Jon Chery
52e17aefbf
--type linux (REQ-161): - internal/linux/bootstrap.go: SSH bootstrap for generic Linux workers (orcas pubkey, system user, drift-events dir; no PVE role/sudoers) - internal/cli/node.go: joinLinux function + --type linux dispatch - peer-setup kept as documented fallback UAT plan (REQ-162): - docs/uat.md: 3-host topology (lead Ubuntu + pve01 Proxmox + worker01 Ubuntu), 22 step-by-step commands, 35-claim matrix, Proxmox prerequisite + alternative 3xUbuntu path (C-48), signoff procedure UAT signoff script (REQ-163, C-47): - scripts/uat-signoff.sh: 35 idempotent read-only assertions, exit 0 iff all pass. Includes 4 critical-path assertions: job deploys to remote, ACL deny-by-default, seal/unseal round-trip, OIDC health - scripts/uat-smoke.sh: 13 CI-tested pure-CLI assertions for .coreci.yml Tests: node join --type linux test, fingerprint test updated, smoke test all 13 pass. ---ci--- project: orca phase: 12 milestone: v0.13 status: complete requirements: covered: [161, 162, 163] ---/ci---
516 lines
15 KiB
Go
516 lines
15 KiB
Go
// This file tests the `orca node` subcommand family (join/leave/list,
|
|
// capacity is covered in node_capacity_test.go). Tests execute rootCmd
|
|
// against a temp ORCA_HOME and assert stdout/stderr/exit per RESEARCH
|
|
// §1.2.
|
|
//
|
|
// daemon.go is EXCLUDED from the cli ≥70% coverage target: the daemon
|
|
// command starts a long-running mTLS server whose lifecycle is better
|
|
// covered by internal/daemon/server_test.go (already 150 LOC). The
|
|
// --pprof flag registration is verified in daemon_test.go.
|
|
package cli
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/json"
|
|
"os"
|
|
"path/filepath"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
|
|
"git.cloudinit.dev/coreci/orca/internal/certpaths"
|
|
"git.cloudinit.dev/coreci/orca/internal/model"
|
|
"git.cloudinit.dev/coreci/orca/internal/security"
|
|
"git.cloudinit.dev/coreci/orca/internal/store"
|
|
)
|
|
|
|
func TestNodeJoinLocalText(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "worker-1", "--addr", "10.0.0.5:8443"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node join: %v", err)
|
|
}
|
|
out := buf.String()
|
|
if !strings.Contains(out, "Node joined") {
|
|
t.Errorf("node join output unexpected: %s", out)
|
|
}
|
|
if !strings.Contains(out, "worker-1") {
|
|
t.Errorf("node join output missing name: %s", out)
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinLocalJSON(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "worker-2", "--addr", "10.0.0.6:8443", "--json"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node join --json: %v", err)
|
|
}
|
|
var node map[string]any
|
|
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &node); err != nil {
|
|
t.Fatalf("unmarshal node json: %v\n%s", err, buf.String())
|
|
}
|
|
if node["name"] != "worker-2" {
|
|
t.Errorf("node join --json name = %v, want worker-2", node["name"])
|
|
}
|
|
if node["address"] != "10.0.0.6:8443" {
|
|
t.Errorf("node join --json address = %v, want 10.0.0.6:8443", node["address"])
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinMissingName(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join"})
|
|
if err := rootCmd.Execute(); err == nil {
|
|
t.Fatal("expected error for missing --name, got nil")
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinDefaultAddr(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "defaulter", "--json"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node join: %v", err)
|
|
}
|
|
var node map[string]any
|
|
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &node); err != nil {
|
|
t.Fatalf("unmarshal node json: %v\n%s", err, buf.String())
|
|
}
|
|
if node["address"] != "localhost:8443" {
|
|
t.Errorf("node join default addr = %v, want localhost:8443", node["address"])
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinCAFingerprintMatch(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
if err := runInit(discardWriter{}); err != nil {
|
|
t.Fatalf("init: %v", err)
|
|
}
|
|
fp, err := security.Fingerprint(certpaths.CACertPath())
|
|
if err != nil {
|
|
t.Fatalf("fingerprint: %v", err)
|
|
}
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "pinned", "--ca-fingerprint", fp, "--json"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node join with matching fingerprint: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinCAFingerprintMismatch(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "badpin", "--ca-fingerprint", padHex(64)})
|
|
if err := rootCmd.Execute(); err == nil {
|
|
t.Fatal("expected error for CA fingerprint mismatch, got nil")
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinCAFingerprintNoCA(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "noca", "--ca-fingerprint", padHex(64)})
|
|
if err := rootCmd.Execute(); err == nil {
|
|
t.Fatal("expected error for missing CA with --ca-fingerprint, got nil")
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinProxmoxMissingHost(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--ssh-key", "/tmp/nonexistent-key"})
|
|
if err := rootCmd.Execute(); err == nil {
|
|
t.Fatal("expected error for proxmox without --host, got nil")
|
|
}
|
|
}
|
|
|
|
func TestNodeJoinProxmoxMissingSSHKey(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
// No --ssh-key and no default orca key -> error (R-021).
|
|
rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--host", "10.0.0.99"})
|
|
if err := rootCmd.Execute(); err == nil {
|
|
t.Fatal("expected error for proxmox without ssh-key, got nil")
|
|
}
|
|
}
|
|
|
|
func TestNodeListEmpty(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "list"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node list: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestNodeListAfterJoin(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "lister", "--addr", "10.0.0.7:8443"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node join: %v", err)
|
|
}
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "list"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node list: %v", err)
|
|
}
|
|
out := buf.String()
|
|
if !strings.Contains(out, "lister") {
|
|
t.Errorf("node list missing joined node: %s", out)
|
|
}
|
|
}
|
|
|
|
func TestNodeListJSON(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
rootCmd.SetArgs([]string{"node", "join", "--name", "jsonlister", "--addr", "10.0.0.8:8443"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node join: %v", err)
|
|
}
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "list", "--json"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node list --json: %v", err)
|
|
}
|
|
var nodes []map[string]any
|
|
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &nodes); err != nil {
|
|
t.Fatalf("unmarshal node list json: %v\n%s", err, buf.String())
|
|
}
|
|
found := false
|
|
for _, n := range nodes {
|
|
if n["name"] == "jsonlister" {
|
|
found = true
|
|
}
|
|
}
|
|
if !found {
|
|
t.Errorf("node list --json missing jsonlister: %s", buf.String())
|
|
}
|
|
}
|
|
|
|
func TestNodeLeave(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
nodeID := seedNode(t, "leaver", "10.0.0.9:8443")
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "leave", nodeID})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node leave: %v", err)
|
|
}
|
|
if !strings.Contains(buf.String(), "Node left") {
|
|
t.Errorf("node leave output unexpected: %s", buf.String())
|
|
}
|
|
}
|
|
|
|
func TestNodeLeaveJSON(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
nodeID := seedNode(t, "jsonleaver", "10.0.0.10:8443")
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "leave", nodeID, "--json"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node leave --json: %v", err)
|
|
}
|
|
var result map[string]any
|
|
if err := json.Unmarshal(bytes.TrimSpace(buf.Bytes()), &result); err != nil {
|
|
t.Fatalf("unmarshal node leave json: %v\n%s", err, buf.String())
|
|
}
|
|
if result["state"] != "left" {
|
|
t.Errorf("node leave --json state = %v, want left", result["state"])
|
|
}
|
|
}
|
|
|
|
func TestNodeLeaveMissingID(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "leave"})
|
|
if err := rootCmd.Execute(); err == nil {
|
|
t.Fatal("expected error for node leave without id, got nil")
|
|
}
|
|
}
|
|
|
|
func seedNode(t *testing.T, name, addr string) string {
|
|
t.Helper()
|
|
db, err := store.Open(certpaths.DBPath())
|
|
if err != nil {
|
|
t.Fatalf("open db: %v", err)
|
|
}
|
|
defer db.Close()
|
|
repo := store.NewNodeRepo(db)
|
|
ctx := context.Background()
|
|
n := &model.Node{
|
|
ID: "node-" + name,
|
|
Name: name,
|
|
Address: addr,
|
|
State: model.NodeStateReady,
|
|
JoinedAt: time.Now().UTC(),
|
|
LastSeen: time.Now().UTC(),
|
|
}
|
|
if err := repo.Insert(ctx, n); err != nil {
|
|
t.Fatalf("insert node: %v", err)
|
|
}
|
|
return n.ID
|
|
}
|
|
|
|
func padHex(n int) string {
|
|
b := make([]byte, n)
|
|
for i := range b {
|
|
b[i] = 'a'
|
|
}
|
|
return string(b)
|
|
}
|
|
|
|
// TestNodeKeyReset removes the target node's known_hosts lines, leaves
|
|
// other hosts' lines intact, and inserts an audit row (T02.8, REQ-059).
|
|
func TestNodeKeyReset(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
|
|
// Seed a proxmox node whose Name is the host address (matches the
|
|
// key-reset RunE, which uses node.Name as the known_hosts match key).
|
|
seedProxmoxNode(t, "10.0.0.1", "10.0.0.1:8443")
|
|
|
|
// Pre-populate known_hosts: 2 lines for the target + 1 for another host.
|
|
knownHosts := certpaths.KnownHostsPath()
|
|
if err := os.MkdirAll(filepath.Dir(knownHosts), 0o755); err != nil {
|
|
t.Fatalf("mkdir known_hosts dir: %v", err)
|
|
}
|
|
original := []byte("[10.0.0.1]:22 ssh-ed25519 AAAAKEY1 host1\n" +
|
|
"10.0.0.1 ssh-ed25519 AAAAKEY1ALT host1-alt\n" +
|
|
"[10.0.0.2]:22 ssh-ed25519 AAAAKEY2 host2\n")
|
|
if err := os.WriteFile(knownHosts, original, 0o600); err != nil {
|
|
t.Fatalf("write known_hosts: %v", err)
|
|
}
|
|
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "key-reset", "10.0.0.1"})
|
|
if err := rootCmd.Execute(); err != nil {
|
|
t.Fatalf("node key-reset: %v", err)
|
|
}
|
|
out := buf.String()
|
|
if !strings.Contains(out, "Host key reset for 10.0.0.1") {
|
|
t.Errorf("output missing reset confirmation: %s", out)
|
|
}
|
|
|
|
// known_hosts: target's 2 lines removed, other host's line intact.
|
|
data, err := os.ReadFile(knownHosts)
|
|
if err != nil {
|
|
t.Fatalf("read known_hosts: %v", err)
|
|
}
|
|
result := string(data)
|
|
if strings.Contains(result, "AAAAKEY1") {
|
|
t.Errorf("target key line 1 not removed: %s", result)
|
|
}
|
|
if strings.Contains(result, "AAAAKEY1ALT") {
|
|
t.Errorf("target key line 2 not removed: %s", result)
|
|
}
|
|
if !strings.Contains(result, "AAAAKEY2") {
|
|
t.Errorf("other host's line was removed (should be intact): %s", result)
|
|
}
|
|
|
|
// Audit row inserted with action=node.key_reset.
|
|
db, err := store.Open(certpaths.DBPath())
|
|
if err != nil {
|
|
t.Fatalf("open db: %v", err)
|
|
}
|
|
defer db.Close()
|
|
entries, err := store.NewAuditRepo(db).List(context.Background(), 50)
|
|
if err != nil {
|
|
t.Fatalf("list audit: %v", err)
|
|
}
|
|
found := false
|
|
for _, e := range entries {
|
|
if e.Action == "node.key_reset" && strings.Contains(e.Resource, "10.0.0.1") {
|
|
found = true
|
|
break
|
|
}
|
|
}
|
|
if !found {
|
|
t.Errorf("audit row for node.key_reset not inserted: %+v", entries)
|
|
}
|
|
}
|
|
|
|
// TestNodeKeyReset_NodeNotFound verifies key-reset errors when the
|
|
// node is not in the registry (T02.8).
|
|
func TestNodeKeyReset_NodeNotFound(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "key-reset", "no.such.host"})
|
|
err := rootCmd.Execute()
|
|
if err == nil {
|
|
t.Fatal("expected error for unknown node, got nil")
|
|
}
|
|
if !strings.Contains(err.Error(), "not found") {
|
|
t.Errorf("error should mention not found, got: %v", err)
|
|
}
|
|
}
|
|
|
|
func seedProxmoxNode(t *testing.T, name, addr string) string {
|
|
t.Helper()
|
|
db, err := store.Open(certpaths.DBPath())
|
|
if err != nil {
|
|
t.Fatalf("open db: %v", err)
|
|
}
|
|
defer db.Close()
|
|
repo := store.NewNodeRepo(db)
|
|
ctx := context.Background()
|
|
n := &model.Node{
|
|
ID: "node-" + name,
|
|
Name: name,
|
|
Address: addr,
|
|
State: model.NodeStateReady,
|
|
JoinedAt: time.Now().UTC(),
|
|
LastSeen: time.Now().UTC(),
|
|
Kind: string(model.NodeKindProxmox),
|
|
OS: "pve",
|
|
}
|
|
if err := repo.Insert(ctx, n); err != nil {
|
|
t.Fatalf("insert proxmox node: %v", err)
|
|
}
|
|
return n.ID
|
|
}
|
|
|
|
// TestNodeJoinHostKeyFingerprintRequiresProxmox verifies T02.11:
|
|
// `orca node join --type linux --host-key-fingerprint SHA256:...`
|
|
// fails with a clear error from the D-044 RunE check. Exercises the
|
|
// cobra Execute() error path end-to-end.
|
|
func TestNodeJoinHostKeyFingerprintRequiresProxmox(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{
|
|
"node", "join",
|
|
"--type", "localhost",
|
|
"--name", "localhost-node",
|
|
"--host-key-fingerprint", "SHA256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
|
|
})
|
|
err := rootCmd.Execute()
|
|
if err == nil {
|
|
t.Fatal("expected error for --host-key-fingerprint without --type proxmox, got nil")
|
|
}
|
|
if !strings.Contains(err.Error(), "--host-key-fingerprint requires --type proxmox or --type linux") {
|
|
t.Errorf("error should mention the --host-key-fingerprint/--type proxmox requirement, got: %v", err)
|
|
}
|
|
}
|
|
|
|
// TestNodeJoinHostKeyFingerprintProxmoxAccepted verifies that
|
|
// --host-key-fingerprint IS accepted for --type proxmox (the RunE check
|
|
// does not reject a proxmox-type join that pins the host key). This is
|
|
// the negative-space companion to TestNodeJoinHostKeyFingerprintRequiresProxmox
|
|
// (T02.11): the validation must only reject non-proxmox types.
|
|
//
|
|
// We can't run the full bootstrap without a real SSH server, so we
|
|
// assert that the RunE check passes (no "requires --type proxmox"
|
|
// error) and the failure — if any — comes from a later stage (missing
|
|
// --host / ssh-key), not the D-044 guard.
|
|
func TestNodeJoinHostKeyFingerprintProxmoxAccepted(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{
|
|
"node", "join",
|
|
"--type", "proxmox",
|
|
"--host-key-fingerprint", "SHA256:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=",
|
|
})
|
|
err := rootCmd.Execute()
|
|
if err == nil {
|
|
t.Fatal("expected a later-stage error (missing --host), got nil")
|
|
}
|
|
if strings.Contains(err.Error(), "requires --type proxmox") {
|
|
t.Errorf("D-044 guard wrongly rejected proxmox type: %v", err)
|
|
}
|
|
}
|
|
|
|
// --- REQ-146 / R-021 password removal regression test ---
|
|
|
|
// TestNodeJoinProxmoxPasswordRejected verifies the --password flag is
|
|
// no longer accepted (R-021: no passwords). The flag is removed; the
|
|
// CLI should reject it as an unknown flag.
|
|
func TestNodeJoinProxmoxPasswordRejected(t *testing.T) {
|
|
_, cleanup := initTestEnv(t)
|
|
defer cleanup()
|
|
resetRootFlags(t)
|
|
var buf bytes.Buffer
|
|
rootCmd.SetOut(&buf)
|
|
rootCmd.SetErr(&buf)
|
|
rootCmd.SetArgs([]string{"node", "join", "--type", "proxmox", "--host", "10.0.0.99", "--password", "secret"})
|
|
if err := rootCmd.Execute(); err == nil {
|
|
t.Fatal("expected error for --password (R-021: no passwords), got nil")
|
|
}
|
|
}
|