michel/clusterflux-public
1
0
Fork 0
Code Issues Pull requests Projects Releases 21 Packages Wiki Activity Actions

Public release source-69fccd306838

Browse source 
Source commit: 69fccd306838141ba9b1730f4ac4afb1a617bb4e

Public tree identity: sha256:8c03637496d3f7ee1b625aa1c823cd69bfcf0247a061d8cb571e05d537329691
This commit is contained in:
Clusterflux release 2026-07-25 17:53:21 +02:00
parent f4590ca576
commit ba749b9e47
88 changed files with 204 additions and 18991 deletions
Download patch file Download diff file Expand all files Collapse all files

24
crates/clusterflux-cli/src/admin.rs
View file

@ -48,7 +48,7 @@ pub(crate) fn admin_status_report(args: AdminStatusArgs) -> Result<Value> {
.unwrap_or(json!(false)),
"response": response,
"safe_default": "read_only",
"private_website_required": false,
"external_website_required": false,
"coordinator_session_requests": session.requests(),
}));
}
@ -56,7 +56,7 @@ pub(crate) fn admin_status_report(args: AdminStatusArgs) -> Result<Value> {
"command": "admin status",
"mode": "self_hosted_local",
"safe_default": "read_only",
"private_website_required": false,
"external_website_required": false,
}))
}
@ -86,7 +86,7 @@ pub(crate) fn admin_bootstrap_report(args: AdminBootstrapArgs, cwd: PathBuf) ->
"project": project.clone(),
"user": user,
"coordinator": scope.coordinator,
"private_website_required": false,
"external_website_required": false,
"self_hosted_cli_only": true,
"project_config_written": project_init
.get("project_config_written")
@ -107,13 +107,13 @@ pub(crate) fn admin_bootstrap_report(args: AdminBootstrapArgs, cwd: PathBuf) ->
{
"step": "start_self_hosted_coordinator",
"command": "clusterflux-coordinator --listen 127.0.0.1:0",
"private_website_required": false,
"external_website_required": false,
},
{
"step": "create_or_link_project",
"command": "clusterflux project init --yes",
"completed": true,
"private_website_required": false,
"external_website_required": false,
},
{
"step": "create_node_enrollment_grant",
@ -121,7 +121,7 @@ pub(crate) fn admin_bootstrap_report(args: AdminBootstrapArgs, cwd: PathBuf) ->
"clusterflux node enroll --coordinator {coordinator} --tenant {} --project-id {}",
tenant, project
),
"private_website_required": false,
"external_website_required": false,
},
{
"step": "attach_worker_node",
@ -129,7 +129,7 @@ pub(crate) fn admin_bootstrap_report(args: AdminBootstrapArgs, cwd: PathBuf) ->
"clusterflux node attach --coordinator {coordinator} --tenant {} --project-id {} --worker",
tenant, project
),
"private_website_required": false,
"external_website_required": false,
},
{
"step": "run_process",
@ -137,7 +137,7 @@ pub(crate) fn admin_bootstrap_report(args: AdminBootstrapArgs, cwd: PathBuf) ->
"clusterflux run --coordinator {coordinator} --tenant {} --project-id {}",
tenant, project
),
"private_website_required": false,
"external_website_required": false,
},
{
"step": "inspect_status_logs_artifacts",
@ -148,12 +148,12 @@ pub(crate) fn admin_bootstrap_report(args: AdminBootstrapArgs, cwd: PathBuf) ->
"clusterflux artifact list",
"clusterflux quota status",
],
"private_website_required": false,
"external_website_required": false,
},
{
"step": "revoke_access",
"command": "clusterflux admin revoke-node --node <node-id> --yes",
"private_website_required": false,
"external_website_required": false,
}
],
}))
@ -209,7 +209,7 @@ pub(crate) fn admin_suspend_tenant_report(args: AdminSuspendTenantArgs) -> Resul
"actor_tenant": actor_tenant,
"actor_user": actor_user,
"suspended": response.get("type").and_then(Value::as_str) == Some("tenant_suspended"),
"private_website_required": false,
"external_website_required": false,
"response": response,
"coordinator_session_requests": session.requests(),
}));
@ -219,7 +219,7 @@ pub(crate) fn admin_suspend_tenant_report(args: AdminSuspendTenantArgs) -> Resul
"status": "requires_coordinator",
"requires_confirmation": !args.yes,
"tenant": tenant,
"private_website_required": false,
"external_website_required": false,
}))
}

12
crates/clusterflux-cli/src/auth.rs
View file

@ -227,7 +227,7 @@ pub(crate) fn auth_status_report(args: AuthStatusArgs, cwd: PathBuf) -> Result<V
"suspension_known": false,
"account_state_known": false,
"account_status": "unknown",
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
})
});
@ -263,7 +263,7 @@ fn coordinator_auth_status_summary(
"account_status": "unknown",
"suspension_known": false,
"account_state_known": false,
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
"machine_error": cli_error_summary(&message),
"error": message,
@ -296,7 +296,7 @@ fn coordinator_auth_status_summary(
"account_status": "unknown",
"suspension_known": false,
"account_state_known": false,
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
"machine_error": cli_error_summary(&message),
"error": message,
@ -316,7 +316,7 @@ fn coordinator_auth_status_summary(
"account_status": "unknown",
"suspension_known": false,
"account_state_known": false,
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
"machine_error": cli_error_summary(&message),
"error": message,
@ -338,7 +338,7 @@ fn coordinator_auth_status_summary(
"account_status": "unknown",
"suspension_known": false,
"account_state_known": false,
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
"machine_error": cli_error_summary(message),
"coordinator_response_type": "error",
@ -403,7 +403,7 @@ fn coordinator_auth_status_summary(
"manual_review": manual_review,
"sanitized_reason": sanitized_reason,
"next_actions": next_actions,
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
"coordinator_response_type": response.get("type").and_then(Value::as_str).unwrap_or("auth_status"),
"coordinator_session_requests": coordinator_session_requests,

2
crates/clusterflux-cli/src/auth_scope.rs
View file

@ -60,7 +60,7 @@ pub(crate) fn session_scope_mismatch_status(fields: &[&str]) -> Value {
"account_status": "unknown",
"suspension_known": false,
"account_state_known": false,
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
"next_actions": ["clusterflux login --browser"],
})

3
crates/clusterflux-cli/src/config.rs
View file

@ -5,8 +5,7 @@ use serde::{Deserialize, Serialize};
use crate::CliScopeArgs;
pub(crate) const DEFAULT_HOSTED_COORDINATOR_ENDPOINT: &str =
"https://clusterflux.michelpaulissen.com";
pub(crate) const DEFAULT_HOSTED_COORDINATOR_ENDPOINT: &str = "https://clusterflux.lesstuff.com";
#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
pub(crate) struct ProjectConfig {

6
crates/clusterflux-cli/src/debug.rs
View file

@ -15,7 +15,7 @@ pub(crate) fn dap_plan(args: DapArgs) -> Result<Value> {
"command": "dap",
"adapter": dap_binary_path()?.display().to_string(),
"args": args.args,
"private_website_required": false,
"external_website_required": false,
}))
}
@ -102,7 +102,7 @@ pub(crate) fn debug_attach_report_with_dap_and_session(
.cloned()
.unwrap_or_else(|| json!(0)),
"debug_reads_quota_limited": true,
"private_website_required": false,
"external_website_required": false,
"coordinator_session_requests": session.requests(),
}));
}
@ -115,6 +115,6 @@ pub(crate) fn debug_attach_report_with_dap_and_session(
"dap": dap,
"authorized": "unknown_without_coordinator",
"debug_reads_quota_limited": "unknown_without_coordinator",
"private_website_required": false,
"external_website_required": false,
}))
}

5
crates/clusterflux-cli/src/errors.rs
View file

@ -38,7 +38,10 @@ pub(crate) fn cli_error_summary_for_category(category: &'static str, message: &s
);
object.insert("community_tier_language".to_owned(), json!(true));
object.insert("community_tier_label".to_owned(), json!("community tier"));
object.insert("private_abuse_heuristics_exposed".to_owned(), json!(false));
object.insert(
"sensitive_abuse_heuristics_exposed".to_owned(),
json!(false),
);
}
}
summary

4
crates/clusterflux-cli/src/node.rs
View file

@ -152,7 +152,7 @@ pub(crate) fn node_enroll_report(args: NodeEnrollArgs, cwd: PathBuf) -> Result<V
"tenant": tenant,
"project": project,
"user": user,
"private_website_required": false,
"external_website_required": false,
"enrollment_grant": enrollment_grant,
"response": response,
"coordinator_session_requests": session.requests(),
@ -161,7 +161,7 @@ pub(crate) fn node_enroll_report(args: NodeEnrollArgs, cwd: PathBuf) -> Result<V
Ok(json!({
"command": "node enroll",
"status": "requires_coordinator",
"private_website_required": false,
"external_website_required": false,
"requested_ttl_seconds": args.ttl_seconds,
"enrollment_grant": null,
"reason": "enrollment grants are generated by the coordinator and cannot be planned client-side",

8
crates/clusterflux-cli/src/output.rs
View file

@ -217,10 +217,10 @@ pub(crate) fn human_report(value: &Value) -> String {
}
push_nested_string_field(&mut lines, account, "sanitized_reason", "account reason");
if let Some(exposed) = account
.get("private_moderation_details_exposed")
.get("sensitive_moderation_details_exposed")
.and_then(Value::as_bool)
{
lines.push(format!("private moderation details exposed: {exposed}"));
lines.push(format!("sensitive moderation details exposed: {exposed}"));
}
}
if let Some(coordinator_selection) = value.get("coordinator") {
@ -277,10 +277,10 @@ pub(crate) fn human_report(value: &Value) -> String {
));
}
if let Some(flag) = value
.get("private_website_required")
.get("external_website_required")
.and_then(Value::as_bool)
{
lines.push(format!("private website required: {flag}"));
lines.push(format!("external website required: {flag}"));
}
if let Some(next_actions) = value.get("next_actions").and_then(Value::as_array) {
let actions = next_actions

4
crates/clusterflux-cli/src/process_events.rs
View file

@ -557,7 +557,7 @@ pub(crate) fn artifact_download_grant_disclosures(response: &Value) -> Value {
"cross_tenant_reuse_allowed": false,
"unauthorized_project_reuse_allowed": false,
"default_durable_store_assumed": false,
"private_website_required": false,
"external_website_required": false,
}])
}
@ -613,7 +613,7 @@ pub(crate) fn project_quota_posture(attached_nodes: &Value, task_events: Option<
"current_usage": current_usage,
"limits": quota_limits_value(),
"next_blocked_action": next_blocked_action,
"private_abuse_heuristics_exposed": false,
"sensitive_abuse_heuristics_exposed": false,
})
}

12
crates/clusterflux-cli/src/project.rs
View file

@ -92,7 +92,7 @@ pub(crate) fn project_init_report(args: ProjectInitArgs, cwd: PathBuf) -> Result
Ok(json!({
"command": "project init",
"source": if coordinator.is_some() { "public_coordinator_api" } else { "local_project_config" },
"private_website_required": false,
"external_website_required": false,
"project_config_written": true,
"project_config_write_after_coordinator_acceptance": coordinator.is_some(),
"coordinator_create_before_local_write": coordinator.is_some(),
@ -104,7 +104,7 @@ pub(crate) fn project_init_report(args: ProjectInitArgs, cwd: PathBuf) -> Result
"config_format": "clusterflux_project_config_v1",
"links_current_directory": true,
"writes_current_directory_only": true,
"private_website_required": false,
"external_website_required": false,
},
"safe_defaults": {
"tenant": config.tenant.clone(),
@ -115,7 +115,7 @@ pub(crate) fn project_init_report(args: ProjectInitArgs, cwd: PathBuf) -> Result
"default_project_id_used": args.new_project == "project",
"default_project_name_used": args.name == "Clusterflux Project",
"browser_interaction_required": false,
"private_website_required": false,
"external_website_required": false,
},
"project_config": config,
"config_file": project_config_file(&cwd),
@ -283,7 +283,7 @@ pub(crate) fn project_list_report(args: ProjectListArgs, cwd: PathBuf) -> Result
"user": user,
"projects": projects,
"project_count": project_count,
"private_website_required": false,
"external_website_required": false,
"response": response,
"coordinator_session_requests": session.requests(),
}));
@ -295,7 +295,7 @@ pub(crate) fn project_list_report(args: ProjectListArgs, cwd: PathBuf) -> Result
"source": "local_project_config",
"projects": projects,
"project_count": project_count,
"private_website_required": false,
"external_website_required": false,
}))
}
@ -361,7 +361,7 @@ pub(crate) fn project_select_report(args: ProjectSelectArgs, cwd: PathBuf) -> Re
"source": if coordinator.is_some() { "public_coordinator_api" } else { "local_project_config" },
"selected_project": selected_project,
"project_config_written": true,
"private_website_required": false,
"external_website_required": false,
"project_config": config,
"coordinator_response": coordinator_response,
}))

4
crates/clusterflux-cli/src/quota.rs
View file

@ -96,7 +96,7 @@ pub(crate) fn quota_status_report(args: QuotaStatusArgs, cwd: PathBuf) -> Result
"user": effective_scope.user,
"coordinator": coordinator,
"project_config": config,
"policy_surface": "generic public quota categories; hosted tuning remains private policy",
"policy_surface": "generic public quota categories; hosted tuning is coordinator-defined",
"limits": limits,
"window_seconds": window_seconds,
"current_usage": current_usage,
@ -105,7 +105,7 @@ pub(crate) fn quota_status_report(args: QuotaStatusArgs, cwd: PathBuf) -> Result
"next_blocked_action": quota_next_blocked_action(&current_usage),
"quota_configuration_source": if quota_status.is_some() { "coordinator" } else { "unavailable_offline" },
"quota_tier": quota_tier,
"private_abuse_heuristics_exposed": false,
"sensitive_abuse_heuristics_exposed": false,
"quota_response": quota_status,
}))
}

4
crates/clusterflux-cli/src/run.rs
View file

@ -142,7 +142,7 @@ fn non_interactive_run_requires_auth_report(args: RunArgs, cwd: PathBuf) -> Valu
"safe_failure": true,
"message": message,
"next_actions": next_actions,
"private_website_required": false,
"external_website_required": false,
"machine_error": machine_error,
})
}
@ -329,7 +329,7 @@ fn coordinator_run_report(plan: RunPlan) -> Result<Value> {
"task_launch": launch_task_response,
"coordinator_response": response,
"coordinator_session_requests": session.requests(),
"private_website_required": false,
"external_website_required": false,
}))
}

75
crates/clusterflux-cli/src/tests.rs
View file

@ -124,7 +124,7 @@ fn cli_error_classifier_distinguishes_mvp_failure_categories() {
assert_eq!(summary["resource_category"], "api_calls");
assert_eq!(summary["community_tier_language"], true);
assert_eq!(summary["community_tier_label"], "community tier");
assert_eq!(summary["private_abuse_heuristics_exposed"], false);
assert_eq!(summary["sensitive_abuse_heuristics_exposed"], false);
let rendered = human_report(&json!({
"command": "run",
"machine_error": summary,
@ -207,7 +207,7 @@ fn non_interactive_run_without_session_requires_explicit_auth_or_local() {
assert_eq!(report["status"], "authentication_required");
assert_eq!(report["non_interactive"], true);
assert_eq!(report["browser_opened"], false);
assert_eq!(report["private_website_required"], false);
assert_eq!(report["external_website_required"], false);
assert_eq!(report["machine_error"]["category"], "authentication");
assert_eq!(report["machine_error"]["stable_exit_code"], 20);
assert_eq!(report["machine_error"]["browser_opened"], false);
@ -827,7 +827,7 @@ fn run_rejection_reports_machine_readable_error_category() {
assert_eq!(rejected["machine_error"]["resource_category"], "api_calls");
assert_eq!(rejected["machine_error"]["community_tier_language"], true);
assert_eq!(
rejected["machine_error"]["private_abuse_heuristics_exposed"],
rejected["machine_error"]["sensitive_abuse_heuristics_exposed"],
false
);
assert!(rejected["machine_error"]["next_actions"]
@ -1665,12 +1665,11 @@ fn node_attach_refuses_a_symlink_credential_target() {
fn hosted_coordinator_remains_a_real_https_control_endpoint() {
assert_eq!(
control_endpoint_identity(DEFAULT_HOSTED_COORDINATOR_ENDPOINT).unwrap(),
"https://clusterflux.michelpaulissen.com/api/v1/control"
"https://clusterflux.lesstuff.com/api/v1/control"
);
assert_eq!(
control_endpoint_identity("https://clusterflux.michelpaulissen.com/api/v1/control")
.unwrap(),
"https://clusterflux.michelpaulissen.com/api/v1/control"
control_endpoint_identity("https://clusterflux.lesstuff.com/api/v1/control").unwrap(),
"https://clusterflux.lesstuff.com/api/v1/control"
);
assert!(control_endpoint_identity("http://operator.example.test").is_err());
assert_eq!(
@ -1788,7 +1787,7 @@ fn auth_status_reads_stored_cli_session_without_provider_tokens() {
assert!(!line.contains(r#""actor_user":"user-session""#));
stream
.write_all(
br#"{"type":"auth_status","tenant":"tenant-session","project":"project-session","actor":"user-session","authenticated":true,"account_status":"active","suspended":false,"disabled":false,"sanitized_reason":null,"next_actions":[],"private_moderation_details_exposed":false,"signup_failure_details_exposed":false}"#,
br#"{"type":"auth_status","tenant":"tenant-session","project":"project-session","actor":"user-session","authenticated":true,"account_status":"active","suspended":false,"disabled":false,"sanitized_reason":null,"next_actions":[],"sensitive_moderation_details_exposed":false,"signup_failure_details_exposed":false}"#,
)
.unwrap();
stream.write_all(b"\n").unwrap();
@ -1851,7 +1850,7 @@ fn auth_status_reads_stored_cli_session_without_provider_tokens() {
"active"
);
assert_eq!(
report["coordinator_account_status"]["private_moderation_details_exposed"],
report["coordinator_account_status"]["sensitive_moderation_details_exposed"],
false
);
}
@ -1933,7 +1932,7 @@ fn auth_status_reports_expired_or_revoked_cli_session_as_login_required() {
}
#[test]
fn auth_status_queries_coordinator_account_state_without_private_moderation_details() {
fn auth_status_queries_coordinator_account_state_without_sensitive_moderation_details() {
let listener = TcpListener::bind("127.0.0.1:0").unwrap();
let addr = listener.local_addr().unwrap().to_string();
let server = std::thread::spawn(move || {
@ -1947,7 +1946,7 @@ fn auth_status_queries_coordinator_account_state_without_private_moderation_deta
assert!(line.contains(r#""actor_user":"user-live""#));
stream
.write_all(
br#"{"type":"auth_status","tenant":"tenant-live","project":"project-live","actor":"user-live","authenticated":true,"account_status":"suspended","suspended":true,"disabled":false,"sanitized_reason":"account or tenant is suspended by hosted policy","next_actions":["contact the hosted operator"],"private_moderation_details_exposed":false,"signup_failure_details_exposed":false,"abuse_score":99,"moderation_notes":"private moderation note"}"#,
br#"{"type":"auth_status","tenant":"tenant-live","project":"project-live","actor":"user-live","authenticated":true,"account_status":"suspended","suspended":true,"disabled":false,"sanitized_reason":"account or tenant is suspended by hosted policy","next_actions":["contact the hosted operator"],"sensitive_moderation_details_exposed":false,"signup_failure_details_exposed":false,"abuse_score":99,"moderation_notes":"sensitive moderation note"}"#,
)
.unwrap();
stream.write_all(b"\n").unwrap();
@ -1987,7 +1986,7 @@ fn auth_status_queries_coordinator_account_state_without_private_moderation_deta
"account or tenant is suspended by hosted policy"
);
assert_eq!(
report["coordinator_account_status"]["private_moderation_details_exposed"],
report["coordinator_account_status"]["sensitive_moderation_details_exposed"],
false
);
assert_eq!(
@ -2005,13 +2004,13 @@ fn auth_status_queries_coordinator_account_state_without_private_moderation_deta
let serialized = serde_json::to_string(&report).unwrap();
assert!(!serialized.contains("abuse_score"));
assert!(!serialized.contains("moderation_notes"));
assert!(!serialized.contains("private moderation note"));
assert!(!serialized.contains("sensitive moderation note"));
let rendered = human_report(&report);
assert!(rendered.contains("account status: suspended"));
assert!(rendered.contains("account suspended: true"));
assert!(rendered.contains("private moderation details exposed: false"));
assert!(!rendered.contains("private moderation note"));
assert!(rendered.contains("sensitive moderation details exposed: false"));
assert!(!rendered.contains("sensitive moderation note"));
}
#[test]
@ -2062,11 +2061,11 @@ fn auth_status_reports_disabled_deleted_and_manual_review_safely() {
"manual_review": manual_review,
"sanitized_reason": reason,
"next_actions": ["contact the hosted operator"],
"private_moderation_details_exposed": false,
"sensitive_moderation_details_exposed": false,
"signup_failure_details_exposed": false,
"abuse_score": 99,
"moderation_notes": "private moderation note",
"signup_policy_trace": "private signup trace",
"moderation_notes": "sensitive moderation note",
"signup_policy_trace": "sensitive signup trace",
})
)
.unwrap();
@ -2105,7 +2104,7 @@ fn auth_status_reports_disabled_deleted_and_manual_review_safely() {
true
);
assert_eq!(
report["coordinator_account_status"]["private_moderation_details_exposed"],
report["coordinator_account_status"]["sensitive_moderation_details_exposed"],
false
);
assert_eq!(
@ -2116,11 +2115,11 @@ fn auth_status_reports_disabled_deleted_and_manual_review_safely() {
assert!(!serialized.contains("abuse_score"));
assert!(!serialized.contains("moderation_notes"));
assert!(!serialized.contains("signup_policy_trace"));
assert!(!serialized.contains("private moderation note"));
assert!(!serialized.contains("sensitive moderation note"));
let rendered = human_report(&report);
assert!(rendered.contains(&format!("account status: {status}")));
assert!(rendered.contains(rendered_marker));
assert!(!rendered.contains("private moderation note"));
assert!(!rendered.contains("sensitive moderation note"));
}
server.join().unwrap();
}
@ -2235,11 +2234,11 @@ fn admin_bootstrap_reports_self_hosted_cli_only_path() {
assert_eq!(report["command"], "admin bootstrap");
assert_eq!(report["mode"], "self_hosted_local");
assert_eq!(report["private_website_required"], false);
assert_eq!(report["external_website_required"], false);
assert_eq!(report["self_hosted_cli_only"], true);
assert_eq!(report["project_config_written"], true);
assert_eq!(report["project_init"]["command"], "project init");
assert_eq!(report["project_init"]["private_website_required"], false);
assert_eq!(report["project_init"]["external_website_required"], false);
assert_eq!(
report["project_init"]["project_config"]["project"],
"self-hosted"
@ -2265,7 +2264,7 @@ fn admin_bootstrap_reports_self_hosted_cli_only_path() {
}
assert!(steps.iter().all(|step| {
!step
.get("private_website_required")
.get("external_website_required")
.and_then(Value::as_bool)
.unwrap_or(false)
}));
@ -2893,13 +2892,13 @@ fn admin_status_and_suspend_use_public_coordinator_api() {
assert_eq!(status["command"], "admin status");
assert_eq!(status["safe_default"], "read_only");
assert_eq!(status["private_website_required"], false);
assert_eq!(status["external_website_required"], false);
assert_eq!(status["suspended"], false);
assert_eq!(suspended["command"], "admin suspend-tenant");
assert_eq!(suspended["tenant"], "tenant");
assert_eq!(suspended["actor_tenant"], "admin-tenant");
assert_eq!(suspended["suspended"], true);
assert_eq!(suspended["private_website_required"], false);
assert_eq!(suspended["external_website_required"], false);
}
#[test]
@ -2968,7 +2967,7 @@ fn debug_attach_reports_public_authorization() {
assert_eq!(report["charged_debug_read_bytes"], 1024);
assert_eq!(report["used_debug_read_bytes"], 1024);
assert_eq!(report["debug_reads_quota_limited"], true);
assert_eq!(report["private_website_required"], false);
assert_eq!(report["external_website_required"], false);
}
#[test]
@ -3311,7 +3310,7 @@ fn project_init_uses_public_create_before_writing_local_config() {
created["safe_defaults"]["browser_interaction_required"],
false
);
assert_eq!(created["private_website_required"], false);
assert_eq!(created["external_website_required"], false);
assert_eq!(
read_project_config(temp_success.path())
.unwrap()
@ -3411,7 +3410,7 @@ fn project_list_and_select_use_public_api_without_website() {
assert_eq!(list["source"], "public_coordinator_api");
assert_eq!(list["project_count"], 1);
assert_eq!(list["projects"][0]["id"], "project-a");
assert_eq!(list["private_website_required"], false);
assert_eq!(list["external_website_required"], false);
assert_eq!(list["coordinator_session_requests"], 1);
let selected = project_select_report(
@ -3426,7 +3425,7 @@ fn project_list_and_select_use_public_api_without_website() {
assert_eq!(selected["source"], "public_coordinator_api");
assert_eq!(selected["selected_project"]["id"], "project-a");
assert_eq!(selected["project_config_written"], true);
assert_eq!(selected["private_website_required"], false);
assert_eq!(selected["external_website_required"], false);
assert_eq!(
read_project_config(temp.path()).unwrap().unwrap().project,
"project-a"
@ -4455,7 +4454,7 @@ fn build_command_reuses_bundle_inspection_without_full_repo_upload() {
let temp = tempfile::tempdir().unwrap();
let project = PathBuf::from(env!("CARGO_MANIFEST_DIR"))
.join("../..")
.join("tests/fixtures/runtime-conformance");
.join("examples/hello-build");
let output = temp.path().join("bundle");
let report = build_report(
@ -4473,8 +4472,8 @@ fn build_command_reuses_bundle_inspection_without_full_repo_upload() {
assert_eq!(report["command"], "build");
assert_eq!(report["content_addressed"], true);
assert_eq!(report["contains_full_repository_upload"], false);
assert_eq!(report["bundle_artifact"]["task_descriptor_count"], 12);
assert_eq!(report["bundle_artifact"]["entrypoint_count"], 6);
assert_eq!(report["bundle_artifact"]["task_descriptor_count"], 2);
assert_eq!(report["bundle_artifact"]["entrypoint_count"], 1);
assert!(output.join("module.wasm").is_file());
assert!(output.join("manifest.json").is_file());
assert!(output.join("task-descriptors.json").is_file());
@ -4485,9 +4484,9 @@ fn build_command_reuses_bundle_inspection_without_full_repo_upload() {
.unwrap()
.iter()
.any(|descriptor| {
descriptor["name"] == "task_add_one"
&& descriptor["argument_schema"] == "input : i32"
&& descriptor["result_schema"] == "i32"
descriptor["name"] == "compile"
&& descriptor["argument_schema"] == "source : SourceSnapshot"
&& descriptor["result_schema"] == "Result < Artifact >"
&& descriptor["restart_compatibility_hash"]
.as_str()
.unwrap()
@ -4648,7 +4647,7 @@ fn node_enroll_reports_short_lived_public_api_grant() {
assert_eq!(report["command"], "node enroll");
assert_eq!(report["status"], "created");
assert_eq!(report["private_website_required"], false);
assert_eq!(report["external_website_required"], false);
assert_eq!(report["tenant"], "tenant");
assert_eq!(report["project"], "project");
assert_eq!(report["user"], "user");
@ -4791,7 +4790,7 @@ fn node_enroll_and_process_commands_have_safe_plan_without_coordinator() {
)
.unwrap();
assert_eq!(enroll["status"], "requires_coordinator");
assert_eq!(enroll["private_website_required"], false);
assert_eq!(enroll["external_website_required"], false);
assert_eq!(enroll["enrollment_grant"], serde_json::Value::Null);
assert_eq!(enroll["requested_ttl_seconds"], 60);

2
crates/clusterflux-coordinator/src/lib.rs
View file

@ -1046,7 +1046,7 @@ mod tests {
}
#[test]
fn account_policy_state_summarizes_private_admin_records_safely() {
fn account_policy_state_summarizes_sensitive_admin_records_safely() {
let tenant = TenantId::from("tenant");
let mut coordinator = Coordinator::boot(&InMemoryDurableStore::default(), 1);

2
crates/clusterflux-coordinator/src/service/protocol/responses.rs
View file

@ -213,7 +213,7 @@ pub enum CoordinatorResponse {
manual_review: bool,
sanitized_reason: Option<String>,
next_actions: Vec<String>,
private_moderation_details_exposed: bool,
sensitive_moderation_details_exposed: bool,
signup_failure_details_exposed: bool,
},
AdminStatus {

4
crates/clusterflux-coordinator/src/service/routing.rs
View file

@ -45,7 +45,7 @@ impl CoordinatorService {
manual_review: account_state.manual_review,
sanitized_reason: account_state.sanitized_reason,
next_actions: account_state.next_actions,
private_moderation_details_exposed: false,
sensitive_moderation_details_exposed: false,
signup_failure_details_exposed: false,
})
}
@ -609,7 +609,7 @@ impl CoordinatorService {
manual_review: account_state.manual_review,
sanitized_reason: account_state.sanitized_reason,
next_actions: account_state.next_actions,
private_moderation_details_exposed: false,
sensitive_moderation_details_exposed: false,
signup_failure_details_exposed: false,
})
}

12
crates/clusterflux-coordinator/src/service/tests.rs
View file

@ -1499,7 +1499,7 @@ fn service_reports_and_enforces_public_admin_tenant_suspension() {
suspended,
disabled,
sanitized_reason,
private_moderation_details_exposed,
sensitive_moderation_details_exposed,
signup_failure_details_exposed,
..
} = service
@ -1520,7 +1520,7 @@ fn service_reports_and_enforces_public_admin_tenant_suspension() {
assert!(!suspended);
assert!(!disabled);
assert!(sanitized_reason.is_none());
assert!(!private_moderation_details_exposed);
assert!(!sensitive_moderation_details_exposed);
assert!(!signup_failure_details_exposed);
for (tenant, policy_name, expected_status, expected_reason) in [
@ -1556,7 +1556,7 @@ fn service_reports_and_enforces_public_admin_tenant_suspension() {
manual_review,
sanitized_reason,
next_actions,
private_moderation_details_exposed,
sensitive_moderation_details_exposed,
signup_failure_details_exposed,
..
} = service
@ -1578,7 +1578,7 @@ fn service_reports_and_enforces_public_admin_tenant_suspension() {
assert!(next_actions
.iter()
.any(|action| action.contains("hosted operator")));
assert!(!private_moderation_details_exposed);
assert!(!sensitive_moderation_details_exposed);
assert!(!signup_failure_details_exposed);
}
@ -1717,7 +1717,7 @@ fn service_reports_and_enforces_public_admin_tenant_suspension() {
disabled,
sanitized_reason,
next_actions,
private_moderation_details_exposed,
sensitive_moderation_details_exposed,
signup_failure_details_exposed,
..
} = service
@ -1740,7 +1740,7 @@ fn service_reports_and_enforces_public_admin_tenant_suspension() {
assert!(next_actions
.iter()
.any(|action| action.contains("hosted operator")));
assert!(!private_moderation_details_exposed);
assert!(!sensitive_moderation_details_exposed);
assert!(!signup_failure_details_exposed);
let create = service

58
crates/clusterflux-dap/src/tests.rs
View file

@ -704,11 +704,40 @@ fn terminal_record_without_snapshots_clears_active_threads() {
#[test]
fn source_locals_infer_clusterflux_api_values_from_runtime_state() {
let mut state = AdapterState::default();
let project = Path::new(env!("CARGO_MANIFEST_DIR"))
.join("../../tests/fixtures/runtime-conformance")
.canonicalize()
let project = std::env::temp_dir().join(format!(
"clusterflux-dap-source-locals-{}",
std::process::id()
));
let src = project.join("src");
fs::create_dir_all(&src).unwrap();
fs::write(
src.join("lib.rs"),
r#"async fn run_build_workflow() {
let source = prepare_source_snapshot();
let linux = clusterflux::spawn::async_task_with_arg(source.clone(), compile_linux)
.name("compile linux")
.env(linux_env())
.start()
.await
.unwrap();
let linux_thread = linux.virtual_thread_id();
let linux_artifact = linux.join().await.unwrap();
let package = clusterflux::spawn::async_task_with_arg(
vec![linux_artifact.clone()],
package_release,
)
.name("package artifacts")
.env(linux_env())
.start()
.await
.unwrap();
let package_artifact = package.join().await.unwrap();
}
"#,
)
.unwrap();
let mut state = AdapterState::default();
state.project = project.to_string_lossy().into_owned();
state.source_path = "src/lib.rs".to_owned();
let source = fs::read_to_string(project.join(&state.source_path)).unwrap();
@ -744,6 +773,8 @@ fn source_locals_infer_clusterflux_api_values_from_runtime_state() {
variable["name"] == "unavailable-local-diagnostic"
&& variable["type"] == "unavailable-local"
}));
let _ = fs::remove_dir_all(project);
}
#[test]
@ -863,11 +894,20 @@ fn package_release(inputs: Vec<Artifact>) -> Artifact {
#[test]
fn wasm_frame_locals_expose_only_values_from_the_node_snapshot() {
let project = std::env::temp_dir().join(format!(
"clusterflux-dap-wasm-locals-{}",
std::process::id()
));
let src = project.join("src");
fs::create_dir_all(&src).unwrap();
fs::write(
src.join("lib.rs"),
"pub extern \"C\" fn task_add_one(input: i32) -> i32 {\n input + 1\n}\n",
)
.unwrap();
let mut state = AdapterState::default();
state.project = Path::new(env!("CARGO_MANIFEST_DIR"))
.join("../../tests/fixtures/runtime-conformance")
.to_string_lossy()
.into_owned();
state.project = project.to_string_lossy().into_owned();
state.source_path = "src/lib.rs".to_owned();
let source = fs::read_to_string(Path::new(&state.project).join(&state.source_path)).unwrap();
state.threads.get_mut(&MAIN_THREAD).unwrap().line = source
@ -895,6 +935,8 @@ fn wasm_frame_locals_expose_only_values_from_the_node_snapshot() {
assert!(!locals
.iter()
.any(|variable| variable["name"] == "wasm-local-diagnostic"));
let _ = fs::remove_dir_all(project);
}
#[test]

2
crates/clusterflux-dap/src/virtual_model.rs
View file

@ -114,7 +114,7 @@ impl Default for AdapterState {
project,
source_path: "src/lib.rs".to_owned(),
runtime_backend: RuntimeBackend::Simulated,
coordinator_endpoint: "https://clusterflux.michelpaulissen.com".to_owned(),
coordinator_endpoint: "https://clusterflux.lesstuff.com".to_owned(),
tenant: TenantId::from("tenant"),
project_id: ProjectId::from("project"),
actor_user: UserId::from("dap"),

9
crates/clusterflux-node/src/daemon.rs
View file

@ -634,13 +634,12 @@ mod tests {
#[test]
fn hosted_url_remains_an_https_control_endpoint() {
assert_eq!(
control_endpoint_identity("https://clusterflux.michelpaulissen.com").unwrap(),
"https://clusterflux.michelpaulissen.com/api/v1/control"
control_endpoint_identity("https://clusterflux.lesstuff.com").unwrap(),
"https://clusterflux.lesstuff.com/api/v1/control"
);
assert_eq!(
control_endpoint_identity("https://clusterflux.michelpaulissen.com/api/v1/control")
.unwrap(),
"https://clusterflux.michelpaulissen.com/api/v1/control"
control_endpoint_identity("https://clusterflux.lesstuff.com/api/v1/control").unwrap(),
"https://clusterflux.lesstuff.com/api/v1/control"
);
assert_eq!(
control_endpoint_identity("127.0.0.1:7999").unwrap(),

2
crates/clusterflux-node/src/lib.rs
View file

@ -1029,7 +1029,7 @@ mod tests {
}
#[test]
fn public_node_crate_does_not_require_hosted_private_types() {
fn public_node_crate_does_not_require_hosted_service_types() {
let _tenant = TenantId::from("tenant");
let _project = ProjectId::from("project");
let _backend = LinuxRootlessPodmanBackend;