Publish curated ITWorx_MCP_Hub source from 6c7434368ce2a594005983c5a6601a31a639e7f1

tests/test_client_lifecycle_audit.py

@@ -0,0 +1,108 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime, timedelta
+from typing import Any
+
+import pytest
+from sqlalchemy import event, select
+
+from packages.hub_clients import ClientKind, ClientStatus
+from services.control_api.auth.models import AuthenticatedPrincipal, PrincipalKind
+from services.control_api.persistence.models import AuditEventRow, ClientBindingRow, ClientRow
+from services.runtime.client_service import PersistentClientService
+
+pytest_plugins = ("tests.test_machine_client_provisioning",)
+
+
+def _actor() -> AuthenticatedPrincipal:
+    now = datetime.now(UTC)
+    return AuthenticatedPrincipal(
+        subject="operator-audit-fixture",
+        issuer="https://identity.fixture.invalid",
+        audience=("hub-fixture",),
+        kind=PrincipalKind.MANAGEMENT_USER,
+        issued_at=now,
+        expires_at=now + timedelta(minutes=5),
+    )
+
+
+def _active_client(database: Any) -> tuple[PersistentClientService, Any]:
+    service = PersistentClientService(
+        database, issuer="https://identity.fixture.invalid", public_host="mcp.fixture.invalid"
+    )
+    record, _, _ = service.create(
+        name="Audit fixture", project="ludarium", environment="prod", kind=ClientKind.STDIO_BRIDGE
+    )
+    with database() as session, session.begin():
+        row = session.get(ClientRow, record.id)
+        assert row is not None
+        row.status = "active"
+        binding = session.scalar(
+            select(ClientBindingRow).where(ClientBindingRow.client_id == record.id)
+        )
+        assert binding is not None
+        binding.enabled = True
+    return service, record.id
+
+
+def test_client_disable_and_revoke_are_scoped_and_append_actor_audits(database: Any) -> None:
+    service, client_id = _active_client(database)
+    actor = _actor()
+    disabled = service.transition(client_id, ClientStatus.DISABLED, actor)
+    assert disabled.status is ClientStatus.DISABLED
+    revoked = service.transition(client_id, ClientStatus.REVOKED, actor)
+    assert revoked.status is ClientStatus.REVOKED
+    with database() as session:
+        binding = session.scalar(
+            select(ClientBindingRow).where(ClientBindingRow.client_id == client_id)
+        )
+        assert binding is not None and binding.enabled is False
+        audits = session.scalars(
+            select(AuditEventRow)
+            .where(AuditEventRow.client_id == client_id)
+            .order_by(AuditEventRow.occurred_at)
+        ).all()
+        assert [row.event_type for row in audits] == ["client.disable", "client.revoke"]
+        for row in audits:
+            assert row.principal_subject == actor.subject
+            assert row.principal_issuer == actor.issuer
+            assert row.project_id == binding.project_id
+            assert row.virtual_server_id == binding.virtual_server_id
+            assert row.environment_id is not None
+            assert row.policy_decision == "allow" and row.outcome == "success"
+            assert row.sanitized_arguments == {"clientId": str(client_id), "action": row.event_type}
+            assert row.arguments_hash is not None and len(row.arguments_hash) == 64
+        assert audits[0].trace_id != audits[1].trace_id
+    with pytest.raises(ValueError, match="revoked"):
+        service.transition(client_id, ClientStatus.DISABLED, actor)
+    with database() as session:
+        row = session.get(ClientRow, client_id)
+        assert row is not None and row.status == "revoked"
+        assert len(session.scalars(select(AuditEventRow)).all()) == 2
+
+
+@pytest.mark.parametrize("status", [ClientStatus.DISABLED, ClientStatus.REVOKED])
+def test_audit_failure_rolls_back_client_and_binding_transition(
+    database: Any, status: ClientStatus
+) -> None:
+    service, client_id = _active_client(database)
+
+    def reject_audit(*_: Any) -> None:
+        raise RuntimeError("fixture audit insert failed")
+
+    event.listen(AuditEventRow, "before_insert", reject_audit)
+    try:
+        with pytest.raises(RuntimeError, match="fixture audit insert failed"):
+            service.transition(client_id, status, _actor())
+    finally:
+        event.remove(AuditEventRow, "before_insert", reject_audit)
+    with database() as session:
+        row = session.get(ClientRow, client_id)
+        binding = session.scalar(
+            select(ClientBindingRow).where(ClientBindingRow.client_id == client_id)
+        )
+        assert row is not None and row.status == "active"
+        assert row.revoked_at is None
+        assert row.record_metadata["operatorDisabled"] is False
+        assert binding is not None and binding.enabled is True
+        assert session.scalars(select(AuditEventRow)).all() == []