@celilo/cli 1.8.0 → 1.9.0

package/src/hooks/capability-loader-firewall.test.ts

@@ -78,6 +78,28 @@ export function createFirewall(config, store, upstreamFirewall, logger) {
 }
 `;
 
+/**
+ * Reports back the FirewallConfig it was handed, so a test can assert on what
+ * the loader actually forwarded rather than on a downstream effect.
+ *
+ * The real iptables module reads `defaultRouteZone` and `isolateTransitNetwork`
+ * off this object and nothing else in celilo constructs one. So if the loader
+ * drops a field, the setting is simply dead: the operator sets it, the config
+ * row exists, `module config get` shows it, and no rule changes. That is what
+ * happened to both of these, and it is invisible from every surface except the
+ * rendered ruleset.
+ */
+const MOCK_CONFIG_REPORTER = `
+export function createFirewall(config, store, upstreamFirewall, logger) {
+  return {
+    receivedConfig: () => config,
+    exposeService: async (opts) => ({ externalIp: '203.0.113.10', natIp: config.natIp }),
+    unexposeService: async () => {},
+    listExposedServices: async () => [],
+  };
+}
+`;
+
 describe('Firewall Chain Building', () => {
   let db: DbClient;
   let tempDir: string;
@@ -235,4 +257,90 @@ describe('Firewall Chain Building', () => {
     // But buildFirewallChain is only called with >1 providers
     // Single provider loads normally via the standard path
   });
+
+  describe('operator settings reach the module', () => {
+    /**
+     * Both settings are opt-in and both default to a no-op, which is exactly
+     * why losing them is silent. A dropped `isolateTransitNetwork` renders the
+     * ruleset celilo has always rendered, and a dropped `defaultRouteZone`
+     * falls back to `internal`, which is the common case. Nothing errors,
+     * nothing warns, and the only observable difference is a DROP that is
+     * absent from a chain nobody reads.
+     */
+    function installReporter(moduleId: string, capabilityData: string, zones: string) {
+      const path = join(tempDir, moduleId);
+      const scripts = join(path, 'scripts');
+      mkdirSync(scripts, { recursive: true });
+      writeFileSync(join(scripts, 'firewall-functions.ts'), MOCK_CONFIG_REPORTER);
+      db.$client.run(
+        `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('${moduleId}', '${moduleId}', '1.0.0', '${path}', '{}')`,
+      );
+      db.$client.run(
+        `INSERT INTO capabilities (module_id, capability_name, version, data, zones) VALUES ('${moduleId}', 'firewall', '1.0.0', '${capabilityData}', '${zones}')`,
+      );
+    }
+
+    async function loadedConfig(): Promise<Record<string, unknown>> {
+      const result = await loadCapabilityFunctions('test-consumer', db, noopLogger);
+      const fw = result.firewall as { receivedConfig: () => Record<string, unknown> };
+      expect(fw, 'no firewall capability loaded').toBeTruthy();
+      return fw.receivedConfig();
+    }
+
+    test('single provider: default_route_zone and isolate_transit_network are forwarded', async () => {
+      installReporter('iptables', '{"has_external":true}', '["dmz","app","secure"]');
+      upsertModuleConfig(db, 'iptables', 'firewall_ip', '192.168.0.254');
+      upsertModuleConfig(db, 'iptables', 'nat_ip', '192.168.0.253');
+      upsertModuleConfig(db, 'iptables', 'default_route_zone', 'isp-transit');
+      upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
+
+      const config = await loadedConfig();
+      expect(config.defaultRouteZone).toBe('isp-transit');
+      // A REAL boolean, not the string 'true'. `parseStoredConfigValue`
+      // preserves the manifest-declared type, and the module tests
+      // `state.isolateTransitNetwork && ...` — where 'false' would be truthy.
+      expect(config.isolateTransitNetwork).toBe(true);
+    });
+
+    test('chained provider: the downstream layer gets them too', async () => {
+      // greenwave owns the WAN, so iptables is built through buildFirewallChain
+      // rather than the single-provider path. That is a SECOND construction
+      // site with its own field list, and it is the one a real downstream
+      // firewall goes through.
+      const gwPath = join(tempDir, 'greenwave');
+      const gwScripts = join(gwPath, 'scripts');
+      mkdirSync(gwScripts, { recursive: true });
+      writeFileSync(join(gwScripts, 'firewall-functions.ts'), MOCK_GREENWAVE_MODULE);
+      db.$client.run(
+        `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('greenwave', 'GreenWave', '1.0.0', '${gwPath}', '{}')`,
+      );
+      db.$client.run(
+        `INSERT INTO capabilities (module_id, capability_name, version, data, zones) VALUES ('greenwave', 'firewall', '1.0.0', '{"has_external":true}', '["internal"]')`,
+      );
+      upsertModuleConfig(db, 'greenwave', 'router_ip', '192.168.0.1');
+
+      installReporter('iptables', '{}', '["dmz","app","secure"]');
+      upsertModuleConfig(db, 'iptables', 'firewall_ip', '192.168.0.254');
+      upsertModuleConfig(db, 'iptables', 'nat_ip', '192.168.0.253');
+      upsertModuleConfig(db, 'iptables', 'default_route_zone', 'internal');
+      upsertModuleConfig(db, 'iptables', 'isolate_transit_network', true);
+
+      const config = await loadedConfig();
+      expect(config.defaultRouteZone).toBe('internal');
+      expect(config.isolateTransitNetwork).toBe(true);
+    });
+
+    test('unset settings arrive undefined, not as a wrong default', async () => {
+      installReporter('iptables', '{"has_external":true}', '["dmz"]');
+      upsertModuleConfig(db, 'iptables', 'firewall_ip', '192.168.0.254');
+      upsertModuleConfig(db, 'iptables', 'nat_ip', '192.168.0.253');
+
+      const config = await loadedConfig();
+      // The module owns both defaults (`?? 'internal'` and `?? false`). The
+      // loader must not invent one, or a future change to the module's default
+      // would be silently overridden by a stale copy here.
+      expect(config.defaultRouteZone).toBeUndefined();
+      expect(config.isolateTransitNetwork).toBeUndefined();
+    });
+  });
 });

package/src/hooks/capability-loader.test.ts

@@ -161,6 +161,14 @@ describe('Capability Loader', () => {
     db.$client.run(
       `INSERT INTO capabilities (module_id, capability_name, version, data, registered_at) VALUES ('caddy', 'public_web', '1.0.0', '{}', unixepoch())`,
     );
+    // The two route CONSUMERS, as real rows. `web_routes.module_id` is a foreign
+    // key onto `modules`, and seeding a route without its module was accepted
+    // only because the test helper ran with foreign keys off (celilo#1074).
+    for (const consumer of ['apt-repo', 'authentik']) {
+      db.$client.run(
+        `INSERT INTO modules (id, name, version, source_path, manifest_data) VALUES ('${consumer}', '${consumer}', '1.0.0', '${tempDir}/${consumer}', '{}')`,
+      );
+    }
     db.$client.run(
       `INSERT INTO web_routes (slug, module_id, type, path, hostname, target_host, target_port, websocket) VALUES ('apt--root', 'apt-repo', 'reverse_proxy', '/', 'apt.example.com', '10.0.20.50', 8080, 0)`,
     );
@@ -172,10 +180,10 @@ describe('Capability Loader', () => {
     const provider = await loadCapabilityFunctions('caddy', db, noopLogger);
     expect(provider).toHaveProperty('web_routes');
     const view = provider.web_routes as RouteReadView;
-    const all = view.getAllRoutes();
+    const all = await view.getAllRoutes();
     expect(all).toHaveLength(2);
     expect(all.map((r) => r.hostname).sort()).toEqual(['apt.example.com', 'auth.example.com']);
-    expect(view.getRoutes('apt-repo').map((r) => r.hostname)).toEqual(['apt.example.com']);
+    expect((await view.getRoutes('apt-repo')).map((r) => r.hostname)).toEqual(['apt.example.com']);
 
     // A consumer (not the provider) never sees the route table.
     const consumer = await loadCapabilityFunctions('apt-repo', db, noopLogger);

package/src/hooks/capability-loader.ts

@@ -40,6 +40,7 @@ import {
 } from '../db/schema';
 import { decryptSecret } from '../secrets/encryption';
 import { getOrCreateMasterKey } from '../secrets/master-key';
+import { recordCapabilityBinding, withBindingRecord } from '../services/capability-bindings';
 import { emitWebRoutesChangedAndWait } from '../services/celilo-events';
 import { getModuleSystems } from '../services/deployed-systems';
 import { withDnsInternalLedger } from '../services/dns-internal-records';
@@ -224,6 +225,11 @@ export async function loadCapabilityFunctions(
   logger: HookLogger,
 ): Promise<Record<string, unknown>> {
   const result: Record<string, unknown> = {};
+  // Which provider each injected capability came from, so the binding recorded
+  // at the return names the provider the consumer actually reached. Provider
+  // self-views (`firewall_registry`, `web_routes`) are deliberately absent —
+  // a module reading its own registry has not bound to anything.
+  const providerByCapability = new Map<string, string>();
 
   const masterKey = await getOrCreateMasterKey();
 
@@ -270,6 +276,11 @@ export async function loadCapabilityFunctions(
       );
       if (chain) {
         result[capName] = chain;
+        // The consumer talks to the OUTERMOST layer, which is not necessarily
+        // the edge provider. Every layer is `stampProvider`'d on the way out,
+        // so the one it was handed names itself.
+        const chainProvider = (chain as { providerModuleId?: string }).providerModuleId;
+        if (chainProvider) providerByCapability.set(capName, chainProvider);
       }
       // The chain hands a CONSUMER the innermost layer, which is not this
       // provider's own layer when it sits further out. `on_consumer_removed`
@@ -377,6 +388,7 @@ export async function loadCapabilityFunctions(
         // greenwave — true, useless, and a violation of the contract's
         // requirement to name the provider.
         result[capName] = withLedger(stampProvider(capabilityInterface, capability.moduleId));
+        providerByCapability.set(capName, capability.moduleId);
         debugLog(`${capName}: loaded via defineCapabilityFunction`);
         continue;
       }
@@ -403,6 +415,7 @@ export async function loadCapabilityFunctions(
         result[capName] = withLedger(
           wrapWithLogging(capabilityInterface as object, logger, capName),
         );
+        providerByCapability.set(capName, capability.moduleId);
         debugLog(`${capName}: loaded via legacy factory`);
         // Sole firewall provider running its OWN hook: the interface just built
         // IS its layer, so hand it back under the provider-view name too.
@@ -544,6 +557,10 @@ export async function loadCapabilityFunctions(
     }
 
     try {
+      // The name comes off the row rather than being restated here: core
+      // naming a capability is what `no-module-business-in-core` Scan B counts,
+      // and this is bookkeeping, not a branch.
+      providerByCapability.set(provider.capabilityName, provider.moduleId);
       result.public_web = createPublicWeb({
         moduleId: consumingModuleId,
         logger,
@@ -610,9 +627,12 @@ export async function loadCapabilityFunctions(
     // — symmetric with how consumers get the public_web capability. Consumers
     // never see this; only the provider does.
     if (consumingModuleId === provider.moduleId) {
+      // Async because the consumer is a hook, which now runs in its own
+      // process. `routeOps` itself stays synchronous: it is bun:sqlite and it
+      // is called in-process by `createPublicWeb`.
       const routeView: RouteReadView = {
-        getAllRoutes: () => routeOps.getAllRoutes(),
-        getRoutes: (m: string) => routeOps.getRoutes(m),
+        getAllRoutes: async () => routeOps.getAllRoutes(),
+        getRoutes: async (m: string) => routeOps.getRoutes(m),
       };
       result.web_routes = routeView;
       debugLog(`web_routes: read-only route view injected for provider ${consumingModuleId}`);
@@ -621,6 +641,32 @@ export async function loadCapabilityFunctions(
     debugLog('public_web: not registered in DB, skipping');
   }
 
+  // celilo#1072: the CALL is the binding, not the resolution. Everything above
+  // is injected whether or not the consumer declared it — the loop's own
+  // comment says "not just required ones" — so recording what was resolved
+  // would name every provider on the fleet. A method invocation is the only
+  // event that separates the optional capability a module uses from the ones it
+  // merely declares.
+  for (const [capName, iface] of Object.entries(result)) {
+    const providerModuleId = providerByCapability.get(capName);
+    // A module that provides and consumes the same capability is not bound to
+    // itself, and a provider reading its own registry is not a consumer.
+    if (!providerModuleId || providerModuleId === consumingModuleId) continue;
+    if (!iface || typeof iface !== 'object') continue;
+    result[capName] = withBindingRecord(iface as object, () => {
+      try {
+        recordCapabilityBinding(db, consumingModuleId, capName, providerModuleId);
+      } catch (error) {
+        // Bookkeeping must never fail the call it is observing. Loud, not silent.
+        logger.warn(
+          `Could not record the ${capName} binding ${consumingModuleId} → ${providerModuleId}: ${
+            error instanceof Error ? error.message : String(error)
+          }`,
+        );
+      }
+    });
+  }
+
   return result;
 }
 
@@ -674,6 +720,11 @@ function buildCapabilityInterface(
           trustedSubnets: zones?.trustedSubnets ?? [],
           controlPlaneSubnet: zones?.controlPlaneSubnet,
           frontedSubnets: zones?.frontedSubnets ?? [],
+          // Operator settings, forwarded verbatim. `parseStoredConfigValue`
+          // preserves each manifest-declared type, so the boolean arrives as a
+          // boolean and needs no coercion here.
+          defaultRouteZone: config.default_route_zone as string | undefined,
+          isolateTransitNetwork: config.isolate_transit_network as boolean | undefined,
         },
         store,
         undefined, // no upstream — the chain path handles that
@@ -1191,6 +1242,12 @@ async function buildFirewallChain(
         // Absent means the box has never converged cleanly, so an interface
         // celilo cannot attribute refuses rather than being disabled.
         interfaceBaseline: parseInterfaceBaseline(provConfig.interface_baseline),
+        // Which declared zone carries this firewall's default route, and
+        // whether fronted zones may initiate into it. Both are operator
+        // settings and both are read HERE or nowhere: the module declares them
+        // on `FirewallConfig`, and nothing else in celilo constructs one.
+        defaultRouteZone: provConfig.default_route_zone as string | undefined,
+        isolateTransitNetwork: provConfig.isolate_transit_network as boolean | undefined,
       },
       store,
       currentUpstream,