Paul Payne
c67c06d8e6
- add static 'role' (authority|follower) to NodeConfig/CastleConfig, wired from castle.yaml through the registry to the mesh wire; civil pinned authority - castle-presence: TTL KV bucket each node renews (churn signal); delete-on-stop - castle-config: authority-gated get/put + change-watch SSE (follower reconcile hook hangs off it) - bound the NATS drain on stop() so shutdown can't hang - tests: role config/registry round-trip, wire round-trip, role write-gating Single-node verified; follower reconcile pending the second node.
31 lines
896 B
Python
31 lines
896 B
Python
"""CastleNATSClient role gating — hermetic (no live NATS server needed).
|
|
|
|
The write-gate is checked before touching the KV bucket, so a follower is denied
|
|
without any connection.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import asyncio
|
|
|
|
import pytest
|
|
from castle_core.registry import NodeConfig, NodeRegistry
|
|
|
|
from castle_api.nats_client import CastleNATSClient
|
|
|
|
|
|
def _client(role: str) -> CastleNATSClient:
|
|
reg = NodeRegistry(node=NodeConfig(hostname="n", role=role), deployed={})
|
|
return CastleNATSClient("n", reg, servers="nats://localhost:4222")
|
|
|
|
|
|
def test_role_property() -> None:
|
|
assert _client("authority").role == "authority"
|
|
assert _client("follower").role == "follower"
|
|
|
|
|
|
def test_follower_cannot_write_shared_config() -> None:
|
|
client = _client("follower")
|
|
with pytest.raises(PermissionError):
|
|
asyncio.run(client.put_shared_config("fleet/key", "value"))
|