test(golang): the untyped-field checker test skips with no guest, and shares Check's engine call

TestCheckerRefusesAnIndexedUntypedField handed NewChecker's error to
t.Fatal, so `go test ./...` without the gitignored guest builds reported
it as the module's one failure, where every other guest test skips. It
calls guestOrSkip first now, and still runs through NewChecker, the
constructor stashgen uses.

Its "past Validate" half copied the engine part of Checker.Check, so the
two could drift: a change to what Check sends se_plan_check would leave
the test sending the old encoding and passing. That part of Check is now
engineCheck, which Check and the test both call, and the test no longer
imports vcffi.

Addresses PR #1096 review comments 4203316804 and 4203316856.

Author: coderdan

languages/golang/encrypt/checker.go

@@ -46,6 +46,12 @@ func (k *Checker) Check(ctx context.Context, plan *record.Plan) error {
 	if err := plan.Validate(); err != nil {
 		return fmt.Errorf("%w: %v", ErrEncoding, err)
 	}
+	return k.engineCheck(ctx, plan)
+}
+
+// engineCheck asks se_plan_check alone, with no host rule first: the half
+// of Check that reaches the engine.
+func (k *Checker) engineCheck(ctx context.Context, plan *record.Plan) error {
 	encoded, err := vcffi.Marshal(plan.Wire())
 	if err != nil {
 		return fmt.Errorf("%w: %v", ErrEncoding, err)

languages/golang/encrypt/guest_test.go

@@ -20,7 +20,6 @@ import (
 	"github.com/cipherstash/stack/languages/golang/auth"
 	"github.com/cipherstash/stack/languages/golang/internal/guest"
 	"github.com/cipherstash/stack/languages/golang/internal/record"
-	"github.com/cipherstash/vitaminc/bindings/go/vcffi"
 	"github.com/tetratelabs/wazero"
 	"github.com/tetratelabs/wazero/sys"
 )
@@ -738,6 +737,7 @@ func TestGuestRefusesMalformedInputsBeforeState(t *testing.T) {
 // generator never emits such a declaration, so only a plan built by hand
 // reaches this. A sealed-only untyped field passes.
 func TestCheckerRefusesAnIndexedUntypedField(t *testing.T) {
+	guestOrSkip(t)
 	ctx := context.Background()
 	checker, err := NewChecker(ctx)
 	if err != nil {
@@ -760,14 +760,7 @@ func TestCheckerRefusesAnIndexedUntypedField(t *testing.T) {
 		// stack-encrypt) and the guest reports it as the caller's input. The
 		// ABI carries a status word and no message, so the field's name is
 		// the Go rule's to give; this asserts the two rules agree.
-		encoded, err := vcffi.Marshal(p.Wire())
-		if err != nil {
-			t.Fatal(err)
-		}
-		_, err = checker.c.call(ctx, func(inst *instance) ([]byte, error) {
-			return inst.call(ctx, inst.planCheck, buf(encoded))
-		})
-		if !errors.Is(err, ErrEncoding) {
+		if err := checker.engineCheck(ctx, p); !errors.Is(err, ErrEncoding) {
 			t.Errorf("%s past Validate: err = %v, want ErrEncoding from the engine", name, err)
 		}
 	}