@shortlink-org/portolan 0.1.0

package/plugins/verify-otel/verify_test.go

@@ -0,0 +1,460 @@
+package main
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/shortlink-org/portolan/catalog"
+	"github.com/shortlink-org/portolan/plugin"
+)
+
+// The catalog the traces are read against: one service, two aggregates, an
+// endpoint flow read from code and a policy flow that opens on the bus.
+func estate() catalog.Catalog {
+	auth := "auth"
+	step := func(id, from, to string, kind catalog.StepKind, label, ref string) *catalog.Step {
+		return &catalog.Step{Type: "step", ID: id, From: from, To: to, Kind: kind, Label: label, Ref: ref, Status: catalog.StatusDeclared}
+	}
+	lanes := []catalog.Participant{
+		{ID: "client", Kind: catalog.ParticipantActor},
+		{ID: "auth.auth", Kind: catalog.ParticipantService, Context: &auth},
+		{ID: "auth-pg", Kind: catalog.ParticipantStore, Context: &auth},
+		{ID: "bus", Kind: catalog.ParticipantBroker},
+	}
+
+	return catalog.Catalog{
+		GeneratedAt: "2026-01-01T00:00:00Z",
+		Commit:      "abc1234",
+		Defs:        map[string]catalog.TypeDef{},
+		Adrs:        []catalog.Adr{},
+		Contexts: []catalog.BoundedContext{{
+			ID: "auth", Slug: "auth", Name: "Authentication",
+			Services: []catalog.Service{{
+				ID: "auth.auth", Slug: "auth", Name: "Auth",
+				Provides: []catalog.RpcService{{
+					ID: "auth.v1.Sessions",
+					Methods: []catalog.RpcMethod{
+						{Name: "login", HTTP: &catalog.HttpRoute{Method: "POST", Path: "/v1/sessions"}},
+						{Name: "changePassword", HTTP: &catalog.HttpRoute{Method: "POST", Path: "/v1/users/me/password"}},
+						{Name: "getUser", HTTP: &catalog.HttpRoute{Method: "GET", Path: "/v1/users/{userId}"}},
+					},
+				}},
+				Consumes: []catalog.RpcCall{{ID: "risk.v1.RiskService/Assess", Peer: "risk.v1", Status: catalog.StatusUnresolved, Source: "gen"}},
+				Aggregates: []catalog.Aggregate{
+					{ID: "auth.auth.session", Slug: "session", Name: "Session", Root: "Session", Events: []catalog.Event{
+						{ID: "auth.auth.session.SessionStarted", Slug: "session-started", Name: "SessionStarted", Versions: []catalog.EventVersion{{Version: "v1"}}, Consumers: []catalog.EventConsumer{}},
+						{ID: "auth.auth.session.SessionEnded", Slug: "session-ended", Name: "SessionEnded", Versions: []catalog.EventVersion{{Version: "v1"}}, Consumers: []catalog.EventConsumer{}},
+					}},
+					{ID: "auth.auth.user", Slug: "user", Name: "User", Root: "User", Events: []catalog.Event{
+						{ID: "auth.auth.user.PasswordChanged", Slug: "password-changed", Name: "PasswordChanged", Versions: []catalog.EventVersion{{Version: "v1"}}, Consumers: []catalog.EventConsumer{{Service: "auth.auth", Status: catalog.StatusDeclared}}},
+					}},
+				},
+			}},
+		}},
+		Stores: []catalog.Store{{ID: "auth.auth.pg", Slug: "pg", Name: "Auth database", Kind: catalog.StoreKindPostgres, Owner: "auth.auth"}},
+		Flows: []catalog.Flow{
+			{
+				ID: "flow.auth-login", Slug: "auth-login", Name: "Login", Owner: "auth", Participants: lanes,
+				Steps: catalog.FlowNodes{
+					step("s1", "client", "auth.auth", catalog.StepRPC, "login", ""),
+					step("s2", "auth.auth", "auth-pg", catalog.StepCall, "ByEmail", ""),
+					&catalog.Step{Type: "step", ID: "s3", From: "auth.auth", To: "risk-v1", Kind: catalog.StepRPC, Label: "Assess", Ref: "risk.v1.RiskService/Assess", Status: catalog.StatusUnresolved},
+					&catalog.Alt{Type: "alt", ID: "alt4", Branches: []catalog.AltBranch{
+						{Title: "blocked", Terminal: true, Steps: catalog.FlowNodes{step("s5", "auth.auth", "bus", catalog.StepEvent, "SessionEnded", "auth.auth.session.SessionEnded")}},
+						{Title: "otherwise", Steps: catalog.FlowNodes{}},
+					}},
+					step("s6", "auth.auth", "bus", catalog.StepEvent, "SessionStarted", "auth.auth.session.SessionStarted"),
+				},
+			},
+			{
+				ID: "flow.auth-revoke", Slug: "auth-revoke", Name: "Revoke", Owner: "auth", Participants: lanes,
+				Steps: catalog.FlowNodes{
+					step("s1", "bus", "auth.auth", catalog.StepEvent, "PasswordChanged", "auth.auth.user.PasswordChanged"),
+					step("s2", "auth.auth", "auth-pg", catalog.StepCall, "Save", ""),
+					step("s3", "auth.auth", "bus", catalog.StepEvent, "SessionEnded", "auth.auth.session.SessionEnded"),
+				},
+			},
+		},
+	}
+}
+
+// One batch, written the way a collector writes it: the kinds as numbers
+// except one, to show the names are read too.
+const recording = `{"resourceSpans":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"auth"}}]},"scopeSpans":[{"spans":[
+ {"traceId":"t1","spanId":"a1","name":"POST /v1/sessions","kind":2,"startTimeUnixNano":"100","attributes":[{"key":"http.route","value":{"stringValue":"/v1/sessions"}},{"key":"http.request.method","value":{"stringValue":"POST"}}]},
+ {"traceId":"t1","spanId":"a2","parentSpanId":"a1","name":"SELECT users","kind":3,"startTimeUnixNano":"110","attributes":[{"key":"db.system.name","value":{"stringValue":"postgresql"}},{"key":"db.operation.name","value":{"stringValue":"SELECT"}}]},
+ {"traceId":"t1","spanId":"a3","parentSpanId":"a2","name":"prepare SELECT users","kind":3,"startTimeUnixNano":"111","attributes":[{"key":"db.system.name","value":{"stringValue":"postgresql"}},{"key":"db.operation.name","value":{"stringValue":"SELECT"}}]},
+ {"traceId":"t1","spanId":"a4","parentSpanId":"a1","name":"risk.v1.RiskService/Assess","kind":3,"startTimeUnixNano":"120","attributes":[{"key":"rpc.system","value":{"stringValue":"grpc"}},{"key":"rpc.service","value":{"stringValue":"risk.v1.RiskService"}},{"key":"rpc.method","value":{"stringValue":"Assess"}}]},
+ {"traceId":"t1","spanId":"a6","parentSpanId":"a1","name":"GET","kind":3,"startTimeUnixNano":"125","attributes":[{"key":"http.request.method","value":{"stringValue":"GET"}},{"key":"url.full","value":{"stringValue":"http://auth:8080/v1/users/42?verbose=1"}},{"key":"server.address","value":{"stringValue":"auth"}}]},
+ {"traceId":"t1","spanId":"a7","parentSpanId":"a1","name":"GET","kind":3,"startTimeUnixNano":"126","attributes":[{"key":"http.request.method","value":{"stringValue":"GET"}},{"key":"url.full","value":{"stringValue":"http://profile:9000/v1/profiles/42"}},{"key":"server.address","value":{"stringValue":"profile"}}]},
+ {"traceId":"t1","spanId":"a5","parentSpanId":"a1","name":"publish auth.SessionStarted","kind":"SPAN_KIND_PRODUCER","startTimeUnixNano":"130","attributes":[{"key":"messaging.destination.name","value":{"stringValue":"auth_session"}},{"key":"event.name","value":{"stringValue":"auth.SessionStarted"}}]},
+
+ {"traceId":"t2","spanId":"b1","name":"POST /v1/users/me/password","kind":2,"startTimeUnixNano":"200","attributes":[{"key":"http.route","value":{"stringValue":"/v1/users/me/password"}},{"key":"http.request.method","value":{"stringValue":"POST"}}]},
+ {"traceId":"t2","spanId":"b2","parentSpanId":"b1","name":"publish auth.PasswordChanged","kind":4,"startTimeUnixNano":"210","attributes":[{"key":"event.name","value":{"stringValue":"auth.PasswordChanged"}}]},
+ {"traceId":"t2","spanId":"b3","parentSpanId":"b2","name":"consume auth.PasswordChanged","kind":5,"startTimeUnixNano":"220","attributes":[{"key":"event.name","value":{"stringValue":"auth.PasswordChanged"}}]},
+ {"traceId":"t2","spanId":"b4","parentSpanId":"b3","name":"UPDATE sessions","kind":3,"startTimeUnixNano":"230","attributes":[{"key":"db.system.name","value":{"stringValue":"postgresql"}},{"key":"db.operation.name","value":{"stringValue":"UPDATE"}}]},
+ {"traceId":"t2","spanId":"b5","parentSpanId":"b3","name":"publish auth.SessionEnded","kind":4,"startTimeUnixNano":"240","attributes":[{"key":"event.name","value":{"stringValue":"auth.SessionEnded"}}]},
+
+ {"traceId":"t3","spanId":"c1","name":"GET /v1/health","kind":2,"startTimeUnixNano":"300","attributes":[{"key":"http.route","value":{"stringValue":"/v1/health"}},{"key":"http.request.method","value":{"stringValue":"GET"}}]},
+ {"traceId":"t3","spanId":"c2","parentSpanId":"c1","name":"SELECT 1","kind":3,"startTimeUnixNano":"310","attributes":[{"key":"db.system.name","value":{"stringValue":"postgresql"}},{"key":"db.operation.name","value":{"stringValue":"SELECT"}}]}
+]}]},
+{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"billing"}}]},"scopeSpans":[{"spans":[
+ {"traceId":"t4","spanId":"d1","name":"POST /v1/charges","kind":2,"startTimeUnixNano":"400","attributes":[{"key":"http.route","value":{"stringValue":"/v1/charges"}}]}
+]}]}]}`
+
+func runVerify(t *testing.T, traces string, opts Options) (catalog.Catalog, plugin.Response) {
+	t.Helper()
+
+	return runVerifyOn(t, estate(), traces, opts)
+}
+
+func runVerifyOn(t *testing.T, cat catalog.Catalog, traces string, opts Options) (catalog.Catalog, plugin.Response) {
+	t.Helper()
+	root := t.TempDir()
+	if err := os.MkdirAll(filepath.Join(root, "telemetry"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(filepath.Join(root, "telemetry/traces.jsonl"), []byte(traces), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	if opts.Traces == nil {
+		opts.Traces = []string{"telemetry/*.jsonl"}
+	}
+
+	resp, err := verify(plugin.Request{Catalog: cat, Input: plugin.Input{Root: root, Commit: "abc1234", GeneratedAt: "2026-01-01T00:00:00Z"}}, opts)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(resp.Files) != 1 || resp.Files[0].Name != "observed.json" {
+		t.Fatalf("files = %+v", resp.Files)
+	}
+	var out catalog.Catalog
+	if err := json.Unmarshal([]byte(resp.Files[0].Contents), &out); err != nil {
+		t.Fatalf("fragment is not a catalog: %v", err)
+	}
+
+	return out, resp
+}
+
+func flowNamed(t *testing.T, cat catalog.Catalog, slug string) catalog.Flow {
+	t.Helper()
+	for _, f := range cat.Flows {
+		if f.Slug == slug {
+			return f
+		}
+	}
+	t.Fatalf("no flow %s in %v", slug, slugs(cat))
+
+	return catalog.Flow{}
+}
+
+func slugs(cat catalog.Catalog) []string {
+	var out []string
+	for _, f := range cat.Flows {
+		out = append(out, f.Slug)
+	}
+
+	return out
+}
+
+func statuses(flow catalog.Flow) map[string]catalog.Status {
+	out := map[string]catalog.Status{}
+	walkSteps(flow.Steps, func(s *catalog.Step) { out[s.ID] = s.Status })
+
+	return out
+}
+
+// A trace that opens on a declared endpoint raises the steps it shows - the
+// call in, the events out - and leaves the rest as the code declared them.
+// A store call is not raised: a query ran, but nothing in the span says it
+// was the repository method the code names.
+func TestATraceRaisesTheHopsItShows(t *testing.T) {
+	out, resp := runVerify(t, recording, Options{})
+
+	login := flowNamed(t, out, "auth-login")
+	got := statuses(login)
+	want := map[string]catalog.Status{
+		"s1": catalog.StatusVerified,   // client -> auth.auth login
+		"s2": catalog.StatusDeclared,   // ByEmail: a SELECT ran, which is not the same claim
+		"s3": catalog.StatusUnresolved, // risk: seen, but its far end is still not in the catalog
+		"s5": catalog.StatusDeclared,   // the blocked arm did not run
+		"s6": catalog.StatusVerified,   // SessionStarted published
+	}
+	for id, status := range want {
+		if got[id] != status {
+			t.Errorf("%s = %s, want %s", id, got[id], status)
+		}
+	}
+	first := firstStep(login.Steps)
+	if !strings.Contains(first.Note, "telemetry/traces.jsonl") {
+		t.Errorf("note = %q, want the recording named", first.Note)
+	}
+	if len(login.Participants) != 4 {
+		t.Errorf("participants changed: %+v", login.Participants)
+	}
+	for _, d := range resp.Warnings() {
+		if strings.Contains(d.Message, "no service in the catalog") && !strings.Contains(d.Message, "billing") && !strings.Contains(d.Message, "profile") {
+			t.Errorf("unexpected diagnostic: %s", d.Message)
+		}
+	}
+}
+
+// An event that declares its wire is matched by that name before any guess
+// from the last segment, and a publish span that names a channel other than
+// the declared one is reported once - the hop stays, because the event did
+// go out.
+func TestTheWireIsMatchedByNameAndHeldToItsChannel(t *testing.T) {
+	cat := estate()
+	ev := &cat.Contexts[0].Services[0].Aggregates[0].Events[0]
+	if ev.ID != "auth.auth.session.SessionStarted" {
+		t.Fatalf("fixture moved: %s", ev.ID)
+	}
+	ev.Name = "Started"
+	ev.Wire = &catalog.EventWire{Name: "auth.SessionStarted", Channel: "sessions"}
+
+	out, resp := runVerifyOn(t, cat, recording, Options{})
+
+	seen := false
+	for _, f := range out.Flows {
+		walkSteps(f.Steps, func(s *catalog.Step) {
+			if s.Ref == ev.ID && s.Status == catalog.StatusVerified {
+				seen = true
+			}
+		})
+	}
+	if !seen {
+		t.Errorf("a publish of the declared wire name should resolve to the event: %+v", out.Flows)
+	}
+
+	warned := 0
+	for _, d := range resp.Warnings() {
+		if strings.Contains(d.Message, `on "auth_session"`) && strings.Contains(d.Message, `it goes on "sessions"`) {
+			warned++
+		}
+	}
+	if warned != 1 {
+		t.Errorf("the channel the trace shows should be held against the declared one, once: %+v", resp.Warnings())
+	}
+}
+
+// A consumer inside a trace is the opening of a flow of its own: the policy
+// flow is raised from the middle of the password change, and the consumer
+// edge comes out verified.
+func TestAConsumerInsideATraceOpensThePolicyFlow(t *testing.T) {
+	out, _ := runVerify(t, recording, Options{})
+
+	revoke := flowNamed(t, out, "auth-revoke")
+	got := statuses(revoke)
+	if got["s1"] != catalog.StatusVerified || got["s3"] != catalog.StatusVerified || got["s2"] != catalog.StatusDeclared {
+		t.Errorf("statuses = %v", got)
+	}
+
+	var consumers []catalog.EventConsumer
+	for _, ctx := range out.Contexts {
+		for _, svc := range ctx.Services {
+			for _, agg := range svc.Aggregates {
+				for _, ev := range agg.Events {
+					if ev.ID == "auth.auth.user.PasswordChanged" {
+						consumers = ev.Consumers
+					}
+				}
+			}
+		}
+	}
+	if len(consumers) != 1 || consumers[0].Service != "auth.auth" || consumers[0].Status != catalog.StatusVerified {
+		t.Errorf("consumers = %+v", consumers)
+	}
+}
+
+// A call to a service the catalog does not have is recorded as made and still
+// unresolved; the peer is the package, on a lane without a dot.
+func TestACallToNobodyStaysUnresolved(t *testing.T) {
+	out, _ := runVerify(t, recording, Options{})
+
+	var calls []catalog.RpcCall
+	for _, ctx := range out.Contexts {
+		for _, svc := range ctx.Services {
+			if svc.ID == "auth.auth" {
+				calls = svc.Consumes
+			}
+		}
+	}
+	if len(calls) != 2 || calls[1].ID != "risk.v1.RiskService/Assess" || calls[1].Status != catalog.StatusUnresolved || calls[1].Peer != "risk.v1" {
+		t.Errorf("consumes = %+v", calls)
+	}
+}
+
+// A call over HTTP is read back to the operation whose route it hit, by the
+// verb and the path's shape; one no service answers on is a hop to a host.
+func TestAnHTTPCallIsNamedByTheRouteItHit(t *testing.T) {
+	out, resp := runVerify(t, recording, Options{})
+
+	var calls []catalog.RpcCall
+	for _, ctx := range out.Contexts {
+		for _, svc := range ctx.Services {
+			if svc.ID == "auth.auth" {
+				calls = svc.Consumes
+			}
+		}
+	}
+	if len(calls) != 2 || calls[0].ID != "auth.v1.Sessions/getUser" || calls[0].Peer != "auth.auth" || calls[0].Status != catalog.StatusVerified {
+		t.Errorf("consumes = %+v", calls)
+	}
+	var warned bool
+	for _, d := range resp.Warnings() {
+		if strings.Contains(d.Message, "GET /v1/profiles/42") && strings.Contains(d.Message, "profile") {
+			warned = true
+		}
+	}
+	if !warned {
+		t.Errorf("a call to a host nobody in the catalog is should be reported: %+v", resp.Warnings())
+	}
+}
+
+// A sequence no flow opens is written down as seen, once per shape, on the
+// route it came in on.
+func TestASequenceNobodyDeclaredIsObserved(t *testing.T) {
+	out, resp := runVerify(t, recording, Options{})
+
+	health := flowNamed(t, out, "observed-auth-get-v1-health")
+	if health.Owner != "auth" || len(health.Steps) != 2 {
+		t.Fatalf("flow = %+v", health)
+	}
+	first := firstStep(health.Steps)
+	if first.Label != "GET /v1/health" || first.Status != catalog.StatusVerified || first.From != "client" || first.To != "auth.auth" {
+		t.Errorf("first = %+v", first)
+	}
+	second := health.Steps[1].(*catalog.Step)
+	if second.To != "auth-pg" || second.Label != "SELECT" {
+		t.Errorf("second = %+v", second)
+	}
+	if !strings.Contains(health.Summary, "1 trace") {
+		t.Errorf("summary = %q", health.Summary)
+	}
+
+	var warned bool
+	for _, d := range resp.Warnings() {
+		if strings.Contains(d.Message, "GET /v1/health") {
+			warned = true
+		}
+	}
+	if !warned {
+		t.Error("a route no interface declares should be reported")
+	}
+}
+
+// Spans from a service the catalog does not have are reported once and read
+// as nothing: a flow for a service that does not exist would be a service.
+func TestAnUnknownServiceIsReportedNotInvented(t *testing.T) {
+	out, resp := runVerify(t, recording, Options{})
+
+	for _, slug := range slugs(out) {
+		if strings.Contains(slug, "charges") {
+			t.Errorf("a flow was written for the unknown service: %s", slug)
+		}
+	}
+	var n int
+	for _, d := range resp.Warnings() {
+		if strings.Contains(d.Message, `"billing"`) {
+			n++
+		}
+	}
+	if n != 1 {
+		t.Errorf("billing was reported %d times, want once", n)
+	}
+
+	named, _ := runVerify(t, recording, Options{Services: map[string]string{"billing": "auth.auth"}})
+	if len(named.Flows) <= len(out.Flows) {
+		t.Error("naming the service under `services` should read its spans")
+	}
+}
+
+// One batch per line and one value per file are the same recording.
+func TestJSONLinesAndOneValueReadAlike(t *testing.T) {
+	lines := strings.ReplaceAll(recording, "\n\n", "\n")
+	a, err := parseOTLP([]byte(recording), "x")
+	if err != nil {
+		t.Fatal(err)
+	}
+	two := strings.Replace(lines, `]}]},
+{"resource"`, "]}]}]}\n{\"resourceSpans\":[{\"resource\"", 1)
+	b, err := parseOTLP([]byte(two), "x")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(a) != len(b) || len(a) != 15 {
+		t.Errorf("spans = %d and %d, want 15 both ways", len(a), len(b))
+	}
+	if a[6].kind != kindProducer {
+		t.Errorf("kind written as a name = %d", a[6].kind)
+	}
+}
+
+// The fragment says nothing when there is nothing to read, and says so.
+func TestNoRecordingIsAWarningAndAnEmptyFragment(t *testing.T) {
+	root := t.TempDir()
+	resp, err := verify(plugin.Request{Catalog: estate(), Input: plugin.Input{Root: root}}, Options{Traces: []string{"telemetry/*.jsonl"}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(resp.Warnings()) != 1 || !strings.Contains(resp.Warnings()[0].Message, "no trace files") {
+		t.Errorf("diagnostics = %+v", resp.Warnings())
+	}
+	var out catalog.Catalog
+	if err := json.Unmarshal([]byte(resp.Files[0].Contents), &out); err != nil || len(out.Flows) != 0 {
+		t.Errorf("fragment = %s", resp.Files[0].Contents)
+	}
+}
+
+func TestAColonRouteHasTheShapeOfABracedOne(t *testing.T) {
+	if shapeOf("/v1/baskets/:basketId/items/:sku") != shapeOf("/v1/baskets/{basketId}/items/{sku}") {
+		t.Fatalf("a Fastify route and the OpenAPI path it serves read as different shapes")
+	}
+	if !routeMatches("/v1/baskets/{basketId}", "/v1/baskets/42") || routeMatches("/v1/baskets/{basketId}", "/v1/baskets") {
+		t.Fatalf("routeMatches does not fill a parameter with exactly one segment")
+	}
+}
+
+// An outbox writes the event and a relay puts it on the bus, and each opens
+// a producer span, the second under the first. They are one publish: the
+// event left the service once, and a shape nobody declared must show it
+// once too.
+const relayed = `{"resourceSpans":[{"resource":{"attributes":[{"key":"service.name","value":{"stringValue":"auth"}}]},"scopeSpans":[{"spans":[
+ {"traceId":"t9","spanId":"r1","name":"POST /v1/ping","kind":2,"startTimeUnixNano":"900","attributes":[{"key":"http.route","value":{"stringValue":"/v1/ping"}},{"key":"http.request.method","value":{"stringValue":"POST"}}]},
+ {"traceId":"t9","spanId":"r2","parentSpanId":"r1","name":"publish auth.SessionStarted","kind":4,"startTimeUnixNano":"910","attributes":[{"key":"messaging.system","value":{"stringValue":"outbox"}},{"key":"messaging.destination.name","value":{"stringValue":"auth_session"}},{"key":"messaging.operation.type","value":{"stringValue":"publish"}},{"key":"event.name","value":{"stringValue":"auth.SessionStarted"}}]},
+ {"traceId":"t9","spanId":"r3","parentSpanId":"r2","name":"publish auth.SessionStarted","kind":4,"startTimeUnixNano":"920","attributes":[{"key":"messaging.system","value":{"stringValue":"nats"}},{"key":"messaging.destination.name","value":{"stringValue":"sessions"}},{"key":"messaging.operation.type","value":{"stringValue":"publish"}},{"key":"event.name","value":{"stringValue":"auth.SessionStarted"}}]}
+]}]}]}`
+
+func TestARelayedPublishIsOneHop(t *testing.T) {
+	cat := estate()
+	ev := &cat.Contexts[0].Services[0].Aggregates[0].Events[0]
+	ev.Wire = &catalog.EventWire{Name: "auth.SessionStarted", Channel: "auth_session"}
+
+	out, resp := runVerifyOn(t, cat, relayed, Options{})
+
+	ping := flowNamed(t, out, "observed-auth-post-v1-ping")
+	var events []string
+	walkSteps(ping.Steps, func(s *catalog.Step) {
+		if s.Kind == catalog.StepEvent {
+			events = append(events, s.From+">"+s.To+":"+s.Ref)
+		}
+	})
+	if len(events) != 1 || events[0] != "auth.auth>bus:"+ev.ID {
+		t.Errorf("one event left, so one hop: %v", events)
+	}
+
+	// The inner span is the one that says which bus, so it is the one the
+	// channel is read off.
+	warned := false
+	for _, d := range resp.Warnings() {
+		if strings.Contains(d.Message, `on "sessions"`) {
+			warned = true
+		}
+	}
+	if !warned {
+		t.Errorf("the relay's destination should be held against the declared channel: %+v", resp.Warnings())
+	}
+}