Publish curated ITWorx-ModelForge source from 990401737f96c8d46a9f7b0d84994516cadcb6a0

node-agent/tests/test_agent.py

@@ -1,6 +1,7 @@
 import asyncio
 import logging
 from pathlib import Path
+from unittest.mock import call, patch
 
 import httpx
 import pytest
@@ -182,6 +183,24 @@ def test_first_enrollment_and_restart_reuse_persisted_credential(tmp_path: Path)
     assert restarted.credential == first.credential
 
 
+def test_persisted_credential_is_group_readable_for_the_runtime_worker(tmp_path: Path) -> None:
+    with patch("modelforge_node_agent.state.os.chmod") as chmod:
+        agent = build_agent(tmp_path, FakeTransport())
+        agent.ensure_enrolled()
+        credential_file = agent.settings.credential_file
+        assert chmod.call_args_list == [call(credential_file, 0o640)]
+
+        # An upgrade can retain the stricter historical mode. The Agent owns the file and repairs
+        # only that mode at startup so the separately non-root runtime worker can read, never
+        # write, its node credential.
+        restarted = build_agent(tmp_path, FakeTransport(), token=None)
+        assert restarted.credential == agent.credential
+        assert chmod.call_args_list == [
+            call(credential_file, 0o640),
+            call(credential_file, 0o640),
+        ]
+
+
 def test_agent_advertises_typed_runtime_worker_capabilities(tmp_path: Path) -> None:
     capabilities = build_agent(tmp_path, FakeTransport()).metadata().supported_capabilities
     assert "runtime.probe.v1" in capabilities