testdata: re-run ssh tscap corpus with localpart anonymization

Regenerates ssh_results/*.hujson on top of the tscap fix
(kradalby/tscap@833a50a + 837f1f6) that rewrites localpart:*@<domain>
patterns in policy text alongside user email substitution. Before the
fix, anonymized captures kept the raw @passkey domain in policy while
the users landed on @example.com, so localpart:*@passkey matched zero
users and headscale emitted only the wildcard rule, diffing against
SaaS's per-user rules on 40 failing leaves across 14 scenarios
(ssh-d2..d12 minus d1/d10, ssh-e6, ssh-f3..f5).

With the new corpus:

  - localpart:*@passkey in policy → localpart:*@example.com
  - thor moves from thor@example.com to thor@dalby.cc so that
    "localpart:*@example.com" resolves to exactly odin+freya (matching
    SaaS output), and "localpart:*@dalby.cc" in ssh-d1 keeps matching
    exactly one user.

Test code update: setupSSHDataCompatUsers() now pins thor on
@dalby.cc to match the capture topologies. All other compat tests
(routes, grants, acl, via-grant) use their own per-file topology
loaders and are unaffected — thor's email change is scoped to the
SSH hardcoded setup.

TestSSHDataCompat: 41 failing leaves → 1 failing leaf. The single
remaining ssh-b6/beedrill failure is a pre-existing, unrelated
duplicate-principals bug in headscale's SSH compiler (same diff
shape before and after this change).

Updates #3157
This commit is contained in:
Kristoffer Dalby
2026-04-09 08:51:57 +00:00
parent 5cba8ddc62
commit 2764e5f228
44 changed files with 180625 additions and 179433 deletions
@@ -36,6 +36,12 @@ import (
// compatibility tests. Users get norse-god names; nodes get original-151
// pokémon names — matching the anonymized identifiers tscap writes into
// the capture files (see github.com/kradalby/tscap/anonymize).
//
// odin and freya live on @example.com; thor is intentionally kept on
// @dalby.cc so that "localpart:*@example.com" resolves to exactly two
// users (matching SaaS output) and the "user on a different email
// domain" case stays covered by scenarios like ssh-d1 that use
// "localpart:*@dalby.cc".
func setupSSHDataCompatUsers() types.Users {
return types.Users{
{
@@ -46,7 +52,7 @@ func setupSSHDataCompatUsers() types.Users {
{
Model: gorm.Model{ID: 2},
Name: "thor",
Email: "thor@example.com",
Email: "thor@dalby.cc",
},
{
Model: gorm.Model{ID: 3},
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff
File diff suppressed because it is too large Load Diff