Merge branch 'main' into dependabot/go_modules/all-go-7de9e40c71

Author: julienrbrt

pkg/raft/node.go

@@ -257,6 +257,18 @@ func (n *Node) NodeID() string {
 	return n.config.NodeID
 }
 
+// LeaderID returns the server ID of the current cluster leader.
+// Returns an empty string if the receiver is nil, raft is uninitialized, or no
+// leader has been elected yet. The value may be momentarily stale between raft
+// leadership changes; callers that need a strong guarantee should cross-check
+// with HasQuorum.
+func (n *Node) LeaderID() string {
+	if n == nil || n.raft == nil {
+		return ""
+	}
+	return n.leaderID()
+}
+
 func (n *Node) leaderID() string {
 	_, id := n.raft.LeaderWithID()
 	return string(id)

pkg/rpc/server/http.go

@@ -139,11 +139,16 @@ func RegisterCustomHTTPEndpoints(mux *http.ServeMux, s store.Store, pm p2p.P2PRP
 				http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
 				return
 			}
+			leaderID := raftNode.LeaderID()
+			isLeader := raftNode.IsLeader()
+			if leaderID != "" {
+				isLeader = leaderID == raftNode.NodeID()
+			}
 			rsp := struct {
 				IsLeader bool   `json:"is_leader"`
 				NodeID   string `json:"node_id"`
 			}{
-				IsLeader: raftNode.IsLeader(),
+				IsLeader: isLeader,
 				NodeID:   raftNode.NodeID(),
 			}
 			w.Header().Set("Content-Type", "application/json")

pkg/rpc/server/http_test.go

@@ -1,6 +1,7 @@
 package server
 
 import (
+	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -45,6 +46,103 @@ func TestRegisterCustomHTTPEndpoints(t *testing.T) {
 	mockStore.AssertExpectations(t)
 }
 
+type testRaftNodeSource struct {
+	isLeader bool
+	leaderID string
+	nodeID   string
+}
+
+func (t testRaftNodeSource) IsLeader() bool {
+	return t.isLeader
+}
+
+func (t testRaftNodeSource) LeaderID() string {
+	return t.leaderID
+}
+
+func (t testRaftNodeSource) NodeID() string {
+	return t.nodeID
+}
+
+func TestRegisterCustomHTTPEndpoints_RaftNodeStatus(t *testing.T) {
+	type bodyShape struct {
+		IsLeader bool   `json:"is_leader"`
+		NodeID   string `json:"node_id"`
+	}
+
+	cases := []struct {
+		name           string
+		node           testRaftNodeSource
+		method         string
+		wantStatus     int
+		wantIsLeader   bool
+		wantNodeID     string
+		skipBodyDecode bool
+	}{
+		{
+			// leaderID == nodeID: handler derives is_leader=true from LeaderID(),
+			// regardless of the IsLeader() field on testRaftNodeSource.
+			name:         "leader matches — is_leader true",
+			node:         testRaftNodeSource{leaderID: "node-a", nodeID: "node-a"},
+			method:       http.MethodGet,
+			wantStatus:   http.StatusOK,
+			wantIsLeader: true,
+			wantNodeID:   "node-a",
+		},
+		{
+			// leaderID != nodeID: handler derives is_leader=false.
+			name:         "leader differs — is_leader false",
+			node:         testRaftNodeSource{leaderID: "node-b", nodeID: "node-a"},
+			method:       http.MethodGet,
+			wantStatus:   http.StatusOK,
+			wantIsLeader: false,
+			wantNodeID:   "node-a",
+		},
+		{
+			// empty leaderID: fallback — is_leader=false (no elected leader known).
+			name:         "empty leaderID fallback — is_leader false",
+			node:         testRaftNodeSource{leaderID: "", nodeID: "node-a"},
+			method:       http.MethodGet,
+			wantStatus:   http.StatusOK,
+			wantIsLeader: false,
+			wantNodeID:   "node-a",
+		},
+		{
+			name:           "non-GET method — 405",
+			node:           testRaftNodeSource{},
+			method:         http.MethodPost,
+			wantStatus:     http.StatusMethodNotAllowed,
+			skipBodyDecode: true,
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			mux := http.NewServeMux()
+			RegisterCustomHTTPEndpoints(mux, nil, nil, config.DefaultConfig(), nil, zerolog.Nop(), tc.node)
+
+			ts := httptest.NewServer(mux)
+			t.Cleanup(ts.Close)
+
+			req, err := http.NewRequest(tc.method, ts.URL+"/raft/node", nil)
+			require.NoError(t, err)
+			resp, err := http.DefaultClient.Do(req) //nolint:gosec // test-only request to httptest server
+			require.NoError(t, err)
+			t.Cleanup(func() { _ = resp.Body.Close() })
+
+			require.Equal(t, tc.wantStatus, resp.StatusCode)
+			if tc.skipBodyDecode {
+				return
+			}
+
+			var body bodyShape
+			require.NoError(t, json.NewDecoder(resp.Body).Decode(&body))
+			assert.Equal(t, tc.wantIsLeader, body.IsLeader)
+			assert.Equal(t, tc.wantNodeID, body.NodeID)
+		})
+	}
+}
+
 func TestHealthReady_aggregatorBlockDelay(t *testing.T) {
 	logger := zerolog.Nop()
 

pkg/rpc/server/server.go

@@ -368,6 +368,7 @@ func (p *P2PServer) GetNetInfo(
 
 type RaftNodeSource interface {
 	IsLeader() bool
+	LeaderID() string
 	NodeID() string
 }
 

pkg/signer/aws/signer_test.go

@@ -154,20 +154,20 @@ func TestSign_RetryBehavior(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			_, der := generateTestEd25519DER(t)
 
-			var calls int32
+			var calls atomic.Int32
 			signer := newTestSigner(t, &mockKMSClient{
 				keyID:     awsTestKeyID,
 				pubKeyDER: der,
 				signFn: func(_ context.Context, _ *kms.SignInput) (*kms.SignOutput, error) {
-					atomic.AddInt32(&calls, 1)
+					calls.Add(1)
 					return nil, spec.signErr
 				},
 			}, spec.opts)
 
 			_, err := signer.Sign(t.Context(), []byte("hello world"))
 			require.Error(t, err)
 			assert.Contains(t, err.Error(), spec.errSubstr)
-			assert.Equal(t, spec.expectedCall, atomic.LoadInt32(&calls))
+			assert.Equal(t, spec.expectedCall, calls.Load())
 		})
 	}
 }

pkg/signer/gcp/signer_test.go

@@ -164,20 +164,20 @@ func TestSign_RetryBehavior(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			_, publicKeyPEM := generateTestEd25519PEM(t)
 
-			var calls int32
+			var calls atomic.Int32
 			signer := newTestSigner(t, &mockKMSClient{
 				keyID:        myKeyID,
 				publicKeyPEM: publicKeyPEM,
 				signFn: func(_ context.Context, _ *kmspb.AsymmetricSignRequest) (*kmspb.AsymmetricSignResponse, error) {
-					atomic.AddInt32(&calls, 1)
+					calls.Add(1)
 					return nil, spec.signErr
 				},
 			}, spec.opts)
 
 			_, err := signer.Sign(t.Context(), []byte("hello world"))
 			require.Error(t, err)
 			assert.Contains(t, err.Error(), spec.errSubstr)
-			assert.Equal(t, spec.expectedCall, atomic.LoadInt32(&calls))
+			assert.Equal(t, spec.expectedCall, calls.Load())
 		})
 	}
 }
@@ -228,34 +228,34 @@ func TestSign_IntegrityFailures_RetryAndFail(t *testing.T) {
 		t.Run(name, func(t *testing.T) {
 			_, publicKeyPEM := generateTestEd25519PEM(t)
 
-			var calls int32
+			var calls atomic.Int32
 			signer := newTestSigner(t, &mockKMSClient{
 				keyID:        myKeyID,
 				publicKeyPEM: publicKeyPEM,
 				signFn: func(_ context.Context, _ *kmspb.AsymmetricSignRequest) (*kmspb.AsymmetricSignResponse, error) {
-					atomic.AddInt32(&calls, 1)
+					calls.Add(1)
 					return spec.responseFn(), nil
 				},
 			}, &Options{MaxRetries: 1})
 
 			_, err := signer.Sign(t.Context(), []byte("hello world"))
 			require.Error(t, err)
 			assert.Contains(t, err.Error(), spec.expectedErrSubstr)
-			assert.Equal(t, int32(2), atomic.LoadInt32(&calls), "integrity failures should be retried")
+			assert.Equal(t, int32(2), calls.Load(), "integrity failures should be retried")
 		})
 	}
 }
 
 func TestSign_IntegrityCheckRecoversOnRetry(t *testing.T) {
 	_, publicKeyPEM := generateTestEd25519PEM(t)
 
-	var calls int32
+	var calls atomic.Int32
 	expectedSig := []byte("valid-signature")
 	mock := &mockKMSClient{
 		keyID:        myKeyID,
 		publicKeyPEM: publicKeyPEM,
 		signFn: func(_ context.Context, _ *kmspb.AsymmetricSignRequest) (*kmspb.AsymmetricSignResponse, error) {
-			attempt := atomic.AddInt32(&calls, 1)
+			attempt := calls.Add(1)
 			if attempt == 1 {
 				return &kmspb.AsymmetricSignResponse{
 					Name:               myKeyID,
@@ -278,7 +278,7 @@ func TestSign_IntegrityCheckRecoversOnRetry(t *testing.T) {
 	got, err := s.Sign(t.Context(), []byte("hello world"))
 	require.NoError(t, err)
 	assert.Equal(t, expectedSig, got)
-	assert.Equal(t, int32(2), atomic.LoadInt32(&calls), "second attempt should succeed")
+	assert.Equal(t, int32(2), calls.Load(), "second attempt should succeed")
 }
 
 func TestRetryBackoff_Capped(t *testing.T) {