Improve auth explain diagnostics

crates/geth/tests/bootstrap.rs

@@ -1853,6 +1853,133 @@ fn auth_explain_distinguishes_discovered_peer_candidates() {
         geth_control::ControlResponse::AuthExplain(explanation) => {
             assert!(!explanation.allowed);
             assert!(explanation.reason.contains("discovered peer candidate"));
+            assert!(
+                explanation
+                    .diagnostics
+                    .contains(&"subject:discovered-only".to_owned())
+            );
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+}
+
+#[test]
+fn auth_explain_distinguishes_endpoint_binding_state() {
+    let home = tempfile::tempdir().expect("tempdir");
+    let paths = geth_config::GethPaths::from_home(home.path());
+    let node = geth_node::init_node(&paths).expect("init node");
+    let store = geth_store::Store::open(&paths.metadata_db()).expect("open store");
+    let created_at = geth_store::now_ms();
+
+    for op in [
+        geth_keychain::KeychainOp {
+            id: "op:keychain:init".into(),
+            created_at: geth_types::UnixMillis(created_at),
+            kind: geth_keychain::KeychainOpKind::KeychainInit,
+        },
+        geth_keychain::KeychainOp {
+            id: "op:user:add".into(),
+            created_at: geth_types::UnixMillis(created_at + 1),
+            kind: geth_keychain::KeychainOpKind::UserAdd {
+                user: "user:owner".into(),
+                name: "Owner".to_owned(),
+            },
+        },
+        geth_keychain::KeychainOp {
+            id: "op:device:add".into(),
+            created_at: geth_types::UnixMillis(created_at + 2),
+            kind: geth_keychain::KeychainOpKind::DeviceAdd {
+                device: "device:laptop".into(),
+                user: "user:owner".into(),
+            },
+        },
+        geth_keychain::KeychainOp {
+            id: "op:node:add".into(),
+            created_at: geth_types::UnixMillis(created_at + 3),
+            kind: geth_keychain::KeychainOpKind::NodeAdd {
+                node: "node:trusted".into(),
+                device: "device:laptop".into(),
+                name: "trusted".to_owned(),
+            },
+        },
+    ] {
+        store
+            .insert_keychain_op(&geth_store::StoredKeychainOp {
+                op_id: op.id.to_string(),
+                op_json: serde_json::to_string(&op).expect("keychain op json"),
+                created_at_ms: op.created_at.0,
+            })
+            .expect("insert keychain op");
+    }
+
+    store
+        .upsert_peer_card(&geth_store::StoredPeerCard {
+            peer_id: "node:trusted".to_owned(),
+            card_json: r#"{
+                "node_id":"node:trusted",
+                "agent_id":"agent:test",
+                "endpoints":[{"endpoint_id":"endpoint:card-only","relay_url":null,"direct_addresses":[],"source":"manual"}],
+                "issued_at":1,
+                "signature":{"namespace":"","signer":"","public_key":"","signature":""}
+            }"#
+            .to_owned(),
+            updated_at_ms: created_at + 4,
+        })
+        .expect("insert peer card");
+
+    let missing = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::AuthExplain {
+            subject: "node:trusted".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+        },
+    )
+    .expect("explain missing endpoint binding");
+    match missing {
+        geth_control::ControlResponse::AuthExplain(explanation) => {
+            assert!(!explanation.allowed);
+            assert!(
+                explanation
+                    .diagnostics
+                    .contains(&"endpoint-binding:missing".to_owned())
+            );
+        }
+        other => panic!("unexpected response: {other:?}"),
+    }
+
+    let endpoint_op = geth_keychain::KeychainOp {
+        id: "op:node:endpoint:add".into(),
+        created_at: geth_types::UnixMillis(created_at + 5),
+        kind: geth_keychain::KeychainOpKind::NodeEndpointAdd {
+            node: "node:trusted".into(),
+            endpoint: "endpoint:card-only".to_owned(),
+        },
+    };
+    store
+        .insert_keychain_op(&geth_store::StoredKeychainOp {
+            op_id: endpoint_op.id.to_string(),
+            op_json: serde_json::to_string(&endpoint_op).expect("endpoint op json"),
+            created_at_ms: endpoint_op.created_at.0,
+        })
+        .expect("insert endpoint op");
+
+    let matched = geth_node::handle_request(
+        &node,
+        geth_control::ControlRequest::AuthExplain {
+            subject: "node:trusted".to_owned(),
+            resource: "resource:cas:local".to_owned(),
+            capability: "cas.fetch".to_owned(),
+        },
+    )
+    .expect("explain matched endpoint binding");
+    match matched {
+        geth_control::ControlResponse::AuthExplain(explanation) => {
+            assert!(
+                explanation
+                    .diagnostics
+                    .contains(&"endpoint-binding:matched:endpoint:card-only".to_owned())
+            );
         }
         other => panic!("unexpected response: {other:?}"),
     }
@@ -1926,7 +2053,12 @@ fn auth_grant_revoke_and_explain_use_local_auth_log() {
         geth_control::ControlResponse::AuthExplain(explanation) => {
             assert!(!explanation.allowed);
             assert_eq!(explanation.evaluated_ops, 2);
-            assert!(explanation.reason.contains("no active"));
+            assert!(explanation.reason.contains("revoked"));
+            assert!(
+                explanation
+                    .diagnostics
+                    .contains(&"grant:revoked:grant:test-fetch".to_owned())
+            );
         }
         other => panic!("unexpected response: {other:?}"),
     }