EvoBGP/internal/nodedispatch/legacy_agent_binary_test.go

package nodedispatch_test

import (
	"context"
	"crypto/ed25519"
	"crypto/rand"
	"encoding/base64"
	"fmt"
	"net"
	"net/http"
	"net/http/httptest"
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"sync/atomic"
	"testing"
	"time"

	"evobgp/internal/bundle"
	"evobgp/internal/nodedispatch"
	"evobgp/internal/store"
)

func TestMain(m *testing.M) {
	if os.Getenv("EVOBGP_TEST_LEGACY_BIRD_HELPER") != "1" {
		os.Exit(m.Run())
	}
	args := os.Args[1:]
	log, err := os.OpenFile(os.Getenv("EVOBGP_TEST_BIRD_LOG"), os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0o600)
	if err != nil {
		os.Exit(2)
	}
	_, _ = fmt.Fprintln(log, strings.Join(args, " "))
	_ = log.Close()
	switch {
	case len(args) == 3 && args[0] == "-c" && args[2] == "-p":
		if _, err := os.Stat(args[1]); err == nil {
			os.Exit(0)
		}
	case len(args) == 3 && args[0] == "-s" && args[2] == "configure":
		os.Exit(0)
	case len(args) == 5 && args[0] == "-s" && strings.Join(args[2:], " ") == "show protocols all":
		fmt.Println("peer_test BGP master up 2026-01-01 Established")
		os.Exit(0)
	}
	os.Exit(2)
}

// TestLegacyAgentBinaryCurrentDispatch runs the historical agent as a separate
// process. All network traffic stays on loopback and BIRD executables are fakes.
func TestLegacyAgentBinaryCurrentDispatch(t *testing.T) {
	binary := os.Getenv("EVOBGP_TEST_LEGACY_AGENT_BIN")
	if binary == "" {
		t.Skip("EVOBGP_TEST_LEGACY_AGENT_BIN not set")
	}
	binary, err := filepath.Abs(binary)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(binary); err != nil {
		t.Fatal(err)
	}
	const speakerID = "legacy-speaker"
	const revisionID = "legacy-revision"
	const nodeToken = "local-node-token"
	const agentSecret = "local-agent-secret"
	pub, priv, err := ed25519.GenerateKey(rand.Reader)
	if err != nil {
		t.Fatal(err)
	}
	archive, err := bundle.BuildGzippedTar(revisionID, speakerID, map[string]string{
		"bird.conf": "router id 192.0.2.1;\n",
	}, priv)
	if err != nil {
		t.Fatal(err)
	}
	var bundleGets atomic.Int32
	controlPlane := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		if r.Header.Get("Authorization") != "Bearer "+nodeToken {
			http.Error(w, "unauthorized", http.StatusUnauthorized)
			return
		}
		switch r.URL.Path {
		case "/v1/speakers/" + speakerID + "/bundle/" + revisionID:
			bundleGets.Add(1)
			w.Header().Set("Content-Type", "application/gzip")
			_, _ = w.Write(archive)
		default:
			http.NotFound(w, r)
		}
	}))
	defer controlPlane.Close()

	root := t.TempDir()
	logPath := filepath.Join(root, "bird-invocations")
	helper, err := os.Executable()
	if err != nil {
		t.Fatal(err)
	}
	listener, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatal(err)
	}
	agentAddr := listener.Addr().String()
	_ = listener.Close()
	outputPath := filepath.Join(root, "agent.log")
	output, err := os.Create(outputPath)
	if err != nil {
		t.Fatal(err)
	}
	defer func() { _ = output.Close() }()
	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()
	cmd := exec.CommandContext(ctx, binary, "-listen", agentAddr, "serve")
	cmd.Stdout, cmd.Stderr = output, output
	cmd.Env = append(os.Environ(),
		"EVOBGP_AGENT_SECRET="+agentSecret,
		"EVOBGP_CONTROL_PLANE_URL="+controlPlane.URL,
		"EVOBGP_NODE_TOKEN="+nodeToken,
		"EVOBGP_SPEAKER_ID="+speakerID,
		"EVOBGP_BUNDLE_PUBKEY_BASE64="+base64.StdEncoding.EncodeToString(pub),
		"EVOBGP_BIRD_EXTRACT_DIR="+filepath.Join(root, "extract"),
		"EVOBGP_BIRD_BIN="+helper,
		"EVOBGP_BIRDC_BIN="+helper,
		"EVOBGP_BIRDC_SOCKET="+filepath.Join(root, "fake.ctl"),
		"EVOBGP_TEST_LEGACY_BIRD_HELPER=1",
		"EVOBGP_TEST_BIRD_LOG="+logPath,
		"TMPDIR="+root,
		"TMP="+root,
		"TEMP="+root,
	)
	if err := cmd.Start(); err != nil {
		t.Fatal(err)
	}
	defer func() {
		cancel()
		_ = cmd.Wait()
	}()

	transport := http.DefaultTransport.(*http.Transport).Clone()
	// Under -race each helper process can spend a second flushing race output at
	// exit. Sync executes parse-check and configure before returning its ACK.
	client := &http.Client{Timeout: 10 * time.Second, Transport: legacyAgentTransport{addr: agentAddr, base: transport}}
	defer transport.CloseIdleConnections()
	sp := &store.Speaker{ID: speakerID, Role: "replica", MetaJSON: store.SpeakerMetaJSON(store.SpeakerMeta{
		AgentDomain: "legacy-agent.example.test", AgentSecret: agentSecret,
	})}
	deadline := time.Now().Add(10 * time.Second)
	for {
		health := nodedispatch.FetchAgentHealth(context.Background(), sp, nodedispatch.Options{HTTPClient: client})
		if health.OK {
			if health.LastAppliedRevisionID != "" {
				t.Fatalf("initial health has applied revision: %+v", health)
			}
			break
		}
		if time.Now().After(deadline) {
			log, _ := os.ReadFile(outputPath)
			t.Fatalf("legacy agent did not become healthy: %+v; output: %s", health, log)
		}
		time.Sleep(50 * time.Millisecond)
	}

	// The historical agent must enforce the bearer token before reaching sync.
	badReq, err := http.NewRequest(http.MethodPost, "https://legacy-agent.example.test/v1/agent/sync", strings.NewReader(`{"revision_id":"legacy-revision"}`))
	if err != nil {
		t.Fatal(err)
	}
	badReq.Header.Set("Authorization", "Bearer wrong-secret")
	badResp, err := client.Do(badReq)
	if err != nil {
		t.Fatal(err)
	}
	_ = badResp.Body.Close()
	if badResp.StatusCode != http.StatusUnauthorized || bundleGets.Load() != 0 {
		t.Fatalf("unauthorized sync: status=%d bundle_gets=%d", badResp.StatusCode, bundleGets.Load())
	}

	result := nodedispatch.WakeSpeaker(context.Background(), sp, nodedispatch.Options{
		HTTPClient: client, MaxRetries: 1, RevisionID: revisionID,
	})
	if result.Status != "ok" || result.Confirmation != "agent_reported" || result.AppliedRevisionID != revisionID {
		log, _ := os.ReadFile(outputPath)
		t.Fatalf("current dispatch to legacy agent: %+v; output: %s", result, log)
	}
	if bundleGets.Load() != 1 {
		t.Fatalf("signed bundle gets = %d, want 1", bundleGets.Load())
	}
	health := nodedispatch.FetchAgentHealth(context.Background(), sp, nodedispatch.Options{HTTPClient: client})
	if !health.OK || health.LastAppliedRevisionID != revisionID || health.LastSyncAt == "" {
		t.Fatalf("post-sync legacy health: %+v", health)
	}
	protocols := nodedispatch.FetchBirdProtocols(context.Background(), sp, nodedispatch.Options{HTTPClient: client})
	if protocols.Error != "" || len(protocols.Sessions) != 1 || protocols.Sessions[0].State != "Established" {
		t.Fatalf("legacy bird protocols: %+v", protocols)
	}
	mainConfig, err := os.ReadFile(filepath.Join(root, "extract", "bird.conf"))
	if err != nil || string(mainConfig) != "router id 192.0.2.1;\n" {
		t.Fatalf("extracted signed bundle: content=%q err=%v", mainConfig, err)
	}
	invocations, err := os.ReadFile(logPath)
	if err != nil {
		t.Fatal(err)
	}
	wantParse := fmt.Sprintf("-c %s -p", filepath.Join(root, "extract", "bird.conf"))
	if !strings.Contains(string(invocations), wantParse) || !strings.Contains(string(invocations), "-s "+filepath.Join(root, "fake.ctl")+" configure") {
		t.Fatalf("legacy agent did not parse-check and configure via stand-ins: %s", invocations)
	}
}

type legacyAgentTransport struct {
	addr string
	base http.RoundTripper
}

func (tr legacyAgentTransport) RoundTrip(req *http.Request) (*http.Response, error) {
	copyReq := req.Clone(req.Context())
	copyReq.URL.Scheme = "http"
	copyReq.URL.Host = tr.addr
	copyReq.Host = tr.addr
	return tr.base.RoundTrip(copyReq)
}