84 lines
3.4 KiB
Python
84 lines
3.4 KiB
Python
from __future__ import annotations
|
|
|
|
import json
|
|
from pathlib import Path
|
|
|
|
from services.control_api.catalog.loader import CatalogLoader
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
PROJECTS = ("ludarium", "vacatureradar", "forgeflow", "geointel", "devrunbook")
|
|
LOCAL_ROOTS = {
|
|
"ludarium": Path(r"C:\Projects\Ludarium"),
|
|
"vacatureradar": Path(r"C:\Projects\VacatureRadar"),
|
|
"forgeflow": Path(r"C:\Projects\ForgeFlow"),
|
|
"geointel": Path(r"C:\Projects\geointel"),
|
|
"devrunbook": Path(r"C:\Projects\DevRunbook"),
|
|
}
|
|
|
|
|
|
def catalog(slug: str) -> dict:
|
|
return json.loads((ROOT / "catalog/projects" / f"{slug}.yaml").read_text(encoding="utf-8"))
|
|
|
|
|
|
def test_all_known_projects_have_deny_first_scoped_virtual_servers() -> None:
|
|
report = CatalogLoader(ROOT / "catalog").load()
|
|
assert report.valid, report.issues
|
|
assert {catalog(slug)["metadata"]["slug"] for slug in PROJECTS} == set(PROJECTS)
|
|
for slug in PROJECTS:
|
|
document = catalog(slug)
|
|
servers = document["spec"]["virtualServers"]
|
|
assert servers
|
|
for server in servers:
|
|
assert server["endpointAlias"] == f"/mcp/{slug}/{server['environment']}"
|
|
assert server["defaultDecision"] == "deny"
|
|
assert any(
|
|
pattern.startswith(f"itworx-project://{slug}/")
|
|
for pattern in server["resourceAllowPatterns"]
|
|
)
|
|
assert all(
|
|
slug not in pattern or pattern.startswith(("itworx-project://", "itworx-docs://"))
|
|
for pattern in server["resourceAllowPatterns"]
|
|
)
|
|
assert (
|
|
"project-reader" in document["spec"]["capabilityPacks"]
|
|
or slug == "general-infrastructure"
|
|
)
|
|
|
|
|
|
def test_local_sources_are_evidence_backed_and_remote_mappings_are_not_guessed() -> None:
|
|
inventory = json.loads(
|
|
(ROOT / "evidence/WP-145/ONBOARDING_INVENTORY.json").read_text(encoding="utf-8")
|
|
)
|
|
assert {item["project"] for item in inventory} == set(PROJECTS)
|
|
for item in inventory:
|
|
root = Path(item["localRoot"])
|
|
assert root == LOCAL_ROOTS[item["project"]]
|
|
assert item["gitPresent"] is True
|
|
assert item["sourceChecks"]["readme"] is True
|
|
assert item["sourceChecks"]["docs"] is True
|
|
assert item["knowledgeSourceMapping"] == "verified-local-filesystem"
|
|
assert item["repositoryMapping"] == "external-input-required"
|
|
assert item["giteaSmoke"] == "external-input-required"
|
|
assert item["unraidSmoke"] == "external-input-required"
|
|
assert catalog("forgeflow")["spec"]["repository"]["exposeMetadata"] == "never-public"
|
|
|
|
|
|
def test_project_connector_visibility_is_explicitly_scoped() -> None:
|
|
for slug in PROJECTS:
|
|
bindings = catalog(slug)["spec"]["connectorBindings"]
|
|
refs = {binding["ref"] for binding in bindings}
|
|
assert "knowledge-default" in refs
|
|
assert all(binding["environments"] for binding in bindings)
|
|
assert all(
|
|
binding["verification"]
|
|
in {"verified", "external-input-required", "unverified", "fake-only"}
|
|
for binding in bindings
|
|
)
|
|
for server in catalog(slug)["spec"]["virtualServers"]:
|
|
patterns = server["toolAllowPatterns"]
|
|
assert "project.status.get" in patterns
|
|
assert "knowledge.*" in patterns
|
|
assert not any(
|
|
pattern.startswith("*") and "project" not in pattern for pattern in patterns
|
|
)
|