make squid's allowed domains editable at runtime in the swarm ui

nix/vm-tests/hive-squid.nix

@@ -152,6 +152,8 @@ pkgs.testers.runNixOSTest {
             "cache.t.local"
             "api.t.local"
             "other.t.local"
+            "swarm.t.local"
+            "agentonly.t.local"
             "deny-canary.invalid"
           ];
           "127.0.0.1" = [ "loop.t.local" ];
@@ -231,6 +233,7 @@ pkgs.testers.runNixOSTest {
   testScript = ''
     import re
     import secrets
+    import shlex
     import time
 
     # Drawn fresh each run. The users file holds only their hashes, as
@@ -248,6 +251,8 @@ pkgs.testers.runNixOSTest {
     RUTH = "ruth:" + PW["ruth"]
     USERS = "/var/lib/hive-squid/users"
     LIST = "/var/lib/hive-squid/unrestricted"
+    ALLOWED = "/var/lib/hive-squid/allowed"
+    AGENT_ALLOW = "/var/lib/hive-squid/agent-allow.conf"
     UNRESTRICTED = ["uma", "selfcheck-unrestricted.squid"]
 
     start_all()
@@ -289,6 +294,16 @@ pkgs.testers.runNixOSTest {
             f"&& chmod 640 {LIST}.new && mv {LIST}.new {LIST}"
         )
 
+    def write_allow(allowed, agent_conf):
+        # What hive-c0re does for its two files: written aside and renamed into
+        # place, in squid's group. Squid reads them on a reload, which
+        # squid-unrestricted-reload does when either changes.
+        for path, body in ((ALLOWED, allowed), (AGENT_ALLOW, agent_conf)):
+            proxy.succeed(
+                f"printf '%s' {shlex.quote(body)} > {path}.new && chown hive-core:squid {path}.new "
+                f"&& chmod 640 {path}.new && mv {path}.new {path}"
+            )
+
     def wait_status(host, cred, want):
         # The reload that follows a list write is asynchronous.
         got = None
@@ -310,6 +325,11 @@ pkgs.testers.runNixOSTest {
         assert proxy.succeed("stat -c %a /var/lib/hive-squid").strip() == "2750"
         assert proxy.succeed(f"stat -c %s {USERS}").strip() == "0"
         assert proxy.succeed(f"stat -c %s {LIST}").strip() == "0"
+        assert proxy.succeed(f"stat -c '%U:%G %a' {ALLOWED}").strip() == "hive-core:squid 640"
+        assert proxy.succeed(f"stat -c '%U:%G %a' {AGENT_ALLOW}").strip() == "hive-core:squid 640"
+        assert proxy.succeed(f"stat -c %s {AGENT_ALLOW}").strip() == "0"
+        # The allow-list file starts as the hive's own allowedDomains.
+        proxy.succeed(f"grep -Fx forge.t.local {ALLOWED}")
         assert connect("forge.t.local", ATLAS) == "407", "no such user"
         assert connect("other.t.local", UMA) == "407", "no such user, unlisted name"
 
@@ -500,6 +520,31 @@ pkgs.testers.runNixOSTest {
         wait_status("other.t.local", RUTH, "403")
         assert connect("other.t.local", UMA) == "200", "control: uma is still listed"
 
+    with subtest("the swarm's allow-list replaces the hive's names, opens one to every restricted user, and a per-agent rule opens one to that agent alone"):
+        seeded = proxy.succeed(f"cat {ALLOWED}")
+        assert connect("swarm.t.local", RUTH) == "403", "control: not allowed yet"
+        assert connect("agentonly.t.local", ATLAS) == "403", "control: not allowed yet"
+        assert connect("forge.t.local", RUTH) == "200", "control: the hive's own name"
+        write_allow(
+            "# source: swarm\nswarm.t.local\n",
+            "# source: swarm\n"
+            "acl agent_allow_atlas proxy_auth atlas\n"
+            "acl agent_allow_atlas_dst dstdomain agentonly.t.local priv10.t.local\n"
+            "http_access allow agent_allow_atlas agent_allow_atlas_dst\n",
+        )
+        wait_status("swarm.t.local", RUTH, "200")
+        wait_status("agentonly.t.local", ATLAS, "200")
+        assert connect("swarm.t.local", ATLAS) == "200", "swarm-wide, another user"
+        assert connect("agentonly.t.local", RUTH) == "403", "the per-agent name, another restricted user"
+        assert connect("agentonly.t.local") == "407", "no credential"
+        assert connect("forge.t.local", RUTH) == "403", "the hive's own name is replaced"
+        assert connect("priv10.t.local", ATLAS) == "403", "a per-agent name that resolves privately"
+        assert connect("agentonly.t.local", UMA) == "200", "control: unrestricted reaches it anyway"
+        write_allow(seeded, "")
+        wait_status("swarm.t.local", RUTH, "403")
+        wait_status("agentonly.t.local", ATLAS, "403")
+        assert connect("forge.t.local", RUTH) == "200", "the hive's own name is back"
+
     with subtest("squid starts on a missing list, treats every user as restricted, and recovers when it appears"):
         proxy.succeed(f"rm {LIST}")
         proxy.succeed("systemctl restart squid.service")