Initial curated ITWorx_MCP_Hub source from 368fba691ea8d23403b4d56b53b5ec670d7c5020

tests/test_wp280_runtime_quality.py

@@ -0,0 +1,140 @@
+"""WP-310 base-image remediation and live-tool contract regression tests."""
+
+from __future__ import annotations
+
+import json
+from pathlib import Path
+from uuid import UUID
+
+from jsonschema import Draft202012Validator
+
+from connectors.gitea import GiteaConnector
+from connectors.unraid import FakeBrokerClient, RegisteredContainer, UnraidConnector
+from packages.connector_kit import ConnectorContext, GiteaRepositoryRegistry, RegisteredRepository
+from services.runtime.control_api import _project_connector_output
+
+ROOT = Path(__file__).resolve().parents[1]
+PROJECT_ID = UUID("11111111-1111-1111-1111-111111111111")
+
+
+class _RepositoryMetadataClient:
+    @staticmethod
+    def repository(repository: RegisteredRepository) -> dict[str, object]:
+        return {
+            "name": repository.name,
+            "owner": {"login": repository.owner},
+            "private": repository.private,
+            "default_branch": "main",
+            "empty": False,
+        }
+
+
+def _context() -> ConnectorContext:
+    return ConnectorContext(
+        workspace_id=UUID("22222222-2222-2222-2222-222222222222"),
+        project_id=PROJECT_ID,
+        project_slug="ludarium",
+        environment="prod",
+    )
+
+
+def _output_schema(name: str) -> dict:
+    document = json.loads((ROOT / "catalog" / "tools" / name).read_text(encoding="utf-8"))
+    return document["spec"]["outputSchema"]
+
+
+def test_all_python_runtime_images_apply_the_exact_security_layer() -> None:
+    installer = (ROOT / "infrastructure" / "images" / "install-base-security-updates.sh").read_text(
+        encoding="utf-8"
+    )
+    assert "2.41.5-0+deb13u1" in installer
+    assert "1:4.16.0-2+really2.41.5-0+deb13u1" in installer
+    assert "apt-get upgrade" not in installer
+    assert "apt-get dist-upgrade" not in installer
+    for dockerfile in (
+        ROOT / "infrastructure" / "images" / "python-service" / "Dockerfile",
+        ROOT / "infrastructure" / "images" / "docker-read-broker" / "Dockerfile",
+        ROOT / "infrastructure" / "images" / "observability" / "Dockerfile",
+    ):
+        content = dockerfile.read_text(encoding="utf-8")
+        assert "COPY infrastructure/images/install-base-security-updates.sh" in content
+        assert "RUN sh /tmp/install-base-security-updates.sh" in content
+
+
+def test_base_security_layer_pins_and_verifies_staging_fixed_versions() -> None:
+    installer = (ROOT / "infrastructure" / "images" / "install-base-security-updates.sh").read_text(
+        encoding="utf-8"
+    )
+    fixed_packages = {
+        "gzip": ("gzip", "1.13-1+deb13u1"),
+        "libpcre2-8-0": ("pcre2", "10.46-1~deb13u2"),
+        "libsqlite3-0": ("sqlite3", "3.46.1-7+deb13u2"),
+        "libssl3t64": ("openssl", "3.5.7-1~deb13u2"),
+        "openssl": ("openssl", "3.5.7-1~deb13u2"),
+        "openssl-provider-legacy": ("openssl", "3.5.7-1~deb13u2"),
+        "perl-base": ("perl_base", "5.40.1-6+deb13u1"),
+    }
+    for package, (variable, version) in fixed_packages.items():
+        assert f"{variable}_version='{version}'" in installer
+        assert f'"{package}=${{{variable}_version}}"' in installer
+        assert f'assert_package_version "{package}" "${{{variable}_version}}"' in installer
+
+
+def test_gitea_list_envelope_projects_to_the_registered_contract() -> None:
+    registry = GiteaRepositoryRegistry(
+        (
+            RegisteredRepository(
+                repository_ref="ludarium",
+                project_id=PROJECT_ID,
+                owner="jens",
+                name="Ludarium",
+                source_uri="itworx-git://ludarium/ludarium",
+                private=True,
+            ),
+        )
+    )
+    connector = GiteaConnector(_RepositoryMetadataClient(), registry)  # type: ignore[arg-type]
+    schema = _output_schema("gitea-repository-list.yaml")
+
+    projected, warnings = _project_connector_output(connector.repository_list(_context()), schema)
+
+    assert list(Draft202012Validator(schema).iter_errors(projected)) == []
+    assert projected["items"][0]["defaultBranch"] == "main"
+    assert "sourceUri" not in projected["items"][0]
+    assert projected["generatedAt"]
+    assert warnings == []
+
+
+def test_unraid_host_envelope_projects_to_the_registered_contract() -> None:
+    connector = UnraidConnector(
+        FakeBrokerClient(), (RegisteredContainer("ludarium-web", PROJECT_ID, "prod"),)
+    )
+    schema = _output_schema("unraid-host-status.yaml")
+
+    projected, warnings = _project_connector_output(connector.host_status(_context()), schema)
+
+    assert list(Draft202012Validator(schema).iter_errors(projected)) == []
+    assert projected["hostRef"] == "unraid"
+    assert projected["generatedAt"]
+    assert warnings == []
+
+
+def test_catalog_marks_only_live_registered_connector_bindings_verified() -> None:
+    expected = {
+        "devrunbook": set(),
+        "forgeflow": set(),
+        "geointel": set(),
+        "ludarium": {"knowledge-default", "gitea-default", "unraid-default"},
+        "vacatureradar": {"knowledge-default", "gitea-default", "unraid-default"},
+        "mobilityops": {"mobilityops-default"},
+    }
+    for slug, verified in expected.items():
+        document = json.loads(
+            (ROOT / "catalog" / "projects" / f"{slug}.yaml").read_text(encoding="utf-8")
+        )
+        actual = {
+            binding["ref"]
+            for binding in document["spec"]["connectorBindings"]
+            if binding.get("verification") == "verified"
+        }
+        assert actual == verified