fix(bootstrap): an empty preview when no operator CA is registered, not a refusal

Signed-off-by: Bugs5382 <12115015+Bugs5382@users.noreply.github.com>

Author: Bugs5382

docs/first-run.md

@@ -89,7 +89,8 @@ during first run retires the earlier one at once.
 
 A new session keeps the registration but must confirm it again before it can
 submit a certificate: call with `ca_cert_der` empty for the preview, then with
-its `confirm_sha256`.
+its `confirm_sha256`. With nothing registered, that preview is empty (no
+`operator_ca`) and doesn't count as a failure.
 
 ## 👤 The first admin certificate
 

internal/bootstrap/register.go

@@ -263,10 +263,16 @@ func (s *Service) previewOf(reg *registration) *fleetv1.OperatorCA {
 }
 
 // reconfirm previews the current registration for a new session, or records
-// the new session's confirmation of it without changing anything.
+// the new session's confirmation of it without changing anything. With
+// nothing registered the preview is empty.
 func (s *Service) reconfirm(ctx context.Context, sessionHash, confirm string) (*connect.Response[fleetv1.BootstrapServiceRegisterOperatorCAResponse], error) {
 	row := s.activeCA(ctx)
 	if row == nil {
+		// A new session asks for the current registration first. Nothing
+		// registered is an empty answer, not the caller's mistake.
+		if confirm == "" {
+			return connect.NewResponse(&fleetv1.BootstrapServiceRegisterOperatorCAResponse{}), nil
+		}
 		return nil, s.fail(ctx, caRejected(connect.CodeFailedPrecondition, fleetv1.ErrorReason_ERROR_REASON_NOT_CONFIRMED,
 			"no operator CA is registered yet; upload one"))
 	}

internal/bootstrap/register_test.go

@@ -18,6 +18,7 @@ limitations under the License.
 
 import (
 	"context"
+	"crypto/rand"
 	"crypto/x509"
 	"net/http"
 	"net/http/httptest"
@@ -304,10 +305,27 @@ func TestRegister_LaterSessionRetiresTheEarlierAndMustReconfirm(t *testing.T) {
 	}
 }
 
+// A new session probes for the current registration. With nothing
+// registered that is an empty preview, not a refusal, and it spends no
+// rate-limit budget, so restarting first run costs the token holder nothing.
+// Confirming a CA that isn't registered is still refused.
 func TestRegister_NothingRegisteredToPreview(t *testing.T) {
 	h := newHarness(t)
 	secret := h.startSession()
-	_, err := h.register(secret, &fleetv1.BootstrapServiceRegisterOperatorCARequest{})
+	for i := 0; i < 10; i++ {
+		resp, err := h.register(secret, &fleetv1.BootstrapServiceRegisterOperatorCARequest{})
+		if err != nil {
+			t.Fatalf("preview %d with nothing registered: %v", i+1, err)
+		}
+		if resp.GetOperatorCa() != nil || resp.GetConfirmed() {
+			t.Fatalf("preview with nothing registered = %+v, want empty", resp)
+		}
+	}
+	bad, _ := NewToken(rand.Reader)
+	_, err := h.client().StartBootstrapSession(h.ctx, connect.NewRequest(&fleetv1.StartBootstrapSessionRequest{Token: bad}))
+	wantCode(t, err, apperr.CodeTokenInvalid, "") // not 1602: the previews spent nothing
+
+	_, err = h.register(secret, &fleetv1.BootstrapServiceRegisterOperatorCARequest{ConfirmSha256: strings.Repeat("ab", 32)})
 	wantCode(t, err, apperr.CodeOperatorCARejected, "NOT_CONFIRMED")
 	if connect.CodeOf(err) != connect.CodeFailedPrecondition {
 		t.Errorf("Connect code %v, want FailedPrecondition", connect.CodeOf(err))