND_PUSH_REJECTED"),
        (EventKind::RepoCreated, "EVENT_KIND_REPO_CREATED"),
        (EventKind::RepoDeleted, "EVENT_KIND_REPO_DELETED"),
        (EventKind::MirrorSynced, "EVENT_KIND_MIRROR_SYNCED"),
        (EventKind::KeyUsed, "EVENT_KIND_KEY_USED"),
        (EventKind::PushAttestation, "EVENT_KIND_PUSH_ATTESTATION"),
        (EventKind::Gap, "EVENT_KIND_GAP"),
        (
            EventKind::ReplicationFailed,
            "EVENT_KIND_REPLICATION_FAILED",
        ),
        (
            EventKind::PullRequestOpened,
            "EVENT_KIND_PULL_REQUEST_OPENED",
        ),
        (
            EventKind::PullRequestMerged,
            "EVENT_KIND_PULL_REQUEST_MERGED",
        ),
        (
            EventKind::PullRequestClosed,
            "EVENT_KIND_PULL_REQUEST_CLOSED",
        ),
        (EventKind::StreamOpened, "EVENT_KIND_STREAM_OPENED"),
    ] {
        assert_eq!(kind.as_str_name(), name);
        assert_eq!(
            EventKind::from_str_name(name),
            Some(kind),
            "{name} must round-trip"
        );
    }
}

/// One payload of every kind, so the mapping below cannot be tested against a
/// subset of the variants it claims to cover.
fn one_of_each_payload() -> Vec<(event::Payload, EventKind)> {
    let repo = || Some(RepoPath::new("nordisk", "gunnar"));
    vec![
        (
            event::Payload::RefUpdated(RefUpdated {
                repo: repo(),
                ref_name: "refs/heads/main".into(),
                ..Default::default()
            }),
            EventKind::RefUpdated,
        ),
        (
            event::Payload::RefDeleted(RefDeleted {
                repo: repo(),
                ..Default::default()
            }),
            EventKind::RefDeleted,
        ),
        (
            event::Payload::PushRejected(PushRejected {
                repo: repo(),
                gate: "branch-protection".into(),
                ..Default::default()
            }),
            EventKind::PushRejected,
        ),
        (
            event::Payload::RepoCreated(RepoCreated {
                repo: Some(Repo {
                    path: repo(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            EventKind::RepoCreated,
        ),
        (
            event::Payload::RepoDeleted(RepoDeleted {
                repo: repo(),
                ..Default::default()
            }),
            EventKind::RepoDeleted,
        ),
        (
            event::Payload::MirrorSynced(MirrorSynced {
                repo: repo(),
                ..Default::default()
            }),
            EventKind::MirrorSynced,
        ),
        (
            event::Payload::KeyUsed(KeyUsed {
                repo: repo(),
                ..Default::default()
            }),
            EventKind::KeyUsed,
        ),
        (
            event::Payload::PushAttestation(PushAttestation {
                repo: repo(),
                ..Default::default()
            }),
            EventKind::PushAttestation,
        ),
        (
            event::Payload::Gap(EventGap {
                dropped: 7,
                ..Default::default()
            }),
            EventKind::Gap,
        ),
        (
            event::Payload::ReplicationFailed(ReplicationFailed {
                repo: repo(),
                target: "standby".into(),
                ..Default::default()
            }),
            EventKind::ReplicationFailed,
        ),
        (
            event::Payload::PullRequestOpened(PullRequestOpened {
                repo: repo(),
                number: 1,
                title: "the first".into(),
                ..Default::default()
            }),
            EventKind::PullRequestOpened,
        ),
        (
            event::Payload::PullRequestMerged(PullRequestMerged {
                repo: repo(),
                number: 1,
                merge_oid: "feedbeef".into(),
                ..Default::default()
            }),
            EventKind::PullRequestMerged,
        ),
        (
            event::Payload::PullRequestClosed(PullRequestClosed {
                repo: repo(),
                number: 2,
                ..Default::default()
            }),
            EventKind::PullRequestClosed,
        ),
        (
            event::Payload::StreamOpened(StreamOpened {
                epoch: "an-epoch".into(),
                ..Default::default()
            }),
            EventKind::StreamOpened,
        ),
        (
            event::Payload::VisibilityChanged(VisibilityChanged {
                repo: repo(),
                from: Visibility::Private as i32,
                to: Visibility::Public as i32,
                principal_id: "p1".into(),
            }),
            EventKind::VisibilityChanged,
        ),
        (
            event::Payload::EncryptedChanged(EncryptedChanged {
                repo: repo(),
                from: false,
                to: true,
                principal_id: "p1".into(),
            }),
            EventKind::EncryptedChanged,
        ),
    ]
}

#[test]
fn event_kind_agrees_with_its_payload_for_every_variant() {
    let payloads = one_of_each_payload();
    assert_eq!(
        payloads.len(),
        16,
        "one payload per EventKind; add the new variant here too"
    );
    for (payload, expected) in payloads {
        let event = Event::new(1, 0, payload);
        assert_eq!(Event::kind_of(event.payload.as_ref().unwrap()), expected);
        assert!(event.kind_matches_payload());
    }
}

#[test]
fn a_mislabelled_event_is_detected() {
    // Measured: `kind_matches_payload` would be worthless if it could not return
    // false. Prove it can, on a hand-built event whose kind is a lie.
    let mut event = Event::new(1, 0, event::Payload::RepoDeleted(RepoDeleted::default()));
    event.kind = EventKind::RefUpdated as i32;
    assert!(!event.kind_matches_payload());

    let empty = Event {
        seq: 1,
        at_unix_ms: 0,
        kind: EventKind::RefUpdated as i32,
        payload: None,
    };
    assert!(!empty.kind_matches_payload(), "no payload is not a match");
}

#[test]
fn every_repo_scoped_event_carries_its_namespace() {
    // Multi-tenancy in every path. A UI filtering by namespace can only
    // work if the namespace is actually on each event.
    for (payload, kind) in one_of_each_payload() {
        let event = Event::new(1, 0, payload);
        match kind {
            // Facts about the STREAM, not about a repository.
            EventKind::Gap | EventKind::StreamOpened => assert!(event.repo_path().is_none()),
            _ => {
                let path = event
                    .repo_path()
                    .unwrap_or_else(|| panic!("{kind:?} lost its RepoPath"));
                assert_eq!(path.namespace, "nordisk");
                assert_eq!(path.repo, "gunnar");
                assert_eq!(path.to_string(), "nordisk/gunnar");
            }
        }
    }
}

#[test]
fn repo_path_accepts_legitimate_paths() {
    // A validator that rejected everything would pass every negative test
    // below while breaking the server. That is the identity-value trap, so the
    // accepting direction goes first.
    for input in [
        "nordisk/gunnar",
        "nordisk/gunnar.git",
        "a/b",
        "with-dash/under_score",
        "Ünicöde/repö",
        "ns/repo.with.dots",
        "ns/..hidden-prefix-but-not-dotdot",
        // Nested namespaces are first class, so the control plane must
        // be able to spell one.
        "team/sub/repo",
        "team/sub/deeper/repo.git",
    ] {
        let path = RepoPath::parse(input).unwrap_or_else(|e| panic!("{input} rejected: {e}"));
        assert!(!path.namespace.is_empty());
        assert!(!path.repo.is_empty());
        path.validate().expect("a parsed path must validate");
    }
    assert_eq!(
        RepoPath::parse("nordisk/gunnar.git").unwrap(),
        RepoPath::new("nordisk", "gunnar"),
        "the SSH spelling and the gRPC spelling must name the same repo"
    );
}

#[test]
fn repo_path_rejects_each_bad_shape_for_the_right_reason() {
    for (input, expected) in [
        ("", RepoPathError::Empty),
        (".git", RepoPathError::Empty),
        ("bare", RepoPathError::NotTwoSegments),
        // `a/b/c` is a NESTED NAMESPACE and is accepted; see
        // `repo_path_accepts_legitimate_paths` and `tests/nested_namespace.rs`.
        // It used to be rejected here, which is the divergence: the SSH sandbox serves
        // `team/sub/repo.git` and the control plane could not name it.
        ("a/b/c/d/e", RepoPathError::TooManyComponents),
        (
            "../etc/passwd",
            RepoPathError::IllegalCharacter("`.` or `..`"),
        ),
        ("/repo", RepoPathError::EmptyNamespace),
        ("ns//repo", RepoPathError::EmptyNamespace),
        ("ns/", RepoPathError::EmptyRepo),
        ("../repo", RepoPathError::IllegalCharacter("`.` or `..`")),
        ("ns/..", RepoPathError::IllegalCharacter("`.` or `..`")),
        ("./repo", RepoPathError::IllegalCharacter("`.` or `..`")),
        ("ns/re\0po", RepoPathError::IllegalCharacter("a NUL byte")),
        (
            "ns/re\npo",
            RepoPathError::IllegalCharacter("a control character"),
        ),
        (
            "ns\\evil/repo",
            RepoPathError::IllegalCharacter("a backslash"),
        ),
        ("host:ns/repo", RepoPathError::IllegalCharacter("a colon")),
    ] {
        let error = RepoPath::parse(input)
            .map(|p| p.to_string())
            .expect_err(&format!("{input:?} must be rejected"));
        assert_eq!(error, expected, "wrong reason for {input:?}");
    }
}

#[test]
fn validate_catches_a_path_that_never_went_through_parse() {
    // Requests arrive with namespace and repo already split, so `validate` —
    // not `parse` — is what actually guards the control plane.
    assert!(RepoPath::new("ns", "repo").validate().is_ok());
    assert_eq!(
        RepoPath::new("..", "repo").validate().unwrap_err(),
        RepoPathError::IllegalCharacter("`.` or `..`")
    );
    assert_eq!(
        RepoPath::new("ns", "sub/repo").validate().unwrap_err(),
        RepoPathError::NotTwoSegments,
        "a slash smuggled into the repo half is still two segments' worth"
    );
    assert_eq!(
        RepoPath::new("", "repo").validate().unwrap_err(),
        RepoPathError::EmptyNamespace,
        "there is no default namespace"
    );
}

#[test]
fn null_oid_width_follows_the_hash_kind() {
    assert_eq!(null_oid(HashKind::Sha1).len(), 40);
    assert_eq!(null_oid(HashKind::Sha256).len(), 64);
    assert!(null_oid(HashKind::Sha256).bytes().all(|b| b == b'0'));
    assert_ne!(
        null_oid(HashKind::Sha1),
        null_oid(HashKind::Sha256),
        "answering the wrong width is the object-format bug that cost a session"
    );
}

#[test]
fn an_attestation_survives_the_wire() {
    // Attestation: encode/decode through prost, then assert the FIELDS, not that
    // decoding returned Ok.
    let original = PushAttestation {
        attestation_id: "att-42".into(),
        repo: Some(RepoPath::new("nordisk", "gunnar")),
        principal_id: "principal-00000001".into(),
        principal_name: "alice".into(),
        key_fingerprint: "SHA256:zzz".into(),
        credential: "key:SHA256:zzz".into(),
        hash_kind: HashKind::Sha256 as i32,
        ref_updates: vec![RefUpdate {
            ref_name: "refs/heads/main".into(),
            old_oid: null_oid(HashKind::Sha256).into(),
            new_oid: "9".repeat(64),
        }],
        new_object_oids: vec!["a".repeat(64), "b".repeat(64)],
        new_object_oids_unknown: String::new(),
        new_object_count: 2,
        // Empty: this attestation's object set is known, so the count
        // above is a count. A non-empty value here means a reader must
        // treat the count as absent rather than as zero.
        new_object_bytes: 8192,
        pack_hash: "c".repeat(64),
        received_at_unix_ms: 1_700_000_000_000,
        server_agent: AGENT.into(),
        transport: "ssh".into(),
    };

    let bytes = original.encode_to_vec();
    let decoded = PushAttestation::decode(bytes.as_slice()).expect("decodes");

    assert_eq!(decoded, original);
    assert_eq!(decoded.repo.as_ref().unwrap().to_string(), "nordisk/gunnar");
    assert_eq!(decoded.ref_updates[0].new_oid.len(), 64);
    assert_eq!(decoded.new_object_oids.len(), 2);
    assert!(
        decoded.new_object_oids_unknown.is_empty(),
        "an enumerated set leaves the reason empty"
    );
    assert!(AGENT.starts_with("gunnar/"), "agent string is {AGENT}");

    // The other shape, over the same wire: no list, a count that is still
    // true, and the sentence that reconciles them. An empty `repeated` field
    // and an empty `string` are both the proto default, so this is the one
    // assertion that proves the reason SURVIVES encoding rather than being
    // re-defaulted on the far side.
    let unenumerated = PushAttestation {
        new_object_oids: Vec::new(),
        new_object_oids_unknown: "the policy has no gate over objects, so the object set was \
                                  not enumerated"
            .into(),
        new_object_count: 13,
        ..original
    };
    let back = PushAttestation::decode(unenumerated.encode_to_vec().as_slice()).expect("decodes");
    assert!(back.new_object_oids.is_empty());
    assert_eq!(back.new_object_count, 13);
    assert_eq!(
        back.new_object_oids_unknown,
        unenumerated.new_object_oids_unknown
    );
}

#[test]
fn an_attestation_is_json_line_shaped() {
    // Attestation's second half: one JSON line appended to gunnar's own log. The serde
    // derives are applied by build.rs to exactly the attestation types, so if
    // that list ever loses one this stops compiling.
    let attestation = PushAttestation {
        repo: Some(RepoPath::new("nordisk", "gunnar")),
        ref_updates: vec![RefUpdate {
            ref_name: "refs/heads/main".into(),
            ..Default::default()
        }],
        ..Default::default()
    };
    let line = serde_json::to_string(&attestation).expect("serialises");
    assert!(!line.contains('\n'));
    assert!(line.contains("\"namespace\":\"nordisk\""), "{line}");
    assert!(line.contains("\"ref_name\":\"refs/heads/main\""), "{line}");

    let back: PushAttestation = serde_json::from_str(&line).expect("round-trips");
    assert_eq!(back, attestation);
}

#[test]
fn watch_request_filters_on_all_three_axes() {
    // The event stream: filterable by namespace / repo / kind.
    let request = WatchRequest {
        namespaces: vec!["nordisk".into()],
        repos: vec![RepoPath::new("nordisk", "gunnar")],
        kinds: vec![EventKind::RefUpdated as i32, EventKind::PushRejected as i32],
        include_attestation_object_ids: true,
        from_seq: 0,
    };
    let bytes = request.encode_to_vec();
    let decoded = WatchRequest::decode(bytes.as_slice()).expect("decodes");
    assert_eq!(decoded, request);
    assert_eq!(decoded.repos[0].namespace, "nordisk");
}

#[test]
fn a_watch_request_carries_a_resume_cursor_on_the_wire() {
    // The resume cursor is a wire field, not a client-side convention. proto3
    // does not encode a zero, so BOTH halves are asserted: a cursor survives
    // the round trip, and its absence still decodes as "no cursor" rather than
    // as something a server might mistake for one.
    let with_cursor = WatchRequest {
        from_seq: 4096,
        ..Default::default()
    };
    let decoded =
        WatchRequest::decode(with_cursor.encode_to_vec().as_slice()).expect("decodes");
    assert_eq!(
        decoded.from_seq, 4096,
        "a cursor a client sent must reach the server unchanged"
    );

    let without = WatchRequest::default();
    assert!(
        without.encode_to_vec().is_empty(),
        "an empty WatchRequest must still encode to nothing: `from_seq: 0` is the default and \
         costs no bytes, so no existing client's request changed shape"
    );
    assert_eq!(
        WatchRequest::decode(without.encode_to_vec().as_slice())
            .expect("decodes")
            .from_seq,
        0,
        "absent means no cursor"
    );
}

#[test]
fn a_stream_prologue_and_a_gap_both_carry_the_epoch() {
    // The epoch is what makes a cursor meaningful across a reconnect, so it has
    // to survive the wire on both carriers. An epoch that encoded but did not
    // decode would look exactly like a server that never restarted.
    let opened = StreamOpened {
        epoch: "0000000000000001000000ff0000".into(),
        last_seq: 900,
        oldest_buffered_seq: 837,
        replaying: 63,
        from_seq: 837,
    };
    let decoded = StreamOpened::decode(opened.encode_to_vec().as_slice()).expect("decodes");
    assert_eq!(decoded, opened);
    assert_eq!(decoded.epoch, "0000000000000001000000ff0000");

    let gap = EventGap {
        dropped: 12,
        last_delivered_seq: 800,
        resume_seq: 813,
        epoch: "0000000000000001000000ff0000".into(),
    };
    let decoded = EventGap::decode(gap.encode_to_vec().as_slice()).expect("decodes");
    assert_eq!(decoded, gap);
    assert_eq!(
        decoded.epoch, gap.epoch,
        "a gap must be self-describing: the numbers either side of it are only comparable \
         within one run of the server"
    );
}

#[test]
fn every_repo_scoped_request_carries_a_repo_path() {
    // Multi-tenancy, at the type level: each of these would not compile if its request
    // dropped the namespace half of the path.
    let path = RepoPath::new("nordisk", "gunnar");
    assert_eq!(
        GetRepoRequest {
            path: Some(path.clone())
        }
        .path
        .unwrap(),
        path
    );
    assert_eq!(
        ListRefsRequest {
            repo: Some(path.clone()),
            ..Default::default()
        }
        .repo
        .unwrap(),
        path
    );
    assert_eq!(
        GetProtectionRequest {
            repo: Some(path.clone()),
            ..Default::default()
        }
        .repo
        .unwrap(),
        path
    );
    assert_eq!(
        AddMirrorRequest {
            repo: Some(path.clone()),
            ..Default::default()
        }
        .repo
        .unwrap(),
        path
    );
    // Grants scope to a namespace OR a repo within it, never to a bare repo.
    let grant = GrantRequest {
        principal_id: "p".into(),
        namespace: "nordisk".into(),
        repo: String::new(),
        level: GrantLevel::Admin as i32,
    };
    assert!(!grant.namespace.is_empty());
}