feat(felis): add Operator break-glass op behind an operation menu
When a staff account already exists, the break-glass console now opens on a thin top-level menu (menuModel) where account operations are peers rather than tails of one wizard: provision/reset the Owner, or add an Operator. A fresh machine with no Owner skips the menu and goes straight to Owner bootstrap, since minting an Operator first would create a staff account the login gate rejects. The Operator path reuses ownerModel via a bgOperation discriminator. It is insert-only (performAddOperator -> InsertOperator), wraps a duplicate username as api.ErrConflict and routes back to the provision form for a retry rather than tearing down, and deliberately never flips the global local_auth toggle the way the Owner thread does. The post-exit summary and audit trail distinguish the two outcomes (isOperator); only the Owner provision claims local-password login was enabled. Tests cover the operator-model defaults, path selection (insert vs upsert and the local-auth gate), conflict-retry versus generic teardown, isOperator propagation, and the root menu routing for both fresh and admin-present machines.
This commit is contained in:
6 files changed
+513
-28
No files matched your search
@@ -0,0 +1,252 @@
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"fmt"
|
||||
"testing"
|
||||
|
||||
"felis.lolicon.best/internal/api"
|
||||
|
||||
tea "github.com/charmbracelet/bubbletea"
|
||||
)
|
||||
|
||||
// These tests cover the break-glass operator path that the menu added: the new
|
||||
// menuModel, the operation discriminator on ownerModel, and the root routing that
|
||||
// turns a menu choice into the right screen. Like tui_root_test.go they inject the
|
||||
// inter-screen messages directly and run the screens' outgoing commands by hand, so
|
||||
// no database, terminal, or huh key-replay is involved — only the wiring is under
|
||||
// test (the core provisioning logic is covered in breakglass_test.go).
|
||||
|
||||
func TestNewOperatorModelDefaults(t *testing.T) {
|
||||
m := newOperatorModel(context.Background(), &fakeOwnerStore{}, "root")
|
||||
if m.operation != bgAddOperator {
|
||||
t.Errorf("operation = %v, want bgAddOperator", m.operation)
|
||||
}
|
||||
if !m.adminExists {
|
||||
t.Error("adminExists = false, want true — adding an Operator presupposes an existing admin")
|
||||
}
|
||||
if m.step != owAuth {
|
||||
t.Errorf("step = %v, want owAuth — the operator path always authenticates first", m.step)
|
||||
}
|
||||
// The username must NOT default to "owner" the way the Owner flow does: the
|
||||
// operator path is insert-only, so a defaulted name would hit ErrConflict on the
|
||||
// happy path every single time.
|
||||
if m.ownerUser != "" {
|
||||
t.Errorf("ownerUser = %q, want empty (no default for the insert-only operator path)", m.ownerUser)
|
||||
}
|
||||
if m.subject() != "Operator" {
|
||||
t.Errorf("subject() = %q, want Operator", m.subject())
|
||||
}
|
||||
|
||||
// The Owner flow is the zero value and is unchanged by the discriminator.
|
||||
ow := newOwnerModel(context.Background(), &fakeOwnerStore{}, "root", true)
|
||||
if ow.operation != bgProvisionOwner {
|
||||
t.Errorf("owner operation = %v, want bgProvisionOwner", ow.operation)
|
||||
}
|
||||
if ow.ownerUser != "owner" || ow.subject() != "Owner" {
|
||||
t.Errorf("owner defaults changed: ownerUser=%q subject=%q", ow.ownerUser, ow.subject())
|
||||
}
|
||||
}
|
||||
|
||||
func TestProvisionCmdSelectsPathByOperation(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
t.Run("operator path inserts and leaves local auth untouched", func(t *testing.T) {
|
||||
f := &fakeOwnerStore{}
|
||||
m := newOperatorModel(ctx, f, "root")
|
||||
m.mode, m.accountable, m.username, m.attempt = "recovery", "root", "ops-new", "root"
|
||||
|
||||
out := m.provisionCmd()()
|
||||
msg, ok := out.(owProvisionMsg)
|
||||
if !ok {
|
||||
t.Fatalf("provisionCmd produced %T, want owProvisionMsg", out)
|
||||
}
|
||||
if msg.err != nil {
|
||||
t.Fatalf("operator provision: %v", msg.err)
|
||||
}
|
||||
// performAddOperator is insert-only and never uses the Owner upsert path.
|
||||
if len(f.inserts) != 1 {
|
||||
t.Fatalf("want 1 insert (performAddOperator), got %d", len(f.inserts))
|
||||
}
|
||||
if len(f.upserts) != 0 {
|
||||
t.Errorf("want 0 owner upserts, got %d — the operator path must not use UpsertOwner", len(f.upserts))
|
||||
}
|
||||
// The operator path must NOT flip the global local-auth gate (Owner-only).
|
||||
if _, ok := f.settings[api.LocalAuthEnabledKey]; ok {
|
||||
t.Error("the operator path flipped local auth — only the Owner thread may")
|
||||
}
|
||||
// No password was typed, so a one-time credential is surfaced to hand off.
|
||||
if msg.outcome.displayPassword == "" {
|
||||
t.Error("want a generated one-time password to hand to the new operator")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("owner path upserts and enables local auth", func(t *testing.T) {
|
||||
f := &fakeOwnerStore{}
|
||||
m := newOwnerModel(ctx, f, "root", true)
|
||||
m.mode, m.accountable, m.username = "recovery", "root", "owner"
|
||||
|
||||
out := m.provisionCmd()()
|
||||
msg, ok := out.(owProvisionMsg)
|
||||
if !ok {
|
||||
t.Fatalf("provisionCmd produced %T, want owProvisionMsg", out)
|
||||
}
|
||||
if msg.err != nil {
|
||||
t.Fatalf("owner provision: %v", msg.err)
|
||||
}
|
||||
// performBreakGlass upserts the single Owner and enables local-password login.
|
||||
if len(f.upserts) != 1 || len(f.inserts) != 0 {
|
||||
t.Fatalf("want 1 upsert and 0 inserts (performBreakGlass), got upserts=%d inserts=%d", len(f.upserts), len(f.inserts))
|
||||
}
|
||||
if _, ok := f.settings[api.LocalAuthEnabledKey]; !ok {
|
||||
t.Error("the owner path did not enable local auth — the thin thread requires it")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestOwnerModelProvisionErrorRouting(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
// A wrapped conflict, exactly as provisionOperator surfaces it.
|
||||
conflict := fmt.Errorf("operator %q already exists: %w", "owner", api.ErrConflict)
|
||||
|
||||
t.Run("an operator name clash returns to the provision form with a prompt", func(t *testing.T) {
|
||||
m := newOperatorModel(ctx, &fakeOwnerStore{}, "root")
|
||||
m.mode, m.accountable = "recovery", "root"
|
||||
|
||||
next, _ := m.Update(owProvisionMsg{err: conflict})
|
||||
om, ok := next.(*ownerModel)
|
||||
if !ok {
|
||||
t.Fatalf("Update returned %T, want *ownerModel", next)
|
||||
}
|
||||
if om.step != owProvision {
|
||||
t.Fatalf("step = %v, want owProvision — a taken name is recoverable, not fatal", om.step)
|
||||
}
|
||||
// provisionErr is what buildProvisionForm keys the "already taken — choose
|
||||
// another name" prompt off of, so a still-matchable conflict here is what makes
|
||||
// the retry legible to the operator.
|
||||
if !errors.Is(om.provisionErr, api.ErrConflict) {
|
||||
t.Errorf("provisionErr = %v, want it to wrap api.ErrConflict so the form can prompt for another name", om.provisionErr)
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("a non-conflict error tears the console down", func(t *testing.T) {
|
||||
m := newOperatorModel(ctx, &fakeOwnerStore{}, "root")
|
||||
|
||||
next, cmd := m.Update(owProvisionMsg{err: errors.New("boom")})
|
||||
om := next.(*ownerModel)
|
||||
if om.step == owProvision {
|
||||
t.Error("a generic store fault must not be treated as a retryable name clash")
|
||||
}
|
||||
if cmd == nil {
|
||||
t.Fatal("a fatal provision error should return a failure command")
|
||||
}
|
||||
res, ok := cmd().(ownerResultMsg)
|
||||
if !ok {
|
||||
t.Fatalf("failure cmd produced %T, want ownerResultMsg", cmd())
|
||||
}
|
||||
if res.err == nil {
|
||||
t.Error("ownerResultMsg.err = nil, want the surfaced failure")
|
||||
}
|
||||
})
|
||||
|
||||
t.Run("a conflict on the Owner path is not a retry", func(t *testing.T) {
|
||||
// Defensive: the Owner upserts and so never conflicts, but were one ever to
|
||||
// surface it must end the session rather than loop the form — only the
|
||||
// insert-only operator path is retryable.
|
||||
m := newOwnerModel(ctx, &fakeOwnerStore{}, "root", true)
|
||||
|
||||
next, cmd := m.Update(owProvisionMsg{err: conflict})
|
||||
om := next.(*ownerModel)
|
||||
if om.provisionErr != nil {
|
||||
t.Error("the Owner path recorded a retryable conflict; only the operator path retries")
|
||||
}
|
||||
if res, ok := cmd().(ownerResultMsg); !ok || res.err == nil {
|
||||
t.Error("an Owner-path conflict should tear down via an error result")
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
func TestOwnerResultCmdCarriesIsOperator(t *testing.T) {
|
||||
ctx := context.Background()
|
||||
|
||||
op := newOperatorModel(ctx, &fakeOwnerStore{}, "root")
|
||||
op.username, op.displayPassword, op.mode, op.accountable = "ops", "pw", "recovery", "root"
|
||||
if res := op.ownerResultCmd()().(ownerResultMsg); !res.isOperator {
|
||||
t.Error("operator result.isOperator = false, want true")
|
||||
}
|
||||
|
||||
ow := newOwnerModel(ctx, &fakeOwnerStore{}, "root", true)
|
||||
ow.username, ow.mode, ow.accountable = "owner", "recovery", "root"
|
||||
if res := ow.ownerResultCmd()().(ownerResultMsg); res.isOperator {
|
||||
t.Error("owner result.isOperator = true, want false")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRootBreakGlassOpensMenuWhenAdminExists(t *testing.T) {
|
||||
m := newTestRoot(true, consoleModeBreakGlass, "")
|
||||
if m.stage != stageMenu {
|
||||
t.Fatalf("stage = %v, want stageMenu", m.stage)
|
||||
}
|
||||
if _, ok := m.screen.(*menuModel); !ok {
|
||||
t.Fatalf("screen = %T, want *menuModel", m.screen)
|
||||
}
|
||||
|
||||
// Picking "add Operator" adopts an ownerModel wired for the operator path.
|
||||
m = drive(t, m, menuChoiceMsg{op: bgAddOperator})
|
||||
if m.stage != stageOwner {
|
||||
t.Fatalf("after the menu choice, stage = %v, want stageOwner", m.stage)
|
||||
}
|
||||
om, ok := m.screen.(*ownerModel)
|
||||
if !ok {
|
||||
t.Fatalf("screen = %T, want *ownerModel", m.screen)
|
||||
}
|
||||
if om.operation != bgAddOperator {
|
||||
t.Errorf("operation = %v, want bgAddOperator", om.operation)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRootBreakGlassMenuOwnerChoice(t *testing.T) {
|
||||
m := newTestRoot(true, consoleModeBreakGlass, "")
|
||||
m = drive(t, m, menuChoiceMsg{op: bgProvisionOwner})
|
||||
om, ok := m.screen.(*ownerModel)
|
||||
if !ok {
|
||||
t.Fatalf("screen = %T, want *ownerModel", m.screen)
|
||||
}
|
||||
if om.operation != bgProvisionOwner {
|
||||
t.Errorf("operation = %v, want bgProvisionOwner", om.operation)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRootBreakGlassSkipsMenuOnFreshMachine(t *testing.T) {
|
||||
// No admin yet: bootstrapping the first Owner is the only sensible op, so the menu
|
||||
// is skipped and the console opens straight on the Owner screen.
|
||||
m := newTestRoot(false, consoleModeBreakGlass, "")
|
||||
if m.stage != stageOwner {
|
||||
t.Fatalf("stage = %v, want stageOwner (no menu on a fresh machine)", m.stage)
|
||||
}
|
||||
om, ok := m.screen.(*ownerModel)
|
||||
if !ok {
|
||||
t.Fatalf("screen = %T, want *ownerModel", m.screen)
|
||||
}
|
||||
if om.operation != bgProvisionOwner {
|
||||
t.Errorf("operation = %v, want bgProvisionOwner", om.operation)
|
||||
}
|
||||
}
|
||||
|
||||
func TestMenuModelCancelQuits(t *testing.T) {
|
||||
if m := newMenuModel(); m.choice != bgProvisionOwner {
|
||||
t.Errorf("default choice = %v, want bgProvisionOwner (Owner reset is the common path)", m.choice)
|
||||
}
|
||||
// Backing out of the top-level menu cancels the whole console.
|
||||
for _, kt := range []tea.KeyType{tea.KeyEsc, tea.KeyCtrlC} {
|
||||
m := newMenuModel()
|
||||
_, cmd := m.Update(key(kt))
|
||||
if cmd == nil {
|
||||
t.Fatalf("%v on the menu should return a command (tea.Quit)", kt)
|
||||
}
|
||||
if msg := cmd(); !isQuit(msg) {
|
||||
t.Errorf("%v on the menu = %T, want tea.Quit", kt, msg)
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user