harn-package 0.10.162

Authoritative Harn package resolution, materialization and connector discovery
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

use super::*;
use harn_vm::secrets::SecretId;

fn provider(id: &str, outbound: &str) -> String {
    format!(
        r#"
[[providers]]
id = "{id}"
connector = {{ rust = "builtin" }}
[providers.setup]
required_secrets = [
  {{ id = "{id}/{outbound}", direction = "outbound" }},
  {{ id = "{id}/webhook-signing-secret", direction = "inbound" }},
]
"#
    )
}

#[test]
fn linked_discovery_selects_outbound_grants_after_root_precedence() {
    let tmp = tempfile::tempdir().unwrap();
    let root = tmp.path();
    let dependency = root.join("vendor/connectors");
    fs::create_dir_all(&dependency).unwrap();
    fs::write(
        dependency.join(MANIFEST),
        format!(
            "[package]\nname = \"connectors\"\nversion = \"1.0.0\"\n{}{}",
            provider("github", "package-token"),
            provider("gitlab", "package-token"),
        ),
    )
    .unwrap();
    fs::write(
        root.join(MANIFEST),
        format!(
            "[package]\nname = \"consumer\"\n[dependencies]\nconnectors = {{ path = \"vendor/connectors\" }}\n{}{}",
            provider("github", "root-token"), provider("github", "shadowed-token"),
        ),
    ).unwrap();
    let workspace = PackageWorkspace::for_test(root, root.join(".cache"));
    assert_eq!(
        install_packages_in(&workspace, false, None, false).unwrap(),
        1
    );

    let resolved = crate::try_load_provider_connectors(&root.join("main.harn")).unwrap();
    assert_eq!(resolved.configs.len(), 2);
    assert_eq!(
        resolved.outbound_secret_ids(),
        BTreeSet::from([
            SecretId::new("github", "root-token"),
            SecretId::new("gitlab", "package-token"),
        ])
    );
    let root_only = crate::try_load_root_provider_connectors(&root.join("main.harn")).unwrap();
    assert_eq!(root_only.configs.len(), 1);
    assert_eq!(
        root_only.outbound_secret_ids(),
        BTreeSet::from([SecretId::new("github", "root-token"),])
    );
}

#[test]
fn linked_discovery_retains_generation_lease_across_publication() {
    let tmp = tempfile::tempdir().unwrap();
    let root = tmp.path();
    let dependency = root.join("vendor/connectors");
    fs::create_dir_all(&dependency).unwrap();
    fs::write(
        dependency.join(MANIFEST),
        format!(
            "[package]\nname = \"connectors\"\nversion = \"1.0.0\"\n{}",
            provider("github", "package-token"),
        ),
    )
    .unwrap();
    fs::write(root.join(MANIFEST),
        "[package]\nname = \"consumer\"\n[dependencies]\nconnectors = { path = \"vendor/connectors\" }\n",
    ).unwrap();
    let workspace = PackageWorkspace::for_test(root, root.join(".cache"));
    install_packages_in(&workspace, false, None, false).unwrap();
    let resolved = crate::try_load_provider_connectors(&root.join("main.harn")).unwrap();
    assert_eq!(resolved.configs.len(), 1);
    let snapshot = resolved
        ._package_snapshot
        .as_ref()
        .expect("dependency generation retained");
    let old_generation = snapshot.generation().to_string();
    let old_module_dir = resolved.configs[0].manifest_dir.clone();
    let lease_path = harn_modules::package_snapshot::generation_root(root, &old_generation)
        .join(harn_modules::package_snapshot::GENERATION_LEASE_FILE);
    let lease = File::options()
        .read(true)
        .write(true)
        .open(&lease_path)
        .unwrap();
    assert!(
        matches!(lease.try_lock(), Err(std::fs::TryLockError::WouldBlock)),
        "returned discovery must hold a real shared lease"
    );

    install_packages_in(&workspace, false, Some("connectors"), false).unwrap();
    let current = harn_modules::package_snapshot::PackageSnapshot::acquire(root)
        .unwrap()
        .unwrap();
    assert_ne!(current.generation(), old_generation);
    assert!(
        old_module_dir.join(MANIFEST).is_file(),
        "publication must preserve the leased generation"
    );
    assert!(matches!(
        lease.try_lock(),
        Err(std::fs::TryLockError::WouldBlock)
    ));
    drop(resolved);
    lease
        .try_lock()
        .expect("dropping discovery releases generation custody");
}

#[test]
fn linked_discovery_refuses_missing_and_malformed_dependencies() {
    let tmp = tempfile::tempdir().unwrap();
    let root = tmp.path();
    fs::write(
        root.join(MANIFEST),
        "[package]\nname = \"consumer\"\n[dependencies]\nmissing = { path = \"vendor/missing\" }\n",
    )
    .unwrap();
    let anchor = root.join("main.harn");
    let missing = crate::try_load_provider_connectors(&anchor)
        .err()
        .expect("missing lock must fail");
    assert!(missing.to_string().contains("harn.lock"));
    fs::write(root.join(LOCK_FILE), "version = [\n").unwrap();
    assert!(
        crate::try_load_provider_connectors(&anchor).is_err(),
        "malformed lock must fail"
    );
    fs::write(root.join(MANIFEST), "[[providers]\n").unwrap();
    assert!(
        crate::try_load_provider_connectors(&anchor).is_err(),
        "malformed manifest must fail"
    );
}