use std::path::Path;
use anyhow::{Context, Result};
use tracing::{debug, info, warn};
use crate::CloudflareClient;
pub async fn ensure_r2_custom_domain(
workspace_root: &Path,
provider_id: &str,
bucket_name: &str,
domain: &str,
) -> Result<()> {
let cf_provider = super::cf_creds::CfProvider::resolve(workspace_root, provider_id)?;
let account_id = cf_provider.account_id.clone();
let cf = CloudflareClient::new(cf_provider.api_token()?);
let existing = cf
.list_r2_custom_domains(&account_id, bucket_name)
.await
.with_context(|| format!("listing R2 custom domains on bucket {bucket_name:?}"))?;
if existing.iter().any(|d| d.domain == domain) {
debug!(
domain,
bucket_name, "R2 custom domain already bound — skipping"
);
return Ok(());
}
let zone_name = parent_zone_name(domain);
let zone_id = cf
.zone_id_for_name(zone_name)
.await
.with_context(|| format!("resolving zone id for {zone_name:?}"))?;
cf.add_r2_custom_domain(&account_id, bucket_name, domain, &zone_id)
.await
.with_context(|| format!("binding R2 custom domain {domain:?} → bucket {bucket_name:?}"))?;
info!(domain, bucket_name, zone_name, "R2 custom domain bound");
Ok(())
}
fn parent_zone_name(domain: &str) -> &str {
let last_dot = domain.rfind('.');
let Some(last_dot) = last_dot else {
return domain; };
if let Some(prev_dot) = domain[..last_dot].rfind('.') {
&domain[prev_dot + 1..]
} else {
domain }
}
use crate::config::{DomainConfig, DomainRoute, FrontDoor, RouteMode};
use crate::provider::cloudflare::WorkerBinding;
use crate::reconciler::mesofact_static::{
worker_config_bindings, BackendOrigins, ConfigBinding, WorkerMode, WORKER_SCRIPT,
};
use crate::route_table::WorkerAssets;
use std::collections::BTreeMap;
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct DomainWorkerPlan {
pub worker_name: String,
pub custom_domain: String,
pub asset_origin: Option<String>,
pub bindings: Vec<ConfigBinding>,
}
pub fn plan_domain_worker(
domain: &DomainConfig,
assets: WorkerAssets<'_>,
) -> Result<DomainWorkerPlan> {
if domain.front_door != FrontDoor::Worker {
anyhow::bail!(
"domain {} ({}) declares front_door = \"{}\" — only \"worker\" \
domains get a generated Cloudflare Worker",
domain.name,
domain.domain,
domain.front_door.as_str()
);
}
if !domain.routes.iter().any(|r| {
matches!(
r.mode,
RouteMode::Static { .. } | RouteMode::StaticBucket { .. }
)
}) {
anyhow::bail!(
"domain {} ({}) has no `static` route — nothing for a static Worker to serve",
domain.name,
domain.domain
);
}
let bindings = worker_config_bindings(
&WorkerMode::Static,
assets,
&BackendOrigins::default(),
Some(domain),
)?;
let asset_origin = assets.fallback_origin(Some(domain));
Ok(DomainWorkerPlan {
worker_name: domain.name.clone(),
custom_domain: domain.domain.clone(),
bindings,
asset_origin,
})
}
pub async fn deploy_domain_worker(
workspace_root: &Path,
provider_id: &str,
plan: &DomainWorkerPlan,
) -> Result<()> {
let cf_provider = super::cf_creds::CfProvider::resolve(workspace_root, provider_id)?;
let account_id = cf_provider.account_id.clone();
let cf = CloudflareClient::new(cf_provider.api_token()?);
let worker_bindings: Vec<WorkerBinding<'_>> = plan
.bindings
.iter()
.map(ConfigBinding::as_worker_binding)
.collect();
cf.deploy_worker_script(
&account_id,
&plan.worker_name,
WORKER_SCRIPT,
&worker_bindings,
)
.await
.with_context(|| format!("deploying static Worker {}", plan.worker_name))?;
info!(worker = %plan.worker_name, "alias-tier Worker deployed");
let zone = parent_zone_name(&plan.custom_domain);
let zone_id = cf
.zone_id_for_name(zone)
.await
.with_context(|| format!("resolving zone id for {zone:?}"))?;
cf.upsert_worker_custom_domain(
&account_id,
&zone_id,
&plan.custom_domain,
&plan.worker_name,
)
.await
.with_context(|| {
format!(
"binding {} to Worker {}",
plan.custom_domain, plan.worker_name
)
})?;
info!(domain = %plan.custom_domain, worker = %plan.worker_name, "alias-tier custom domain bound");
Ok(())
}
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum AliasTier {
Com,
Net,
}
impl AliasTier {
pub fn zone(self) -> &'static str {
match self {
AliasTier::Com => "com.yah.dev",
AliasTier::Net => "net.yah.dev",
}
}
pub fn bucket(self) -> &'static str {
match self {
AliasTier::Com => "com-yah-dev",
AliasTier::Net => "net-yah-dev",
}
}
fn slug(self) -> &'static str {
match self {
AliasTier::Com => "com",
AliasTier::Net => "net",
}
}
}
pub fn valid_subdomain_label(name: &str) -> bool {
!name.is_empty()
&& name.len() <= 63
&& !name.starts_with('-')
&& !name.ends_with('-')
&& name
.bytes()
.all(|b| b.is_ascii_lowercase() || b.is_ascii_digit() || b == b'-')
}
pub fn plan_alias_claim(
tier: AliasTier,
name: &str,
component: &str,
existing: &BTreeMap<String, DomainConfig>,
) -> Result<DomainConfig> {
if !valid_subdomain_label(name) {
anyhow::bail!(
"invalid subdomain {name:?} — must be 1–63 chars, lowercase \
alphanumeric or hyphen, no leading/trailing hyphen"
);
}
if component.split_once('/').is_none() {
anyhow::bail!("component {component:?} — expected \"<service>/<component-id>\"");
}
let domain = format!("{name}.{}", tier.zone());
let stem = format!("{name}-{}-yah-dev", tier.slug());
if existing.values().any(|d| d.domain == domain) {
anyhow::bail!("{domain} is already claimed");
}
if existing.contains_key(&stem) {
anyhow::bail!("domain manifest {stem:?} already exists");
}
Ok(DomainConfig {
schema_version: 1,
name: stem,
domain,
front_door: FrontDoor::Worker,
cdn_bucket: tier.bucket().to_string(),
worker_bundle_path: None,
routes: vec![DomainRoute {
path: "/*".into(),
headers: BTreeMap::new(),
mode: RouteMode::Static {
component: component.to_string(),
},
}],
})
}
use crate::config::MachineConfig;
use crate::envoy::dns_record::{
DnsRecordDeleteInput, DnsRecordListInput, DnsRecordUpsertInput,
};
use crate::provider::cloudflare_envoy::CloudflareEnvoy;
use std::net::Ipv4Addr;
#[derive(Debug, Clone, PartialEq, Eq, PartialOrd, Ord)]
pub struct PasswayOrigin {
pub machine: String,
pub address: Ipv4Addr,
}
#[derive(Debug, Clone, Default, PartialEq, Eq)]
pub struct ResolvedOrigins {
pub origins: Vec<PasswayOrigin>,
pub health_withdrawn: Vec<PasswayOrigin>,
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct DomainPasswayPlan {
pub zone: String,
pub name: String,
pub origins: Vec<PasswayOrigin>,
pub origins_complete: bool,
pub health_withdrawn: Vec<PasswayOrigin>,
}
#[derive(Debug, Clone, PartialEq, Eq)]
pub struct LiveApexRecord {
pub content: String,
pub proxied: bool,
}
#[derive(Debug, Clone, Default, PartialEq, Eq)]
pub struct ApexRecordDiff {
pub upsert: Vec<String>,
pub prune: Vec<String>,
pub withheld_prune: Vec<String>,
}
impl ApexRecordDiff {
pub fn is_converged(&self) -> bool {
self.upsert.is_empty() && self.prune.is_empty()
}
}
#[derive(Debug, Clone, Default, PartialEq, Eq)]
pub struct PasswayApexOutcome {
pub upserted: Vec<String>,
pub pruned: Vec<String>,
pub withheld_prune: Vec<String>,
}
impl PasswayApexOutcome {
pub fn is_noop(&self) -> bool {
self.upserted.is_empty() && self.pruned.is_empty()
}
}
fn public_ipv4_for(machine: &str, address: &str) -> Result<Ipv4Addr> {
let ip: Ipv4Addr = address.parse().map_err(|_| {
anyhow::anyhow!(
"machine {machine}: connect.address = {address:?} is not an IPv4 address, so it \
cannot be published as an apex A record. Either set it to the box's public IPv4 \
or drop the `public-ip` taint from {machine}.toml."
)
})?;
let o = ip.octets();
let is_cgnat = o[0] == 100 && (64..=127).contains(&o[1]);
let reason = if ip.is_unspecified() {
Some("unspecified")
} else if ip.is_loopback() {
Some("loopback")
} else if ip.is_private() {
Some("RFC 1918 private")
} else if ip.is_link_local() {
Some("link-local")
} else if is_cgnat {
Some("RFC 6598 shared / tailnet")
} else if ip.is_multicast() {
Some("multicast")
} else if ip.is_broadcast() {
Some("broadcast")
} else {
None
};
if let Some(reason) = reason {
anyhow::bail!(
"machine {machine}: connect.address = {address:?} is a {reason} address, not a \
public one — publishing it at a public apex would black-hole its share of the \
round-robin. Set connect.address to the box's public IPv4 or drop the \
`public-ip` taint from {machine}.toml."
);
}
Ok(ip)
}
pub fn public_origins(
front_door_machines: &[String],
machines: &[MachineConfig],
health_excluded: &[String],
) -> Result<ResolvedOrigins> {
let mut resolved = ResolvedOrigins::default();
for name in front_door_machines {
let machine = machines
.iter()
.find(|m| &m.name == name)
.with_context(|| {
format!(
"front door collated onto machine {name:?}, which is in neither this \
camp's own .yah/infra/machines/*.toml nor any fleet it borrows through \
.yah/infra/sources.toml — cannot resolve its public address"
)
})?;
if !machine
.taints
.iter()
.any(|t| t == workload_spec::PUBLIC_IP_TAINT)
{
debug!(
machine = %name,
"front-door machine has no `public-ip` taint — not an apex origin"
);
continue;
}
let address = machine
.connect
.as_ref()
.map(|c| c.address.as_str())
.with_context(|| {
format!(
"machine {name} carries the `public-ip` taint but declares no \
[connect] address — nothing to publish at the apex"
)
})?;
let origin = PasswayOrigin {
machine: name.clone(),
address: public_ipv4_for(name, address)?,
};
if health_excluded.iter().any(|m| m == name) {
debug!(
machine = %name,
address = %origin.address,
"front-door machine confirmed down — withheld from the apex origin set"
);
resolved.health_withdrawn.push(origin);
} else {
resolved.origins.push(origin);
}
}
Ok(resolved)
}
pub fn plan_domain_passway(
domain: &DomainConfig,
resolved: ResolvedOrigins,
origins_complete: bool,
) -> Result<DomainPasswayPlan> {
let ResolvedOrigins {
origins,
health_withdrawn,
} = resolved;
if domain.front_door != FrontDoor::Passway {
anyhow::bail!(
"domain {} ({}) declares front_door = \"{}\" — only \"passway\" domains \
get a sovereign apex rendered here",
domain.name,
domain.domain,
domain.front_door.as_str()
);
}
let mut origins = origins;
origins.sort_by(|a, b| (a.address, &a.machine).cmp(&(b.address, &b.machine)));
origins.dedup_by(|a, b| a.address == b.address);
if origins.is_empty() {
anyhow::bail!(
"domain {} ({}) declares front_door = \"passway\" but no declared front-door \
machine carries the `public-ip` taint with a public address — refusing to \
render an empty apex, which would withdraw every A record and take the site \
down. Declare the ingress edge's machines (or their taints) first.",
domain.name,
domain.domain
);
}
let mut health_withdrawn = health_withdrawn;
health_withdrawn.retain(|w| !origins.iter().any(|o| o.address == w.address));
health_withdrawn.sort_by(|a, b| (a.address, &a.machine).cmp(&(b.address, &b.machine)));
health_withdrawn.dedup_by(|a, b| a.address == b.address);
Ok(DomainPasswayPlan {
zone: parent_zone_name(&domain.domain).to_string(),
name: domain.domain.clone(),
origins,
origins_complete,
health_withdrawn,
})
}
pub fn diff_apex_records(plan: &DomainPasswayPlan, live: &[LiveApexRecord]) -> ApexRecordDiff {
let desired: Vec<String> = plan
.origins
.iter()
.map(|o| o.address.to_string())
.collect();
let upsert = desired
.iter()
.filter(|ip| {
!live
.iter()
.any(|r| &&r.content == ip && !r.proxied)
})
.cloned()
.collect();
let surplus: Vec<String> = live
.iter()
.filter(|r| !desired.contains(&r.content))
.map(|r| r.content.clone())
.collect();
if plan.origins_complete {
return ApexRecordDiff {
upsert,
prune: surplus,
withheld_prune: Vec::new(),
};
}
let withdrawn: Vec<String> = plan
.health_withdrawn
.iter()
.map(|o| o.address.to_string())
.collect();
let (prune, withheld_prune) = surplus
.into_iter()
.partition(|content| withdrawn.contains(content));
ApexRecordDiff {
upsert,
prune,
withheld_prune,
}
}
fn passway_envoy(workspace_root: &Path, provider_id: &str) -> Result<CloudflareEnvoy> {
let cf_provider = super::cf_creds::CfProvider::resolve(workspace_root, provider_id)?;
Ok(CloudflareEnvoy::new(
cf_provider.api_token()?,
cf_provider.account_id.clone(),
))
}
async fn read_live_apex(
envoy: &CloudflareEnvoy,
zone: &str,
name: &str,
) -> Result<Vec<LiveApexRecord>> {
let listed = envoy
.dns_record_list(DnsRecordListInput {
zone: zone.to_string(),
name: Some(name.to_string()),
record_type: Some("A".to_string()),
})
.await
.with_context(|| format!("listing A records at {name}"))?;
Ok(listed
.records
.into_iter()
.map(|r| LiveApexRecord {
content: r.content,
proxied: r.proxied,
})
.collect())
}
pub async fn list_live_apex_records(
workspace_root: &Path,
provider_id: &str,
plan: &DomainPasswayPlan,
) -> Result<Vec<LiveApexRecord>> {
let envoy = passway_envoy(workspace_root, provider_id)?;
read_live_apex(&envoy, &plan.zone, &plan.name).await
}
pub async fn deploy_domain_passway(
workspace_root: &Path,
provider_id: &str,
plan: &DomainPasswayPlan,
) -> Result<PasswayApexOutcome> {
let envoy = passway_envoy(workspace_root, provider_id)?;
let live = read_live_apex(&envoy, &plan.zone, &plan.name).await?;
let diff = diff_apex_records(plan, &live);
if !diff.withheld_prune.is_empty() {
warn!(
domain = %plan.name,
withheld = %diff.withheld_prune.join(", "),
"apex A records NOT withdrawn: the ingress collation reported problems, so an \
origin missing from it may be a broken declaration rather than a withdrawal. \
Run `yah cloud validate` and fix the reported ingress declaration; these \
records stay live until the collation is clean."
);
}
if diff.is_converged() {
debug!(
domain = %plan.name,
origins = plan.origins.len(),
"sovereign apex already matches the declaration — skipping"
);
return Ok(PasswayApexOutcome {
withheld_prune: diff.withheld_prune,
..Default::default()
});
}
for ip in &diff.upsert {
envoy
.dns_record_upsert(DnsRecordUpsertInput {
zone: plan.zone.clone(),
name: plan.name.clone(),
record_type: "A".to_string(),
content: ip.clone(),
ttl: 1,
proxied: false,
match_content: true,
})
.await
.with_context(|| format!("upserting A {} -> {ip}", plan.name))?;
info!(domain = %plan.name, origin = %ip, "sovereign apex A record written");
}
for ip in &diff.prune {
envoy
.dns_record_delete(DnsRecordDeleteInput {
zone: plan.zone.clone(),
name: plan.name.clone(),
record_type: Some("A".to_string()),
content: Some(ip.clone()),
})
.await
.with_context(|| format!("pruning surplus A {} -> {ip}", plan.name))?;
info!(domain = %plan.name, origin = %ip, "surplus apex A record withdrawn");
}
Ok(PasswayApexOutcome {
upserted: diff.upsert,
pruned: diff.prune,
withheld_prune: diff.withheld_prune,
})
}
pub async fn ensure_passway_apex(
workspace_root: &Path,
provider_id: &str,
domain: &DomainConfig,
) -> Result<Option<PasswayApexOutcome>> {
let Some(plan) = plan_passway_apex(workspace_root, domain)? else {
let zone = parent_zone_name(&domain.domain).to_string();
let envoy = passway_envoy(workspace_root, provider_id)?;
let live = read_live_apex(&envoy, &zone, &domain.domain).await?;
if live.is_empty() {
debug!(
domain = %domain.domain,
"declares front_door = \"passway\" with no passway ingress edge collated, and \
nothing is live at the apex — nothing to render, skipping"
);
return Ok(None);
}
anyhow::bail!(
"domain {} ({}) declares front_door = \"passway\" and {} A record(s) are live at \
the apex ({}), but no passway ingress edge collates onto it as a public origin. \
Either an edge that was fronting this apex has disappeared from the declaration, \
and these records now point at whatever used to serve — restore the edge, or move \
the domain off `passway` — or every door fronting it now sits behind a cloudflare \
tunnel (`via = \"passway\"`, R910), whose hostname is a CNAME the tunnel owns: \
delete these A records, since Cloudflare refuses a CNAME beside them.",
domain.name,
domain.domain,
live.len(),
live.iter()
.map(|r| r.content.as_str())
.collect::<Vec<_>>()
.join(", "),
);
};
deploy_domain_passway(workspace_root, provider_id, &plan)
.await
.map(Some)
}
pub fn plan_passway_apex(
workspace_root: &Path,
domain: &DomainConfig,
) -> Result<Option<DomainPasswayPlan>> {
let report = crate::validate::collate_workspace_ingress(workspace_root)
.context("collating workspace ingress to find the passway front doors")?;
let origins_complete = report.problems.is_empty();
if !origins_complete {
for problem in &report.problems {
warn!(
domain = %domain.domain,
"ingress collation problem — apex prunes withheld this apply: {}",
problem.message()
);
}
}
let mut front_door_machines: Vec<String> = report
.collation
.front_doors
.iter()
.filter(|fd| fd.provider == crate::config::IngressProvider::Passway)
.filter(|fd| fd.rules.iter().any(|r| r.hostname == domain.domain))
.filter(|fd| !fd.stacked.contains(&domain.domain))
.map(|fd| fd.machine.clone())
.collect();
front_door_machines.sort();
front_door_machines.dedup();
if front_door_machines.is_empty() {
return Ok(None);
}
let inventory = crate::config::resolve_fleet_inventory(workspace_root)
.context("resolving the fleet inventory to place the apex origins")?;
let resolved =
public_origins(&front_door_machines, &inventory.machines, &[]).map_err(|e| {
let sources = inventory.describe_sources();
if sources.is_empty() {
e
} else {
e.context(sources)
}
})?;
plan_domain_passway(domain, resolved, origins_complete).map(Some)
}
#[cfg(test)]
mod tests {
use super::parent_zone_name;
#[test]
fn parent_zone_strips_one_label_off_subdomain() {
assert_eq!(parent_zone_name("cdn.yah.dev"), "yah.dev");
assert_eq!(parent_zone_name("app.yah.dev"), "yah.dev");
}
#[test]
fn parent_zone_returns_self_for_apex() {
assert_eq!(parent_zone_name("yah.dev"), "yah.dev");
}
#[test]
fn parent_zone_strips_only_first_label_for_deeper_subdomain() {
assert_eq!(parent_zone_name("a.b.yah.dev"), "yah.dev");
}
use super::{plan_domain_worker, DomainWorkerPlan};
use crate::config::{DomainConfig, DomainRoute, FrontDoor, RouteMode};
use crate::reconciler::mesofact_static::ConfigBinding;
use crate::route_table::WorkerAssets;
const NET_TIER: WorkerAssets<'static> = WorkerAssets::PerComponent {
cdn_base: "https://cdn.net.yah.dev",
env: "prod",
};
fn plain_text(plan: &DomainWorkerPlan) -> std::collections::BTreeMap<String, String> {
plan.bindings
.iter()
.filter_map(|b| match b {
ConfigBinding::PlainText { name, text } => Some((name.clone(), text.clone())),
ConfigBinding::R2Bucket { .. } => None,
})
.collect()
}
fn r2_buckets(plan: &DomainWorkerPlan) -> Vec<(&str, &str)> {
plan.bindings
.iter()
.filter_map(|b| match b {
ConfigBinding::R2Bucket { name, bucket_name } => {
Some((name.as_str(), bucket_name.as_str()))
}
ConfigBinding::PlainText { .. } => None,
})
.collect()
}
fn multi_bucket_manifest() -> DomainConfig {
let bucket_route = |path: &str, bucket: &str| DomainRoute {
headers: Default::default(),
path: path.into(),
mode: RouteMode::StaticBucket {
bucket: bucket.into(),
},
};
DomainConfig {
schema_version: 1,
name: "cdn-noisetable-com".into(),
domain: "cdn.noisetable.com".into(),
front_door: FrontDoor::Worker,
cdn_bucket: "noisetable-marketing".into(),
worker_bundle_path: None,
routes: vec![
bucket_route("/engine/*", "noisetable-releases"),
bucket_route("/nt-cas/*", "noisetable-assets"),
bucket_route("/dev/*", "noisetable-releases"),
bucket_route("/*", "noisetable-marketing"),
],
}
}
#[test]
fn a_multi_bucket_domain_compiles_each_route_to_its_buckets_binding_in_manifest_order() {
let plan = plan_domain_worker(&multi_bucket_manifest(), WorkerAssets::Unplaced).unwrap();
let table = table_of(&plan);
let got: Vec<(&str, &str, &str)> = table
.iter()
.map(|e| {
assert_eq!(e["mode"], "static", "{e}");
assert!(
e.get("origin").is_none() && e.get("component").is_none(),
"a bucket entry is read through its binding, never fetched: {e}"
);
(
e["path"].as_str().unwrap(),
e["bucket"].as_str().unwrap(),
e["binding"].as_str().unwrap(),
)
})
.collect();
assert_eq!(
got,
[
("/engine/*", "noisetable-releases", "R2_NOISETABLE_RELEASES"),
("/nt-cas/*", "noisetable-assets", "R2_NOISETABLE_ASSETS"),
("/dev/*", "noisetable-releases", "R2_NOISETABLE_RELEASES"),
("/*", "noisetable-marketing", "R2_NOISETABLE_MARKETING"),
]
);
}
#[test]
fn the_binding_list_carries_one_r2_bucket_binding_per_distinct_bucket() {
let plan = plan_domain_worker(&multi_bucket_manifest(), WorkerAssets::Unplaced).unwrap();
let r2 = r2_buckets(&plan);
assert_eq!(
r2,
[
("R2_NOISETABLE_RELEASES", "noisetable-releases"),
("R2_NOISETABLE_ASSETS", "noisetable-assets"),
("R2_NOISETABLE_MARKETING", "noisetable-marketing"),
]
);
for entry in table_of(&plan) {
let binding = entry["binding"].as_str().unwrap();
assert!(r2.iter().any(|(name, _)| *name == binding), "{binding} not bound");
}
assert_eq!(plan.asset_origin, None);
assert_eq!(plain_text(&plan)["ASSET_ORIGIN"], "");
assert_eq!(
plan.bindings.iter().map(ConfigBinding::name).collect::<Vec<_>>(),
[
"ASSET_ORIGIN",
"POINTER_ORIGIN",
"WORKER_MODE",
"ROUTE_TABLE",
"R2_NOISETABLE_RELEASES",
"R2_NOISETABLE_ASSETS",
"R2_NOISETABLE_MARKETING",
]
);
}
#[test]
fn a_component_only_domain_deploys_exactly_todays_bindings() {
let plan = plan_domain_worker(&net_tier_manifest(), NET_TIER).unwrap();
let plain = |name: &str, text: &str| ConfigBinding::PlainText {
name: name.into(),
text: text.into(),
};
assert_eq!(
plan.bindings,
vec![
plain("ASSET_ORIGIN", "https://cdn.net.yah.dev/scrabcake/prod"),
plain("POINTER_ORIGIN", "https://cdn.net.yah.dev/scrabcake/prod"),
plain("WORKER_MODE", "static"),
plain(
"ROUTE_TABLE",
r#"[{"path":"/*","mode":"static","component":"scrabcake/site","origin":"https://cdn.net.yah.dev/scrabcake/prod","auth":"anonymous"}]"#,
),
]
);
}
#[test]
fn an_unplaced_worker_refuses_a_component_static_route() {
let err = plan_domain_worker(&net_tier_manifest(), WorkerAssets::Unplaced).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("scrabcake/site"), "{msg}");
assert!(msg.contains("no resolved origin"), "{msg}");
}
fn net_tier_manifest() -> DomainConfig {
DomainConfig {
schema_version: 1,
name: "scrabcake-net-yah-dev".into(),
domain: "scrabcake.net.yah.dev".into(),
front_door: FrontDoor::Worker,
cdn_bucket: "net-yah-dev".into(),
worker_bundle_path: None,
routes: vec![DomainRoute {
headers: Default::default(),
path: "/*".into(),
mode: RouteMode::Static {
component: "scrabcake/site".into(),
},
}],
}
}
fn table_of(plan: &DomainWorkerPlan) -> Vec<serde_json::Value> {
let raw = plain_text(plan)
.remove("ROUTE_TABLE")
.expect("ROUTE_TABLE binding");
serde_json::from_str(&raw).expect("ROUTE_TABLE is JSON")
}
#[test]
fn plan_resolves_worker_name_domain_and_the_one_producers_bindings() {
let plan =
plan_domain_worker(&net_tier_manifest(), NET_TIER).unwrap();
assert_eq!(plan.worker_name, "scrabcake-net-yah-dev");
assert_eq!(plan.custom_domain, "scrabcake.net.yah.dev");
assert_eq!(
plan.asset_origin.as_deref(),
Some("https://cdn.net.yah.dev/scrabcake/prod")
);
assert_eq!(
plan.bindings.iter().map(ConfigBinding::name).collect::<Vec<_>>(),
["ASSET_ORIGIN", "POINTER_ORIGIN", "WORKER_MODE", "ROUTE_TABLE"],
"the alias tier must deploy the same binding set the mirror-driven \
arm does — a twin is how it drifted last time"
);
let map = plain_text(&plan);
assert_eq!(map["ASSET_ORIGIN"], "https://cdn.net.yah.dev/scrabcake/prod");
assert_eq!(map["POINTER_ORIGIN"], "https://cdn.net.yah.dev/scrabcake/prod");
assert_eq!(map["WORKER_MODE"], "static");
let table = table_of(&plan);
assert_eq!(table.len(), 1);
assert_eq!(table[0]["path"], "/*");
assert_eq!(table[0]["mode"], "static");
assert_eq!(table[0]["component"], "scrabcake/site");
assert_eq!(table[0]["origin"], "https://cdn.net.yah.dev/scrabcake/prod");
}
#[test]
fn plan_carries_every_static_route_in_manifest_order_with_its_own_origin() {
let mut dom = net_tier_manifest();
dom.routes = vec![
DomainRoute {
headers: Default::default(),
path: "/docs/*".into(),
mode: RouteMode::Static {
component: "handbook/site".into(),
},
},
DomainRoute {
headers: Default::default(),
path: "/*".into(),
mode: RouteMode::Static {
component: "scrabcake/site".into(),
},
},
];
let plan = plan_domain_worker(&dom, NET_TIER).unwrap();
let table = table_of(&plan);
assert_eq!(table.len(), 2, "both static routes, not just the first");
assert_eq!(table[0]["path"], "/docs/*");
assert_eq!(table[0]["origin"], "https://cdn.net.yah.dev/handbook/prod");
assert_eq!(table[1]["path"], "/*");
assert_eq!(table[1]["origin"], "https://cdn.net.yah.dev/scrabcake/prod");
assert_eq!(
plan.asset_origin.as_deref(),
Some("https://cdn.net.yah.dev/handbook/prod")
);
}
#[test]
fn plan_carries_backend_and_redirect_routes_the_old_planner_dropped() {
let mut dom = net_tier_manifest();
dom.routes.insert(
0,
DomainRoute {
headers: Default::default(),
path: "/old/*".into(),
mode: RouteMode::Redirect {
target: "https://elsewhere.example".into(),
status: 308,
},
},
);
let plan = plan_domain_worker(&dom, NET_TIER).unwrap();
let table = table_of(&plan);
assert_eq!(table.len(), 2);
assert_eq!(table[0]["mode"], "redirect");
assert_eq!(table[0]["target"], "https://elsewhere.example");
assert_eq!(table[0]["status"], 308);
assert_eq!(table[1]["mode"], "static");
}
#[test]
fn plan_carries_declared_route_headers_into_the_bindings() {
let mut dom = net_tier_manifest();
dom.routes[0].headers = [
("Cross-Origin-Opener-Policy".to_string(), "same-origin".to_string()),
(
"Cross-Origin-Embedder-Policy".to_string(),
"require-corp".to_string(),
),
]
.into_iter()
.collect();
let plan = plan_domain_worker(&dom, NET_TIER).unwrap();
let table = table_of(&plan);
assert_eq!(table[0]["path"], "/*");
assert_eq!(
table[0]["headers"]["Cross-Origin-Opener-Policy"],
"same-origin"
);
assert_eq!(
table[0]["headers"]["Cross-Origin-Embedder-Policy"],
"require-corp"
);
}
#[test]
fn plan_refuses_a_malformed_component_ref() {
let mut dom = net_tier_manifest();
dom.routes[0].mode = RouteMode::Static {
component: "no-slash".into(),
};
let err = plan_domain_worker(&dom, NET_TIER).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("no-slash"), "{msg}");
assert!(msg.contains("no resolved origin"), "{msg}");
}
#[test]
fn plan_trims_trailing_slash_on_cdn_base() {
let plan =
plan_domain_worker(
&net_tier_manifest(),
WorkerAssets::PerComponent {
cdn_base: "https://cdn.net.yah.dev/",
env: "prod",
},
)
.unwrap();
assert_eq!(
plan.asset_origin.as_deref(),
Some("https://cdn.net.yah.dev/scrabcake/prod")
);
}
#[test]
fn plan_bails_when_front_door_is_not_worker() {
for door in [FrontDoor::BucketDirect, FrontDoor::Passway] {
let mut dom = net_tier_manifest();
dom.front_door = door;
let err = plan_domain_worker(&dom, NET_TIER).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("front_door"), "{msg}");
assert!(msg.contains(door.as_str()), "{msg}");
}
}
#[test]
fn plan_bails_when_no_static_route() {
let mut dom = net_tier_manifest();
dom.routes = vec![DomainRoute {
headers: Default::default(),
path: "/old".into(),
mode: RouteMode::Redirect {
target: "https://elsewhere".into(),
status: 308,
},
}];
let err = plan_domain_worker(&dom, NET_TIER).unwrap_err();
assert!(
format!("{err:#}").contains("no `static` route"),
"got: {err:#}"
);
}
use super::{plan_alias_claim, valid_subdomain_label, AliasTier};
use std::collections::BTreeMap;
#[test]
fn label_validation_rules() {
assert!(valid_subdomain_label("scrabcake"));
assert!(valid_subdomain_label("my-repo-1"));
assert!(!valid_subdomain_label("")); assert!(!valid_subdomain_label("-lead")); assert!(!valid_subdomain_label("trail-")); assert!(!valid_subdomain_label("Caps")); assert!(!valid_subdomain_label("under_score")); }
#[test]
fn claim_builds_net_tier_manifest() {
let dom = plan_alias_claim(
AliasTier::Net,
"scrabcake",
"scrabcake/site",
&BTreeMap::new(),
)
.unwrap();
assert_eq!(dom.name, "scrabcake-net-yah-dev");
assert_eq!(dom.domain, "scrabcake.net.yah.dev");
assert_eq!(dom.cdn_bucket, "net-yah-dev");
assert_eq!(dom.routes.len(), 1);
assert!(
matches!(&dom.routes[0].mode, RouteMode::Static { component } if component == "scrabcake/site")
);
}
#[test]
fn claim_uses_com_tier_zone_and_bucket() {
let dom = plan_alias_claim(AliasTier::Com, "acme", "acme/site", &BTreeMap::new()).unwrap();
assert_eq!(dom.domain, "acme.com.yah.dev");
assert_eq!(dom.cdn_bucket, "com-yah-dev");
}
#[test]
fn claim_bails_on_duplicate_host() {
let existing: BTreeMap<String, DomainConfig> =
[("scrabcake-net-yah-dev".to_string(), net_tier_manifest())]
.into_iter()
.collect();
let err =
plan_alias_claim(AliasTier::Net, "scrabcake", "scrabcake/site", &existing).unwrap_err();
assert!(format!("{err:#}").contains("already"), "got: {err:#}");
}
#[test]
fn claim_bails_on_invalid_label() {
let err =
plan_alias_claim(AliasTier::Net, "Bad_Name", "x/y", &BTreeMap::new()).unwrap_err();
assert!(
format!("{err:#}").contains("invalid subdomain"),
"got: {err:#}"
);
}
use super::{
diff_apex_records, plan_domain_passway, plan_passway_apex, public_origins, ApexRecordDiff,
DomainPasswayPlan, LiveApexRecord, PasswayOrigin, ResolvedOrigins,
};
use crate::config::{ConnectSpec, MachineConfig};
use std::net::Ipv4Addr;
fn passway_manifest() -> DomainConfig {
DomainConfig {
schema_version: 1,
name: "yah-dev".into(),
domain: "yah.dev".into(),
front_door: FrontDoor::Passway,
cdn_bucket: "yah-dev".into(),
worker_bundle_path: None,
routes: vec![DomainRoute {
headers: Default::default(),
path: "/*".into(),
mode: RouteMode::Static {
component: "yah-marketing/site".into(),
},
}],
}
}
fn machine(name: &str, address: Option<&str>, taints: &[&str]) -> MachineConfig {
MachineConfig {
name: name.into(),
provider: "ovh".into(),
location: None,
server_type: None,
hosts_mirrors: vec![],
mesh_tags: vec![],
region: None,
zone: None,
arch: None,
bucket: None,
vendor: None,
nickname: None,
legacy_hostkey_fingerprint: None,
registration: Default::default(),
ssh_keys: vec![],
cloudflared: None,
hosts_operator_bridge: false,
connect: address.map(|a| ConnectSpec {
address: a.into(),
ssh: format!("root@{a}"),
identity_file: "~/.ssh/yah".into(),
yubaba_port: None,
yubaba: None,
}),
allocatable: None,
taints: taints.iter().map(|t| t.to_string()).collect(),
sovereign_group: None,
sovereign_role: None,
ingress_floating_ip: None,
}
}
fn fleet() -> Vec<MachineConfig> {
vec![
machine("us-east-001", Some("51.81.85.145"), &["public-ip"]),
machine("us-west-001", Some("15.204.89.240"), &["public-ip"]),
machine("us-west-002", Some("100.64.0.4"), &[]),
]
}
fn origins(names: &[&str]) -> ResolvedOrigins {
origins_excluding(names, &[])
}
fn origins_excluding(names: &[&str], down: &[&str]) -> ResolvedOrigins {
let fleet = fleet();
let names: Vec<String> = names.iter().map(|n| n.to_string()).collect();
let down: Vec<String> = down.iter().map(|n| n.to_string()).collect();
public_origins(&names, &fleet, &down).unwrap()
}
fn plan_of(names: &[&str]) -> DomainPasswayPlan {
plan_domain_passway(&passway_manifest(), origins(names), true).unwrap()
}
fn plan_of_incomplete(names: &[&str]) -> DomainPasswayPlan {
plan_domain_passway(&passway_manifest(), origins(names), false).unwrap()
}
fn live(records: &[(&str, bool)]) -> Vec<LiveApexRecord> {
records
.iter()
.map(|(content, proxied)| LiveApexRecord {
content: (*content).into(),
proxied: *proxied,
})
.collect()
}
#[test]
fn public_origins_keeps_tainted_machines_and_skips_the_rest() {
let got = origins(&["us-east-001", "us-west-001", "us-west-002"]);
assert!(
got.health_withdrawn.is_empty(),
"no exclusions were passed, so nothing may be withheld"
);
assert_eq!(
got.origins,
vec![
PasswayOrigin {
machine: "us-east-001".into(),
address: Ipv4Addr::new(51, 81, 85, 145),
},
PasswayOrigin {
machine: "us-west-001".into(),
address: Ipv4Addr::new(15, 204, 89, 240),
},
],
"an untainted mesh-only front door is not an apex origin"
);
}
#[test]
fn public_origins_rejects_a_non_public_address_and_names_the_machine() {
for bad in ["100.64.0.4", "10.0.0.7", "192.168.1.20", "127.0.0.1"] {
let fleet = vec![machine("us-west-002", Some(bad), &["public-ip"])];
let err = public_origins(&["us-west-002".to_string()], &fleet, &[]).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("us-west-002"), "{msg}");
assert!(msg.contains(bad), "{msg}");
assert!(msg.contains("public"), "{msg}");
}
}
#[test]
fn public_origins_rejects_an_unparseable_address_and_names_the_machine() {
let fleet = vec![machine("us-east-001", Some("edge.example.net"), &["public-ip"])];
let err = public_origins(&["us-east-001".to_string()], &fleet, &[]).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("us-east-001"), "{msg}");
assert!(msg.contains("not an IPv4 address"), "{msg}");
}
#[test]
fn public_origins_rejects_a_tainted_machine_with_no_connect_block() {
let fleet = vec![machine("us-east-001", None, &["public-ip"])];
let err = public_origins(&["us-east-001".to_string()], &fleet, &[]).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("us-east-001"), "{msg}");
assert!(msg.contains("[connect]"), "{msg}");
}
#[test]
fn public_origins_rejects_a_machine_with_no_toml() {
let err = public_origins(&["ghost-001".to_string()], &fleet(), &[]).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("ghost-001"), "{msg}");
}
#[test]
fn plan_sorts_and_dedups_origins_and_resolves_the_apex_zone() {
let mut o = origins(&["us-west-001", "us-east-001"]);
o.origins.push(o.origins[0].clone()); let plan = plan_domain_passway(&passway_manifest(), o, true).unwrap();
assert_eq!(plan.zone, "yah.dev");
assert_eq!(plan.name, "yah.dev");
assert_eq!(
plan.origins
.iter()
.map(|o| o.address.to_string())
.collect::<Vec<_>>(),
vec!["15.204.89.240", "51.81.85.145"],
);
}
#[test]
fn a_passway_domain_with_no_ingress_edge_plans_to_none_rather_than_erroring() {
let dir = tempfile::tempdir().unwrap();
let root = dir.path();
std::fs::create_dir_all(root.join(".yah/services")).unwrap();
let planned = plan_passway_apex(root, &passway_manifest())
.expect("an undeclared door is not an error");
assert!(
planned.is_none(),
"expected None (nothing to render), got {planned:?}"
);
}
#[test]
fn a_borrowing_camp_renders_its_apex_from_the_owners_machine_declaration() {
let dir = tempfile::tempdir().unwrap();
let owner = dir.path().join("owner");
std::fs::create_dir_all(owner.join(".yah/infra/machines")).unwrap();
std::fs::write(
owner.join(".yah/infra/machines/us-east-001.toml"),
"name = \"us-east-001\"\nprovider = \"ovh\"\nmesh_tags = []\n\
taints = [\"public-ip\"]\n\
[connect]\naddress = \"51.81.85.145\"\nssh = \"root@51.81.85.145\"\n\
identity_file = \"~/.ssh/yah\"\n",
)
.unwrap();
let borrower = dir.path().join("borrower");
std::fs::create_dir_all(borrower.join(".yah/infra/machines")).unwrap();
std::fs::write(
borrower.join(".yah/infra/sources.toml"),
"schema_version = 1\n[[source]]\nowner = \"owner\"\nkind = \"path\"\n\
path = \"../owner\"\nmode = \"read-only\"\n",
)
.unwrap();
let svc = borrower.join(".yah/services/marketing");
std::fs::create_dir_all(svc.join("mirrors")).unwrap();
std::fs::write(
svc.join("service.toml"),
"schema_version = 1\nname = \"marketing\"\n[address]\nkind = \"front-door\"\ndomain = \"yah.dev\"\n\
[[components]]\nid = \"site\"\nkind = \"static-asset\"\n\
path = \"marketing/site\"\nrole = \"static\"\n",
)
.unwrap();
std::fs::write(
svc.join("mirrors/cloud.toml"),
"schema_version = 1\nshape = \"single-machine\"\n\
ingress = \"passway\"\ningress_machines = [\"us-east-001\"]\n\
[providers.compute]\nuse = \"hetzner\"\nzone = \"yah.dev\"\n\
port = 8080\nupstream_host = \"100.64.0.5\"\n",
)
.unwrap();
assert!(crate::validate::load_camp_local_machine_tomls(&borrower)
.unwrap()
.is_empty());
let plan = plan_passway_apex(&borrower, &passway_manifest())
.expect("a borrowed front-door machine must resolve")
.expect("the passway edge collates, so this is not the no-door case");
assert_eq!(
plan.origins
.iter()
.map(|o| o.address.to_string())
.collect::<Vec<_>>(),
vec!["51.81.85.145".to_string()],
);
}
#[test]
fn a_domain_publishes_only_the_doors_fronting_its_own_hostname() {
let dir = tempfile::tempdir().unwrap();
let root = dir.path();
std::fs::create_dir_all(root.join(".yah/infra/machines")).unwrap();
for (name, addr) in [("us-east-001", "51.81.85.145"), ("us-west-001", "15.204.89.240")] {
std::fs::write(
root.join(format!(".yah/infra/machines/{name}.toml")),
format!(
"name = \"{name}\"\nprovider = \"ovh\"\nmesh_tags = []\n\
taints = [\"public-ip\"]\n\
[connect]\naddress = \"{addr}\"\nssh = \"root@{addr}\"\n\
identity_file = \"~/.ssh/yah\"\n"
),
)
.unwrap();
}
for (svc_name, mirror, machine, zone) in [
("marketing", "cloud", "us-east-001", "yah.dev"),
("staging-site", "staging", "us-west-001", "staging.yah.dev"),
] {
let svc = root.join(format!(".yah/services/{svc_name}"));
std::fs::create_dir_all(svc.join("mirrors")).unwrap();
std::fs::write(
svc.join("service.toml"),
format!(
"schema_version = 1\nname = \"{svc_name}\"\n[address]\nkind = \"front-door\"\ndomain = \"yah.dev\"\n\
[[components]]\nid = \"site\"\nkind = \"static-asset\"\n\
path = \"{svc_name}/site\"\nrole = \"static\"\n"
),
)
.unwrap();
std::fs::write(
svc.join(format!("mirrors/{mirror}.toml")),
format!(
"schema_version = 1\nshape = \"single-machine\"\n\
ingress = \"passway\"\ningress_machines = [\"{machine}\"]\n\
[providers.compute]\nuse = \"hetzner\"\nzone = \"{zone}\"\n\
port = 8080\nupstream_host = \"100.64.0.5\"\n"
),
)
.unwrap();
}
let plan = plan_passway_apex(root, &passway_manifest())
.expect("both edges plan")
.expect("the apex has a door of its own");
assert_eq!(
plan.origins
.iter()
.map(|o| o.address.to_string())
.collect::<Vec<_>>(),
vec!["51.81.85.145".to_string()],
"the staging hostname's door must not be published at the apex"
);
}
#[test]
fn a_door_behind_a_cloudflare_tunnel_is_not_an_apex_origin() {
let dir = tempfile::tempdir().unwrap();
let root = dir.path();
std::fs::create_dir_all(root.join(".yah/infra/machines")).unwrap();
std::fs::write(
root.join(".yah/infra/machines/us-west-011.toml"),
"name = \"us-west-011\"\nprovider = \"ovh\"\nmesh_tags = []\n\
taints = [\"public-ip\"]\n\
[connect]\naddress = \"192.168.10.11\"\nssh = \"root@192.168.10.11\"\n\
identity_file = \"~/.ssh/yah\"\n",
)
.unwrap();
let svc = root.join(".yah/services/staging");
std::fs::create_dir_all(svc.join("mirrors")).unwrap();
std::fs::write(
svc.join("service.toml"),
"schema_version = 1\nname = \"staging\"\n[address]\nkind = \"front-door\"\ndomain = \"yah.dev\"\n\
[[components]]\nid = \"site\"\nkind = \"static-asset\"\n\
path = \"staging/site\"\nrole = \"static\"\n",
)
.unwrap();
std::fs::write(
svc.join("mirrors/staging.toml"),
"schema_version = 1\nshape = \"single-machine\"\n\
[[ingress]]\nprovider = \"passway\"\nmachines = [\"us-west-011\"]\n\
hostnames = [\"yah.dev\"]\n\
[ingress.tunnel_door]\ncontact_email = \"ops@yah.dev\"\nzone_id = \"z\"\n\
token_secret = \"yah/cf-dns\"\nports = { \"yah.dev\" = 8445 }\n\
[[ingress]]\nprovider = \"cloudflare-tunnel\"\nvia = \"passway\"\n\
machines = [\"us-west-011\"]\nhostnames = [\"yah.dev\"]\n\
[providers.compute]\nuse = \"hetzner\"\nzone = \"yah.dev\"\n\
port = 8080\nupstream_host = \"100.64.0.5\"\n",
)
.unwrap();
let report = crate::validate::collate_workspace_ingress(root).unwrap();
assert!(report.problems.is_empty(), "the pair plans cleanly");
assert!(
report
.collation
.front_doors
.iter()
.any(|d| d.provider == crate::config::IngressProvider::Passway
&& d.stacked == ["yah.dev"]),
"the passway door collates, marked stacked"
);
assert!(
plan_passway_apex(root, &passway_manifest())
.expect("a tunnel-fronted door must not trip the private-address guard")
.is_none(),
"no apex origin for a door reached through the tunnel"
);
}
#[test]
fn an_unresolvable_front_door_names_the_links_that_were_consulted() {
let dir = tempfile::tempdir().unwrap();
let borrower = dir.path().join("borrower");
std::fs::create_dir_all(borrower.join(".yah/infra/machines")).unwrap();
std::fs::write(
borrower.join(".yah/infra/sources.toml"),
"schema_version = 1\n[[source]]\nowner = \"owner\"\nkind = \"path\"\n\
path = \"../not-a-camp\"\n",
)
.unwrap();
let svc = borrower.join(".yah/services/marketing");
std::fs::create_dir_all(svc.join("mirrors")).unwrap();
std::fs::write(
svc.join("service.toml"),
"schema_version = 1\nname = \"marketing\"\n[address]\nkind = \"front-door\"\ndomain = \"yah.dev\"\n\
[[components]]\nid = \"site\"\nkind = \"static-asset\"\n\
path = \"marketing/site\"\nrole = \"static\"\n",
)
.unwrap();
std::fs::write(
svc.join("mirrors/cloud.toml"),
"schema_version = 1\nshape = \"single-machine\"\n\
ingress = \"passway\"\ningress_machines = [\"us-east-001\"]\n\
[providers.compute]\nuse = \"hetzner\"\nzone = \"yah.dev\"\n\
port = 8080\nupstream_host = \"100.64.0.5\"\n",
)
.unwrap();
let err = plan_passway_apex(&borrower, &passway_manifest()).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("us-east-001"), "{msg}");
assert!(msg.contains("sources.toml"), "{msg}");
assert!(msg.contains("owner"), "{msg}");
assert!(msg.contains("ABSENT"), "{msg}");
}
#[test]
fn a_declared_front_door_that_resolves_to_no_public_address_still_errors() {
let machines = vec![machine("us-east-001", Some("51.81.85.145"), &[])];
let resolved = public_origins(&["us-east-001".to_string()], &machines, &[]).unwrap();
let err = plan_domain_passway(&passway_manifest(), resolved, true).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("empty apex"), "{msg}");
}
#[test]
fn empty_origin_set_is_an_error_not_an_apex_wipe() {
let err = plan_domain_passway(&passway_manifest(), ResolvedOrigins::default(), true).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("refusing to render an empty apex"), "{msg}");
assert!(msg.contains("yah.dev"), "{msg}");
}
#[test]
fn plan_bails_when_front_door_is_not_passway() {
for door in [FrontDoor::BucketDirect, FrontDoor::Worker] {
let mut dom = passway_manifest();
dom.front_door = door;
let err = plan_domain_passway(&dom, origins(&["us-east-001"]), true).unwrap_err();
let msg = format!("{err:#}");
assert!(msg.contains("front_door"), "{msg}");
assert!(msg.contains(door.as_str()), "{msg}");
}
}
#[test]
fn converged_apex_is_a_no_op() {
let plan = plan_of(&["us-east-001", "us-west-001"]);
let diff = diff_apex_records(
&plan,
&live(&[("51.81.85.145", false), ("15.204.89.240", false)]),
);
assert_eq!(diff, ApexRecordDiff::default());
assert!(diff.is_converged());
}
#[test]
fn adding_a_machine_yields_exactly_one_added_record_and_no_prune() {
let plan = plan_of(&["us-east-001", "us-west-001"]);
let diff = diff_apex_records(&plan, &live(&[("51.81.85.145", false)]));
assert_eq!(diff.upsert, vec!["15.204.89.240".to_string()]);
assert!(diff.prune.is_empty(), "{diff:?}");
}
#[test]
fn removing_a_machine_yields_exactly_one_prune_and_leaves_the_survivor() {
let plan = plan_of(&["us-east-001"]);
let diff = diff_apex_records(
&plan,
&live(&[("51.81.85.145", false), ("15.204.89.240", false)]),
);
assert_eq!(diff.prune, vec!["15.204.89.240".to_string()]);
assert!(
diff.upsert.is_empty(),
"the survivor is already correct: {diff:?}"
);
}
#[test]
fn a_proxied_record_at_a_desired_address_is_rewritten_not_left_alone() {
let plan = plan_of(&["us-east-001"]);
let diff = diff_apex_records(&plan, &live(&[("51.81.85.145", true)]));
assert_eq!(diff.upsert, vec!["51.81.85.145".to_string()]);
assert!(
diff.prune.is_empty(),
"the address is declared — it must not be pruned: {diff:?}"
);
}
#[test]
fn an_incomplete_collation_upserts_but_withholds_every_prune() {
let plan = plan_of_incomplete(&["us-east-001"]);
let diff = diff_apex_records(&plan, &live(&[("15.204.89.240", false)]));
assert_eq!(
diff.upsert,
vec!["51.81.85.145".to_string()],
"additions must still land through a dirty collation"
);
assert!(
diff.prune.is_empty(),
"a live record must never be withdrawn on an incomplete collation: {diff:?}"
);
assert_eq!(
diff.withheld_prune,
vec!["15.204.89.240".to_string()],
"the withheld record is reported so the applier can name it"
);
let trusted = plan_of(&["us-east-001"]);
let diff = diff_apex_records(&trusted, &live(&[("15.204.89.240", false)]));
assert_eq!(diff.prune, vec!["15.204.89.240".to_string()]);
assert!(diff.withheld_prune.is_empty(), "{diff:?}");
}
#[test]
fn empty_origin_set_still_errors_on_an_incomplete_collation() {
let err = plan_domain_passway(&passway_manifest(), ResolvedOrigins::default(), false).unwrap_err();
assert!(
format!("{err:#}").contains("refusing to render an empty apex"),
"got: {err:#}"
);
}
#[test]
fn a_confirmed_down_machine_is_resolved_then_withheld_not_dropped() {
let got = origins_excluding(&["us-east-001", "us-west-001"], &["us-east-001"]);
assert_eq!(
got.origins,
vec![PasswayOrigin {
machine: "us-west-001".into(),
address: Ipv4Addr::new(15, 204, 89, 240),
}]
);
assert_eq!(
got.health_withdrawn,
vec![PasswayOrigin {
machine: "us-east-001".into(),
address: Ipv4Addr::new(51, 81, 85, 145),
}],
"a withheld origin must still be reported, with the address it would have published"
);
}
#[test]
fn excluding_a_machine_that_fronts_nothing_is_a_no_op() {
let got = origins_excluding(&["us-east-001"], &["us-west-001", "ghost-001"]);
assert_eq!(got.origins.len(), 1);
assert!(got.health_withdrawn.is_empty());
}
#[test]
fn excluding_every_origin_is_an_error_not_an_apex_wipe() {
let resolved = origins_excluding(
&["us-east-001", "us-west-001"],
&["us-east-001", "us-west-001"],
);
assert_eq!(resolved.health_withdrawn.len(), 2);
let err = plan_domain_passway(&passway_manifest(), resolved, true).unwrap_err();
assert!(
format!("{err:#}").contains("refusing to render an empty apex"),
"got: {err:#}"
);
}
#[test]
fn an_address_a_live_origin_still_serves_is_not_withdrawn() {
let fleet = vec![
machine("us-east-001", Some("51.81.85.145"), &["public-ip"]),
machine("us-east-002", Some("51.81.85.145"), &["public-ip"]),
];
let resolved = public_origins(
&["us-east-001".to_string(), "us-east-002".to_string()],
&fleet,
&["us-east-001".to_string()],
)
.unwrap();
let plan = plan_domain_passway(&passway_manifest(), resolved, true).unwrap();
assert_eq!(
plan.origins
.iter()
.map(|o| o.address.to_string())
.collect::<Vec<_>>(),
vec!["51.81.85.145"]
);
assert!(
plan.health_withdrawn.is_empty(),
"us-east-002 still answers on that address, so it must not be pruned"
);
}
#[test]
fn health_withdrawal_and_declaration_completeness_are_independent() {
let live = live(&[("51.81.85.145", false), ("15.204.89.240", false)]);
let complete_healthy = plan_domain_passway(
&passway_manifest(),
origins(&["us-west-001"]),
true,
)
.unwrap();
let d = diff_apex_records(&complete_healthy, &live);
assert_eq!(d.prune, vec!["51.81.85.145"]);
assert!(d.withheld_prune.is_empty());
let complete_down = plan_domain_passway(
&passway_manifest(),
origins_excluding(&["us-east-001", "us-west-001"], &["us-east-001"]),
true,
)
.unwrap();
let d = diff_apex_records(&complete_down, &live);
assert_eq!(d.prune, vec!["51.81.85.145"]);
assert!(d.withheld_prune.is_empty());
let incomplete_healthy = plan_domain_passway(
&passway_manifest(),
origins(&["us-west-001"]),
false,
)
.unwrap();
let d = diff_apex_records(&incomplete_healthy, &live);
assert!(
d.prune.is_empty(),
"an absence under an incomplete collation must never prune"
);
assert_eq!(d.withheld_prune, vec!["51.81.85.145"]);
let incomplete_down = plan_domain_passway(
&passway_manifest(),
origins_excluding(&["us-east-001", "us-west-001"], &["us-east-001"]),
false,
)
.unwrap();
let d = diff_apex_records(&incomplete_down, &live);
assert_eq!(
d.prune,
vec!["51.81.85.145"],
"a health withdrawal rests on a positive observation, not on an absence, so \
origins_complete = false must not suppress it"
);
assert!(d.withheld_prune.is_empty());
}
#[test]
fn an_incomplete_collation_prunes_only_the_health_withdrawn_surplus() {
let plan = plan_domain_passway(
&passway_manifest(),
origins_excluding(&["us-east-001", "us-west-001"], &["us-east-001"]),
false,
)
.unwrap();
let d = diff_apex_records(
&plan,
&live(&[
("51.81.85.145", false), ("15.204.89.240", false), ("203.0.113.9", false), ]),
);
assert_eq!(d.prune, vec!["51.81.85.145"]);
assert_eq!(d.withheld_prune, vec!["203.0.113.9"]);
assert!(d.upsert.is_empty());
}
#[test]
fn a_withheld_prune_alone_leaves_nothing_to_write() {
let plan = plan_of_incomplete(&["us-east-001"]);
let diff = diff_apex_records(
&plan,
&live(&[("51.81.85.145", false), ("15.204.89.240", false)]),
);
assert!(diff.upsert.is_empty(), "{diff:?}");
assert!(diff.prune.is_empty(), "{diff:?}");
assert!(diff.is_converged(), "no write to make: {diff:?}");
assert_eq!(diff.withheld_prune, vec!["15.204.89.240".to_string()]);
}
#[test]
fn a_full_origin_swap_writes_the_new_record_before_pruning_the_old() {
let plan = plan_of(&["us-west-001"]);
let diff = diff_apex_records(&plan, &live(&[("51.81.85.145", false)]));
assert_eq!(diff.upsert, vec!["15.204.89.240".to_string()]);
assert_eq!(diff.prune, vec!["51.81.85.145".to_string()]);
assert!(!diff.is_converged());
}
}