mirror of
https://github.com/netbirdio/netbird.git
synced 2026-07-21 07:51:29 +02:00
769e12840d
Adds the account-scoped agent-network module: provider/policy/budget CRUD and store, the reverse-proxy service synthesizer, policy selection + limit enforcement, the provider catalog (incl. Vertex AI and AWS Bedrock entries), and the management HTTP + proxy gRPC surfaces.
110 lines
6.0 KiB
Go
110 lines
6.0 KiB
Go
package agentnetwork
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"testing"
|
|
|
|
"github.com/golang/mock/gomock"
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/netbirdio/netbird/management/internals/modules/reverseproxy/proxy"
|
|
rpservice "github.com/netbirdio/netbird/management/internals/modules/reverseproxy/service"
|
|
"github.com/netbirdio/netbird/management/server/agentnetwork/types"
|
|
"github.com/netbirdio/netbird/management/server/store"
|
|
"github.com/netbirdio/netbird/shared/management/proto"
|
|
)
|
|
|
|
// TestSynthesizedService_WireShape locks down the proto shape that
|
|
// flows from the synthesizer through ToProtoMapping to the proxy.
|
|
// Drift between this test and what the proxy expects manifests as
|
|
// "service not matching" — the proxy receives a mapping but can't
|
|
// register an SNI/HTTP route from it.
|
|
func TestSynthesizedService_WireShape(t *testing.T) {
|
|
ctx := context.Background()
|
|
ctrl := gomock.NewController(t)
|
|
defer ctrl.Finish()
|
|
mockStore := store.NewMockStore(ctrl)
|
|
|
|
provider := newSynthTestProvider()
|
|
policy := newSynthTestPolicy(provider.ID, "grp-eng", "")
|
|
|
|
expectSynthBaseInputs(mockStore, ctx, newSynthTestSettings(),
|
|
[]*types.Provider{provider},
|
|
[]*types.Policy{policy},
|
|
[]*types.Guardrail{})
|
|
|
|
services, err := SynthesizeServices(ctx, mockStore, testAccountID)
|
|
require.NoError(t, err)
|
|
require.Len(t, services, 1)
|
|
|
|
svc := services[0]
|
|
mapping := svc.ToProtoMapping(rpservice.Create, "test-token", proxy.OIDCValidationConfig{})
|
|
|
|
// Identifiers — account-scoped service ID, settings-derived domain.
|
|
assert.Equal(t, "agent-net-svc-acct-1", mapping.GetId(), "stable account-scoped virtual service ID")
|
|
assert.Equal(t, testAccountID, mapping.GetAccountId(), "account id round-trips")
|
|
assert.Equal(t, testEndpoint, mapping.GetDomain(), "domain matches settings.Endpoint() output")
|
|
|
|
// Mode + listen port — addMapping at proxy/server.go switches on Mode.
|
|
assert.Equal(t, "http", mapping.GetMode(), "synthesised services are HTTP mode")
|
|
assert.Equal(t, int32(0), mapping.GetListenPort(), "no custom listen port for HTTP services")
|
|
|
|
// Auth token + private/tunnel shape: agent-network endpoints authenticate
|
|
// inbound agents via ValidateTunnelPeer against AccessGroups, not OIDC.
|
|
assert.Equal(t, "test-token", mapping.GetAuthToken(), "auth token round-trips for proxy CreateProxyPeer")
|
|
assert.True(t, mapping.GetPrivate(), "synthesised services are private (tunnel-peer auth via AccessGroups)")
|
|
require.NotNil(t, mapping.GetAuth(), "auth payload carries the session key")
|
|
assert.False(t, mapping.GetAuth().GetOidc(), "OIDC is off for tunnel-auth agent-network services")
|
|
|
|
// Path mappings — proxy/server.go::setupHTTPMapping early-returns when
|
|
// len(mapping.GetPath()) == 0, so this is a critical assertion.
|
|
require.Len(t, mapping.GetPath(), 1, "exactly one path mapping for the cluster target")
|
|
pm := mapping.GetPath()[0]
|
|
assert.Equal(t, "/", pm.GetPath(), "default path is '/'")
|
|
assert.Equal(t, "https://noop.invalid/", pm.GetTarget(),
|
|
"target URL is the placeholder; the router middleware rewrites it per request")
|
|
require.NotNil(t, pm.GetOptions(), "target options must be populated so direct_upstream + middleware chain reach the proxy")
|
|
assert.True(t, pm.GetOptions().GetDirectUpstream(), "synth targets imply direct_upstream so the proxy dials via the host stack")
|
|
assert.True(t, pm.GetOptions().GetAgentNetwork(), "agent_network flag must travel on the wire so the proxy can tag access logs")
|
|
|
|
mws := pm.GetOptions().GetMiddlewares()
|
|
require.Len(t, mws, 8, "eight middlewares reach the proxy: request_parser, router, limit_check, identity_inject, guardrail, limit_record, cost_meter, response_parser")
|
|
|
|
assert.Equal(t, middlewareIDLLMRequestParser, mws[0].GetId(), "first middleware id")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[0].GetSlot(), "request parser slot")
|
|
|
|
assert.Equal(t, middlewareIDLLMRouter, mws[1].GetId(), "second middleware id")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[1].GetSlot(), "router slot")
|
|
require.NotEmpty(t, mws[1].GetConfigJson(), "router config must travel on the wire")
|
|
var routerCfg routerConfig
|
|
require.NoError(t, json.Unmarshal(mws[1].GetConfigJson(), &routerCfg), "router config decodes")
|
|
require.Len(t, routerCfg.Providers, 1, "the only enabled provider reaches the router")
|
|
assert.Equal(t, provider.ID, routerCfg.Providers[0].ID, "router provider id matches synth provider")
|
|
assert.Equal(t, "Bearer sk-test-key", routerCfg.Providers[0].AuthHeaderValue,
|
|
"openai catalog template substitutes the API key on the wire")
|
|
|
|
assert.Equal(t, middlewareIDLLMLimitCheck, mws[2].GetId(),
|
|
"limit_check runs after the router so the resolved provider id is available, before identity_inject so a deny doesn't pay the header-stamp cost")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[2].GetSlot())
|
|
|
|
assert.Equal(t, middlewareIDLLMIdentityInject, mws[3].GetId(), "fourth middleware id")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[3].GetSlot(), "identity inject slot")
|
|
require.NotEmpty(t, mws[3].GetConfigJson(), "identity inject config JSON must travel on the wire")
|
|
|
|
assert.Equal(t, middlewareIDLLMGuardrail, mws[4].GetId(), "fifth middleware id")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_REQUEST, mws[4].GetSlot(), "guardrail slot")
|
|
require.NotEmpty(t, mws[4].GetConfigJson(), "guardrail middleware config JSON must travel on the wire")
|
|
|
|
assert.Equal(t, middlewareIDLLMLimitRecord, mws[5].GetId(),
|
|
"limit_record sits FIRST in the response section so it RUNS LAST at runtime — slot order on the response leg is reverse-of-slice")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[5].GetSlot())
|
|
|
|
assert.Equal(t, middlewareIDCostMeter, mws[6].GetId(), "seventh middleware id")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[6].GetSlot(), "cost meter slot")
|
|
|
|
assert.Equal(t, middlewareIDLLMResponseParser, mws[7].GetId(), "eighth middleware id")
|
|
assert.Equal(t, proto.MiddlewareSlot_MIDDLEWARE_SLOT_ON_RESPONSE, mws[7].GetSlot(), "response parser slot")
|
|
}
|