Authenticate with a seeded operator key; fold escalation and switches into TerdutTeam

Credentials: the TerdutServer controller generates <name>-operator-key in the server's own namespace (owned by it) and hands it to the pods as TERDUT_OPERATOR_KEY; the server creates its instance-scoped account from it at every start. A replaced Secret rolls the pods. The bootstrap handshake, the checkpoint Secret, per-team service accounts and credentials Secrets, BootstrapStateLost and credentials.deletionPolicy are gone. CRDs: TerdutServer, TerdutTeam and TerdutAlertSource. TerdutEscalationRule and TerdutDeadmanSwitch become spec.escalation and spec.deadmanSwitches[] on the team (matched by name, extras removed); team invites are removed. A team is created under the identity <namespace>/<name> (external_id), so a retry, a lost status or a deleted team heal by repeating the same call, and a display name owned by another team is TeamNameTaken instead of an adoption. The server resolves escalation usernames (UnknownUser condition). OIDC claim names and trustEmail are spec fields. Fixes: query values are URL-escaped; every delete treats 404 as success; deleting a team no longer depends on allowedTeams consent; a switch or integration deleted on the server is recreated; unnamed switches take the CR's name. Cleanup: scaffold e2e test, AGENTS.md, devcontainer, unused config/ pieces and Client.Version() removed; DESIGN.md, README, ROADMAP and the demo (run-demo.sh, manifests) rewritten for the new design. Secret RBAC stays cluster-wide, now stated in DESIGN.md section 9. Claude-Session: https://claude.ai/code/session_016mBLURvJoMuUEr9cB2RpUN
2026-10-09 14:56:22 +02:00
parent b0a431f2a4
commit e1103f2b7d
92 changed files with 2082 additions and 7561 deletions
@@ -0,0 +1,375 @@
+package controller
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync"
+
+	"git.ryuvia.com/niklas/terdut-operator/internal/tdclient"
+)
+
+// errJSONKey is the key every error body the fake writes uses, and
+// deadmanSwitchesPath the literal shared by its dead man's switch routes --
+// goconst would otherwise flag the repeats.
+const (
+	errJSONKey          = "error"
+	deadmanSwitchesPath = "/deadman/switches"
+)
+
+// fakeTerdutServer reproduces the parts of terdut-server's API the controllers
+// call, with the same status codes and idempotency rules (POST /api/teams
+// keyed by external_id, unique team names, unique switch names per team), so a
+// controller test exercises the real contract and not a canned reply.
+type fakeTerdutServer struct {
+	mu sync.Mutex
+
+	// expectKey, when set, makes every request without that bearer token a 401.
+	expectKey string
+
+	nextTeamID int64
+	teams      map[string]int64 // name -> id
+	teamNames  map[int64]string // id -> current name
+	teamExt    map[string]int64 // external_id -> id
+	teamOIDC   map[int64][2]string
+	teamDelete map[int64]bool // id -> true once DELETEd
+
+	// unknownUsers are usernames the escalation PUT answers 400 "unknown user" for.
+	unknownUsers map[string]bool
+	escalation   map[int64]tdclient.SetEscalationRequest
+
+	nextSwitchID int64
+	switches     map[int64]map[int64]tdclient.DeadmanSwitch // teamID -> switchID -> switch
+	switchDelete map[int64]bool
+
+	nextIntegrationID int64
+	integrations      map[int64]map[int64]tdclient.Integration
+	integrationDelete map[int64]bool
+}
+
+func newFakeTerdutServer() (*fakeTerdutServer, *httptest.Server) {
+	f := &fakeTerdutServer{
+		teams:             map[string]int64{},
+		teamNames:         map[int64]string{},
+		teamExt:           map[string]int64{},
+		teamOIDC:          map[int64][2]string{},
+		teamDelete:        map[int64]bool{},
+		unknownUsers:      map[string]bool{},
+		escalation:        map[int64]tdclient.SetEscalationRequest{},
+		switches:          map[int64]map[int64]tdclient.DeadmanSwitch{},
+		switchDelete:      map[int64]bool{},
+		integrations:      map[int64]map[int64]tdclient.Integration{},
+		integrationDelete: map[int64]bool{},
+	}
+	return f, httptest.NewServer(f)
+}
+
+func (f *fakeTerdutServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+
+	if f.expectKey != "" && r.Header.Get("Authorization") != "Bearer "+f.expectKey {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{errJSONKey: "invalid or expired API key"})
+		return
+	}
+
+	switch {
+	case r.URL.Path == "/api/version":
+		writeJSON(w, http.StatusOK, map[string]string{"version": "test"})
+
+	case r.URL.Path == "/api/teams" && r.Method == http.MethodPost:
+		var req struct {
+			Name       string `json:"name"`
+			ExternalID string `json:"external_id"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		if id, ok := f.teamExt[req.ExternalID]; ok && req.ExternalID != "" {
+			writeJSON(w, http.StatusOK, tdclient.Team{ID: id, Name: f.teamNames[id]})
+			return
+		}
+		if _, exists := f.teams[req.Name]; exists {
+			writeJSON(w, http.StatusConflict, map[string]string{errJSONKey: "a team with that name already exists"})
+			return
+		}
+		f.nextTeamID++
+		id := f.nextTeamID
+		f.teams[req.Name] = id
+		f.teamNames[id] = req.Name
+		if req.ExternalID != "" {
+			f.teamExt[req.ExternalID] = id
+		}
+		writeJSON(w, http.StatusCreated, tdclient.Team{ID: id, Name: req.Name})
+
+	default:
+		if id, rest, ok := parseTeamSubPath(r.URL.Path); ok {
+			f.handleTeamSubPath(w, r, id, rest)
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}
+}
+
+// handleTeamSubPath answers everything under /api/teams/{id}. rest is whatever
+// parseTeamSubPath found after "/api/teams/{id}" -- "" for the bare resource.
+func (f *fakeTerdutServer) handleTeamSubPath(w http.ResponseWriter, r *http.Request, id int64, rest string) {
+	switch {
+	case rest == "" && r.Method == http.MethodPut:
+		var req struct {
+			Name string `json:"name"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		oldName, exists := f.teamNames[id]
+		if !exists {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		if other, taken := f.teams[req.Name]; taken && other != id {
+			writeJSON(w, http.StatusConflict, map[string]string{errJSONKey: "a team with that name already exists"})
+			return
+		}
+		delete(f.teams, oldName)
+		f.teamNames[id] = req.Name
+		f.teams[req.Name] = id
+		w.WriteHeader(http.StatusNoContent)
+
+	case rest == "" && r.Method == http.MethodDelete:
+		name, exists := f.teamNames[id]
+		if !exists {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		delete(f.teams, name)
+		delete(f.teamNames, id)
+		f.teamDelete[id] = true
+		w.WriteHeader(http.StatusNoContent)
+
+	case rest == "/oidc-groups" && r.Method == http.MethodPut:
+		var req struct {
+			MemberGroup string `json:"member_group"`
+			OwnerGroup  string `json:"owner_group"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		if _, exists := f.teamNames[id]; !exists {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		f.teamOIDC[id] = [2]string{req.MemberGroup, req.OwnerGroup}
+		w.WriteHeader(http.StatusNoContent)
+
+	case rest == "/escalation" && r.Method == http.MethodPut:
+		var req tdclient.SetEscalationRequest
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		for _, l := range req.Levels {
+			for _, t := range l.Targets {
+				if t.Username != "" && f.unknownUsers[t.Username] {
+					writeJSON(w, http.StatusBadRequest, map[string]string{errJSONKey: fmt.Sprintf("unknown user %q", t.Username)})
+					return
+				}
+			}
+		}
+		f.escalation[id] = req
+		w.WriteHeader(http.StatusNoContent)
+
+	case rest == deadmanSwitchesPath || strings.HasPrefix(rest, deadmanSwitchesPath+"/"):
+		f.handleDeadmanSubPath(w, r, id, rest)
+
+	case rest == "/integrations" || strings.HasPrefix(rest, "/integrations/"):
+		f.handleIntegrationSubPath(w, r, id, rest)
+
+	default:
+		w.WriteHeader(http.StatusNotFound)
+	}
+}
+
+// handleDeadmanSubPath answers GET/POST /api/teams/{id}/deadman/switches and
+// PUT/DELETE .../deadman/switches/{switchID} -- split out of
+// handleTeamSubPath for the same gocyclo reason as handleIntegrationSubPath.
+func (f *fakeTerdutServer) handleDeadmanSubPath(w http.ResponseWriter, r *http.Request, id int64, rest string) {
+	switch {
+	case rest == deadmanSwitchesPath && r.Method == http.MethodGet:
+		existing := f.switches[id]
+		out := make([]tdclient.DeadmanSwitch, 0, len(existing))
+		for _, s := range existing {
+			out = append(out, s)
+		}
+		writeJSON(w, http.StatusOK, out)
+
+	case rest == deadmanSwitchesPath && r.Method == http.MethodPost:
+		var req deadmanSwitchFakeRequest
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		name := req.Name
+		for _, s := range f.switches[id] {
+			if s.Name == name {
+				writeJSON(w, http.StatusConflict, map[string]string{errJSONKey: "a switch with that name already exists in this team"})
+				return
+			}
+		}
+		f.nextSwitchID++
+		switchID := f.nextSwitchID
+		sw := tdclient.DeadmanSwitch{
+			ID: switchID, Name: name, Matcher: req.Matcher,
+			TimeoutSeconds: req.TimeoutSeconds, Severity: req.Severity,
+		}
+		if f.switches[id] == nil {
+			f.switches[id] = map[int64]tdclient.DeadmanSwitch{}
+		}
+		f.switches[id][switchID] = sw
+		writeJSON(w, http.StatusCreated, sw)
+
+	case strings.HasPrefix(rest, "/deadman/switches/") && r.Method == http.MethodPut:
+		switchID, ok := parseTrailingID(rest, "/deadman/switches/")
+		if !ok {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		if _, exists := f.switches[id][switchID]; !exists {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		var req deadmanSwitchFakeRequest
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		name := req.Name
+		if name == "" {
+			name = f.switches[id][switchID].Name
+		}
+		f.switches[id][switchID] = tdclient.DeadmanSwitch{
+			ID: switchID, Name: name, Matcher: req.Matcher,
+			TimeoutSeconds: req.TimeoutSeconds, Severity: req.Severity,
+		}
+		w.WriteHeader(http.StatusNoContent)
+
+	case strings.HasPrefix(rest, "/deadman/switches/") && r.Method == http.MethodDelete:
+		switchID, ok := parseTrailingID(rest, "/deadman/switches/")
+		if !ok {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		if _, exists := f.switches[id][switchID]; !exists {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		delete(f.switches[id], switchID)
+		f.switchDelete[switchID] = true
+		w.WriteHeader(http.StatusNoContent)
+
+	default:
+		w.WriteHeader(http.StatusNotFound)
+	}
+}
+
+// handleIntegrationSubPath answers POST /api/teams/{id}/integrations,
+// PATCH .../integrations/{integrationID} and DELETE .../integrations/{integrationID}
+// -- split out of handleTeamSubPath so that switch's own cyclomatic
+// complexity stays under golangci-lint's gocyclo threshold.
+func (f *fakeTerdutServer) handleIntegrationSubPath(w http.ResponseWriter, r *http.Request, id int64, rest string) {
+	switch {
+	case rest == "/integrations" && r.Method == http.MethodPost:
+		var req struct {
+			Name string `json:"name"`
+			Kind string `json:"kind"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		f.nextIntegrationID++
+		integID := f.nextIntegrationID
+		integ := tdclient.Integration{
+			ID: integID, TeamID: id, Kind: req.Kind, Name: req.Name,
+			// Key/URL are only ever in *this* response -- never again,
+			// matching terdut-server's own one-time-show semantics
+			// (DESIGN.md §4.5) -- so what's stored for later GET/PATCH
+			// calls in this fake deliberately omits them too.
+			Key: fmt.Sprintf("webhook-key-%d", integID),
+			URL: fmt.Sprintf("https://terdut.example.invalid/api/integrations/webhook-key-%d/%s", integID, req.Kind),
+		}
+		if f.integrations[id] == nil {
+			f.integrations[id] = map[int64]tdclient.Integration{}
+		}
+		f.integrations[id][integID] = tdclient.Integration{ID: integID, TeamID: id, Kind: req.Kind, Name: req.Name}
+		writeJSON(w, http.StatusCreated, integ)
+
+	case strings.HasPrefix(rest, "/integrations/") && r.Method == http.MethodPatch:
+		integID, ok := parseTrailingID(rest, "/integrations/")
+		if !ok {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		existing, exists := f.integrations[id][integID]
+		if !exists {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		var req struct {
+			Name string `json:"name"`
+		}
+		_ = json.NewDecoder(r.Body).Decode(&req)
+		existing.Name = req.Name
+		f.integrations[id][integID] = existing
+		w.WriteHeader(http.StatusNoContent)
+
+	case strings.HasPrefix(rest, "/integrations/") && r.Method == http.MethodDelete:
+		integID, ok := parseTrailingID(rest, "/integrations/")
+		if !ok {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		if _, exists := f.integrations[id][integID]; !exists {
+			w.WriteHeader(http.StatusNotFound)
+			return
+		}
+		delete(f.integrations[id], integID)
+		f.integrationDelete[integID] = true
+		w.WriteHeader(http.StatusNoContent)
+
+	default:
+		w.WriteHeader(http.StatusNotFound)
+	}
+}
+
+// deadmanSwitchFakeRequest mirrors tdclient's own (unexported)
+// deadmanSwitchRequest -- the fake needs its own copy to decode the same
+// wire shape without reaching across package boundaries for an internal type.
+type deadmanSwitchFakeRequest struct {
+	Name           string `json:"name,omitempty"`
+	Matcher        string `json:"matcher"`
+	TimeoutSeconds int64  `json:"timeout_seconds"`
+	Severity       string `json:"severity"`
+}
+
+// parseTeamSubPath splits "/api/teams/{id}" from anything after it --
+// "" for an exact match, "/oidc-groups", "/escalation", "/deadman/switches"
+// or "/deadman/switches/{switchID}" otherwise. Doesn't itself validate the
+// suffix; handleTeamSubPath's own switch does that.
+func parseTeamSubPath(path string) (id int64, rest string, ok bool) {
+	const prefix = "/api/teams/"
+	if !strings.HasPrefix(path, prefix) {
+		return 0, "", false
+	}
+	trimmed := path[len(prefix):]
+	parts := strings.SplitN(trimmed, "/", 2)
+	parsedID, err := strconv.ParseInt(parts[0], 10, 64)
+	if err != nil {
+		return 0, "", false
+	}
+	if len(parts) == 1 {
+		return parsedID, "", true
+	}
+	return parsedID, "/" + parts[1], true
+}
+
+// parseTrailingID parses the numeric id after prefix within rest, e.g.
+// parseTrailingID("/deadman/switches/7", "/deadman/switches/") -> 7, true.
+func parseTrailingID(rest, prefix string) (id int64, ok bool) {
+	parsedID, err := strconv.ParseInt(strings.TrimPrefix(rest, prefix), 10, 64)
+	if err != nil {
+		return 0, false
+	}
+	return parsedID, true
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(v)
+}