ingestion main.go: symlink tripwire wiring, buildMux arguments and ListenAndServe line remain untested (split from #154) #182

New Issue

2026-10-05T07:40:18Z

mathias commented

2026-10-05 07:40:18 +00:00

Split from #154 (comment 14360). The #154 fix moved /mcp's bearer and the metrics wrap into buildMux, so the handler ListenAndServe serves is built and tested in one function. Three pieces of wiring in ingestion/cmd/server/main.go are still untested:

Symlink tripwire order. startupSymlinkCheck(brainDir) must run before any brain reader starts, and go symlinkguard.Watch(...) must run at all. Removing both calls keeps the suite green.
The arguments main passes to buildMux. These are the restAuth fields (token, validator, realm, resourceMetadataURL) and the public map. The tests build their own arguments. The PR #183 review (comment 15474) showed this by execution: changing main's validator: jwtValidator to validator: nil leaves go vet and go test ./cmd/server/ green, yet it drops JWT acceptance on /mcp and REST and breaks the claude.ai OAuth connector. PR #183 now tests that buildMux uses the validator and resourceMetadataURL on /mcp, but not that main supplies them.
http.ListenAndServe(addr, handler) must serve buildMux's result unchanged. A handler built around it in main (for example a public POST /query in front of it) would not be seen by the tests.

The comments in routes.go, main.go and routes_test.go (testMux) claim only this (PR #183, b04a348).

Fix direction: extract main's assembly into a tested run(ctx, cfg) error, or a server struct with injectable reader starters. A test can then assert that a planted symlink refuses boot before any reader starts, that the served handler is buildMux's, and that a configured issuer yields a non-nil validator on the router main builds. This was deferred because main.go is about 600 lines with env-driven side effects (k8s client, pg, graph backfill), which is a larger refactor than #154. Signal handling (#184) touches the same function.

Source: ingestion/cmd/server/main.go (the startupSymlinkCheck call near the top of main, go symlinkguard.Watch, the buildMux(restAuth{...}, ...) call, and the final ListenAndServe).

Created via git-mcp on behalf of @mathias; scope widened per PR #183 review 15474

Split from #154 (comment 14360). The #154 fix moved `/mcp`'s bearer and the metrics wrap into `buildMux`, so the handler `ListenAndServe` serves is built and tested in one function. Three pieces of wiring in `ingestion/cmd/server/main.go` are still untested: 1. **Symlink tripwire order.** `startupSymlinkCheck(brainDir)` must run before any brain reader starts, and `go symlinkguard.Watch(...)` must run at all. Removing both calls keeps the suite green. 2. **The arguments main passes to `buildMux`.** These are the `restAuth` fields (`token`, `validator`, `realm`, `resourceMetadataURL`) and the `public` map. The tests build their own arguments. The PR #183 review (comment 15474) showed this by execution: changing main's `validator: jwtValidator` to `validator: nil` leaves `go vet` and `go test ./cmd/server/` green, yet it drops JWT acceptance on /mcp and REST and breaks the claude.ai OAuth connector. PR #183 now tests that buildMux *uses* the validator and resourceMetadataURL on /mcp, but not that main *supplies* them. 3. **`http.ListenAndServe(addr, handler)`** must serve `buildMux`'s result unchanged. A handler built around it in main (for example a public `POST /query` in front of it) would not be seen by the tests. The comments in `routes.go`, `main.go` and `routes_test.go` (testMux) claim only this (PR #183, b04a348). Fix direction: extract main's assembly into a tested `run(ctx, cfg) error`, or a server struct with injectable reader starters. A test can then assert that a planted symlink refuses boot before any reader starts, that the served handler is `buildMux`'s, and that a configured issuer yields a non-nil validator on the router main builds. This was deferred because main.go is about 600 lines with env-driven side effects (k8s client, pg, graph backfill), which is a larger refactor than #154. Signal handling (#184) touches the same function. Source: `ingestion/cmd/server/main.go` (the startupSymlinkCheck call near the top of main, `go symlinkguard.Watch`, the `buildMux(restAuth{...}, ...)` call, and the final ListenAndServe). --- _Created via git-mcp on behalf of @mathias; scope widened per PR #183 review 15474_

mathias added the risk/low type/test labels 2026-10-05 07:40:18 +00:00

mathias referenced this issue from a commit

2026-10-05 07:41:32 +00:00

fix(ingestion): build /mcp's bearer and the metrics wrap inside buildMux

mathias referenced this issue

2026-10-05 14:16:55 +00:00

fix(ingestion): build /mcp's bearer and the metrics wrap inside buildMux (#154) #183

mathias referenced this issue

2026-10-05 14:20:58 +00:00

fix(ingestion): build /mcp's bearer and the metrics wrap inside buildMux (#154) #183

mathias referenced this issue

2026-10-05 14:20:59 +00:00

Test that /mcp authenticates through the production router; close the re-wrap gap in main.go #154

mathias referenced this issue from a commit

2026-10-05 14:34:17 +00:00

fix(ingestion): build /mcp's bearer and the metrics wrap inside buildMux

mathias changed title from ~~ingestion main.go: symlink tripwire wiring and ListenAndServe line remain untested (split from #154)~~ to ingestion main.go: symlink tripwire wiring, buildMux arguments and ListenAndServe line remain untested (split from #154)

2026-10-05 14:34:30 +00:00

mathias referenced this issue

2026-10-05 14:34:30 +00:00

fix(ingestion): build /mcp's bearer and the metrics wrap inside buildMux (#154) #183

mathias referenced this issue

2026-10-05 14:39:47 +00:00

fix(ingestion): build /mcp's bearer and the metrics wrap inside buildMux (#154) #183

mathias referenced this issue

2026-10-05 14:39:48 +00:00

Test that /mcp authenticates through the production router; close the re-wrap gap in main.go #154

mathias referenced this issue from a commit

2026-10-05 14:42:45 +00:00