report the real error when the granter role's bootstrap step fails, and retry on a standby store

nix/script-tests/granter-login.sh

@@ -99,5 +99,75 @@ err_has "the store is sealed or unreachable; retrying."
 err_has "Vault is sealed"
 err_lacks "role is not set up"
 
+# The bootstrap token's `auth list` step: the rendered snippet runs under
+# `set -e` with the scratch file the unit makes. Sets $rc, $got (the listing it
+# left in `mounted`) and $dir/err.
+token=/tmp/granter-bootstrap-test.token
+
+setup_list() {
+  setup "$1"
+  export FAKE_BAO_LIST_COUNT=$dir/list-count FAKE_BAO_LIST=ok
+  unset FAKE_BAO_LIST_FIRST
+  echo dead >"$token"
+}
+
+run_list() {
+  got=$(
+    (
+      set -e
+      PATH="$FAKE_BAO_BIN:$PATH"
+      err=$(mktemp)
+      # shellcheck source=/dev/null
+      . "$BOOTSTRAP_LIST"
+      echo "$mounted"
+    ) 2>"$dir/err"
+  )
+  rc=$?
+}
+
+setup_list "a listing that succeeds leaves it in mounted and prints nothing"
+run_list
+expect 0 '{"cert/":{},"oidc/":{}}'
+if [ -s "$dir/err" ]; then fail "printed: $(cat "$dir/err")"; fi
+
+setup_list "a standby store fails the listing with its own error, does not blame the token, keeps the token file, and the next attempt succeeds"
+export FAKE_BAO_LIST_FIRST=standby
+run_list
+expect 1 ""
+err_has "local node not active but active cluster node not found"
+err_has "listing its auth mounts failed without a refused token"
+err_lacks "refused the bootstrap token"
+err_lacks "one-time step"
+if [ ! -e "$token" ]; then fail "token file deleted"; fi
+run_list
+expect 0 '{"cert/":{},"oidc/":{}}'
+
+setup_list "a refused token with no working granter names the token and the setup steps, then bao's error, and exits 4"
+export FAKE_BAO_LIST=denied FAKE_BAO_LOGIN=no-role
+run_list
+expect 4 ""
+err_has "the store refused the bootstrap token in /tmp/granter-bootstrap-test.token"
+err_has "one-time step, as root on this host"
+err_has "  bao policy write bao-bootstrap /etc/bootstrap.hcl"
+err_has "permission denied"
+if [ ! -e "$token" ]; then fail "token file deleted"; fi
+
+setup_list "a refused token beside a working granter exits 0 and deletes the token"
+export FAKE_BAO_LIST=denied FAKE_BAO_LOGIN=ok
+run_list
+expect 0 "granter role already in place; bootstrap token not needed"
+err_lacks "refused the bootstrap token"
+if [ -e "$token" ]; then fail "token file kept"; fi
+
+setup_list "a sealed store is reported as sealed or unreachable, with bao's error"
+export FAKE_BAO_LIST=sealed FAKE_BAO_STATUS_RC=2
+run_list
+expect 1 ""
+err_has "the store is sealed or unreachable; retrying."
+err_has "Vault is sealed"
+err_lacks "refused the bootstrap token"
+
+rm -f "$token"
+
 echo "granter-login: $count cases, $failures failures"
 [ "$failures" = 0 ]