mirror of
https://github.com/hanzoai/o11y.git
synced 2026-11-02 09:37:36 +00:00
zeekay
69b187636d
o11y carried a second identity system: email/password sign-in, Google,
OIDC and SAML callbacks, self-registration, invites, reset-password
tokens, roles-on-users, SSO auth domains, and a pair of tokenizers that
minted and stored its own sessions. Hanzo IAM answers all of it, once,
at the edge. Two credential stores is one too many, and the one nobody
signs into is the one that rots.
What is left is Identity: WHO a request is, resolved from what the edge
asserted or from a service-account key, never issued here. The routes are
not merely unrouted — the handlers, stores, tables and templates behind
them are gone, and anonymous_test.go names each dead address so that
re-exempting one fails even though no route can come back.
The census moves with it: 366 addresses to 329, 353 typed ops to 319, ten
escape hatches to seven. zipdoc_gen.go loses the 34 descriptions whose
addresses left, because zip keys its doc registry by method and path, so
a description outliving its declaration attaches this module's prose to
whatever a host serves at that address. zipdoc_test.go pins that.
Cherry-picked from delete/o11y-identity 89854a68ae.
67 lines
2.5 KiB
Go
67 lines
2.5 KiB
Go
package o11yapiserver
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/hanzoai/o11y"
|
|
"github.com/hanzoai/o11y/pkg/http/routing"
|
|
"github.com/zap-proto/zip"
|
|
)
|
|
|
|
// BY NAME, NOT BY COUNT.
|
|
//
|
|
// routes_test.go counts this registrar's routes and the module's declaration
|
|
// counts its own, and 197 + 132 = 329 on both sides. Two sets of 329 can be 329
|
|
// DIFFERENT addresses and every count in the repo stays green — which is not a
|
|
// hypothetical: three of these routes bound {traceID} where the declaration
|
|
// named {traceId}, and nothing could see it, because a router matches by
|
|
// POSITION and a parameter's name is invisible to it. It only became visible
|
|
// when something wanted to look an address UP by name, which is what the seam
|
|
// between the two now does (routing.Table.Handler).
|
|
//
|
|
// So this compares the sets. Every address this registrar serves must be one the
|
|
// module declares, and must resolve through the table by that same name — the
|
|
// two properties the seam depends on, checked against the real registration
|
|
// rather than against a list.
|
|
//
|
|
// Equality follows without a second test: this file and its sibling in
|
|
// pkg/query-service/app each prove registered ⊆ declared, their counts are 197
|
|
// and 132, the declaration's is 329, and a duplicate registration panics at boot
|
|
// (routing.Handle). 197 + 132 distinct addresses inside a set of 329 is the whole
|
|
// set.
|
|
func TestEveryRegisteredAddressIsDeclaredAndResolves(t *testing.T) {
|
|
app := zip.New(zip.Config{DisableStartupMessage: true})
|
|
router := routing.New(app.Group(""), nil)
|
|
censusProvider().AddToRouter(router)
|
|
table := router.Table()
|
|
|
|
for _, route := range table.Routes() {
|
|
if !declared(t)[route.Method+" "+route.Path] {
|
|
t.Errorf("%s %s is served here and declared nowhere — a caller reaching it "+
|
|
"is in no document, and the seam cannot name it", route.Method, route.Path)
|
|
}
|
|
if table.Handler(route.Method, route.Path) == nil {
|
|
t.Errorf("%s %s registered but does not resolve by name", route.Method, route.Path)
|
|
}
|
|
}
|
|
}
|
|
|
|
// declared is every address the module's own declaration of this service names,
|
|
// in the PUBLIC spelling both sides state an address in.
|
|
func declared(t *testing.T) map[string]bool {
|
|
t.Helper()
|
|
d := zip.New(zip.Config{DisableStartupMessage: true})
|
|
if err := o11y.Use(d); err != nil {
|
|
t.Fatalf("Mount: %v", err)
|
|
}
|
|
out := map[string]bool{}
|
|
for _, r := range d.Fiber().GetRoutes(true) {
|
|
if r.Method == http.MethodHead || r.Method == http.MethodOptions {
|
|
continue
|
|
}
|
|
out[r.Method+" "+zip.Template(r.Path)] = true
|
|
}
|
|
return out
|
|
}
|