feat: run official executor behind SPIFFE mTLS

internal/runnerfacade/facade_test.go

@@ -2,11 +2,17 @@ package runnerfacade
 
 import (
 	"context"
+	"crypto/tls"
+	"crypto/x509"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"connectrpc.com/connect"
 	"gitea.dev/actionslib/pkg/protocol"
 	runnerv1 "gitea.dev/actionslib/runner/v1"
+	"gitea.dev/actionslib/runner/v1/runnerv1connect"
 	"google.golang.org/protobuf/types/known/structpb"
 
 	"git.ddupan.top/panxiao81/gitea-dynamic-runner/internal/taskassignment"
@@ -81,6 +87,49 @@ func TestFacadeReturnsOnlyPreassignedTaskAndSignalsClaim(t *testing.T) {
 	}
 }
 
+func TestFacadeDeclareReturnsOfficialRunnerMetadata(t *testing.T) {
+	facade, assignment, token := testFacade(t)
+	ctx := WithSPIFFEID(context.Background(), assignment.Identity.SPIFFEID)
+	response, err := facade.Declare(ctx, authenticatedRequest(&runnerv1.DeclareRequest{
+		Version: "v3.5.0", Labels: []string{"self-hosted", "pod"},
+	}, assignment.ID, token))
+	if err != nil {
+		t.Fatal(err)
+	}
+	runner := response.Msg.GetRunner()
+	if runner.GetUuid() != assignment.ID || runner.GetName() != assignment.ID || runner.GetVersion() != "v3.5.0" || !runner.GetEphemeral() {
+		t.Fatalf("runner = %#v", runner)
+	}
+	if len(runner.GetLabels()) != 2 || runner.GetLabels()[0] != "self-hosted" || runner.GetLabels()[1] != "pod" {
+		t.Fatalf("labels = %#v", runner.GetLabels())
+	}
+}
+
+func TestAPIHandlerMatchesOfficialRunnerBasePath(t *testing.T) {
+	facade, assignment, token := testFacade(t)
+	identityURL, err := url.Parse(assignment.Identity.SPIFFEID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	handler := APIHandler(facade)
+	server := httptest.NewServer(http.HandlerFunc(func(response http.ResponseWriter, request *http.Request) {
+		request.TLS = &tls.ConnectionState{PeerCertificates: []*x509.Certificate{{URIs: []*url.URL{identityURL}}}}
+		handler.ServeHTTP(response, request)
+	}))
+	defer server.Close()
+	client := runnerv1connect.NewRunnerServiceClient(server.Client(), server.URL+APIBasePath)
+	request := authenticatedRequest(&runnerv1.DeclareRequest{
+		Version: "v3.5.0", Labels: []string{"self-hosted", "pod"},
+	}, assignment.ID, token)
+	response, err := client.Declare(context.Background(), request)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if response.Msg.GetRunner().GetUuid() != assignment.ID {
+		t.Fatalf("runner = %#v", response.Msg.GetRunner())
+	}
+}
+
 func TestFacadeRejectsWrongIdentityOrCapability(t *testing.T) {
 	facade, assignment, token := testFacade(t)
 	wrongIdentity := WithSPIFFEID(context.Background(), "spiffe://ddupan.top/ci/owner/repo/other")