taodeng/aci-sim
1
0
Fork 0
mirror of https://github.com/dtzp555-max/aci-sim.git synced 2026-07-19 09:46:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(ndo): enforce service-graph device-existence + uniform site redirect (v0.24.0)

Browse Source 
Closes F4 + F12: the sim NDO silently accepted two writes that real NDO 4.x
rejects server-side (the two documented walls behind the two-phase deploy):

- F4: binding a site-local service graph whose serviceNodes[].device.dn does
  not exist on the target APIC -> now 400 "Service graph device <dev> does
  not exist in tenant <t> in Fabric <site>" (cross-plane check against the
  per-site APIC MITStore; single-process sandbox shares live store objects).
- F12: partial per-fabric serviceGraphRelationship redirect coverage -> now
  400 "must have uniform redirect policy configured on all fabrics";
  validated on POST-request state (deepcopy->apply->validate->commit) so a
  single atomic all-fabric PATCH passes, matching real NDO. Coverage-based
  per (template, contract) — sibling templates with same-named contracts
  cannot cross-reject.

Non-service-graph PATCHes keep the in-place fast path. Fail-safe
default-allow; all-or-nothing on rejection. +33 tests (1131 passed).
Live gate: MS-TN2 two-phase chain 12/12 green (no false-reject); phase2-only
400s with golden message + zero residue; single-fabric PATCH 400s while the
atomic both-fabric control returns 200.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017zdUTqU9fvCCvF3uVGZsu1
This commit is contained in:
dtzp555-max
2026-07-10 18:01:14 +10:00
co-authored by Claude Fable 5
parent fe3d13221a
commit c5f8d0f940
6 changed files with 1442 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
CHANGELOG.md
+27
View File
@@ -6,6 +6,33 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html)
(pre-1.0: minor bumps may include breaking changes to the sim's behavior).
## [0.24.0] - 2026-07-10
### Added
- **NDO service-graph server-side enforcement (F4 + F12)** — the sim's NDO now
faithfully rejects, at `PATCH /mso/api/v1/schemas/{id}` time, the two
documented real-NDO 4.x validation walls that drove the two-phase deploy
workflow (new `aci_sim/ndo/service_graph_validation.py`):
- **F4 — device-existence (NDO<->APIC ordering)**: binding a site-local
service graph whose `serviceNodes[].device.dn` (`uni/tn-<t>/lDevVip-<d>`)
does not exist on the target site's APIC returns
`400 "Service graph device <dev> does not exist in tenant <t> in Fabric
<site>"` — matching real NDO. Legal two-phase flows (phase1 creates the
APIC device, phase2 binds) are unaffected; a phase2-only push is now
rejected instead of silently binding a dangling graph.
- **F12 — uniform site redirect**: per-fabric `serviceGraphRelationship`
redirect writes are validated against the POST-request state (deepcopy ->
apply -> validate -> commit): partial coverage (some but not all of a
template's fabrics configured) returns
`400 "must have uniform redirect policy configured on all fabrics"`,
while a single atomic all-fabric PATCH passes — matching real NDO's
post-state validation. Coverage-based (not DN-equality; redirect DNs are
legitimately per-fabric). Uniformity is scoped per (template, contract),
so same-named contracts in sibling templates cannot cross-reject.
Non-service-graph PATCHes keep the original in-place fast path unchanged.
Fail-safe default-allow throughout; all-or-nothing (rejected writes leave
zero residue). +33 tests.
## [0.23.0] - 2026-07-09
### Added