Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

backend/tests/test_selected_comparison_api.py

@@ -0,0 +1,129 @@
+"""Exercise credential separation and secret-safe validation through real middleware."""
+
+from uuid import uuid4
+
+import pytest
+from fastapi.testclient import TestClient
+from sqlalchemy import text
+
+from modelforge_api.api.authorization import AccessBoundary, access_boundary_for_request
+from modelforge_api.db import get_session
+from modelforge_api.domain.serving import ServiceClientCreate
+from modelforge_api.main import app
+from tests.test_operator_authorization import (
+    ADMIN,
+    ALLOWED_ORIGIN,
+    MachineBoundaryHarness,
+    machine_boundary_harness,
+)
+from tests.test_selected_comparison_postgres import _valid_selection
+
+__all__ = ["machine_boundary_harness"]
+PREFIX = "/api/v1/selected-model-comparisons"
+
+
+@pytest.mark.parametrize("outcome", ["failed", "cancelled"])
+def test_authenticated_operator_and_designated_consumer_journey(
+    machine_boundary_harness: MachineBoundaryHarness, outcome: str,
+) -> None:
+    serving = machine_boundary_harness.capability_service
+    session = serving.session
+    session.execute(text("PRAGMA foreign_keys=ON"))
+    assert session.scalar(text("PRAGMA foreign_keys")) == 1
+    request, _unused_client = _valid_selection(session)
+    issued = serving.create_client(ServiceClientCreate(
+        name="comparison-http-consumer", allowed_capabilities=["rag.embedding@1"],
+        project_key="selected-comparison-fixture", project_binding_id=request.project_binding_id,
+        integration_environment="production", purpose="Offline authenticated comparison qualification",
+    ))
+    request = request.model_copy(update={"consumer_client_id": issued.id})
+    app.dependency_overrides[get_session] = lambda: session
+    operator = {**ADMIN, "Origin": ALLOWED_ORIGIN}
+    consumer = {"Authorization": f"Bearer {issued.credential}", "Origin": ALLOWED_ORIGIN}
+    client = TestClient(app)
+    created = client.post(PREFIX, headers=operator, json=request.model_dump(mode="json"))
+    assert created.status_code == 201, created.text
+    comparison_id = created.json()["id"]
+    path = f"{PREFIX}/{comparison_id}"
+    assert created.json()["status"] == "pending"
+    assigned = client.get(f"{PREFIX}/assigned", headers=consumer)
+    assert assigned.status_code == 200, assigned.text
+    assert [item["id"] for item in assigned.json()["items"]] == [comparison_id]
+    claimed = client.post(f"{path}/claim", headers=consumer)
+    assert claimed.status_code == 200, claimed.text
+    assert claimed.headers["Cache-Control"] == "no-store"
+    assert claimed.json()["comparison"]["status"] == "running"
+    assert len(claimed.json()["cases"]) == 1
+    token = claimed.json()["claim_token"]
+    progress = client.post(f"{path}/progress", headers=consumer, json={
+        "claim_token": token, "current_completed_cases": 1, "candidate_completed_cases": 0,
+    })
+    assert progress.status_code == 200, progress.text
+    assert progress.json()["current_completed_cases"] == 1
+    if outcome == "cancelled":
+        cancelled = client.post(f"{path}/cancel", headers=operator,
+                                json={"expected_version": progress.json()["version"]})
+        assert cancelled.status_code == 200, cancelled.text
+        assert cancelled.json()["status"] == "cancel_requested"
+    finished = client.post(f"{path}/finish", headers=consumer, json={
+        "claim_token": token, "outcome": outcome,
+        "error_code": "FIXTURE_CONSUMER_FAILURE" if outcome == "failed" else None,
+    })
+    assert finished.status_code == 200, finished.text
+    assert finished.json()["status"] == outcome
+    assert finished.json()["production_promotion_performed"] is False
+    assert finished.json()["finished_at"] is not None
+    history = client.get(PREFIX, headers=operator)
+    assert history.status_code == 200
+    assert history.json()["items"][0]["status"] == outcome
+    detail = client.get(path, headers=operator)
+    assert detail.status_code == 200
+    assert detail.json()["consumer_client_id"] == str(issued.id)
+    assert token not in history.text and token not in detail.text
+    assert issued.credential not in history.text
+    assert client.get(f"{PREFIX}/assigned", headers=consumer).json()["items"] == []
+    assert session.execute(text("PRAGMA foreign_key_check")).all() == []
+
+
+@pytest.mark.parametrize("action", ["claim", "progress", "result", "finish"])
+def test_operator_key_cannot_become_comparison_consumer(
+    machine_boundary_harness: MachineBoundaryHarness, action: str,
+) -> None:
+    response = TestClient(app).post(f"{PREFIX}/{uuid4()}/{action}", headers={
+        **ADMIN, "Origin": ALLOWED_ORIGIN,
+    }, json={"claim_token": "private-test-claim-that-must-not-echo"})
+    assert response.status_code == 401
+    assert "private-test-claim" not in response.text
+
+
+@pytest.mark.parametrize("action", ["progress", "result", "finish"])
+def test_consumer_validation_does_not_echo_secret_or_extra_values(
+    machine_boundary_harness: MachineBoundaryHarness, action: str,
+) -> None:
+    canary = "private-claim-and-payload-canary-123456789"
+    response = TestClient(app).post(f"{PREFIX}/{uuid4()}/{action}", headers={
+        "Authorization": f"Bearer {machine_boundary_harness.capability_credential}",
+        "Origin": ALLOWED_ORIGIN,
+    }, json={"claim_token": canary, "unexpected": {canary: canary}})
+    assert response.status_code == 422
+    assert canary not in response.text
+    errors = response.json()["error"]["details"]["errors"]
+    assert errors and all(set(error) == {"type", "msg"} for error in errors)
+
+
+@pytest.mark.parametrize("path", [PREFIX, f"{PREFIX}/{uuid4()}/cancel"])
+def test_project_credential_cannot_plan_or_cancel_operator_comparison(
+    machine_boundary_harness: MachineBoundaryHarness, path: str,
+) -> None:
+    response = TestClient(app).post(path, headers={
+        "Authorization": f"Bearer {machine_boundary_harness.capability_credential}",
+        "Origin": ALLOWED_ORIGIN,
+    }, json={})
+    assert response.status_code == 401
+
+
+def test_only_exact_assigned_read_is_a_consumer_route() -> None:
+    assert access_boundary_for_request("GET", f"{PREFIX}/assigned") is AccessBoundary.CAPABILITY_CLIENT
+    assert access_boundary_for_request("GET", PREFIX) is AccessBoundary.CONTROL_PLANE
+    assert access_boundary_for_request("GET", f"{PREFIX}/{uuid4()}") is AccessBoundary.CONTROL_PLANE
+    assert access_boundary_for_request("POST", f"{PREFIX}/{uuid4()}/cancel") is AccessBoundary.CONTROL_PLANE