glm-5.3-flash
930d9c1996
The wave-3 gate read the landed server mappings against mapping.md/ADR-006/ADR-003/auth.md line by line: session/pty/shell/pipe (translation bridge + the derivation contract rules 1-6), git exec (full grammar, no-oracle validation, collapsed denial byte order), route-1 bridge direct rows, the full -R listen flow + forwarded-tcpip data leg, per-build decline matrices, identity observed at every seam, bounded bookkeeping, and the uniform safe tracing vocabulary. All four decomposition-time interpretations confirmed. Fixed inline (this gate): - install_forwarded_surface pre-checks the tunnel/forwarded op — alkcall's register silently replaces an existing entry, so a second adapter over the same shared seam registry silently stole the first adapter's arrival routes; now a failed construction (AdapterError::ListenRegistration), pinned by a new wire row - git take drops a stored pty entry (combined-build stale state) - doc hygiene: channel_cap release ordering, the session-row scoping of the handler Drop, the cancel-order recording, the post-cancel arrival caveat, the exit-chunk ADR lineage cross-ref, the stale lib.rs wave-state doc, the superseded dispatch test name, and mapping.md's listen-resource wording (address verbatim + tcp port) Booked for wave 4: the git row's status-before-close honored by scheduling not construction (needs a seam/shape change), the channel-not-held wire test rows, the tty coverage minors (cancel path, Closed/Break shape, stdout write deadline), and a defensive ListenRouter token-collision pre-check. Verified: cargo test (default) + --all-features (173 rows, 13 binaries), clippy --all-targets -D warnings ×2 (default + --all-features), fmt --check, cargo doc --no-deps (0 warnings), taskgraph validate (26 tasks).
757 lines
30 KiB
Rust
757 lines
30 KiB
Rust
//! The wave-2 dispatch/decline-core contract tests
|
|
//! (`w2-dispatch-decline-core`) — the skeleton rows of the decline
|
|
//! matrix (`mapping.md` §Decline matrix), driven per feature build
|
|
//! through the loopback harness. This task tests the rows it lands;
|
|
//! the full per-build matrix suite is wave-5's.
|
|
//!
|
|
//! Feature builds are compile-time, so the rows are feature-gated to
|
|
//! the build whose matrix row they pin: the shared rows
|
|
//! (never-feature `x11`, the `tcpip-forward` listen decline) run in
|
|
//! every build; the capability rows run in the builds that open their
|
|
//! subject (a session channel needs `session` or `git`); the
|
|
//! per-build matrix rows are pinned to exactly one feature combination
|
|
//! (`not(...)` guards) so `--all-features` runs neither a
|
|
//! git-only row nor a session-only row by accident. Every feature
|
|
//! build is exercised by its own verification run
|
|
//! (`cargo test [--features …]`), not by cfg tricks.
|
|
|
|
#![allow(dead_code)]
|
|
|
|
mod common;
|
|
|
|
use std::sync::Arc;
|
|
|
|
use common::harness::{
|
|
LoopbackSession, adapter, authenticate_publickey, await_close, drive, next_message,
|
|
open_session_channel, open_x11_channel, tcpip_forward,
|
|
};
|
|
use common::{MemHostKeyPolicy, MemIdentityProvider, fixture, identity};
|
|
use russh::client::Msg;
|
|
use russh::{Channel, ChannelOpenFailure, Error};
|
|
|
|
use alkssh::Limits;
|
|
|
|
/// Mounts an authenticated loopback session over the doubles — the
|
|
/// dispatch rows' driver: fixture `alpha` resolves through
|
|
/// `MemIdentityProvider`, host keys `bravo`, the permissive host-key
|
|
/// posture (the explicit test choice).
|
|
async fn authenticated() -> LoopbackSession {
|
|
let provider = Arc::new(MemIdentityProvider::new());
|
|
provider.register(
|
|
fixture("alpha").fingerprint,
|
|
identity("dispatch-core", &["ssh"]),
|
|
);
|
|
let adapter = adapter(provider, &[fixture("bravo")]).await;
|
|
|
|
let policy = Arc::new(MemHostKeyPolicy::with_default(true));
|
|
let mut session = drive(adapter, Arc::clone(&policy), Limits::default())
|
|
.await
|
|
.expect("the loopback mounts");
|
|
|
|
let result =
|
|
authenticate_publickey(&mut session.client, "dispatch-core", fixture("alpha")).await;
|
|
assert!(
|
|
result.success(),
|
|
"the fixture identity authenticates before every dispatch row"
|
|
);
|
|
session
|
|
}
|
|
|
|
/// Matches an open failure's SSH reason — the wire decline reason the
|
|
/// open-gate rows assert.
|
|
fn open_failure(err: Error, expected: ChannelOpenFailure, context: &str) {
|
|
assert!(
|
|
matches!(
|
|
&err,
|
|
Error::ChannelOpenFailure(reason) if *reason == expected
|
|
),
|
|
"{context}: expected open decline with {expected:?}, got {err:?}"
|
|
);
|
|
}
|
|
|
|
/// The request-level decline observation: the channel answers Failure.
|
|
/// A capability decline's channel stays open afterwards — the POC-1 §5
|
|
/// session-survives-declines posture the channel-alive rows lean on.
|
|
async fn expect_failure(channel: &mut Channel<Msg>, context: &str) {
|
|
match next_message(channel).await {
|
|
Some(russh::ChannelMsg::Failure) => {}
|
|
other => panic!("{context}: expected a channel failure, got {other:?}"),
|
|
}
|
|
}
|
|
|
|
/// The serving-path (family-seam stub) decline observation: Failure
|
|
/// then Close — the vanilla-clean shape for a row whose serving path
|
|
/// would own the channel.
|
|
async fn expect_failure_then_close(channel: &mut Channel<Msg>, context: &str) {
|
|
expect_failure(channel, context).await;
|
|
assert!(
|
|
await_close(channel).await,
|
|
"{context}: the seam stub closes the channel after the failure"
|
|
);
|
|
}
|
|
|
|
/// Proves a declined channel is still usable — a follow-up request
|
|
/// reaches the dispatch again instead of the channel being dead.
|
|
async fn expect_channel_alive(channel: &mut Channel<Msg>) {
|
|
common::harness::request_subsystem(channel, "sftp")
|
|
.await
|
|
.expect("the still-open channel carries another request");
|
|
expect_failure(channel, "the surviving channel still dispatches").await;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Shared rows — run in every feature build.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
/// - *Contract stamp:* ADR-003 §5 (x11 is a never-feature — declined
|
|
/// in every build, never feature-gated).
|
|
#[tokio::test]
|
|
async fn x11_channel_opens_decline_in_every_build() {
|
|
let session = authenticated().await;
|
|
let err = open_x11_channel(&session.client, "127.0.0.1", 0)
|
|
.await
|
|
.expect_err("x11 opens decline");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"the never-feature x11 open",
|
|
);
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Global-request rows (the `-R`
|
|
/// listen flow is a `tunnel` row declined when the flow cannot
|
|
/// serve — this wave: every build).
|
|
#[tokio::test]
|
|
async fn tcpip_forward_listen_requests_decline_in_every_build() {
|
|
let session = authenticated().await;
|
|
let err = tcpip_forward(&session.client, "127.0.0.1", 8080)
|
|
.await
|
|
.expect_err("the listen request declines");
|
|
assert!(
|
|
matches!(err, Error::RequestDenied),
|
|
"expected the declined listen's RequestDenied, got {err:?}"
|
|
);
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Decline matrix (git-build row,
|
|
/// request side: `x11` / `auth-agent` requests decline; ADR-003 §5).
|
|
#[cfg(any(feature = "git", feature = "session"))]
|
|
#[tokio::test]
|
|
async fn x11_and_agent_requests_decline_wherever_sessions_open() {
|
|
use common::harness::{request_agent_forward, request_x11};
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens where a session-serving feature exists");
|
|
|
|
request_x11(&channel)
|
|
.await
|
|
.expect("the x11-req rides the wire");
|
|
expect_failure(&mut channel, "the never-feature x11 request declines").await;
|
|
|
|
request_agent_forward(&channel)
|
|
.await
|
|
.expect("the agent-forward request rides the wire");
|
|
expect_failure(&mut channel, "the never-feature agent request declines").await;
|
|
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// Default build (no features): everything declines (mapping.md
|
|
// §Decline matrix — "none (default): declines everything").
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[cfg(not(any(feature = "session", feature = "git", feature = "tunnel")))]
|
|
mod default_build {
|
|
use super::*;
|
|
use common::harness::{open_direct_streamlocal, open_direct_tcpip};
|
|
|
|
/// - *Contract stamp:* mapping.md §Decline matrix (none-build
|
|
/// row: every channel type declines at open — session channels
|
|
/// as unfeatured, tunnel rows as unfeatured — plus the
|
|
/// never-feature x11).
|
|
#[tokio::test]
|
|
async fn every_channel_open_declines_in_a_default_build() {
|
|
let session = authenticated().await;
|
|
|
|
let err = open_session_channel(&session.client)
|
|
.await
|
|
.expect_err("session channels decline unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"the unfeatured session open",
|
|
);
|
|
|
|
let err = open_direct_tcpip(&session.client, "internal.example", 5432)
|
|
.await
|
|
.expect_err("direct-tcpip declines unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"the unfeatured direct-tcpip open",
|
|
);
|
|
|
|
let err = open_direct_streamlocal(&session.client, "/run/alkssh.sock")
|
|
.await
|
|
.expect_err("direct-streamlocal declines unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"the unfeatured direct-streamlocal open",
|
|
);
|
|
|
|
session.unmount().await;
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// git-only build: routes git-parseable exec to the git row; declines
|
|
// pty/shell, plain exec, all other opens (mapping.md §Decline matrix —
|
|
// git row). The harness builds no seam, so the git row's decline is
|
|
// the config-driven one (`w3-git-mapping`: seam-unconfigured — the
|
|
// unset-declines contract, serving-path shape); the serving rows ride
|
|
// `tests/git_mapping.rs`.
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[cfg(all(feature = "git", not(feature = "session"), not(feature = "tunnel")))]
|
|
mod git_build {
|
|
use super::*;
|
|
use common::harness::{
|
|
open_direct_streamlocal, open_direct_tcpip, request_env, request_exec, request_shell,
|
|
request_subsystem,
|
|
};
|
|
|
|
/// - *Contract stamp:* the task's channel-open gate (session
|
|
/// channels open where a session-serving feature exists — `git`
|
|
/// qualifies, the parse path lives inside session channels).
|
|
#[tokio::test]
|
|
async fn session_channels_open_in_a_git_build() {
|
|
let session = authenticated().await;
|
|
open_session_channel(&session.client)
|
|
.await
|
|
.expect("session channels open under the git feature");
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* ADR-006 point 3 (parse-only: a
|
|
/// git-parseable exec routes to the git row; this build
|
|
/// configures no seam, so the row declines at its config gate —
|
|
/// the serving-path shape, failure then close). The row's
|
|
/// serving surface (seam configured, real dispatch) is
|
|
/// `tests/git_mapping.rs`'s.
|
|
#[tokio::test]
|
|
async fn git_parseable_exec_routes_to_the_git_row_stub() {
|
|
let session = authenticated().await;
|
|
for command in [
|
|
"git-upload-pack '/owner/demo'",
|
|
"git-receive-pack '/owner/demo'",
|
|
] {
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_exec(&channel, command)
|
|
.await
|
|
.expect("the exec request rides the wire");
|
|
expect_failure_then_close(
|
|
&mut channel,
|
|
&format!("the git row serves its seam stub for {command}"),
|
|
)
|
|
.await;
|
|
}
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Decline matrix (git-build row:
|
|
/// plain exec declines; the parse-then-fail shape of POC-3
|
|
/// stage A — the channel survives the decline).
|
|
#[tokio::test]
|
|
async fn plain_exec_declines_and_keeps_the_channel_in_a_git_build() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_exec(&channel, "uptime")
|
|
.await
|
|
.expect("the exec request rides the wire");
|
|
expect_failure(&mut channel, "the unfeatured pipe row declines").await;
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* POC-3 §2 (unknown git services take the
|
|
/// agreed declined surface — `w3-git-mapping`'s decided class,
|
|
/// off the pipe row: `ExecRoute::Declined`, build-independent;
|
|
/// the reply vocabulary is shared with parse-then-fail: failure,
|
|
/// channel alive).
|
|
#[tokio::test]
|
|
async fn unknown_git_services_take_the_declined_surface() {
|
|
let session = authenticated().await;
|
|
for command in ["git-send-pack '/r'", "git-upload-archive '/r'"] {
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_exec(&channel, command)
|
|
.await
|
|
.expect("the exec request rides the wire");
|
|
expect_failure(
|
|
&mut channel,
|
|
&format!("an unknown service does not reach the git row: {command}"),
|
|
)
|
|
.await;
|
|
expect_channel_alive(&mut channel).await;
|
|
}
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Decline matrix (git-build row:
|
|
/// pty/shell and all session requests decline).
|
|
#[tokio::test]
|
|
async fn pty_shell_and_capability_requests_decline_in_a_git_build() {
|
|
let session = authenticated().await;
|
|
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_shell(&channel)
|
|
.await
|
|
.expect("the shell request rides the wire");
|
|
expect_failure(&mut channel, "the shell row declines unfeatured").await;
|
|
expect_channel_alive(&mut channel).await;
|
|
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Request-level rows (subsystem:
|
|
/// `sftp` is the OQ-13 placeholder decline; git service names
|
|
/// carry no repository id — ADR-006 decision 2).
|
|
#[tokio::test]
|
|
async fn subsystems_decline_with_their_named_reasons_in_a_git_build() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
for name in ["sftp", "git-upload-pack"] {
|
|
request_subsystem(&channel, name)
|
|
.await
|
|
.expect("the subsystem request rides the wire");
|
|
expect_failure(
|
|
&mut channel,
|
|
&format!("the subsystem {name} declines with reason"),
|
|
)
|
|
.await;
|
|
}
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* OQ-09 (mapping.md §Request-level rows:
|
|
/// `env_request` declines unconditionally — no allowlist ships).
|
|
#[tokio::test]
|
|
async fn env_requests_decline_in_a_git_build() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_env(&channel, "GIT_DIR", "/srv/git")
|
|
.await
|
|
.expect("the env request rides the wire");
|
|
expect_failure(&mut channel, "the env request declines").await;
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Decline matrix (git-build
|
|
/// row: all other channel types decline — tunnel unfeatured).
|
|
#[tokio::test]
|
|
async fn tunnel_opens_decline_unfeatured_in_a_git_build() {
|
|
let session = authenticated().await;
|
|
|
|
let err = open_direct_tcpip(&session.client, "internal.example", 5432)
|
|
.await
|
|
.expect_err("direct-tcpip declines unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"direct-tcpip",
|
|
);
|
|
|
|
let err = open_direct_streamlocal(&session.client, "/run/alkssh.sock")
|
|
.await
|
|
.expect_err("direct-streamlocal declines unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"direct-streamlocal",
|
|
);
|
|
|
|
session.unmount().await;
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// session-only build: declines git-parseable exec (the git parse is
|
|
// its gate); with no seam/config this build's session rows decline at
|
|
// their config gates (the unset-declines contract, serving-path
|
|
// shape: `w3-tty-session`); declines tunnel opens (mapping.md
|
|
// §Decline matrix — session row).
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[cfg(all(feature = "session", not(feature = "git"), not(feature = "tunnel")))]
|
|
mod session_build {
|
|
use super::*;
|
|
use common::harness::{
|
|
open_direct_streamlocal, open_direct_tcpip, request_env, request_exec, request_pty,
|
|
request_shell, request_subsystem,
|
|
};
|
|
|
|
/// - *Contract stamp:* the task's channel-open gate (session
|
|
/// channels open where a session-serving feature exists).
|
|
#[tokio::test]
|
|
async fn session_channels_open_in_a_session_build() {
|
|
let session = authenticated().await;
|
|
open_session_channel(&session.client)
|
|
.await
|
|
.expect("session channels open under the session feature");
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Decline matrix (session row:
|
|
/// git-parseable exec declines — the `git` parse is its gate;
|
|
/// the channel survives the decline, POC-1 §5).
|
|
#[tokio::test]
|
|
async fn git_parseable_exec_declines_in_a_session_build() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_exec(&channel, "git-upload-pack '/owner/demo'")
|
|
.await
|
|
.expect("the exec request rides the wire");
|
|
expect_failure(
|
|
&mut channel,
|
|
"the git parse gates the row off in a session build",
|
|
)
|
|
.await;
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* OQ-08 + the recorded wire shape
|
|
/// (`w3-tty-session`: `exec_wrapper_argv` unset → the pipe row
|
|
/// declines — the serving-path shape, failure then close, never
|
|
/// a fallback). The row's serving surface (everything
|
|
/// configured) is `tests/tty_mapping.rs`'s.
|
|
#[tokio::test]
|
|
async fn plain_exec_declines_wrapper_unconfigured_in_a_session_build() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_exec(&channel, "uptime")
|
|
.await
|
|
.expect("the exec request rides the wire");
|
|
expect_failure_then_close(&mut channel, "the unset-wrapper pipe row").await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Channel-type rows + OQ-08 (the
|
|
/// `session` feature alone configures nothing: `session_seam`
|
|
/// unset → the pty/shell rows decline `seam-unconfigured`, the
|
|
/// serving-path shape this build pins).
|
|
#[tokio::test]
|
|
async fn pty_and_shell_decline_seam_unconfigured_in_a_session_build() {
|
|
let session = authenticated().await;
|
|
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_pty(&channel)
|
|
.await
|
|
.expect("the pty request rides the wire");
|
|
expect_failure_then_close(&mut channel, "the unset-seam pty row").await;
|
|
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_shell(&channel)
|
|
.await
|
|
.expect("the shell request rides the wire");
|
|
expect_failure_then_close(&mut channel, "the unset-seam shell row").await;
|
|
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Request-level rows (subsystem:
|
|
/// the OQ-13 placeholder and git service names decline-with-
|
|
/// reason in every session-serving build).
|
|
#[tokio::test]
|
|
async fn subsystems_decline_with_their_named_reasons_in_a_session_build() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
for name in ["sftp", "git-upload-pack"] {
|
|
request_subsystem(&channel, name)
|
|
.await
|
|
.expect("the subsystem request rides the wire");
|
|
expect_failure(
|
|
&mut channel,
|
|
&format!("the subsystem {name} declines with reason"),
|
|
)
|
|
.await;
|
|
}
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* OQ-09 (mapping.md §Request-level rows:
|
|
/// `env_request` declines unconditionally).
|
|
#[tokio::test]
|
|
async fn env_requests_decline_in_a_session_build() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_env(&channel, "GIT_DIR", "/srv/git")
|
|
.await
|
|
.expect("the env request rides the wire");
|
|
expect_failure(&mut channel, "the env request declines").await;
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Decline matrix (session row:
|
|
/// other channel types decline — tunnel unfeatured).
|
|
#[tokio::test]
|
|
async fn tunnel_opens_decline_unfeatured_in_a_session_build() {
|
|
let session = authenticated().await;
|
|
|
|
let err = open_direct_tcpip(&session.client, "internal.example", 5432)
|
|
.await
|
|
.expect_err("direct-tcpip declines unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"direct-tcpip",
|
|
);
|
|
|
|
let err = open_direct_streamlocal(&session.client, "/run/alkssh.sock")
|
|
.await
|
|
.expect_err("direct-streamlocal declines unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"direct-streamlocal",
|
|
);
|
|
|
|
session.unmount().await;
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// tunnel-only build: session channels decline (auto-reject); the
|
|
// tunnel direct rows decline on the **absent handle** even with the
|
|
// feature on (the route-1 bridge is `w3-tunnel-direct`: the pre-admit
|
|
// unset-handle class — the unset-declines posture; the fabric double's
|
|
// serve/cap/fabric-failure rows ride tests/tunnel_mapping.rs) —
|
|
// mapping.md §Decline matrix (tunnel row).
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[cfg(all(feature = "tunnel", not(feature = "git"), not(feature = "session")))]
|
|
mod tunnel_build {
|
|
use super::*;
|
|
use common::harness::{open_direct_streamlocal, open_direct_tcpip};
|
|
|
|
/// - *Contract stamp:* ADR-006 point 3 as amended (parse-only
|
|
/// dispatch: a request-less/deserving-less session channel
|
|
/// declines as unfeatured — a tunnel-only build has no
|
|
/// session-serving feature, so the open declines).
|
|
#[tokio::test]
|
|
async fn session_channels_decline_in_a_tunnel_build() {
|
|
let session = authenticated().await;
|
|
let err = open_session_channel(&session.client)
|
|
.await
|
|
.expect_err("session channels decline unfeatured");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::AdministrativelyProhibited,
|
|
"the unfeatured session open in a tunnel build",
|
|
);
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Channel-type rows + the
|
|
/// unset-declines posture (`w3-seam-config` — the feature alone
|
|
/// configures nothing): the direct rows decline on the **absent
|
|
/// fabric handle** even with `tunnel` on —
|
|
/// [`connect failed`], the cannot-bridge class ADR-006 decision
|
|
/// 1 pins (`w3-tunnel-direct`'s recorded wire classes: policy
|
|
/// refusals are administratively-prohibited, cannot-bridge is
|
|
/// connect-failed).
|
|
#[tokio::test]
|
|
async fn tunnel_direct_rows_decline_seam_unconfigured_without_a_handle() {
|
|
let session = authenticated().await;
|
|
|
|
let err = open_direct_tcpip(&session.client, "internal.example", 5432)
|
|
.await
|
|
.expect_err("the direct-tcpip row declines on the absent handle");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::ConnectFailed,
|
|
"the direct-tcpip unset-handle decline",
|
|
);
|
|
|
|
let err = open_direct_streamlocal(&session.client, "/run/alkssh.sock")
|
|
.await
|
|
.expect_err("the direct-streamlocal row declines on the absent handle");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::ConnectFailed,
|
|
"the direct-streamlocal unset-handle decline",
|
|
);
|
|
|
|
session.unmount().await;
|
|
}
|
|
}
|
|
|
|
// ---------------------------------------------------------------------------
|
|
// All features: the routing decisions hold with the full graph on —
|
|
// the git row is still its config-driven decline in this binary (the
|
|
// serving rows ride tests/git_mapping.rs), and the session rows are
|
|
// still their config-driven declines (the serving rows ride
|
|
// tests/tty_mapping.rs).
|
|
// ---------------------------------------------------------------------------
|
|
|
|
#[cfg(all(feature = "git", feature = "session", feature = "tunnel"))]
|
|
mod all_features {
|
|
use super::*;
|
|
use common::harness::{
|
|
open_direct_streamlocal, open_direct_tcpip, request_env, request_exec, request_pty,
|
|
request_shell, request_subsystem,
|
|
};
|
|
|
|
/// - *Contract stamp:* mapping.md §Session-channel dispatch (the
|
|
/// git-parseable exec routes to the git row in the full build).
|
|
#[tokio::test]
|
|
async fn git_exec_routes_to_the_git_row_stub_with_all_features() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_exec(&channel, "git-upload-pack '/owner/demo'")
|
|
.await
|
|
.expect("the exec request rides the wire");
|
|
expect_failure_then_close(&mut channel, "the git row serves its seam stub").await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* OQ-08 + the recorded wire shape (the
|
|
/// unset-wrapper pipe row declines — the serving-path shape;
|
|
/// `w3-tty-session`). The serving surface rides
|
|
/// `tests/tty_mapping.rs`.
|
|
#[tokio::test]
|
|
async fn plain_exec_declines_wrapper_unconfigured_with_all_features() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_exec(&channel, "uptime")
|
|
.await
|
|
.expect("the exec request rides the wire");
|
|
expect_failure_then_close(&mut channel, "the unset-wrapper pipe row").await;
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Channel-type rows + OQ-08 (the
|
|
/// unset-seam pty/shell declines with the full graph on — the
|
|
/// feature alone configures nothing; the serving surface rides
|
|
/// `tests/tty_mapping.rs`).
|
|
#[tokio::test]
|
|
async fn pty_and_shell_decline_seam_unconfigured_with_all_features() {
|
|
let session = authenticated().await;
|
|
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_pty(&channel)
|
|
.await
|
|
.expect("the pty request rides the wire");
|
|
expect_failure_then_close(&mut channel, "the unset-seam pty row").await;
|
|
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
request_shell(&channel)
|
|
.await
|
|
.expect("the shell request rides the wire");
|
|
expect_failure_then_close(&mut channel, "the unset-seam shell row").await;
|
|
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* the unset-declines posture (`w3-seam-config`,
|
|
/// carried through `w3-tunnel-direct`: the route-1 bridge's
|
|
/// pre-admit unset-handle class) — the direct rows decline on
|
|
/// the **absent fabric handle** even with the full feature graph
|
|
/// on (`ConnectFailed`, the cannot-bridge class); the served
|
|
/// surface rides tests/tunnel_mapping.rs's fabric double.
|
|
#[tokio::test]
|
|
async fn tunnel_direct_rows_decline_seam_unconfigured_without_a_handle_with_all_features() {
|
|
let session = authenticated().await;
|
|
|
|
let err = open_direct_tcpip(&session.client, "internal.example", 5432)
|
|
.await
|
|
.expect_err("the full-featured direct-tcpip row declines on the absent handle");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::ConnectFailed,
|
|
"the direct-tcpip unset-handle decline",
|
|
);
|
|
|
|
let err = open_direct_streamlocal(&session.client, "/run/alkssh.sock")
|
|
.await
|
|
.expect_err("the full-featured direct-streamlocal row declines on the absent handle");
|
|
open_failure(
|
|
err,
|
|
ChannelOpenFailure::ConnectFailed,
|
|
"the direct-streamlocal unset-handle decline",
|
|
);
|
|
|
|
session.unmount().await;
|
|
}
|
|
|
|
/// - *Contract stamp:* mapping.md §Request-level rows (the
|
|
/// capability declines — sftp placeholder, git subsystem
|
|
/// names, env — hold with everything on).
|
|
#[tokio::test]
|
|
async fn capability_declines_hold_with_all_features() {
|
|
let session = authenticated().await;
|
|
let mut channel = open_session_channel(&session.client)
|
|
.await
|
|
.expect("the session channel opens");
|
|
|
|
request_subsystem(&channel, "sftp")
|
|
.await
|
|
.expect("the subsystem request rides the wire");
|
|
expect_failure(&mut channel, "the sftp placeholder declines").await;
|
|
|
|
request_subsystem(&channel, "git-upload-pack")
|
|
.await
|
|
.expect("the subsystem request rides the wire");
|
|
expect_failure(&mut channel, "the git subsystem declines").await;
|
|
|
|
request_env(&channel, "GIT_DIR", "/srv/git")
|
|
.await
|
|
.expect("the env request rides the wire");
|
|
expect_failure(&mut channel, "the env request declines").await;
|
|
|
|
expect_channel_alive(&mut channel).await;
|
|
session.unmount().await;
|
|
}
|
|
}
|