b57894b183
Introduces the browser-facing surface and the worker-side protocol that backs it: - internal/ui: joined read model plus per-task lifecycle and approval controls, kept separate from the raw endpoints workers and harnesses depend on. - internal/webui + web/: Vite/React app, build output embedded via go:embed and served as an SPA fallback. - federation: per-(worker, task) captures with a monotonic revision that advances only when pane text actually changes, and a command queue restricted to grant_approval / deny_approval, each bound to the capture revision the operator acted on. - orchestra-worker: publishes captures and executes commands only after re-reading the pane and confirming the revision still matches. Sends keystrokes only for a visible y/n prompt or OpenCode's fully labelled selector, and refuses to deny through that selector rather than guess at unobservable navigation. This is the ownership boundary AUDIT.md's B14 and B17 call for: approval becomes an explicit, revision-bound operation executed by the worker that owns the pane, instead of a side effect of prompting over a coordinator-driven remote socket. Also ignores the web build inputs and outputs. node_modules ships vendored Go packages, so go build and go test walk into it if it is merely untracked; both node_modules and .node_modules are excluded. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01535A3Y8RtkAi8wYuWhtkEd
108 lines
3.2 KiB
Go
108 lines
3.2 KiB
Go
package federation
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCursorIsMonotonicAndAuthenticationIsRequired(t *testing.T) {
|
|
r := &Registry{}
|
|
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, ""); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.Authenticate("workpc", "wrong"); err != ErrUnauthorized {
|
|
t.Fatalf("got %v", err)
|
|
}
|
|
if err := r.Authenticate("workpc", "secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.Ack("workpc", 7); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := r.Ack("workpc", 6); err == nil {
|
|
t.Fatal("backwards cursor accepted")
|
|
}
|
|
if got, _ := r.Cursor("workpc"); got != 7 {
|
|
t.Fatalf("cursor = %d", got)
|
|
}
|
|
}
|
|
|
|
func TestRegisterRequiresAdmitTokenAndOwnToken(t *testing.T) {
|
|
r := &Registry{AdmitToken: "admit-secret"}
|
|
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, "wrong"); err != ErrUnauthorized {
|
|
t.Fatalf("wrong admit token: got %v", err)
|
|
}
|
|
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, "admit-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
// Re-registering the same id with a different token is a hijack
|
|
// attempt (S10), not a legitimate re-registration, and must be refused
|
|
// even with a valid admit token.
|
|
if err := r.Register(Worker{ID: "workpc", Token: "different"}, "admit-secret"); err != ErrUnauthorized {
|
|
t.Fatalf("hijack with different token: got %v", err)
|
|
}
|
|
// The same worker re-registering with its own token (e.g. after a
|
|
// restart) must still succeed.
|
|
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, "admit-secret"); err != nil {
|
|
t.Fatalf("legitimate re-registration: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestOfflineHookRunsOnceOnTransition(t *testing.T) {
|
|
called := make(chan Worker, 1)
|
|
r := &Registry{TTL: time.Millisecond, OnOffline: func(w Worker) { called <- w }}
|
|
if err := r.Register(Worker{ID: "workpc", Token: "secret"}, ""); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
r.mu.Lock()
|
|
w := r.workers["workpc"]
|
|
w.LastSeen = time.Now().Add(-time.Second)
|
|
r.workers["workpc"] = w
|
|
r.mu.Unlock()
|
|
r.Snapshot()
|
|
select {
|
|
case got := <-called:
|
|
if got.ID != "workpc" {
|
|
t.Fatal(got.ID)
|
|
}
|
|
case <-time.After(time.Second):
|
|
t.Fatal("offline hook not called")
|
|
}
|
|
r.Snapshot()
|
|
select {
|
|
case <-called:
|
|
t.Fatal("offline hook called twice")
|
|
case <-time.After(10 * time.Millisecond):
|
|
}
|
|
}
|
|
|
|
func TestCaptureRevisionAndCommandQueue(t *testing.T) {
|
|
r := &Registry{}
|
|
if err := r.Register(Worker{ID: "w", Token: "t"}, ""); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
c, err := r.PutCapture("w", Capture{TaskID: "task", PaneID: "pane", Text: "Permission required\n$ ls"})
|
|
if err != nil || c.Revision != 1 {
|
|
t.Fatalf("capture=%#v err=%v", c, err)
|
|
}
|
|
again, err := r.PutCapture("w", Capture{TaskID: "task", PaneID: "pane", Text: c.Text})
|
|
if err != nil || again.Revision != 1 {
|
|
t.Fatalf("same capture=%#v err=%v", again, err)
|
|
}
|
|
cmd, err := r.Queue("w", Command{TaskID: "task", Kind: "grant_approval", PaneID: "pane", CaptureRevision: 1})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
commands, err := r.Commands("w")
|
|
if err != nil || len(commands) != 1 || commands[0].ID != cmd.ID {
|
|
t.Fatalf("commands=%#v err=%v", commands, err)
|
|
}
|
|
if err := r.CompleteCommand("w", cmd.ID, "acknowledged", ""); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
commands, _ = r.Commands("w")
|
|
if len(commands) != 0 {
|
|
t.Fatalf("pending=%#v", commands)
|
|
}
|
|
}
|