tags approved via acl

Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>

integration/cli_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/juanfont/headscale/integration/hsic"
 	"github.com/juanfont/headscale/integration/tsic"
 	"github.com/stretchr/testify/assert"
+	"golang.org/x/exp/slices"
 )
 
 func executeAndUnmarshal[T any](headscale ControlServer, command []string, result T) error {
@@ -786,70 +787,22 @@ func TestNodeTagCommand(t *testing.T) {
 	)
 }
 
-func TestNodeAdvertiseTagNoACLCommand(t *testing.T) {
+func TestNodeAdvertiseTagCommand(t *testing.T) {
 	IntegrationSkip(t)
 	t.Parallel()
 
-	scenario, err := NewScenario(dockertestMaxWait())
+	tests := []struct {
-	assertNoErr(t, err)
+		name    string
-	defer scenario.ShutdownAssertNoPanics(t)
+		policy  *policy.ACLPolicy
-
+		wantTag bool
-	spec := map[string]int{
+	}{
-		"user1": 1,
+		{
-	}
+			name:    "no-policy",
-
+			wantTag: false,
-	err = scenario.CreateHeadscaleEnv(spec, []tsic.Option{tsic.WithTags([]string{"tag:test"})}, hsic.WithTestName("cliadvtags"))
-	assertNoErr(t, err)
-
-	headscale, err := scenario.Headscale()
-	assertNoErr(t, err)
-
-	// Test list all nodes after added seconds
-	resultMachines := make([]*v1.Node, spec["user1"])
-	err = executeAndUnmarshal(
-		headscale,
-		[]string{
-			"headscale",
-			"nodes",
-			"list",
-			"--tags",
-			"--output", "json",
 		},
-		&resultMachines,
+		{
-	)
+			name: "with-policy",
-	assert.Nil(t, err)
+			policy: &policy.ACLPolicy{
-	found := false
-	for _, node := range resultMachines {
-		if node.GetInvalidTags() != nil {
-			for _, tag := range node.GetInvalidTags() {
-				if tag == "tag:test" {
-					found = true
-				}
-			}
-		}
-	}
-	assert.Equal(
-		t,
-		true,
-		found,
-		"should not find a node with the tag 'tag:test' in the list of nodes",
-	)
-}
-
-func TestNodeAdvertiseTagWithACLCommand(t *testing.T) {
-	IntegrationSkip(t)
-	t.Parallel()
-
-	scenario, err := NewScenario(dockertestMaxWait())
-	assertNoErr(t, err)
-	defer scenario.ShutdownAssertNoPanics(t)
-
-	spec := map[string]int{
-		"user1": 1,
-	}
-
-	err = scenario.CreateHeadscaleEnv(spec, []tsic.Option{tsic.WithTags([]string{"tag:exists"})}, hsic.WithTestName("cliadvtags"), hsic.WithACLPolicy(
-		&policy.ACLPolicy{
 				ACLs: []policy.ACL{
 					{
 						Action:       "accept",
@@ -858,10 +811,28 @@ func TestNodeAdvertiseTagWithACLCommand(t *testing.T) {
 					},
 				},
 				TagOwners: map[string][]string{
-				"tag:exists": {"user1"},
+					"tag:test": {"user1"},
 				},
 			},
-	))
+			wantTag: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			scenario, err := NewScenario(dockertestMaxWait())
+			assertNoErr(t, err)
+			// defer scenario.ShutdownAssertNoPanics(t)
+
+			spec := map[string]int{
+				"user1": 1,
+			}
+
+			err = scenario.CreateHeadscaleEnv(spec,
+				[]tsic.Option{tsic.WithTags([]string{"tag:test"})},
+				hsic.WithTestName("cliadvtags"),
+				hsic.WithACLPolicy(tt.policy),
+			)
 			assertNoErr(t, err)
 
 			headscale, err := scenario.Headscale()
@@ -883,20 +854,18 @@ func TestNodeAdvertiseTagWithACLCommand(t *testing.T) {
 			assert.Nil(t, err)
 			found := false
 			for _, node := range resultMachines {
-		if node.GetValidTags() != nil {
+				if tags := node.GetValidTags(); tags != nil {
-			for _, tag := range node.GetValidTags() {
+					found = slices.Contains(tags, "tag:test")
-				if tag == "tag:exists" {
-					found = true
 				}
 			}
-		}
+			assert.Equalf(
-	}
-	assert.Equal(
 				t,
-		true,
+				tt.wantTag,
 				found,
-		"should not find a node with the tag 'tag:exists' in the list of nodes",
+				"'tag:test' found(%t) is the list of nodes, expected %t", found, tt.wantTag,
 			)
+		})
+	}
 }
 
 func TestNodeCommand(t *testing.T) {

integration/hsic/hsic.go

@@ -81,6 +81,10 @@ type Option = func(c *HeadscaleInContainer)
 // HeadscaleInContainer instance.
 func WithACLPolicy(acl *policy.ACLPolicy) Option {
 	return func(hsic *HeadscaleInContainer) {
+		if acl == nil {
+			return
+		}
+
 		// TODO(kradalby): Move somewhere appropriate
 		hsic.env["HEADSCALE_POLICY_PATH"] = aclPolicyPath