hyperhive/nix/module-eval/agent-github-bao.nix

# `checks.module-eval-agent-github-bao` — see ./lib.nix for the shared
# rationale (why this suite exists, naming convention, "evaluates
# not executes").
#
# The agent side of the swarm-stored GitHub token: ../agent-modules/github-token.nix
# fetches it into the `/run` file ../agent-modules/github.nix's readers use.
{
  pkgs,
  lib,
  self,
  nixosSystem,
  shared,
}:
let
  inherit
    (import ./lib.nix {
      inherit
        pkgs
        lib
        self
        nixosSystem
        ;
    })
    agentWith
    runGroup
    ;

  baoAddr = "https://bao.t.local:8200";

  # A store, and the integration on by default.
  agentGithubBao = shared.agentWithBao;

  # No store: the absence arm, and what makes the cases above able to fail.
  agentGithubNoBao = shared.agentBare;

  # A store, and the integration switched off.
  agentGithubOff = agentWith {
    services.hyperhive.agent.bao.addr = baoAddr;
    services.hyperhive.agent.github.enable = false;
  };

  fetchUnit = machine: machine.systemd.services.hive-agent-github-token;
  has = machine: machine.systemd.services ? hive-agent-github-token;
  hasTimer = machine: machine.systemd.timers ? hive-agent-github-token;
in
let
  tokenFile = "/run/hive-agent-github-token/token";
  cases = [
    {
      name = "an agent with a store address and the integration on fetches its github token";
      ok = has agentGithubBao && hasTimer agentGithubBao;
    }
    {
      name = "an agent with no store address, or with the integration off, fetches none";
      ok =
        !(has agentGithubNoBao)
        && !(hasTimer agentGithubNoBao)
        && !(has agentGithubOff)
        && !(hasTimer agentGithubOff);
    }
    {
      # The nix half of `swarm_secret_client::github::account_path`, and the
      # file ./github.nix's `gh` wrapper, credential helper and poller read.
      name = "the fetch reads the agent's own github-token path into a file under /run";
      ok =
        let
          name = agentGithubBao.services.hyperhive.agent.user.name;
          s = (fetchUnit agentGithubBao).script;
        in
        lib.hasInfix "bao kv get -format=json secret/swarm/agents/${name}/github-token >" s
        && lib.hasInfix "token=${tokenFile}" s
        && lib.hasInfix ".data.data.value | strings" s
        && agentGithubBao.services.hyperhive.agent.github.tokenFile == tokenFile;
    }
    {
      # The presence arms are the `${tokenFile}` matches above and below: the
      # unit and the path unit do name the `/run` file, so a state-dir path
      # missing here is a fact and not a misspelled lookup.
      name = "neither the fetch nor the poller's units name the state-dir github-token";
      ok =
        let
          name = agentGithubBao.services.hyperhive.agent.user.name;
          stateToken = "/agents/${name}/state/github-token";
          notify = agentGithubBao.systemd.services.hive-github-notify;
          path = agentGithubBao.systemd.paths.hive-github-notify;
        in
        !(lib.hasInfix "/state" (fetchUnit agentGithubBao).script)
        && notify.environment.HIVE_GITHUB_TOKEN_FILE == tokenFile
        && path.pathConfig.PathChanged == tokenFile
        && path.pathConfig.PathChanged != stateToken;
    }
    {
      # `/run` is empty at every start, so a token the store no longer has is
      # gone then; the preserved directory keeps it between this unit's runs.
      name = "the token file lives in a preserved 0700 runtime directory and is 0400";
      ok =
        let
          u = fetchUnit agentGithubBao;
        in
        u.serviceConfig.RuntimeDirectory == "hive-agent-github-token"
        && u.serviceConfig.RuntimeDirectoryMode == "0700"
        && u.serviceConfig.RuntimeDirectoryPreserve == "yes"
        && u.serviceConfig.UMask == "0377";
    }
    {
      # The runtime directory is the agent user's.
      name = "the fetch runs as the agent, with its own store identity";
      ok =
        let
          u = fetchUnit agentGithubBao;
          name = agentGithubBao.services.hyperhive.agent.user.name;
        in
        u.serviceConfig.User == name
        && u.environment.BAO_ADDR == baoAddr
        && u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
        && u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key";
    }
    {
      # The fetch itself is run, against a stub store, by
      # `checks.script-test-agent-bao-fetch`.
      name = "the fetch never deletes the token, and swaps it in only on a change";
      ok =
        let
          s = (fetchUnit agentGithubBao).script;
        in
        !(lib.hasInfix "rm -f \"$token\"" s)
        && lib.hasInfix "cmp -s \"$staged\" \"$token\"" s
        && lib.hasInfix "mv -f \"$staged\" \"$token\"" s;
    }
    {
      # The poller reads the token once at start.
      name = "the fetch runs before the github poller starts";
      ok = builtins.elem "hive-github-notify.service" (fetchUnit agentGithubBao).before;
    }
    {
      # The poller waits for the token about ten minutes and then exits 0, which
      # `on-failure` does not restart; the path unit starts it when the token lands.
      name = "a token that lands after the github poller gave up starts it again";
      ok =
        let
          path = agentGithubBao.systemd.paths.hive-github-notify;
        in
        path.pathConfig.PathChanged == tokenFile
        && path.wantedBy == [ "multi-user.target" ]
        && agentGithubBao.systemd.services ? hive-github-notify
        && !(agentGithubOff.systemd.paths ? hive-github-notify)
        && !(agentGithubOff.systemd.services ? hive-github-notify);
    }
    {
      name = "the fetch re-runs every two minutes";
      ok = agentGithubBao.systemd.timers.hive-agent-github-token.timerConfig.OnUnitInactiveSec == "2min";
    }
  ];
in
runGroup "agent-github-bao" cases