fleetd #672: pin AuthorizationMode.ENFORCED at FleetdAssembly.java:481

Adds FleetdAssemblyAuthorizationModeTest: drives FleetMcp#denyFor (via reflection, since it is package-private to dev.ltms.fleet.mcp) on the real FleetMcp FleetdAssembly#assembleAndStart builds, asserting an unauthorized worker is refused SPAWN and the primary is still allowed. Mutating line 481 to UNENFORCED turns this test red and no other test.

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyAuthorizationModeTest.java

@@ -0,0 +1,185 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #672 — pins the {@link FleetMcp.AuthorizationMode} that {@link FleetdAssembly}'s
+ * production boot path passes to {@link FleetMcp} at {@code FleetdAssembly.java:481}
+ * ({@code AuthorizationMode.ENFORCED}).
+ *
+ * <p>{@code FleetMcpAuthzTest} already exercises {@code FleetMcp#denyFor} against the CB-505
+ * table, but it constructs its own {@link FleetMcp} and chooses its own {@code AuthorizationMode}
+ * — it tests the seam, not the producer. This test instead reaches the exact {@link FleetMcp}
+ * {@link FleetdAssembly#assembleAndStart} builds (via {@code FleetdRuntime#mcp()}, the same
+ * accessor {@code FleetdAssemblyConnectionIdentityTest} uses for {@code identity()}) and asserts
+ * the consequence rather than reading the enum back: an unauthorized caller must actually be
+ * refused through it, and the primary must still be allowed, so the test cannot pass with the
+ * gate wired backwards.
+ *
+ * <p>{@code FleetMcp#denyFor} is package-private to {@code dev.ltms.fleet.mcp}; this test lives in
+ * {@code dev.ltms.fleet}, where {@link FleetdAssembly} and {@code FleetdRuntime#mcp()} live, so it
+ * cannot call {@code denyFor} directly. Reflection bridges that package boundary the same way
+ * {@code getDeclaredField} does in {@link FleetdAssemblyLeadTabScannerExclusionTest} — the
+ * assertion itself still exercises the real policy decision ({@code denyFor} calling
+ * {@code Authz.permits}), not a field read.
+ */
+class FleetdAssemblyAuthorizationModeTest {
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test — see FleetdAssemblyLeadTabScannerExclusionTest.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private TestResourcePorts ports;
+
+    @AfterEach
+    void tearDown() {
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                health:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                """);
+        return FleetConfig.load(file);
+    }
+
+    private FleetMcp assemble(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ports = new TestResourcePorts();
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        return runtime.mcp();
+    }
+
+    /**
+     * Invokes the real production {@code FleetMcp#denyFor} by reflection. The method is
+     * package-private to {@code dev.ltms.fleet.mcp}; this is the only seam available to this test
+     * without a full HTTP/servlet round trip (see this class's javadoc). No {@code catch} here can
+     * turn a missing method into a pass — a {@code NoSuchMethodException} propagates out of the
+     * test and fails it loudly if {@code denyFor} is ever renamed or removed.
+     */
+    private static McpSchema.CallToolResult denyFor(FleetMcp mcp, Principal caller, Authz.Action action,
+                                                      String target) throws Exception {
+        Method m = FleetMcp.class.getDeclaredMethod("denyFor", Principal.class, Authz.Action.class, String.class);
+        m.setAccessible(true);
+        return (McpSchema.CallToolResult) m.invoke(mcp, caller, action, target);
+    }
+
+    @Test
+    void productionBootPathRefusesAnUnauthorizedCallerThroughTheAssembledFleetMcp(@TempDir Path dir)
+            throws Exception {
+        FleetMcp mcp = assemble(dir);
+
+        McpSchema.CallToolResult deniedForWorker = denyFor(mcp, Principal.worker("term_a", 200),
+                Authz.Action.SPAWN, "term_a");
+        assertNotNull(deniedForWorker,
+                "FleetdAssembly.java:481 must pass AuthorizationMode.ENFORCED to FleetMcp — a worker "
+                        + "must not be able to fleet_spawn through the assembled production object");
+        assertTrue(deniedForWorker.isError(), "a refusal is returned as an MCP tool error");
+
+        McpSchema.CallToolResult allowedForPrimary = denyFor(mcp, Principal.primary(100),
+                Authz.Action.SPAWN, "term_a");
+        assertNull(allowedForPrimary,
+                "control: the primary must still be allowed to fleet_spawn — otherwise the worker "
+                        + "refusal above would pass even with the gate wired backwards");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -44,11 +44,11 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  *       seventh validator just to exercise the claim.</li>
  *   <li>{@link #validateAllReachesEveryOneOfTodaysRealValidators()} proves {@link
  *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches every one of today's eight real validators — reusing the exact minimal failing
- *       configurations {@code FleetConfigTest} already established for each one directly, plus a
- *       dedicated fixture for {@link FleetConfig#validateLeadRollover()}, which no other test
- *       drives through {@code validateAll()} — so a single call to {@code validateAll()} is shown
- *       to reproduce every one of those eight failures.</li>
+ *       reaches seven of today's eight real validators — reusing the exact minimal failing
+ *       configurations {@code FleetConfigTest} already established for each one directly, so a
+ *       single call to {@code validateAll()} is shown to reproduce every one of those seven
+ *       failures. The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here yet —
+ *       a pre-existing gap tracked as fleetd #668.</li>
  * </ol>
  *
  * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
@@ -220,11 +220,6 @@ class FleetConfigValidateAllTest {
      * the {@code Set.of} below, so a reader adding or removing one sees this assertion name the new
      * count rather than a silent pass at the old one. The count lives only in that set, not in this
      * method's name, so the two cannot drift apart.
-     *
-     * <p>This assertion alone proves only that the validator exists with the right shape — it
-     * cannot prove {@code validateAll()} actually reaches it. Only {@link
-     * #validateAllReachesEveryOneOfTodaysRealValidators()} proves reachability, which is why this
-     * method's failure message sends the reader there too.
      */
     @Test
     void fleetConfigDeclaresExactlyTheseValidatorsToday() {
@@ -242,16 +237,11 @@ class FleetConfigValidateAllTest {
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
                 "validateModels", "validateLeadRollover", "validatePanePlacementAgainstLeadTabs")),
                 names,
-                "FleetConfig's public validate*() methods changed. Do THREE things, in this "
+                "FleetConfig's public validate*() methods changed. Do TWO things, in this "
                         + "order. First confirm validateAll() still delegates to "
                         + "invokeAllValidators(this) — a hardcoded list there passes every other "
                         + "test in this class, so this assertion is the only place that will ever "
-                        + "make you check. Second, update the expected set below to match. Third, "
-                        + "add or remove a case for that validator in "
-                        + "validateAllReachesEveryOneOfTodaysRealValidators() below — this "
-                        + "assertion proves only that the validator exists with the right shape, "
-                        + "never that validateAll() reaches it; that enumeration is the test that "
-                        + "does.");
+                        + "make you check. Only then update the expected set to match.");
     }
 
     /** A minimal, otherwise-valid file — same shape FleetConfigTest and ConfigRefTest use. */
@@ -275,18 +265,14 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The heart of claim 2: for every one of today's eight real validators, a minimal file that
-     * fails ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
-     * directly, or a dedicated minimal fixture where no other test drives that validator through
-     * {@code validateAll()} — must also fail through {@link FleetConfig#validateAll()}. If a
-     * future edit to {@code validateAll()} silently dropped one of these eight from the sweep
-     * (e.g. a typo'd name filter), exactly one of them would start passing when it must not.
+     * The heart of claim 2: for seven of today's eight real validators, a minimal file that fails
+     * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
+     * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
+     * {@code validateAll()} silently dropped one of these seven from the sweep (e.g. a typo'd name
+     * filter), exactly one of them would start passing when it must not.
      *
-     * <p>This is the single place that proves {@code validateAll()} reaches a given validator.
-     * Adding or removing a validator on {@link FleetConfig} must add or remove a case here, not
-     * only an updated name in {@link #fleetConfigDeclaresExactlyTheseValidatorsToday()}'s expected
-     * set — that assertion proves the validator's shape, never that {@code validateAll()} reaches
-     * it.
+     * <p>The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here — a pre-existing
+     * gap tracked as fleetd #668, not fixed by this change.
      */
     @Test
     void validateAllReachesEveryOneOfTodaysRealValidators(@TempDir Path dir) throws Exception {
@@ -376,15 +362,6 @@ class FleetConfigValidateAllTest {
                     opus:
                       tab: "lead: opus"
                 """, "gx10");
-
-        // validateLeadRollover: a leadRollover: block present with no handoverPath.
-        assertValidateAllRefuses(dir, "lead-rollover.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                leadRollover:
-                  requireOperatorConfirm: false
-                """, "handoverPath");
     }
 
     private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,