llmgw/internal/control/agentsvc/identity_test.go

package agentsvc

import (
	"context"
	"errors"
	"testing"
	"time"

	"connectrpc.com/connect"
)

func TestARemovedNodesCertificateIsRefused(t *testing.T) {
	removed := time.Date(2026, 10, 4, 12, 0, 0, 0, time.UTC)
	s := newTestService()
	s.requireIdentity = true
	s.SetRevocations(func(_ context.Context, id string) (time.Time, error) {
		if id == "gpu01" {
			return removed, nil
		}
		return time.Time{}, nil
	})
	peer := func(cn string, issued time.Time) context.Context {
		return WithPeerIdentity(context.Background(), PeerIdentity{CommonName: cn, Verified: true, IssuedAt: issued})
	}

	cases := []struct {
		name   string
		ctx    context.Context
		node   string
		refuse connect.Code
	}{
		{"issued before the removal", peer("gpu01", removed.Add(-time.Minute)), "gpu01", connect.CodePermissionDenied},
		{"issued at the removal", peer("gpu01", removed), "gpu01", connect.CodePermissionDenied},
		{"issued after, by onboarding again", peer("gpu01", removed.Add(time.Second)), "gpu01", 0},
		{"another node", peer("gpu02", removed.Add(-time.Hour)), "gpu02", 0},
		{"another node's name", peer("gpu02", removed.Add(time.Hour)), "gpu01", connect.CodePermissionDenied},
		{"no certificate", context.Background(), "gpu02", connect.CodeUnauthenticated},
	}
	for _, c := range cases {
		err := s.admit(c.ctx, c.node)
		if c.refuse == 0 {
			if err != nil {
				t.Errorf("%s: refused: %v", c.name, err)
			}
			continue
		}
		if connect.CodeOf(err) != c.refuse {
			t.Errorf("%s: got %v, expected %v", c.name, err, c.refuse)
		}
	}

	// Not knowing is not "not revoked".
	s.SetRevocations(func(context.Context, string) (time.Time, error) { return time.Time{}, errors.New("store down") })
	if err := s.admit(peer("gpu02", removed), "gpu02"); connect.CodeOf(err) != connect.CodeUnavailable {
		t.Errorf("with the store down: %v, expected unavailable", err)
	}
}