test(provision): unit-test _account_owns_namespace / #303 preflight contract (refs cli#141)

[LukasWodka]

What

Guards the consumer half of the installer's #303 pre-flight contract (companion to tracebloc/cli#141). _account_owns_namespace (scripts/lib/provision.sh) shells tracebloc client list --plain and greps namespace=<ns>([[:space:]]|$); these unit tests pin that behavior so a CLI output change (or a provision.sh regression) fails CI, not a customer install.

Adds to scripts/tests/provision.bats:

• owned namespace → rc 0; absent → rc 1; strict prefix → rc 1 (pins the ([[:space:]]|$) anchor); asserts the preflight actually passes --plain;
• unreadable list → rc 2, distinct from rc 1 (the accept / refuse / fall-through distinction Installer mints a new client before the one-client-per-machine guard — orphans it on the backend #303 branches on).

The fixture mirrors the CLI's --plain format field-for-field, cross-referenced to the cli-side test so they stay in lockstep. CI: auto-discovered by standard-checks.yml (bats scripts/tests/*.bats on ubuntu-latest — the authoritative Linux run). Mutation-proven: dropping the grep anchor or --plain from provision.sh fails these. Test-only. 20/20 provision.bats pass locally.

Refs tracebloc/cli#141.

🤖 Generated with Claude Code

---

Note

Low Risk
Test-only changes to provision.bats; installer behavior is unchanged.

Overview
Adds consumer-side Bats coverage for _account_owns_namespace in provision.bats, complementing tracebloc/cli#141’s producer tests for tracebloc client list --plain.

A new _stub_client_list_plain helper stubs list output in the CLI’s exact --plain line shape and records argv so tests can assert --plain is always passed. One test locks grep semantics: owned namespace → exit 0, absent → 1, and a strict prefix of an owned name (e.g. acme-prod-0 vs acme-prod-01) → 1, pinning the namespace=<ns>([[:space:]]|$) anchor in provision.sh. A second test ensures a failed list read → exit 2, distinct from “absent” 1, so the #303 pre-flight can refuse foreign clients without treating transient list failures as ownership proof.

No production code changes — test-only guard so CLI output or grep regressions fail CI before customer installs.

^{Reviewed by Cursor Bugbot for commit fc052fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[aptracebloc]

Verdict: Approve with nits — the tests exercise the real _account_owns_namespace and pin the security-relevant ownership classification with mutation-proof assertions; a couple of small coverage gaps are worth noting but none block.

cc @LukasWodka@saadqbal

Assessment

This is real coverage, not tautology. setup() sources the actual provision.sh and the tests stub only the external tracebloc command — the correct boundary. The genuine grep -Eq "namespace=${ns}([[:space:]]|$)" logic runs against a fixture that mirrors the CLI's --plain line format field-for-field. The meaningful cases are all present: owned → 0, absent → 1, list-read failure → 2, and --plain propagation.

I verified the two mutation claims in the description hold:

• Anchor: the owned assertion alone does not prove the anchor (a substring match would still return 0). The prefix-boundary assertion (acme-prod-0 vs acme-prod-01) is what pins it — drop ([[:space:]]|$) and namespace=acme-prod-01 matches namespace=acme-prod-0 as a substring, returning 0 where the test expects 1. Correctly mutation-proof.
• --plain: asserted via recorded argv with a real grep exit code, so it fails on bash 3.2 too. Good.

The accept/refuse/fall-through trichotomy that #303 branches on (rc 0/1/2) is pinned, and rc 2 is correctly asserted distinct from rc 1 — the important safety property (a transient list failure must not be read as "not yours").

Findings

🟡 Medium

• scripts/lib/provision.sh — the empty-namespace guard ([[ -n "$ns" ]] || return 1) is untested. The caller currently guards it (if [[ -n "$INSTALLED_CLIENT_NS" ]]), but this is a branch in the function under test; a one-line run _account_owns_namespace "" → rc 1 assertion would pin it and is cheap.

⚪ Notes / nits

• EOL side of the anchor untested. Every fixture namespace is followed by whitespace + location=, so only the [[:space:]] alternative of ([[:space:]]|$) is exercised — the $ (namespace as the last field on a line) branch never fires. Realistically the CLI always emits location= after, so this is low-risk, but adding one fixture line ending at the namespace would fully pin the anchor.
• Assertion granularity. Four logically distinct checks (owned / absent / prefix / --plain) share a single @test. If the first assertion fails, bats stops and the others' state is hidden. This is a common bats idiom and each case is well-commented, so it's acceptable — just flagging that a per-case split would localize failures. (Table-driven Go doesn't apply here — this is Bats/bash, and the multi-run shape is idiomatic for it.)
• Scope note (not this PR): the actual authorization decision lives in provision_client — rc 1 → error (refuse), plus the legacy-tracebloc-namespace exception that deliberately lets rc 1 fall through. This PR pins the helper's return codes, which is the right unit to test here, but that refuse path / legacy exception is where a mis-classification would actually strand or admit a client. Worth a follow-up integration test at the provision_client level.

What's good

• Tests the real function; mocks only the CLI boundary — no over-mocking, no tautologies.
• Prefix-boundary case is a genuinely strong, mutation-proof anchor test for a security-relevant check.
• rc 1 vs rc 2 distinction is explicitly pinned, matching the Installer mints a new client before the one-client-per-machine guard — orphans it on the backend #303 branching contract.
• Fixture is documented as being kept in lockstep with the cli-side producer test (cli#141), with a clear comment on what breaks first if the format drifts.
• Test-only, no production behavior change.

🤖 Generated with Claude Code

[aptracebloc]

@LukasWodka — Approved. Real coverage at the right mock boundary; the auth trichotomy (rc 0/1/2) and the prefix-boundary anchor are genuinely pinned (detailed findings in my comment above).

Caveats — all follow-up, none blocking:

• 🟡 the empty-namespace guard ([[ -n "$ns" ]] || return 1) isn't exercised.
• ⚪ the EOL-$ branch of the anchor is untested; four checks bundled in one @test; the actual refuse decision + legacy-tracebloc exception live in provision_client and aren't integration-tested (out of scope here).

scripts/tests/ isn't code-owned, so this approval satisfies the review requirement — you're clear to merge.

🤖 Generated with Claude Code