rsp2k/headscale
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity
headscale/hscontrol/policy/v2/testdata/grant_results/GRANT-B2.hujson

211 lines
4.6 KiB
Text
Raw Normal View History

testdata: convert .json to .hujson with header comments Rename all 594 test data files from .json to .hujson and add descriptive header comments to each file documenting what policy rules are under test and what outcome is expected. Update test loaders in all 5 _test.go files to parse HuJSON via hujson.Parse/Standardize/Pack before json.Unmarshal. Add cross-dependency warning to via_compat_test.go documenting that GRANT-V29/V30/V31/V36 are shared with TestGrantsCompat. Add .gitignore exemption for testdata HuJSON files.
2026-03-30 17:08:26 +00:00
// GRANT-B2
//
// Grant: src=['*'] dst=['tag:server'] app={tailscale.com/cap/kubernetes}
//
// Expected: Rules on tagged-server
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
{
"test_id": "GRANT-B2",
"input": {
"full_policy": {
"groups": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"group:admins": [
"kratail2tid@passkey"
],
"group:developers": [
"kristoffer@dalby.cc",
"kratail2tid@passkey"
],
"group:monitors": [
"monitorpasskeykradalby@passkey"
],
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
"group:empty": []
},
"tagOwners": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"tag:server": [
"kratail2tid@passkey"
],
"tag:prod": [
"kratail2tid@passkey"
],
"tag:client": [
"kratail2tid@passkey"
],
"tag:router": [
"kratail2tid@passkey"
],
"tag:exit": [
"kratail2tid@passkey"
]
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"hosts": {
"webserver": "100.108.74.26",
"prodbox": "100.103.8.15",
"internal": "10.0.0.0/8"
},
"autoApprovers": {
"routes": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"10.33.0.0/16": [
"tag:router"
],
"0.0.0.0/0": [
"tag:exit"
],
"::/0": [
"tag:exit"
]
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
}
},
"grants": [
{
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"src": [
"*"
],
"dst": [
"tag:server"
],
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
"app": {
"tailscale.com/cap/kubernetes": [
{
"impersonate": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"groups": [
"readers"
]
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
}
},
{
"impersonate": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"groups": [
"writers"
]
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
}
}
]
}
}
]
},
"api_response_code": 200
},
"topology": {
"nodes": {
"exit-node": {
"hostname": "exit-node",
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"tags": [
"tag:exit"
],
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
"ipv4": "100.85.66.106",
"ipv6": "fd7a:115c:a1e0::7c37:426a"
},
"subnet-router": {
"hostname": "subnet-router",
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"tags": [
"tag:router"
],
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
"ipv4": "100.92.142.61",
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"ipv6": "fd7a:115c:a1e0::3e37:8e3d"
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"tagged-client": {
"hostname": "tagged-client",
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"tags": [
"tag:client"
],
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
"ipv4": "100.83.200.69",
"ipv6": "fd7a:115c:a1e0::c537:c845"
},
"tagged-prod": {
"hostname": "unknown",
"tags": [],
"ipv4": "unknown",
"ipv6": "unknown"
},
"tagged-server": {
"hostname": "tagged-server",
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"tags": [
"tag:server"
],
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
"ipv4": "100.108.74.26",
"ipv6": "fd7a:115c:a1e0::b901:4a87"
},
"user-kris": {
"hostname": "user-kris",
"tags": [],
"ipv4": "100.110.121.96",
"ipv6": "fd7a:115c:a1e0::1737:7960"
},
"user-mon": {
"hostname": "user-mon",
"tags": [],
"ipv4": "100.103.90.82",
"ipv6": "fd7a:115c:a1e0::9e37:5a52"
},
"user1": {
"hostname": "user1",
"tags": [],
"ipv4": "100.90.199.68",
"ipv6": "fd7a:115c:a1e0::2d01:c747"
}
}
},
"captures": {
"exit-node": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"packet_filter_rules": null
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"subnet-router": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"packet_filter_rules": null
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"tagged-client": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"packet_filter_rules": null
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"tagged-prod": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"packet_filter_rules": null
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"tagged-server": {
"packet_filter_rules": [
{
"SrcIPs": [
"10.33.0.0/16",
"100.115.94.0-100.127.255.255",
"100.64.0.0-100.115.91.255",
"fd7a:115c:a1e0::/48"
],
"CapGrant": [
{
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"Dsts": [
"100.108.74.26/32",
"fd7a:115c:a1e0::b901:4a87/128"
],
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
"CapMap": {
"tailscale.com/cap/kubernetes": [
policy/v2: add advertised routes to compat test topologies Add routable_ips and approved_routes fields to the node topology definitions in all golden test files. These represent the subnet routes actually advertised by nodes on the Tailscale SaaS network during data capture: Routes topology (92 files, 6 router nodes): big-router: 10.0.0.0/8 subnet-router: 10.33.0.0/16 ha-router1: 192.168.1.0/24 ha-router2: 192.168.1.0/24 multi-router: 172.16.0.0/24 exit-node: 0.0.0.0/0, ::/0 ACL topology (199 files, 1 router node): subnet-router: 10.33.0.0/16 Grants topology (203 files, 1 router node): subnet-router: 10.33.0.0/16 The route assignments were deduced from the golden data by analyzing which router nodes receive FilterRules for which destination CIDRs across all test files, and cross-referenced with the MTS setup script (setup_grant_nodes.sh). Updates #2180
2026-03-18 13:40:19 +00:00
{
"impersonate": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"groups": [
"readers"
]
policy/v2: add advertised routes to compat test topologies Add routable_ips and approved_routes fields to the node topology definitions in all golden test files. These represent the subnet routes actually advertised by nodes on the Tailscale SaaS network during data capture: Routes topology (92 files, 6 router nodes): big-router: 10.0.0.0/8 subnet-router: 10.33.0.0/16 ha-router1: 192.168.1.0/24 ha-router2: 192.168.1.0/24 multi-router: 172.16.0.0/24 exit-node: 0.0.0.0/0, ::/0 ACL topology (199 files, 1 router node): subnet-router: 10.33.0.0/16 Grants topology (203 files, 1 router node): subnet-router: 10.33.0.0/16 The route assignments were deduced from the golden data by analyzing which router nodes receive FilterRules for which destination CIDRs across all test files, and cross-referenced with the MTS setup script (setup_grant_nodes.sh). Updates #2180
2026-03-18 13:40:19 +00:00
}
},
{
"impersonate": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"groups": [
"writers"
]
policy/v2: add advertised routes to compat test topologies Add routable_ips and approved_routes fields to the node topology definitions in all golden test files. These represent the subnet routes actually advertised by nodes on the Tailscale SaaS network during data capture: Routes topology (92 files, 6 router nodes): big-router: 10.0.0.0/8 subnet-router: 10.33.0.0/16 ha-router1: 192.168.1.0/24 ha-router2: 192.168.1.0/24 multi-router: 172.16.0.0/24 exit-node: 0.0.0.0/0, ::/0 ACL topology (199 files, 1 router node): subnet-router: 10.33.0.0/16 Grants topology (203 files, 1 router node): subnet-router: 10.33.0.0/16 The route assignments were deduced from the golden data by analyzing which router nodes receive FilterRules for which destination CIDRs across all test files, and cross-referenced with the MTS setup script (setup_grant_nodes.sh). Updates #2180
2026-03-18 13:40:19 +00:00
}
}
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
]
}
}
]
}
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
]
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"user-kris": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"packet_filter_rules": null
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"user-mon": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"packet_filter_rules": null
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
},
"user1": {
testdata: strip unused fields from all test data files (23MB -> 4MB) Strip fields not consumed by any test from all 594 HuJSON test data files: grant_results/ (248 files, 21MB -> 1.8MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.grants_section, input.api_endpoint, input.api_method, topology.nodes.mts_name, topology.nodes.socket, topology.nodes.user_id, captures.commands, captures.packet_filter_matches, captures.whois - V14-V16, V26-V36: keep stripped netmap (Peers.Name/AllowedIPs/PrimaryRoutes + PacketFilterRules) for via_compat_test.go compatibility - V17-V25: strip netmap (old topology, incompatible with via_compat harness) acl_results/ (215 files, 1.4MB -> 1.2MB): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code, entire topology section (parsed by Go struct but completely ignored — nodes are hardcoded) routes_results/ (92 files, unchanged — topology is actively used): - Remove: timestamp, propagation_wait_seconds, input.policy_file, input.api_endpoint, input.api_response_code ssh_results/ (39 files, unchanged — minimal to begin with): - Remove: policy_file
2026-03-30 17:10:53 +00:00
"packet_filter_rules": null
policy/v2: add data-driven grants compatibility test with Tailscale SaaS captures Rename tailscale_compat_test.go to tailscale_acl_compat_test.go to make room for the grants compat test. Add 237 GRANT-*.json golden test files captured from Tailscale SaaS and a data-driven test driver that compares headscale's grant filter compilation against real Tailscale behavior. Updates #2180
2026-02-23 15:39:54 +00:00
}
}
}
Reference in a new issue Copy permalink