mirror of
https://github.com/zap-proto/zip.git
synced 2026-10-19 15:38:57 +00:00
zeekayandHanzo Dev
e7a4b06a6c
forward() overwrote the Host header with the DIAL ADDRESS on every proxied request. A client dials its own address — HostClient.Addr, zaphttp.Dial(addr) — and never reads this header to find the far end, so that value was not routing anything. It was destroying the one fact a child needs to serve more than one brand: which host was asked. hanzoai/iam is where it showed. It serves every brand from one instance and resolves each brand's OIDC issuer from the request Host, so mounted as a plugin child it was asked as "/var/lib/cloud/run/iam.sock", matched no brand, and fell back to its single default — lux.id and zoolabs.id minting tokens claiming iss=hanzo.id, which their own relying parties reject. Config could not reach it: the brand map was in the child's environment and the Host never arrived. The dial address stays the fallback for a request carrying no Host of its own (the MCP hop builds a fresh one), because HTTP/1.1 requires the header. Read through req.Header.Host() rather than req.Host(): the latter goes through the URI, which parses on first touch — 34 allocations on a hop that is meant to cost none, which the alloc gate catches. And a request that already has a Host is now left ALONE rather than re-set. The test measures the SERIALIZED request. fasthttp writes the Host header from the URI once the URI has been parsed, so reading either field in memory can disagree with what actually goes over the wire; serializing is the only reading that cannot. It fails on the old code and passes on this one. Also: every test that binds a unix socket now does it in a short directory. A socket address is 104 bytes on Darwin and t.TempDir spends most of them on the test's own name, so 9 tests failed with "never began listening" — which reads as a timing bug, is green on Linux, red on every Mac, and breaks when a test is RENAMED. Suite goes 11 red to 2, both of which are pre-existing and platform: SO_PEERCRED (no LOCAL_PEERCRED path on macOS) and the alloc gate, which fails on pristine v1.27.1 when run in isolation. Co-authored-by: Hanzo Dev <[email protected]>
82 lines
2.8 KiB
Go
82 lines
2.8 KiB
Go
package zip_test
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/zap-proto/zip"
|
|
)
|
|
|
|
type askIn struct {
|
|
Ref string `json:"ref"`
|
|
}
|
|
type askOut struct {
|
|
Org string `json:"org"`
|
|
}
|
|
|
|
// Ask is the whole of what a caller needs to reach a peer: a name, an op token
|
|
// and a value. No address, no registry, no discovery — and the tenant rides the
|
|
// CALLER, so the callee reads an org the caller could not choose.
|
|
func TestAskReachesAPeerByNameAndCarriesTheCaller(t *testing.T) {
|
|
dir := sockDir(t)
|
|
t.Setenv(zip.RuntimeDirEnv, dir)
|
|
|
|
peer := zip.New(zip.Config{AppName: "ledger", DisableStartupMessage: true})
|
|
zip.Post(peer, "/v1/ledger/whoami", func(ctx context.Context, in *askIn) (*askOut, error) {
|
|
org, ok := zip.Tenant(ctx)
|
|
if !ok {
|
|
return nil, zip.Errorf(403, "no tenant")
|
|
}
|
|
return &askOut{Org: org}, nil
|
|
}, zip.WithOperationID("ledger_whoami"))
|
|
|
|
go func() { _ = peer.Listen(zip.SocketPath("ledger")) }()
|
|
t.Cleanup(func() { _ = peer.Shutdown() })
|
|
waitSock(t, zip.SocketPath("ledger"))
|
|
|
|
// A background job STATES its caller once, explicitly. It cannot launder one:
|
|
// an inbound request always wins over a stated caller.
|
|
ctx := zip.WithCaller(context.Background(), zip.Caller{User: "u_job", Org: "acme"})
|
|
out, err := zip.Ask[askIn, askOut](ctx, "ledger", "ledger_whoami", &askIn{Ref: "r1"})
|
|
if err != nil {
|
|
t.Fatalf("Ask: %v", err)
|
|
}
|
|
if out.Org != "acme" {
|
|
t.Fatalf("org = %q, want acme", out.Org)
|
|
}
|
|
|
|
// A caller with no validated principal is refused by the CALLEE, not by
|
|
// anything the caller could skip.
|
|
_, err = zip.Ask[askIn, askOut](context.Background(), "ledger", "ledger_whoami", &askIn{})
|
|
var he *zip.HTTPError
|
|
if !errors.As(err, &he) || he.Status != 403 {
|
|
t.Fatalf("unauthenticated Ask = %v, want a 403 from the callee", err)
|
|
}
|
|
}
|
|
|
|
// The Conn is kept for the life of the process: a plane hop must not pay for a
|
|
// fresh connect, which is what "dial, call, close" per call costs.
|
|
func TestAskReusesOneConnPerPeer(t *testing.T) {
|
|
dir := sockDir(t)
|
|
t.Setenv(zip.RuntimeDirEnv, dir)
|
|
|
|
peer := zip.New(zip.Config{AppName: "reuse", DisableStartupMessage: true})
|
|
zip.Post(peer, "/v1/reuse/ping", func(ctx context.Context, in *askIn) (*askOut, error) {
|
|
return &askOut{Org: "ok"}, nil
|
|
}, zip.WithOperationID("reuse_ping"))
|
|
go func() { _ = peer.Listen(zip.SocketPath("reuse")) }()
|
|
t.Cleanup(func() { _ = peer.Shutdown() })
|
|
waitSock(t, zip.SocketPath("reuse"))
|
|
|
|
ctx := zip.WithCaller(context.Background(), zip.Caller{User: "u", Org: "o"})
|
|
for i := 0; i < 20; i++ {
|
|
if _, err := zip.Ask[askIn, askOut](ctx, "reuse", "reuse_ping", &askIn{}); err != nil {
|
|
t.Fatalf("call %d: %v", i, err)
|
|
}
|
|
}
|
|
// One socket, N calls: nothing to assert about the pool from outside, so the
|
|
// property under test is that 20 sequential calls succeed on one handle
|
|
// without the caller ever holding a Conn.
|
|
}
|